shutro-erp 0.3.1 → 0.3.3

package/dist/payment/sslcommerz.js

@@ -0,0 +1,185 @@
+const HOSTS = {
+    sandbox: 'https://sandbox.sslcommerz.com',
+    live: 'https://securepay.sslcommerz.com',
+};
+/** The IPN's fields: a form post (or JSON, which some integrations send). */
+function fieldsOf(call) {
+    if (call.json !== null && typeof call.json === 'object' && !Array.isArray(call.json))
+        return Object.fromEntries(Object.entries(call.json).map(([k, v]) => [k, String(v ?? '')]));
+    return Object.fromEntries(new URLSearchParams(call.body));
+}
+/** What was paid, in the transaction's currency (`currency_type` / `currency_amount` when it was not BDT). */
+const paidAmount = (f) => f['currency_amount'] || f['amount'] || '';
+const paidCurrency = (f) => f['currency_type'] || f['currency'] || '';
+const same = (a, b) => a !== '' && b !== '' && Number(a).toFixed(2) === Number(b).toFixed(2);
+const IPN_STATUS = {
+    VALID: 'done',
+    VALIDATED: 'done',
+    FAILED: 'failed',
+    CANCELLED: 'cancelled',
+    EXPIRED: 'cancelled',
+};
+const countryName = (code) => {
+    if (code === null || code === '')
+        return 'Bangladesh';
+    try {
+        return new Intl.DisplayNames(['en'], { type: 'region' }).of(code.toUpperCase()) ?? code;
+    }
+    catch {
+        return code;
+    }
+};
+export function sslcommerzAdapter(options = {}) {
+    const storeId = options.storeId ?? '';
+    const storePassword = options.storePassword ?? '';
+    const sandbox = options.sandbox ?? true;
+    const host = sandbox ? HOSTS.sandbox : HOSTS.live;
+    const http = options.fetch ?? fetch;
+    const ready = storeId !== '' && storePassword !== '';
+    const credentials = () => {
+        if (!ready)
+            throw new Error('SSLCommerz is not configured: set SHUTRO_ERP_SSLCOMMERZ_STORE_ID and SHUTRO_ERP_SSLCOMMERZ_STORE_PASSWORD.');
+        return { store_id: storeId, store_passwd: storePassword };
+    };
+    const getJson = async (path, query) => {
+        const url = `${host}${path}?${new URLSearchParams({ ...query, ...credentials(), format: 'json' })}`;
+        const res = await http(url, { signal: AbortSignal.timeout(15_000) });
+        if (!res.ok)
+            throw new Error(`SSLCommerz answered ${res.status}.`);
+        return (await res.json());
+    };
+    /** The attempts SSLCommerz knows for a transaction id. */
+    const attempts = async (reference) => {
+        const answer = await getJson('/validator/api/merchantTransIDvalidationAPI.php', {
+            tran_id: reference,
+        });
+        if (answer['APIConnect'] !== 'DONE')
+            return null;
+        const element = Array.isArray(answer['element'])
+            ? answer['element']
+            : [];
+        return element.map((e) => Object.fromEntries(Object.entries(e).map(([k, v]) => [k, String(v ?? '')])));
+    };
+    return {
+        code: 'sslcommerz',
+        configured: (mode) => ready && (mode === 'test') === sandbox,
+        async createPayment(request) {
+            const body = new URLSearchParams({
+                ...credentials(),
+                total_amount: request.amount,
+                currency: request.currency,
+                tran_id: request.reference,
+                success_url: request.returnUrl,
+                fail_url: request.returnUrl,
+                cancel_url: request.returnUrl,
+                ipn_url: request.callbackUrl,
+                cus_name: request.customer.name || 'Customer',
+                cus_email: request.customer.email ?? '',
+                cus_add1: request.customer.street ?? 'N/A',
+                cus_city: request.customer.city ?? 'N/A',
+                cus_postcode: request.customer.zip ?? '0000',
+                cus_country: countryName(request.customer.country),
+                cus_phone: request.customer.phone ?? 'N/A',
+                shipping_method: 'NO',
+                product_name: request.description,
+                product_category: 'Invoice',
+                product_profile: 'general',
+                emi_option: '0',
+                value_a: request.reference,
+            });
+            const res = await http(`${host}/gwprocess/v4/api.php`, {
+                method: 'POST',
+                headers: { 'content-type': 'application/x-www-form-urlencoded' },
+                body,
+                signal: AbortSignal.timeout(15_000),
+            });
+            const answer = (await res.json().catch(() => ({})));
+            const page = answer['GatewayPageURL'];
+            if (answer['status'] !== 'SUCCESS' || typeof page !== 'string' || page === '')
+                throw new Error(`SSLCommerz refused the payment: ${String(answer['failedreason'] ?? res.status)}.`);
+            return { redirectUrl: page };
+        },
+        async verifyCallback(call) {
+            const f = fieldsOf(call);
+            const reference = f['tran_id'] ?? '';
+            const status = IPN_STATUS[f['status'] ?? ''];
+            if (reference === '' || status === undefined || !ready)
+                return null;
+            if (status === 'done') {
+                // Paid: SSLCommerz confirms this val_id, for this transaction, amount and currency.
+                const valId = f['val_id'] ?? '';
+                if (valId === '')
+                    return null;
+                const v = await getJson('/validator/api/validationserverAPI.php', { val_id: valId });
+                const fv = Object.fromEntries(Object.entries(v).map(([k, x]) => [k, String(x ?? '')]));
+                const confirmed = (fv['status'] === 'VALID' || fv['status'] === 'VALIDATED') &&
+                    fv['tran_id'] === reference &&
+                    same(paidAmount(fv), paidAmount(f)) &&
+                    paidCurrency(fv) === paidCurrency(f);
+                return confirmed ? valId : null;
+            }
+            // Failed or cancelled: SSLCommerz knows the transaction and no attempt of it succeeded.
+            const known = await attempts(reference);
+            if (known === null || known.length === 0)
+                return null;
+            if (known.some((a) => a['status'] === 'VALID' || a['status'] === 'VALIDATED'))
+                return null;
+            return `${reference}:${f['status']}:${f['val_id'] || f['tran_date'] || ''}`;
+        },
+        readCallback(call) {
+            const f = fieldsOf(call);
+            const status = IPN_STATUS[f['status'] ?? ''];
+            if ((f['tran_id'] ?? '') === '' || status === undefined)
+                return null;
+            return {
+                reference: f['tran_id'],
+                status,
+                providerReference: f['bank_tran_id'] || f['val_id'] || null,
+                ...(status === 'done' ? { amount: paidAmount(f), currency: paidCurrency(f) } : {}),
+                ...(f['error'] ? { error: f['error'] } : {}),
+            };
+        },
+        async status(reference) {
+            if (!ready)
+                return null;
+            const known = await attempts(reference);
+            if (known === null || known.length === 0)
+                return null;
+            const paid = known.find((a) => a['status'] === 'VALID' || a['status'] === 'VALIDATED');
+            if (paid !== undefined)
+                return {
+                    reference,
+                    status: 'done',
+                    providerReference: paid['bank_tran_id'] || paid['val_id'] || null,
+                    amount: paidAmount(paid),
+                    currency: paidCurrency(paid),
+                };
+            if (known.some((a) => a['status'] === 'PENDING'))
+                return { reference, status: 'pending', providerReference: null };
+            const last = known.at(-1);
+            return {
+                reference,
+                status: 'failed',
+                providerReference: last?.['val_id'] || null,
+                ...(last?.['error'] ? { error: last['error'] } : {}),
+            };
+        },
+    };
+}
+/** SSLCommerz with its credentials from the environment, read on first use (after the server applied its names). */
+export function sslcommerzFromEnvironment(env = process.env) {
+    let made;
+    const real = () => (made ??= sslcommerzAdapter({
+        storeId: env['KOSH_SSLCOMMERZ_STORE_ID'],
+        storePassword: env['KOSH_SSLCOMMERZ_STORE_PASSWORD'],
+        sandbox: env['KOSH_SSLCOMMERZ_SANDBOX'] !== 'false',
+    }));
+    return {
+        code: 'sslcommerz',
+        configured: (mode) => real().configured(mode),
+        createPayment: (request) => real().createPayment(request),
+        verifyCallback: (call, secret) => real().verifyCallback(call, secret),
+        readCallback: (call) => real().readCallback(call),
+        status: (reference, mode, providerReference) => real().status(reference, mode, providerReference),
+    };
+}

package/dist/payment/stripe.d.ts

@@ -0,0 +1,15 @@
+import type { PaymentAdapter } from './providers.js';
+export interface StripeOptions {
+    readonly secretKey?: string | undefined;
+    /** The API's base (default `https://api.stripe.com/v1`). */
+    readonly baseUrl?: string | undefined;
+    /** How old a signed event may be, in seconds (default 300). */
+    readonly tolerance?: number;
+    /** The HTTP client (tests). */
+    readonly fetch?: typeof fetch;
+    /** The clock (tests). */
+    readonly now?: () => number;
+}
+export declare function stripeAdapter(options?: StripeOptions): PaymentAdapter;
+/** Stripe with its key from the environment, read on first use. */
+export declare function stripeFromEnvironment(env?: NodeJS.ProcessEnv): PaymentAdapter;

package/dist/payment/stripe.js

@@ -0,0 +1,182 @@
+/**
+ * The Stripe adapter (RFC 0017 §5.5), on Checkout Sessions: a session per transaction (`client_reference_id` and
+ * `metadata.reference` = its reference, one line of the invoice's amount in subunits) whose page the customer pays
+ * on, back to the return route. Stripe's webhook is set up in its dashboard with the provider's endpoint URL; Stripe
+ * gives the signing secret (`whsec_…`), which goes into **the endpoint's Secret**. `Stripe-Signature`
+ * (`t=…,v1=…`: HMAC-SHA256 hex of `"<t>.<raw body>"`) is checked with it, and old timestamps are refused (5 minutes)
+ * against replays; the event's `id` makes deliveries idempotent. Returns fetch the session from Stripe.
+ *
+ * Credentials come from the environment, never from records: `SHUTRO_ERP_STRIPE_SECRET_KEY`. Test keys
+ * (`sk_test_…`, `rk_test_…`) serve providers in test mode, live keys live ones.
+ */
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { fromSubunits, toSubunits } from './money.js';
+const text = (v) => (v === undefined || v === null ? '' : String(v));
+/** What a Checkout Session says of its payment. */
+function sessionResult(reference, session, kind) {
+    const theirs = text(session['client_reference_id']) ||
+        text(session['metadata']?.['reference']);
+    if (theirs !== reference)
+        return null;
+    const currency = text(session['currency']).toUpperCase();
+    const intent = session['payment_intent'];
+    const providerReference = (typeof intent === 'string' ? intent : text(intent?.['id'])) ||
+        text(session['id']) ||
+        null;
+    // A delayed method (a bank debit) that did not go through.
+    if (kind === 'checkout.session.async_payment_failed')
+        return {
+            reference,
+            status: 'failed',
+            providerReference,
+            error: 'The payment failed at Stripe.',
+        };
+    if (text(session['payment_status']) === 'paid')
+        return {
+            reference,
+            status: 'done',
+            providerReference,
+            amount: fromSubunits(Number(session['amount_total'] ?? 0), currency),
+            currency,
+        };
+    if (text(session['status']) === 'expired' || kind === 'checkout.session.expired')
+        return { reference, status: 'cancelled', providerReference };
+    return { reference, status: 'pending', providerReference };
+}
+/** Stripe's form encoding of nested parameters (`line_items[0][price_data][currency]=bdt`). */
+function form(params, prefix = '', out = new URLSearchParams()) {
+    for (const [key, value] of Object.entries(params)) {
+        const name = prefix === '' ? key : `${prefix}[${key}]`;
+        if (value === undefined || value === null)
+            continue;
+        if (Array.isArray(value))
+            value.forEach((v, i) => {
+                if (typeof v === 'object' && v !== null)
+                    form(v, `${name}[${i}]`, out);
+                else
+                    out.append(`${name}[${i}]`, String(v));
+            });
+        else if (typeof value === 'object')
+            form(value, name, out);
+        else
+            out.append(name, String(value));
+    }
+    return out;
+}
+export function stripeAdapter(options = {}) {
+    const key = options.secretKey ?? '';
+    const base = (options.baseUrl || 'https://api.stripe.com/v1').replace(/\/$/, '');
+    const http = options.fetch ?? fetch;
+    const tolerance = options.tolerance ?? 300;
+    const now = options.now ?? (() => Date.now());
+    const ready = /^(sk|rk)_(test|live)_/.test(key);
+    const call = async (method, path, params) => {
+        if (!ready)
+            throw new Error('Stripe is not configured: set SHUTRO_ERP_STRIPE_SECRET_KEY.');
+        const res = await http(`${base}${path}`, {
+            method,
+            headers: {
+                authorization: `Bearer ${key}`,
+                'content-type': 'application/x-www-form-urlencoded',
+            },
+            ...(params === undefined ? {} : { body: form(params) }),
+            signal: AbortSignal.timeout(30_000),
+        });
+        const answer = (await res.json().catch(() => ({})));
+        if (!res.ok) {
+            const error = (answer['error'] ?? {});
+            throw new Error(`Stripe answered ${res.status}: ${text(error['message']) || 'no detail'}.`);
+        }
+        return answer;
+    };
+    const session = (id) => call('GET', `/checkout/sessions/${encodeURIComponent(id)}`);
+    return {
+        code: 'stripe',
+        configured: (mode) => ready && key.includes(mode === 'test' ? '_test_' : '_live_'),
+        async createPayment(request) {
+            const made = await call('POST', '/checkout/sessions', {
+                mode: 'payment',
+                client_reference_id: request.reference,
+                success_url: request.returnUrl,
+                cancel_url: request.returnUrl,
+                ...(request.customer.email === null ? {} : { customer_email: request.customer.email }),
+                line_items: [
+                    {
+                        quantity: 1,
+                        price_data: {
+                            currency: request.currency.toLowerCase(),
+                            unit_amount: toSubunits(request.amount, request.currency),
+                            product_data: { name: request.description },
+                        },
+                    },
+                ],
+                metadata: { reference: request.reference },
+                payment_intent_data: { metadata: { reference: request.reference } },
+            });
+            const id = text(made['id']);
+            const page = text(made['url']);
+            if (id === '' || page === '')
+                throw new Error('Stripe made no Checkout Session.');
+            return { redirectUrl: page, providerReference: id };
+        },
+        verifyCallback(call, secret) {
+            const header = call.headers['stripe-signature'] ?? '';
+            const parts = header.split(',').map((p) => p.split('='));
+            const t = Number(parts.find(([k]) => k === 't')?.[1]);
+            if (!Number.isFinite(t) || Math.abs(now() / 1000 - t) > tolerance)
+                return null;
+            const expected = Buffer.from(createHmac('sha256', secret).update(`${t}.${call.body}`).digest('hex'));
+            const genuine = parts
+                .filter(([k]) => k === 'v1')
+                .some(([, v]) => {
+                const given = Buffer.from(v ?? '');
+                return given.length === expected.length && timingSafeEqual(given, expected);
+            });
+            if (!genuine)
+                return null;
+            const id = text(call.json?.['id']);
+            return id !== '' ? id : null;
+        },
+        readCallback(call) {
+            const event = call.json;
+            const kind = text(event?.['type']);
+            if (!kind.startsWith('checkout.session.'))
+                return null;
+            const object = (event?.['data']?.['object'] ?? null);
+            if (object === null)
+                return null;
+            const reference = text(object['client_reference_id']) ||
+                text(object['metadata']?.['reference']);
+            const result = sessionResult(reference, object, kind);
+            return result === null || result.status === 'pending' ? null : result;
+        },
+        async returned({ reference, providerReference }) {
+            if (providerReference === null || providerReference === '')
+                return null;
+            const result = sessionResult(reference, await session(providerReference));
+            return result?.status === 'pending' ? null : result;
+        },
+        async status(reference, _mode, providerReference) {
+            if (!ready || providerReference === null || providerReference === '')
+                return null;
+            return sessionResult(reference, await session(providerReference));
+        },
+    };
+}
+/** Stripe with its key from the environment, read on first use. */
+export function stripeFromEnvironment(env = process.env) {
+    let made;
+    const real = () => (made ??= stripeAdapter({
+        secretKey: env['KOSH_STRIPE_SECRET_KEY'],
+        baseUrl: env['KOSH_STRIPE_BASE_URL'],
+    }));
+    return {
+        code: 'stripe',
+        configured: (mode) => real().configured(mode),
+        createPayment: (request) => real().createPayment(request),
+        verifyCallback: (call, secret) => real().verifyCallback(call, secret),
+        readCallback: (call) => real().readCallback(call),
+        returned: (input) => real().returned?.(input) ?? Promise.resolve(null),
+        status: (reference, mode, providerReference) => real().status(reference, mode, providerReference),
+    };
+}

package/dist/permissions/admin.d.ts

@@ -9,5 +9,8 @@
  * Approval policies are data: administrators edit `approval.policy` / `approval.level` through the generated API.
  */
 import { type ModuleContext } from '../server/index.js';
+import type { Env } from '../server/orm.js';
+/** Refuses non-administrators (or, with `permission`, users without it). */
+export declare function requireAdministrator(env: Env, permission?: string): void;
 /** Registers `/api/v1/admin/*`. */
 export declare function registerAdminApi(context: ModuleContext): void;

package/dist/permissions/admin.js

@@ -43,7 +43,7 @@ function idParam(request, key = 'id') {
     return id;
 }
 /** Refuses non-administrators (or, with `permission`, users without it). */
-function requireAdministrator(env, permission) {
+export function requireAdministrator(env, permission) {
     if (env.administrator)
         return;
     if (permission !== undefined && env.access.has(permission))
@@ -99,6 +99,10 @@ export function registerAdminApi(context) {
             params: [],
         });
         const admins = env.access.administratorGroups();
+        // How many people hold each role (administrators read the assignments).
+        const holders = new Map();
+        for (const a of await find(env, 'auth.user_group', {}, ['user', 'group']))
+            holders.set(String(a['group']), (holders.get(String(a['group'])) ?? new Set()).add(a['user']));
         const levelsOf = (implies) => {
             const closure = reg.security.closure(implies.filter((c) => reg.security.groups.has(c)));
             return [...loaded.accessLevels.entries()]
@@ -114,6 +118,7 @@ export function registerAdminApi(context) {
                     administrator: admins.has(g.code),
                     builtIn: true,
                     accessLevels: levelsOf(g.implies),
+                    holders: holders.get(g.code)?.size ?? 0,
                 })),
                 ...runtime.map((r) => ({
                     code: r.code,
@@ -122,6 +127,7 @@ export function registerAdminApi(context) {
                     administrator: admins.has(r.code),
                     builtIn: false,
                     accessLevels: levelsOf(r.implies),
+                    holders: holders.get(r.code)?.size ?? 0,
                 })),
             ],
         };
@@ -342,6 +348,7 @@ export function registerAdminApi(context) {
                 models: Object.fromEntries(models.map((name) => [
                     name,
                     {
+                        label: reg.get(name).model.label ?? name,
                         perms: PERMS.filter((p) => env.access.can(name, p)),
                         hiddenFields: Object.keys(reg.get(name).model.fields).filter((k) => !env.access.canField(name, k, 'read')),
                         readonlyFields: Object.keys(reg.get(name).model.fields).filter((k) => env.access.canField(name, k, 'read') &&
@@ -351,25 +358,67 @@ export function registerAdminApi(context) {
                 permissions: [...reg.security.permissions.keys()]
                     .filter((code) => env.access.has(code))
                     .sort(),
+                /** The permissions' names, for screens. */
+                permissionLabels: Object.fromEntries([...reg.security.permissions.values()].map((p) => [p.code, p.label ?? p.code])),
             };
         });
     });
     const hidden = new Set(loaded.modules.flatMap((m) => m.privateModels ?? []));
     const privateModel = (name) => hidden.has(name);
     // ------------------------------------------------------------------------------------------- audit log
-    app.get('/api/v1/admin/audit', async (request) => {
+    // Filters (RFC 0019 §3.5): `kind` (`auth.` for a family), `actor` (a user id), `model` and `record` (the target),
+    // `from` / `to` (ISO dates, `to` inclusive of its day), `q` (words of the summary), `before` (an id: the next page);
+    // `format=csv` downloads the page as CSV — an export, itself audited.
+    app.get('/api/v1/admin/audit', async (request, reply) => {
         const q = (request.query ?? {});
-        const limit = q.limit === undefined ? 100 : Number(q.limit);
+        const limit = q['limit'] === undefined ? 100 : Number(q['limit']);
         if (!Number.isInteger(limit) || limit < 1 || limit > 1000)
             throw bad('limit must be 1–1000.');
-        return request.env(async (env) => {
+        const where = {};
+        const text = (key) => typeof q[key] === 'string' && q[key] !== '' ? q[key] : undefined;
+        const id = (key) => {
+            const v = text(key);
+            if (v === undefined)
+                return undefined;
+            const n = Number(v);
+            if (!Number.isSafeInteger(n) || n <= 0)
+                throw bad(`${key} is a positive integer.`);
+            return n;
+        };
+        const date = (key) => {
+            const v = text(key);
+            if (v === undefined)
+                return undefined;
+            const d = new Date(v);
+            if (Number.isNaN(d.getTime()))
+                throw bad(`${key} is an ISO date.`);
+            return d;
+        };
+        const kind = text('kind');
+        if (kind !== undefined)
+            where['kind'] = kind.endsWith('.') ? { like: `${kind}%` } : kind;
+        if (id('actor') !== undefined)
+            where['actor'] = id('actor');
+        if (text('model') !== undefined)
+            where['targetModel'] = text('model');
+        if (id('record') !== undefined)
+            where['targetId'] = id('record');
+        if (text('q') !== undefined)
+            where['summary'] = { ilike: `%${text('q')}%` };
+        const from = date('from');
+        const to = date('to');
+        if (from !== undefined || to !== undefined)
+            where['createdAt'] = {
+                ...(from === undefined ? {} : { gte: from }),
+                // `to` is a day: everything before the next one.
+                ...(to === undefined ? {} : { lt: new Date(to.getTime() + 86_400_000) }),
+            };
+        if (id('before') !== undefined)
+            where['id'] = { lt: id('before') };
+        const csv = q['format'] === 'csv';
+        const events = await request.env(async (env) => {
             requireAdministrator(env, 'permissions.view_audit');
             return env.asSuperuser({ reason: 'read audit log' }, async (su) => {
-                const where = {};
-                if (typeof q.kind === 'string' && q.kind !== '')
-                    where['kind'] = q.kind.endsWith('.') ? { like: `${q.kind}%` } : q.kind;
-                if (q.before !== undefined)
-                    where['id'] = { lt: Number(q.before) };
                 const set = await ref(su, 'audit.event').search({ where, order: ['id desc'], limit });
                 const keys = [
                     'kind',
@@ -382,8 +431,57 @@ export function registerAdminApi(context) {
                     'ip',
                     'createdAt',
                 ];
-                return { events: set.length === 0 ? [] : (await set.load(keys)).read(keys) };
+                const found = set.length === 0 ? [] : (await set.load(keys)).read(['id', ...keys]);
+                const actors = [
+                    ...new Set(found.map((e) => e['actor']).filter((a) => typeof a === 'number')),
+                ];
+                const names = new Map(actors.length === 0
+                    ? []
+                    : (await // Deactivated people keep their name in the log.
+                     (await ref(su.withFlags({ activeTest: false }), 'res.users').search({
+                        where: { id: { in: actors } },
+                    })).load(['name']))
+                        .read(['id', 'name'])
+                        .map((u) => [u['id'], String(u['name'])]));
+                if (csv)
+                    await audit(env, {
+                        kind: 'data.export',
+                        summary: `Exported ${found.length} audit event(s).`,
+                        targetModel: 'audit.event',
+                        details: { filters: where },
+                        ip: request.ip,
+                    });
+                return found.map((e) => ({
+                    ...e,
+                    actorName: typeof e['actor'] === 'number' ? (names.get(e['actor']) ?? null) : null,
+                }));
             });
         }, { write: true }); // the system read of the log is itself audited
+        if (!csv)
+            return { events };
+        const cell = (v) => {
+            const s = v === null || v === undefined ? '' : v instanceof Date ? v.toISOString() : String(v);
+            // Quoted, and never read as a formula by a spreadsheet.
+            return `"${(/^[=+\-@]/.test(s) ? `'${s}` : s).replaceAll('"', '""')}"`;
+        };
+        const columns = [
+            'id',
+            'createdAt',
+            'kind',
+            'actorName',
+            'summary',
+            'targetModel',
+            'targetId',
+            'ip',
+        ];
+        const lines = [
+            columns.join(','),
+            ...events.map((e) => columns.map((c) => cell(e[c])).join(',')),
+        ];
+        // A byte-order mark so spreadsheets read UTF-8 (Bangla names).
+        return reply
+            .header('content-type', 'text/csv; charset=utf-8')
+            .header('content-disposition', 'attachment; filename="audit-log.csv"')
+            .send(`${lines.join('\r\n')}\r\n`);
     });
 }

package/dist/permissions/index.d.ts

@@ -8,6 +8,7 @@ import { defineModule } from '../modules-sdk/index.js';
 export { registerAdminApi } from './admin.js';
 export { type ApprovalRequestInfo, approvalGuard, approvalState, decide, inbox, installApprovalPolicies, requestApprovals, requestsOf, } from './approvals.js';
 export { permissionsShutro } from './models.js';
+export { registerRoleRoutes } from './roles.js';
 export { registerApprovalRoutes } from './routes.js';
 /** Package identity. */
 export declare const PACKAGE: {

package/dist/permissions/index.js

@@ -9,10 +9,12 @@ import { base } from '../server/index.js';
 import { registerAdminApi } from './admin.js';
 import { installApprovalPolicies } from './approvals.js';
 import { permissionsShutro } from './models.js';
+import { registerRoleRoutes } from './roles.js';
 import { registerApprovalRoutes } from './routes.js';
 export { registerAdminApi } from './admin.js';
 export { approvalGuard, approvalState, decide, inbox, installApprovalPolicies, requestApprovals, requestsOf, } from './approvals.js';
 export { permissionsShutro } from './models.js';
+export { registerRoleRoutes } from './roles.js';
 export { registerApprovalRoutes } from './routes.js';
 /** Package identity. */
 export const PACKAGE = Object.freeze({
@@ -36,6 +38,7 @@ export const permissions = defineModule({
     },
     routes: (context) => {
         registerAdminApi(context);
+        registerRoleRoutes(context);
         registerApprovalRoutes(context);
     },
 });

package/dist/permissions/roles.d.ts

@@ -0,0 +1,2 @@
+import { type ModuleContext } from '../server/index.js';
+export declare function registerRoleRoutes(context: ModuleContext): void;