@aglyn/aglyn 1.0.0-beta.143

package/src/lib/app-utils/organizations.js

@@ -0,0 +1,511 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * Organization helpers (AGL-233): slug policy for workspace subdomains
+ * (`{slug}.aglyn.com`) and role math shared by the org APIs, the console
+ * UI, and the Firestore rules' mental model. See
+ * docs/MULTI_TENANT_FIRESTORE.md.
+ */ import { generateSubdomain, isBlockedSubdomain, SUBDOMAIN_PATTERN } from "./host-naming.js";
+import { hostScopeToken, ORG_SCOPE_TOKEN, visibleToTokens } from "./scope-tokens.js";
+/** Same lexical policy as host subdomains: 3–30 lowercase/digits/dashes. */ export const ORG_SLUG_PATTERN = SUBDOMAIN_PATTERN;
+/**
+ * Org workspace slugs ride the host reserved/profanity blocklist plus
+ * console-specific labels the workspace router must own.
+ */ const RESERVED_ORG_ONLY = new Set([
+    'staff',
+    'org',
+    'orgs',
+    'workspace'
+]);
+export function isBlockedOrgSlug(slug) {
+    return RESERVED_ORG_ONLY.has(slug.toLowerCase()) || isBlockedSubdomain(slug);
+}
+export function isValidOrgSlug(slug) {
+    return ORG_SLUG_PATTERN.test(slug) && !isBlockedOrgSlug(slug);
+}
+/** Best-effort slug from an org name; '' when nothing usable remains. */ export function generateOrgSlug(name) {
+    const slug = generateSubdomain(name);
+    return slug && !isBlockedOrgSlug(slug) ? slug : '';
+}
+export const ORG_ROLES = [
+    'owner',
+    'admin',
+    'editor',
+    'viewer'
+];
+const ORG_ROLE_WEIGHT = {
+    owner: 3,
+    admin: 2,
+    editor: 1,
+    viewer: 0
+};
+export function isOrgRole(value) {
+    return typeof value === 'string' && value in ORG_ROLE_WEIGHT;
+}
+export function orgRoleAtLeast(role, minimum) {
+    if (!role || !(role in ORG_ROLE_WEIGHT)) return false;
+    return ORG_ROLE_WEIGHT[role] >= ORG_ROLE_WEIGHT[minimum];
+}
+/** Org settings, members, invites, host creation: admin and owner. */ export function canManageOrg(role) {
+    return orgRoleAtLeast(role, 'admin');
+}
+/**
+ * The member's effective role on one host, or null for no access.
+ * Owner/admin span every host; editor/viewer resolve through `allHosts`
+ * (mapped to their org role) or the per-host access map.
+ */ export function hostRoleFor(member, hostId) {
+    var _member_hostAccess;
+    const role = member == null ? void 0 : member.role;
+    if (!isOrgRole(role)) return null;
+    if (role === 'owner' || role === 'admin') return 'admin';
+    const explicit = member == null ? void 0 : (_member_hostAccess = member.hostAccess) == null ? void 0 : _member_hostAccess[hostId];
+    if (explicit) return explicit;
+    return (member == null ? void 0 : member.allHosts) ? role : null;
+}
+/**
+ * Host roles that may MUTATE content — the axis `canWriteHostContent()` in
+ * the security rules asks (AGL-2334).
+ *
+ * `author` is here and absent from `HOST_PUBLISH_ROLES` below: that single
+ * difference IS the "edit content but not publish" role. Kept as two named
+ * sets rather than two inline comparisons because they are read in three
+ * places that must not drift — this module, the ~20 server gates, and the
+ * rules — and because a new host role added to the union has to be a
+ * deliberate decision on BOTH lists rather than an omission from one.
+ */ export const HOST_CONTENT_WRITE_ROLES = [
+    'admin',
+    'editor',
+    'author'
+];
+/**
+ * Host roles that may make content LIVE. Everything that registers a route,
+ * moves a live-version pointer, schedules either of those for later, or
+ * flips a collection entry to `published` asks this and not the set above.
+ *
+ * The list is short and it is the whole product decision: `author` is not on
+ * it. If a role is ever added here, the rules' `canPublishHostContent()` and
+ * the publish-surface field freezes below it must be updated in the same
+ * change — they are the enforcement, this is the server-side echo of it.
+ */ export const HOST_PUBLISH_ROLES = [
+    'admin',
+    'editor'
+];
+/**
+ * Whether the member may mutate a host's content — admin, editor **or
+ * author** on it.
+ *
+ * An author is a content editor in every respect this predicate covers; what
+ * it deliberately does NOT cover is publication. Any caller that is really
+ * asking "may this person make something live" must call `canPublishHost`
+ * instead — this one answering `true` for an author is the point of the role,
+ * not a gap in it.
+ */ export function canWriteHost(member, hostId) {
+    const role = hostRoleFor(member, hostId);
+    return !!role && HOST_CONTENT_WRITE_ROLES.includes(role);
+}
+/**
+ * Whether the member may PUBLISH on a host — register a route, move a live
+ * version pointer, schedule either for later, or publish a collection entry.
+ *
+ * Strictly narrower than `canWriteHost`: `author` edits and does not publish.
+ * This is the server-side echo of the rules, not the enforcement — publishing
+ * is a set of client-direct Firestore writes across five document shapes, so
+ * `cloud/firebase-firestore.rules` is where it is actually refused. Server
+ * routes that schedule or trigger a publish ask this so the console can say
+ * no with a message instead of surfacing a bare permission-denied.
+ */ export function canPublishHost(member, hostId) {
+    const role = hostRoleFor(member, hostId);
+    return !!role && HOST_PUBLISH_ROLES.includes(role);
+}
+/**
+ * The same question asked of a bare `memberRoles` value rather than a member
+ * document — the shape every Admin-SDK route already has in hand after its
+ * `hosts/{hostId}` read, so it does not have to re-load the org membership.
+ *
+ * `String(role)` at the call sites keeps `undefined` out; an unknown value
+ * is simply not in the set, which fails CLOSED.
+ */ export function hostRoleCanWrite(role) {
+    return HOST_CONTENT_WRITE_ROLES.includes(role);
+}
+/** Publish-axis twin of `hostRoleCanWrite`; `author` is excluded. */ export function hostRoleCanPublish(role) {
+    return HOST_PUBLISH_ROLES.includes(role);
+}
+/**
+ * Whether a member's reach is the whole org rather than a list of sites.
+ *
+ * Owner and admin always are; editor/viewer are only when `allHosts` says
+ * so — **or** when the membership predates the flag entirely. A pre-
+ * `allHosts` doc carries neither the flag nor a `hostAccess` map, and
+ * reading that as "scoped, with access to nothing" would lock real members
+ * out of their own workspace. A site collaborator ALWAYS has a non-empty
+ * `hostAccess` (that is what `grantHostAccess` writes), so the absence of
+ * both is the legacy shape, not a scoped one.
+ *
+ * Single source of truth for `resolveOrgPermissions` (the server gate),
+ * `projectMemberScopeTokens` (the rules projection), and the rules'
+ * own `isOrgWideMember()` — three copies of this predicate that disagree
+ * is a privilege bug, not a style problem (AGL-1026, AGL-1038).
+ */ export function isOrgWideMember(member) {
+    if (!member) return false;
+    const role = member.role;
+    if (role === 'owner' || role === 'admin') return true;
+    if (member.allHosts === true) return true;
+    const scoping = member.hostAccess;
+    return member.allHosts === undefined && !Object.keys(scoping != null ? scoping : {}).length;
+}
+/**
+ * How many of these roster entries consume a **manager** seat (AGL-1113).
+ *
+ * `orgs/{orgId}/members` holds BOTH org managers and site-scoped
+ * collaborators — adding a collaborator to one site writes an org member doc
+ * with `allHosts:false` + `hostAccess`, so a raw `.count()` of the collection
+ * billed every collaborator as a manager. Collaborators are metered
+ * separately, per host, against `membersPerHost` at
+ * `hosts/{hostId}/members` — counting them here charged them twice and
+ * tripped the manager gate for orgs nowhere near their manager limit.
+ *
+ * Reuses `isOrgWideMember` rather than filtering on `allHosts` directly:
+ * owner/admin are managers whatever the flag says, and a pre-`allHosts` doc
+ * is a manager too. A Firestore `where('allHosts','==',true)` count gets both
+ * of those wrong, which is why callers pass entries in and count here.
+ *
+ * Accepts pending INVITES as well as members — an invite carries the same
+ * `role`/`allHosts`/`hostAccess` shape and reserves the seat it will become.
+ */ export function countManagerSeats(entries) {
+    let count = 0;
+    for (const entry of entries)if (isOrgWideMember(entry)) count += 1;
+    return count;
+}
+/**
+ * The identity key one entry occupies, or `''` when it identifies nobody.
+ *
+ * EMAIL FIRST, uid second, and that order is the join (AGL-2068). A person
+ * admitted to a site is one seat whether they arrive as an accepted member or
+ * as a still-pending invite, and those two rows live in different collections
+ * keyed different ways — `orgs/{id}/members/{uid}` and
+ * `orgs/{id}/invites/{inviteId}` — with the address as the only field both
+ * carry. Counting by uid would count the invite and the membership it becomes
+ * as two seats; counting only invites would miss every member.
+ *
+ * Legacy roster rows written before `email` was mirrored fall back to the uid,
+ * which cannot collide with an address (the `uid:` prefix is not a legal
+ * local-part/domain pair) and so is safe to mix into the same set.
+ */ function collaboratorSeatKey(entry) {
+    const email = typeof entry.email === 'string' ? entry.email.trim().toLowerCase() : '';
+    if (email) return email;
+    const uid = typeof entry.uid === 'string' ? entry.uid.trim() : '';
+    return uid ? `uid:${uid}` : '';
+}
+/**
+ * Every principal consuming a COLLABORATOR seat on one host (AGL-2068).
+ *
+ * ## Why this exists at all
+ *
+ * `membersPerHost` was enforced on one of the four doors that admit a site
+ * collaborator, and that one door counted `hosts/{hostId}/members` — a
+ * DISPLAY roster only `/api/hosts/members` writes. The other three
+ * (`/api/orgs/invites` create, `/api/orgs/invites` accept, and the
+ * `hostAccess` branch of `/api/orgs/members`) land in `orgs/{id}/members` and
+ * the `hosts/{id}.memberRoles` projection, and were invisible to it. So the
+ * cap was both skipped on three paths and under-counted on the fourth, and a
+ * free org — `membersPerHost: 1` — could take on unlimited collaborators,
+ * each with full site access, on a plan that is never invoiced.
+ *
+ * verbatim: **"We need to make sure the free/hobby tier
+ * does hard cap so it always actually stays free."**
+ *
+ * ## What counts
+ *
+ * A SCOPED grant on `hostId`, and nothing else. An org-wide member
+ * (owner/admin, or `allHosts`) reaches every host but consumes a MANAGER
+ * seat — `countManagerSeats` is that side, and charging them here would bill
+ * one person twice and trip a cap they are not on. This is the same split
+ * AGL-1113 drew; it is now drawn from one place instead of three.
+ *
+ * Pending invites count, for the reason the manager gate counts them: an
+ * invite reserves the seat it will become, and a cap that only bites on
+ * acceptance can be walked past by mailing out N invites first.
+ */ export function collaboratorSeatKeys(entries, hostId) {
+    const keys = new Set();
+    if (!hostId) return keys;
+    for (const entry of entries){
+        var _entry_hostAccess;
+        if (!entry) continue;
+        // Managers are the other counter's population, whatever host map they
+        // happen to carry — a promoted collaborator keeps their old `hostAccess`.
+        if (isOrgWideMember(entry)) continue;
+        if (!((_entry_hostAccess = entry.hostAccess) == null ? void 0 : _entry_hostAccess[hostId])) continue;
+        const key = collaboratorSeatKey(entry);
+        if (key) keys.add(key);
+    }
+    return keys;
+}
+/**
+ * How many collaborator seats on `hostId` are spoken for by someone OTHER
+ * than `exclude` (AGL-2068).
+ *
+ * `exclude` is the principal the caller is about to admit, and dropping them
+ * is what makes this composable with `checkSeatQuota(…, used)`, whose
+ * contract is "usage BEFORE the resource being created". Without it the
+ * accept path refuses its own invite: at the moment acceptance is decided the
+ * invitee holds a pending invite AND is about to hold a membership, so they
+ * would be counted once or twice against a cap they are the subject of.
+ *
+ * Both identities are dropped, not whichever one is present. A person can be
+ * on the roster under a uid with no mirrored email and hold an invite under
+ * that address, and the seat is still one seat.
+ *
+ * ## `emails`, not `email` — an account holds several (AGL-2486)
+ *
+ * Since an invitation may be accepted at any CONFIRMED address on the account,
+ * the pending invite the accepter is about to consume can be keyed by an
+ * address that is not their primary. `exclude.email` alone is the primary, so
+ * that invite survived the exclusion and the person was counted against a cap
+ * they are the subject of — the exact double-count the paragraph above says
+ * this function exists to prevent, re-opened by widening the accept match.
+ *
+ * It fails CLOSED (a spurious "out of seats" refusal, never a free seat), and
+ * only for an org sitting exactly on its cap, which is why it survived review.
+ *
+ * `emails` takes every address PROVEN to belong to the principal being
+ * admitted. Passing an address that is not theirs would hand out a free seat,
+ * so callers must pass confirmed addresses for that uid and nothing else.
+ */ export function countCollaboratorSeats(entries, hostId, exclude) {
+    var _ref;
+    const keys = collaboratorSeatKeys(entries, hostId);
+    for (const candidate of [
+        exclude == null ? void 0 : exclude.email,
+        ...(_ref = exclude == null ? void 0 : exclude.emails) != null ? _ref : []
+    ]){
+        const email = typeof candidate === 'string' ? candidate.trim().toLowerCase() : '';
+        if (email) keys.delete(email);
+    }
+    const uid = typeof (exclude == null ? void 0 : exclude.uid) === 'string' ? exclude.uid.trim() : '';
+    if (uid) keys.delete(`uid:${uid}`);
+    return keys.size;
+}
+/**
+ * Every principal consuming a MANAGER seat, as identities rather than rows.
+ *
+ * The org-wide half of `collaboratorSeatKeys`, drawn from the same entries and
+ * split on the same predicate, so the two counters partition one roster
+ * instead of overlapping on it.
+ *
+ * Deduplicating by identity is the difference from {@link countManagerSeats},
+ * and it is what makes this composable with an `exclude`: a person holding a
+ * pending invite AND the membership it became is one seat, and the row-wise
+ * counter reports two because it is handed the two collections separately and
+ * sums them.
+ */ export function managerSeatKeys(entries) {
+    const keys = new Set();
+    for (const entry of entries){
+        if (!entry) continue;
+        if (!isOrgWideMember(entry)) continue;
+        const key = collaboratorSeatKey(entry);
+        if (key) keys.add(key);
+    }
+    return keys;
+}
+/**
+ * How many manager seats are spoken for by someone OTHER than `exclude`.
+ *
+ * The manager twin of {@link countCollaboratorSeats}, and it exists for the
+ * same reason that one takes an `exclude`: `checkSeatQuota`'s contract is
+ * "usage BEFORE the resource being created", and on the invite-accept path the
+ * accepter holds a pending invite and is about to hold a membership at the
+ * same instant. Counted plainly they are charged once or twice for a seat they
+ * are the subject of, and an org on its last seat refuses its own invitation.
+ *
+ * Both identities are dropped, and `emails` carries the further addresses
+ * proven to belong to that account — an invitation may be accepted at any
+ * confirmed address, so the invite being consumed need not be keyed by the
+ * primary one. Passing an address that is not theirs would hand out a free
+ * seat, so callers must pass confirmed addresses for that uid and nothing
+ * else.
+ *
+ * Kept SEPARATE from {@link countManagerSeats} rather than replacing it: that
+ * one is row-wise and is what the billing and console surfaces count with, and
+ * quietly making it identity-wise would change every one of those totals.
+ */ export function countManagerSeatsExcluding(entries, exclude) {
+    var _ref;
+    const keys = managerSeatKeys(entries);
+    for (const candidate of [
+        exclude == null ? void 0 : exclude.email,
+        ...(_ref = exclude == null ? void 0 : exclude.emails) != null ? _ref : []
+    ]){
+        const email = typeof candidate === 'string' ? candidate.trim().toLowerCase() : '';
+        if (email) keys.delete(email);
+    }
+    const uid = typeof (exclude == null ? void 0 : exclude.uid) === 'string' ? exclude.uid.trim() : '';
+    if (uid) keys.delete(`uid:${uid}`);
+    return keys.size;
+}
+export const CONSOLE_USER_TYPE_LABELS = {
+    manager: 'Team manager',
+    collaborator: 'Site collaborator',
+    siteMember: 'Site member'
+};
+/** One line on what each kind is and what it costs — tooltip/legend copy. */ export const CONSOLE_USER_TYPE_HINTS = {
+    manager: 'Reaches the whole organization. Uses one of your team (manager) seats.',
+    collaborator: 'Scoped to specific sites. Uses a collaborator seat on each site they ' + 'can reach, not a team seat.',
+    siteMember: 'An end-user account on a published site, not a console user. Free and ' + 'unlimited on every plan.'
+};
+/**
+ * Classify an `orgs/{orgId}/members` entry (or a pending invite, same shape).
+ * Never returns `siteMember` — nothing in that collection is one; the value
+ * exists for surfaces that list published-site accounts and must label them —
+ * never for one that lists both, since the two populations do not share an
+ * identity system.
+ */ export function consoleUserType(member) {
+    return isOrgWideMember(member) ? 'manager' : 'collaborator';
+}
+/**
+ * Whether an account is governed by enterprise SSO (AGL-1128) — it lives in
+ * an org's GCIP tenant pool rather than the project pool, so its identity is
+ * owned by the customer's IdP.
+ *
+ * `tenantId` is the whole signal: Firebase sets it on the user whenever the
+ * account belongs to a tenant, and only SSO accounts do.
+ */ export function isSsoGovernedAccount(user) {
+    return Boolean(user == null ? void 0 : user.tenantId);
+}
+/**
+ * Whether the account may connect an additional consumer sign-in provider.
+ *
+ * **No, for any SSO-governed account.** The customer's IdP is the single gate
+ * they bought: they revoke there, enforce MFA there, offboard there. A linked
+ * personal Google account is a way in their IdP can never see or revoke —
+ * exactly what SSO is purchased to prevent.
+ *
+ * Deliberately NOT gated on `sso.enforced`. That flag exists so we never
+ * LOCK OUT an existing sign-in method; it is not a licence to hand out new
+ * bypasses meanwhile. Nothing here removes a provider an account already has,
+ * so this can never lock anyone out.
+ *
+ * This is the intent, not the boundary — the boundary is upstream, since a
+ * GCIP tenant only accepts providers enabled on that tenant. Both matter: the
+ * boundary is remote config that could drift, and a UI that offers a
+ * security-regressing action is wrong even when the action would fail.
+ */ export function canLinkSocialProvider(user) {
+    return !isSsoGovernedAccount(user);
+}
+/**
+ * The same question as `isOrgWideMember`, asked of the `users/{uid}/orgs`
+ * reverse-index row instead of the member doc (AGL-1032).
+ *
+ * The console navigates from the index — it is what `useOrgScope` loads —
+ * and the index carries a MIRROR of the predicate, not the inputs to it, so
+ * this cannot recompute: `role: 'viewer'` on the index means "viewer",
+ * whether the member reaches every site or one.
+ *
+ * Reads a missing flag as org-wide, for the same reason `isOrgWideMember`
+ * reads a missing `allHosts` that way: rows written before the mirror
+ * existed have no flag, and hiding the workspace from a real member is a
+ * worse failure than showing org chrome to a collaborator whose reads the
+ * rules refuse anyway. Owner/admin are org-wide by role regardless of the
+ * mirror, so a stale row can never lock an admin out.
+ *
+ * Navigation only — never an access decision. AGL-1026 (rules) and the
+ * Admin-SDK scope checks are the boundary.
+ */ export function isOrgWideMembership(membership) {
+    if (!membership) return true;
+    if (membership.role === 'owner' || membership.role === 'admin') return true;
+    return membership.orgWide !== false;
+}
+/**
+ * The `scopeTokens` projection stamped onto member docs (AGL-1038) so the
+ * rules can intersect a caller's reach with a resource's `visibleTo` —
+ * rules have no `.map()`, so `hostAccess`'s keys cannot be turned into
+ * tokens at evaluation time and have to be denormalized here.
+ *
+ * Org-wide members get `['org']`; they own the org and read everything in
+ * it, scoped or not (the rules short-circuit on them anyway). A scoped
+ * collaborator gets `'org'` plus one token per granted host — `'org'`
+ * because an org-WIDE resource stays readable by any member, which is
+ * today's behavior and not something this project narrows.
+ *
+ * Not capped at `MAX_SCOPE_HOSTS`: the rules' `hasAny` has no 30-value
+ * limit, only the client `array-contains-any` query does, so a member of
+ * more than 30 sites is a listing problem for AGL-1044 to chunk, not a
+ * reason to under-grant here.
+ */ export function projectMemberScopeTokens(member) {
+    var _ref;
+    if (isOrgWideMember(member)) return [
+        ORG_SCOPE_TOKEN
+    ];
+    const hostIds = Object.keys((_ref = member == null ? void 0 : member.hostAccess) != null ? _ref : {});
+    return [
+        ORG_SCOPE_TOKEN,
+        ...hostIds.map(hostScopeToken)
+    ];
+}
+/**
+ * A member's effective read set: the stored `scopeTokens` projection when it
+ * is there, recomputed from the membership when it is not.
+ *
+ * The fallback is the security-relevant half and it was written out by hand
+ * in four places (`use-scope-tokens`, `erase-scope`, the media sign route,
+ * and by omission in `resolveMediaScope`, which only ever recomputed). Four
+ * copies of "what may this member see" is the shape that eventually
+ * disagrees, and a copy that reads `member.scopeTokens` WITHOUT the
+ * `.length` guard silently grants nothing to a member the AGL-1040 backfill
+ * has not reached — or, written the other way round, grants everything.
+ *
+ * Recomputing is the safe fallback rather than a convenience: it produces
+ * exactly what `grantHostAccess` would have stamped, so an unstamped member
+ * doc behaves as its `hostAccess` says, never as "no access" and never as
+ * org-wide.
+ */ export function memberScopeTokens(member) {
+    const stored = member == null ? void 0 : member.scopeTokens;
+    return (stored == null ? void 0 : stored.length) ? stored : projectMemberScopeTokens(member);
+}
+/**
+ * May this member see a resource carrying `visibleTo`? (AGL-1037/1038)
+ *
+ * The whole client-side/server-side authorization question in one place:
+ * org-wide members read everything they own; everyone else needs their read
+ * set to intersect the resource's scope. Absent/empty `visibleTo` is
+ * org-wide by the same rule the Firestore rules use, so an unbackfilled
+ * resource does not vanish.
+ *
+ * Every Admin-SDK path must call this (or `scopeAllows`, which wraps an
+ * already-resolved scope) — the Admin SDK bypasses rules entirely, so this
+ * IS the enforcement there, not a second opinion about it.
+ *
+ * NOT a membership check, and never a substitute for one: a `null` member
+ * "can see" an org-wide resource here, because the question this answers is
+ * "is this resource in scope for that reach", not "is this person in the
+ * org". Resolve membership first and refuse the caller if there is none —
+ * conflating the two is exactly how AGL-1026 exposed a whole org.
+ */ export function memberCanSee(member, visibleTo) {
+    if (isOrgWideMember(member)) return true;
+    return visibleToTokens(visibleTo != null ? visibleTo : undefined, memberScopeTokens(member));
+}
+/**
+ * The `memberRoles` projection stamped onto host docs so Firestore rules
+ * authorize host content with the single host-doc read they already do
+ * (docs/MULTI_TENANT_FIRESTORE.md §5). Recomputed by the membership API
+ * whenever a member changes; owner/admin appear on every host.
+ */ export function projectHostMemberRoles(members, hostId) {
+    const projection = {};
+    for (const member of members){
+        const role = hostRoleFor(member, hostId);
+        if (role) projection[member.$id] = role;
+    }
+    return projection;
+}
+
+//# sourceMappingURL=organizations.js.map

package/src/lib/app-utils/organizations.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/organizations.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Organization helpers (AGL-233): slug policy for workspace subdomains\n * (`{slug}.aglyn.com`) and role math shared by the org APIs, the console\n * UI, and the Firestore rules' mental model. See\n * docs/MULTI_TENANT_FIRESTORE.md.\n */\n\nimport type {\n  AglynOrgMember,\n  HostAccessRole,\n  HostUid,\n  OrgRole,\n  ScopeToken,\n  UserOrgMembership,\n} from '../foundation'\nimport {\n  generateSubdomain,\n  isBlockedSubdomain,\n  SUBDOMAIN_PATTERN,\n} from './host-naming'\nimport {\n  hostScopeToken,\n  ORG_SCOPE_TOKEN,\n  visibleToTokens,\n} from './scope-tokens'\n\n/** Same lexical policy as host subdomains: 3–30 lowercase/digits/dashes. */\nexport const ORG_SLUG_PATTERN = SUBDOMAIN_PATTERN\n\n/**\n * Org workspace slugs ride the host reserved/profanity blocklist plus\n * console-specific labels the workspace router must own.\n */\nconst RESERVED_ORG_ONLY = new Set(['staff', 'org', 'orgs', 'workspace'])\n\nexport function isBlockedOrgSlug(slug: string): boolean {\n  return RESERVED_ORG_ONLY.has(slug.toLowerCase()) || isBlockedSubdomain(slug)\n}\n\nexport function isValidOrgSlug(slug: string): boolean {\n  return ORG_SLUG_PATTERN.test(slug) && !isBlockedOrgSlug(slug)\n}\n\n/** Best-effort slug from an org name; '' when nothing usable remains. */\nexport function generateOrgSlug(name: string): string {\n  const slug = generateSubdomain(name)\n  return slug && !isBlockedOrgSlug(slug) ? slug : ''\n}\n\nexport const ORG_ROLES: readonly OrgRole[] = [\n  'owner',\n  'admin',\n  'editor',\n  'viewer',\n]\n\nconst ORG_ROLE_WEIGHT: Record<OrgRole, number> = {\n  owner: 3,\n  admin: 2,\n  editor: 1,\n  viewer: 0,\n}\n\nexport function isOrgRole(value: unknown): value is OrgRole {\n  return typeof value === 'string' && value in ORG_ROLE_WEIGHT\n}\n\nexport function orgRoleAtLeast(\n  role: OrgRole | null | undefined,\n  minimum: OrgRole,\n): boolean {\n  if (!role || !(role in ORG_ROLE_WEIGHT)) return false\n  return ORG_ROLE_WEIGHT[role] >= ORG_ROLE_WEIGHT[minimum]\n}\n\n/** Org settings, members, invites, host creation: admin and owner. */\nexport function canManageOrg(role: OrgRole | null | undefined): boolean {\n  return orgRoleAtLeast(role, 'admin')\n}\n\n/**\n * The member's effective role on one host, or null for no access.\n * Owner/admin span every host; editor/viewer resolve through `allHosts`\n * (mapped to their org role) or the per-host access map.\n */\nexport function hostRoleFor(\n  member: Partial<AglynOrgMember> | null | undefined,\n  hostId: HostUid,\n): HostAccessRole | null {\n  const role = member?.role\n  if (!isOrgRole(role)) return null\n  if (role === 'owner' || role === 'admin') return 'admin'\n  const explicit = member?.hostAccess?.[hostId]\n  if (explicit) return explicit\n  return member?.allHosts ? role : null\n}\n\n/**\n * Host roles that may MUTATE content — the axis `canWriteHostContent()` in\n * the security rules asks (AGL-2334).\n *\n * `author` is here and absent from `HOST_PUBLISH_ROLES` below: that single\n * difference IS the \"edit content but not publish\" role. Kept as two named\n * sets rather than two inline comparisons because they are read in three\n * places that must not drift — this module, the ~20 server gates, and the\n * rules — and because a new host role added to the union has to be a\n * deliberate decision on BOTH lists rather than an omission from one.\n */\nexport const HOST_CONTENT_WRITE_ROLES: readonly HostAccessRole[] = [\n  'admin',\n  'editor',\n  'author',\n]\n\n/**\n * Host roles that may make content LIVE. Everything that registers a route,\n * moves a live-version pointer, schedules either of those for later, or\n * flips a collection entry to `published` asks this and not the set above.\n *\n * The list is short and it is the whole product decision: `author` is not on\n * it. If a role is ever added here, the rules' `canPublishHostContent()` and\n * the publish-surface field freezes below it must be updated in the same\n * change — they are the enforcement, this is the server-side echo of it.\n */\nexport const HOST_PUBLISH_ROLES: readonly HostAccessRole[] = ['admin', 'editor']\n\n/**\n * Whether the member may mutate a host's content — admin, editor **or\n * author** on it.\n *\n * An author is a content editor in every respect this predicate covers; what\n * it deliberately does NOT cover is publication. Any caller that is really\n * asking \"may this person make something live\" must call `canPublishHost`\n * instead — this one answering `true` for an author is the point of the role,\n * not a gap in it.\n */\nexport function canWriteHost(\n  member: Partial<AglynOrgMember> | null | undefined,\n  hostId: HostUid,\n): boolean {\n  const role = hostRoleFor(member, hostId)\n  return !!role && HOST_CONTENT_WRITE_ROLES.includes(role)\n}\n\n/**\n * Whether the member may PUBLISH on a host — register a route, move a live\n * version pointer, schedule either for later, or publish a collection entry.\n *\n * Strictly narrower than `canWriteHost`: `author` edits and does not publish.\n * This is the server-side echo of the rules, not the enforcement — publishing\n * is a set of client-direct Firestore writes across five document shapes, so\n * `cloud/firebase-firestore.rules` is where it is actually refused. Server\n * routes that schedule or trigger a publish ask this so the console can say\n * no with a message instead of surfacing a bare permission-denied.\n */\nexport function canPublishHost(\n  member: Partial<AglynOrgMember> | null | undefined,\n  hostId: HostUid,\n): boolean {\n  const role = hostRoleFor(member, hostId)\n  return !!role && HOST_PUBLISH_ROLES.includes(role)\n}\n\n/**\n * The same question asked of a bare `memberRoles` value rather than a member\n * document — the shape every Admin-SDK route already has in hand after its\n * `hosts/{hostId}` read, so it does not have to re-load the org membership.\n *\n * `String(role)` at the call sites keeps `undefined` out; an unknown value\n * is simply not in the set, which fails CLOSED.\n */\nexport function hostRoleCanWrite(role: unknown): boolean {\n  return HOST_CONTENT_WRITE_ROLES.includes(role as HostAccessRole)\n}\n\n/** Publish-axis twin of `hostRoleCanWrite`; `author` is excluded. */\nexport function hostRoleCanPublish(role: unknown): boolean {\n  return HOST_PUBLISH_ROLES.includes(role as HostAccessRole)\n}\n\n/**\n * Whether a member's reach is the whole org rather than a list of sites.\n *\n * Owner and admin always are; editor/viewer are only when `allHosts` says\n * so — **or** when the membership predates the flag entirely. A pre-\n * `allHosts` doc carries neither the flag nor a `hostAccess` map, and\n * reading that as \"scoped, with access to nothing\" would lock real members\n * out of their own workspace. A site collaborator ALWAYS has a non-empty\n * `hostAccess` (that is what `grantHostAccess` writes), so the absence of\n * both is the legacy shape, not a scoped one.\n *\n * Single source of truth for `resolveOrgPermissions` (the server gate),\n * `projectMemberScopeTokens` (the rules projection), and the rules'\n * own `isOrgWideMember()` — three copies of this predicate that disagree\n * is a privilege bug, not a style problem (AGL-1026, AGL-1038).\n */\nexport function isOrgWideMember(\n  member: Partial<AglynOrgMember> | null | undefined,\n): boolean {\n  if (!member) return false\n  const role = member.role\n  if (role === 'owner' || role === 'admin') return true\n  if (member.allHosts === true) return true\n  const scoping = member.hostAccess\n  return (\n    member.allHosts === undefined && !Object.keys(scoping ?? {}).length\n  )\n}\n\n/**\n * How many of these roster entries consume a **manager** seat (AGL-1113).\n *\n * `orgs/{orgId}/members` holds BOTH org managers and site-scoped\n * collaborators — adding a collaborator to one site writes an org member doc\n * with `allHosts:false` + `hostAccess`, so a raw `.count()` of the collection\n * billed every collaborator as a manager. Collaborators are metered\n * separately, per host, against `membersPerHost` at\n * `hosts/{hostId}/members` — counting them here charged them twice and\n * tripped the manager gate for orgs nowhere near their manager limit.\n *\n * Reuses `isOrgWideMember` rather than filtering on `allHosts` directly:\n * owner/admin are managers whatever the flag says, and a pre-`allHosts` doc\n * is a manager too. A Firestore `where('allHosts','==',true)` count gets both\n * of those wrong, which is why callers pass entries in and count here.\n *\n * Accepts pending INVITES as well as members — an invite carries the same\n * `role`/`allHosts`/`hostAccess` shape and reserves the seat it will become.\n */\nexport function countManagerSeats(\n  entries: ReadonlyArray<Partial<AglynOrgMember> | null | undefined>,\n): number {\n  let count = 0\n  for (const entry of entries) if (isOrgWideMember(entry)) count += 1\n  return count\n}\n\n/**\n * One roster row or pending invite, as the collaborator counter needs to see\n * it (AGL-2068). Deliberately structural rather than `Partial<AglynOrgMember>`\n * — an INVITE is not a member document, it is keyed by email and has no uid,\n * and the whole point of this counter is that the two populations must be\n * counted together or the cap is enforced against a fraction of itself.\n */\nexport interface CollaboratorSeatEntry {\n  /** Member documents are keyed by uid; invites have none. */\n  uid?: string | null\n  email?: string | null\n  role?: unknown\n  allHosts?: boolean\n  hostAccess?: Record<string, unknown> | null\n}\n\n/**\n * The identity key one entry occupies, or `''` when it identifies nobody.\n *\n * EMAIL FIRST, uid second, and that order is the join (AGL-2068). A person\n * admitted to a site is one seat whether they arrive as an accepted member or\n * as a still-pending invite, and those two rows live in different collections\n * keyed different ways — `orgs/{id}/members/{uid}` and\n * `orgs/{id}/invites/{inviteId}` — with the address as the only field both\n * carry. Counting by uid would count the invite and the membership it becomes\n * as two seats; counting only invites would miss every member.\n *\n * Legacy roster rows written before `email` was mirrored fall back to the uid,\n * which cannot collide with an address (the `uid:` prefix is not a legal\n * local-part/domain pair) and so is safe to mix into the same set.\n */\nfunction collaboratorSeatKey(entry: CollaboratorSeatEntry): string {\n  const email =\n    typeof entry.email === 'string' ? entry.email.trim().toLowerCase() : ''\n  if (email) return email\n  const uid = typeof entry.uid === 'string' ? entry.uid.trim() : ''\n  return uid ? `uid:${uid}` : ''\n}\n\n/**\n * Every principal consuming a COLLABORATOR seat on one host (AGL-2068).\n *\n * ## Why this exists at all\n *\n * `membersPerHost` was enforced on one of the four doors that admit a site\n * collaborator, and that one door counted `hosts/{hostId}/members` — a\n * DISPLAY roster only `/api/hosts/members` writes. The other three\n * (`/api/orgs/invites` create, `/api/orgs/invites` accept, and the\n * `hostAccess` branch of `/api/orgs/members`) land in `orgs/{id}/members` and\n * the `hosts/{id}.memberRoles` projection, and were invisible to it. So the\n * cap was both skipped on three paths and under-counted on the fourth, and a\n * free org — `membersPerHost: 1` — could take on unlimited collaborators,\n * each with full site access, on a plan that is never invoiced.\n *\n * verbatim: **\"We need to make sure the free/hobby tier\n * does hard cap so it always actually stays free.\"**\n *\n * ## What counts\n *\n * A SCOPED grant on `hostId`, and nothing else. An org-wide member\n * (owner/admin, or `allHosts`) reaches every host but consumes a MANAGER\n * seat — `countManagerSeats` is that side, and charging them here would bill\n * one person twice and trip a cap they are not on. This is the same split\n * AGL-1113 drew; it is now drawn from one place instead of three.\n *\n * Pending invites count, for the reason the manager gate counts them: an\n * invite reserves the seat it will become, and a cap that only bites on\n * acceptance can be walked past by mailing out N invites first.\n */\nexport function collaboratorSeatKeys(\n  entries: ReadonlyArray<CollaboratorSeatEntry | null | undefined>,\n  hostId: string,\n): Set<string> {\n  const keys = new Set<string>()\n  if (!hostId) return keys\n  for (const entry of entries) {\n    if (!entry) continue\n    // Managers are the other counter's population, whatever host map they\n    // happen to carry — a promoted collaborator keeps their old `hostAccess`.\n    if (isOrgWideMember(entry as Partial<AglynOrgMember>)) continue\n    if (!entry.hostAccess?.[hostId]) continue\n    const key = collaboratorSeatKey(entry)\n    if (key) keys.add(key)\n  }\n  return keys\n}\n\n/**\n * How many collaborator seats on `hostId` are spoken for by someone OTHER\n * than `exclude` (AGL-2068).\n *\n * `exclude` is the principal the caller is about to admit, and dropping them\n * is what makes this composable with `checkSeatQuota(…, used)`, whose\n * contract is \"usage BEFORE the resource being created\". Without it the\n * accept path refuses its own invite: at the moment acceptance is decided the\n * invitee holds a pending invite AND is about to hold a membership, so they\n * would be counted once or twice against a cap they are the subject of.\n *\n * Both identities are dropped, not whichever one is present. A person can be\n * on the roster under a uid with no mirrored email and hold an invite under\n * that address, and the seat is still one seat.\n *\n * ## `emails`, not `email` — an account holds several (AGL-2486)\n *\n * Since an invitation may be accepted at any CONFIRMED address on the account,\n * the pending invite the accepter is about to consume can be keyed by an\n * address that is not their primary. `exclude.email` alone is the primary, so\n * that invite survived the exclusion and the person was counted against a cap\n * they are the subject of — the exact double-count the paragraph above says\n * this function exists to prevent, re-opened by widening the accept match.\n *\n * It fails CLOSED (a spurious \"out of seats\" refusal, never a free seat), and\n * only for an org sitting exactly on its cap, which is why it survived review.\n *\n * `emails` takes every address PROVEN to belong to the principal being\n * admitted. Passing an address that is not theirs would hand out a free seat,\n * so callers must pass confirmed addresses for that uid and nothing else.\n */\nexport function countCollaboratorSeats(\n  entries: ReadonlyArray<CollaboratorSeatEntry | null | undefined>,\n  hostId: string,\n  exclude?: {\n    uid?: string | null\n    email?: string | null\n    /** Further addresses on the SAME account; see above. */\n    emails?: readonly (string | null | undefined)[] | null\n  },\n): number {\n  const keys = collaboratorSeatKeys(entries, hostId)\n  for (const candidate of [exclude?.email, ...(exclude?.emails ?? [])]) {\n    const email = typeof candidate === 'string' ? candidate.trim().toLowerCase() : ''\n    if (email) keys.delete(email)\n  }\n  const uid = typeof exclude?.uid === 'string' ? exclude.uid.trim() : ''\n  if (uid) keys.delete(`uid:${uid}`)\n  return keys.size\n}\n\n/**\n * Every principal consuming a MANAGER seat, as identities rather than rows.\n *\n * The org-wide half of `collaboratorSeatKeys`, drawn from the same entries and\n * split on the same predicate, so the two counters partition one roster\n * instead of overlapping on it.\n *\n * Deduplicating by identity is the difference from {@link countManagerSeats},\n * and it is what makes this composable with an `exclude`: a person holding a\n * pending invite AND the membership it became is one seat, and the row-wise\n * counter reports two because it is handed the two collections separately and\n * sums them.\n */\nexport function managerSeatKeys(\n  entries: ReadonlyArray<CollaboratorSeatEntry | null | undefined>,\n): Set<string> {\n  const keys = new Set<string>()\n  for (const entry of entries) {\n    if (!entry) continue\n    if (!isOrgWideMember(entry as Partial<AglynOrgMember>)) continue\n    const key = collaboratorSeatKey(entry)\n    if (key) keys.add(key)\n  }\n  return keys\n}\n\n/**\n * How many manager seats are spoken for by someone OTHER than `exclude`.\n *\n * The manager twin of {@link countCollaboratorSeats}, and it exists for the\n * same reason that one takes an `exclude`: `checkSeatQuota`'s contract is\n * \"usage BEFORE the resource being created\", and on the invite-accept path the\n * accepter holds a pending invite and is about to hold a membership at the\n * same instant. Counted plainly they are charged once or twice for a seat they\n * are the subject of, and an org on its last seat refuses its own invitation.\n *\n * Both identities are dropped, and `emails` carries the further addresses\n * proven to belong to that account — an invitation may be accepted at any\n * confirmed address, so the invite being consumed need not be keyed by the\n * primary one. Passing an address that is not theirs would hand out a free\n * seat, so callers must pass confirmed addresses for that uid and nothing\n * else.\n *\n * Kept SEPARATE from {@link countManagerSeats} rather than replacing it: that\n * one is row-wise and is what the billing and console surfaces count with, and\n * quietly making it identity-wise would change every one of those totals.\n */\nexport function countManagerSeatsExcluding(\n  entries: ReadonlyArray<CollaboratorSeatEntry | null | undefined>,\n  exclude?: {\n    uid?: string | null\n    email?: string | null\n    /** Further addresses on the SAME account; see above. */\n    emails?: readonly (string | null | undefined)[] | null\n  },\n): number {\n  const keys = managerSeatKeys(entries)\n  for (const candidate of [exclude?.email, ...(exclude?.emails ?? [])]) {\n    const email = typeof candidate === 'string' ? candidate.trim().toLowerCase() : ''\n    if (email) keys.delete(email)\n  }\n  const uid = typeof exclude?.uid === 'string' ? exclude.uid.trim() : ''\n  if (uid) keys.delete(`uid:${uid}`)\n  return keys.size\n}\n\n/**\n * What KIND of user a console row represents (AGL-1114) — the distinction\n * that decides which seat they consume, and the one the Team table could not\n * express because a manager and a collaborator differ only by fields the\n * table never showed.\n *\n * Deliberately NOT the same axis as `role`. A `role: 'editor'` is a manager\n * when their reach is the whole org and a collaborator when it is two sites;\n * reading the role alone is the mistake that let a collaborator look like\n * team staff (see the org-leak and role-gate work).\n *\n * `siteMember` is the third kind and never appears in `orgs/{id}/members` at\n * all: it is an end-user account on a PUBLISHED site (`siteMembers`), not a\n * console user. It has no Firebase Auth record of any kind — a site member is\n * a Firestore document under `hosts/{hostId}/siteMembers` with its own scrypt\n * hash and its own session cookie — so no surface that lists AUTH accounts,\n * the staff user directory included, can contain one. The label is here so the\n * vocabulary is complete, for a surface that lists site accounts and needs a\n * word for them. Free and uncounted on every plan (AGL-889).\n */\nexport type ConsoleUserType = 'manager' | 'collaborator' | 'siteMember'\n\nexport const CONSOLE_USER_TYPE_LABELS: Record<ConsoleUserType, string> = {\n  manager: 'Team manager',\n  collaborator: 'Site collaborator',\n  siteMember: 'Site member',\n}\n\n/** One line on what each kind is and what it costs — tooltip/legend copy. */\nexport const CONSOLE_USER_TYPE_HINTS: Record<ConsoleUserType, string> = {\n  manager:\n    'Reaches the whole organization. Uses one of your team (manager) seats.',\n  collaborator:\n    'Scoped to specific sites. Uses a collaborator seat on each site they ' +\n    'can reach, not a team seat.',\n  siteMember:\n    'An end-user account on a published site, not a console user. Free and ' +\n    'unlimited on every plan.',\n}\n\n/**\n * Classify an `orgs/{orgId}/members` entry (or a pending invite, same shape).\n * Never returns `siteMember` — nothing in that collection is one; the value\n * exists for surfaces that list published-site accounts and must label them —\n * never for one that lists both, since the two populations do not share an\n * identity system.\n */\nexport function consoleUserType(\n  member: Partial<AglynOrgMember> | null | undefined,\n): Exclude<ConsoleUserType, 'siteMember'> {\n  return isOrgWideMember(member) ? 'manager' : 'collaborator'\n}\n\n/**\n * Whether an account is governed by enterprise SSO (AGL-1128) — it lives in\n * an org's GCIP tenant pool rather than the project pool, so its identity is\n * owned by the customer's IdP.\n *\n * `tenantId` is the whole signal: Firebase sets it on the user whenever the\n * account belongs to a tenant, and only SSO accounts do.\n */\nexport function isSsoGovernedAccount(\n  user: { tenantId?: string | null } | null | undefined,\n): boolean {\n  return Boolean(user?.tenantId)\n}\n\n/**\n * Whether the account may connect an additional consumer sign-in provider.\n *\n * **No, for any SSO-governed account.** The customer's IdP is the single gate\n * they bought: they revoke there, enforce MFA there, offboard there. A linked\n * personal Google account is a way in their IdP can never see or revoke —\n * exactly what SSO is purchased to prevent.\n *\n * Deliberately NOT gated on `sso.enforced`. That flag exists so we never\n * LOCK OUT an existing sign-in method; it is not a licence to hand out new\n * bypasses meanwhile. Nothing here removes a provider an account already has,\n * so this can never lock anyone out.\n *\n * This is the intent, not the boundary — the boundary is upstream, since a\n * GCIP tenant only accepts providers enabled on that tenant. Both matter: the\n * boundary is remote config that could drift, and a UI that offers a\n * security-regressing action is wrong even when the action would fail.\n */\nexport function canLinkSocialProvider(\n  user: { tenantId?: string | null } | null | undefined,\n): boolean {\n  return !isSsoGovernedAccount(user)\n}\n\n/**\n * The same question as `isOrgWideMember`, asked of the `users/{uid}/orgs`\n * reverse-index row instead of the member doc (AGL-1032).\n *\n * The console navigates from the index — it is what `useOrgScope` loads —\n * and the index carries a MIRROR of the predicate, not the inputs to it, so\n * this cannot recompute: `role: 'viewer'` on the index means \"viewer\",\n * whether the member reaches every site or one.\n *\n * Reads a missing flag as org-wide, for the same reason `isOrgWideMember`\n * reads a missing `allHosts` that way: rows written before the mirror\n * existed have no flag, and hiding the workspace from a real member is a\n * worse failure than showing org chrome to a collaborator whose reads the\n * rules refuse anyway. Owner/admin are org-wide by role regardless of the\n * mirror, so a stale row can never lock an admin out.\n *\n * Navigation only — never an access decision. AGL-1026 (rules) and the\n * Admin-SDK scope checks are the boundary.\n */\nexport function isOrgWideMembership(\n  membership:\n    | Pick<UserOrgMembership, 'role' | 'orgWide'>\n    | null\n    | undefined,\n): boolean {\n  if (!membership) return true\n  if (membership.role === 'owner' || membership.role === 'admin') return true\n  return membership.orgWide !== false\n}\n\n/**\n * The `scopeTokens` projection stamped onto member docs (AGL-1038) so the\n * rules can intersect a caller's reach with a resource's `visibleTo` —\n * rules have no `.map()`, so `hostAccess`'s keys cannot be turned into\n * tokens at evaluation time and have to be denormalized here.\n *\n * Org-wide members get `['org']`; they own the org and read everything in\n * it, scoped or not (the rules short-circuit on them anyway). A scoped\n * collaborator gets `'org'` plus one token per granted host — `'org'`\n * because an org-WIDE resource stays readable by any member, which is\n * today's behavior and not something this project narrows.\n *\n * Not capped at `MAX_SCOPE_HOSTS`: the rules' `hasAny` has no 30-value\n * limit, only the client `array-contains-any` query does, so a member of\n * more than 30 sites is a listing problem for AGL-1044 to chunk, not a\n * reason to under-grant here.\n */\nexport function projectMemberScopeTokens(\n  member: Partial<AglynOrgMember> | null | undefined,\n): ScopeToken[] {\n  if (isOrgWideMember(member)) return [ORG_SCOPE_TOKEN]\n  const hostIds = Object.keys(member?.hostAccess ?? {})\n  return [ORG_SCOPE_TOKEN, ...hostIds.map(hostScopeToken)]\n}\n\n/**\n * A member's effective read set: the stored `scopeTokens` projection when it\n * is there, recomputed from the membership when it is not.\n *\n * The fallback is the security-relevant half and it was written out by hand\n * in four places (`use-scope-tokens`, `erase-scope`, the media sign route,\n * and by omission in `resolveMediaScope`, which only ever recomputed). Four\n * copies of \"what may this member see\" is the shape that eventually\n * disagrees, and a copy that reads `member.scopeTokens` WITHOUT the\n * `.length` guard silently grants nothing to a member the AGL-1040 backfill\n * has not reached — or, written the other way round, grants everything.\n *\n * Recomputing is the safe fallback rather than a convenience: it produces\n * exactly what `grantHostAccess` would have stamped, so an unstamped member\n * doc behaves as its `hostAccess` says, never as \"no access\" and never as\n * org-wide.\n */\nexport function memberScopeTokens(\n  member: Partial<AglynOrgMember> | null | undefined,\n): ScopeToken[] {\n  const stored = member?.scopeTokens\n  return stored?.length ? stored : projectMemberScopeTokens(member)\n}\n\n/**\n * May this member see a resource carrying `visibleTo`? (AGL-1037/1038)\n *\n * The whole client-side/server-side authorization question in one place:\n * org-wide members read everything they own; everyone else needs their read\n * set to intersect the resource's scope. Absent/empty `visibleTo` is\n * org-wide by the same rule the Firestore rules use, so an unbackfilled\n * resource does not vanish.\n *\n * Every Admin-SDK path must call this (or `scopeAllows`, which wraps an\n * already-resolved scope) — the Admin SDK bypasses rules entirely, so this\n * IS the enforcement there, not a second opinion about it.\n *\n * NOT a membership check, and never a substitute for one: a `null` member\n * \"can see\" an org-wide resource here, because the question this answers is\n * \"is this resource in scope for that reach\", not \"is this person in the\n * org\". Resolve membership first and refuse the caller if there is none —\n * conflating the two is exactly how AGL-1026 exposed a whole org.\n */\nexport function memberCanSee(\n  member: Partial<AglynOrgMember> | null | undefined,\n  visibleTo: readonly string[] | null | undefined,\n): boolean {\n  if (isOrgWideMember(member)) return true\n  return visibleToTokens(visibleTo ?? undefined, memberScopeTokens(member))\n}\n\n/**\n * The `memberRoles` projection stamped onto host docs so Firestore rules\n * authorize host content with the single host-doc read they already do\n * (docs/MULTI_TENANT_FIRESTORE.md §5). Recomputed by the membership API\n * whenever a member changes; owner/admin appear on every host.\n */\nexport function projectHostMemberRoles(\n  members: ReadonlyArray<Partial<AglynOrgMember> & { $id: string }>,\n  hostId: HostUid,\n): Record<string, HostAccessRole> {\n  const projection: Record<string, HostAccessRole> = {}\n  for (const member of members) {\n    const role = hostRoleFor(member, hostId)\n    if (role) projection[member.$id] = role\n  }\n  return projection\n}\n"],"names":["generateSubdomain","isBlockedSubdomain","SUBDOMAIN_PATTERN","hostScopeToken","ORG_SCOPE_TOKEN","visibleToTokens","ORG_SLUG_PATTERN","RESERVED_ORG_ONLY","Set","isBlockedOrgSlug","slug","has","toLowerCase","isValidOrgSlug","test","generateOrgSlug","name","ORG_ROLES","ORG_ROLE_WEIGHT","owner","admin","editor","viewer","isOrgRole","value","orgRoleAtLeast","role","minimum","canManageOrg","hostRoleFor","member","hostId","explicit","hostAccess","allHosts","HOST_CONTENT_WRITE_ROLES","HOST_PUBLISH_ROLES","canWriteHost","includes","canPublishHost","hostRoleCanWrite","hostRoleCanPublish","isOrgWideMember","scoping","undefined","Object","keys","length","countManagerSeats","entries","count","entry","collaboratorSeatKey","email","trim","uid","collaboratorSeatKeys","key","add","countCollaboratorSeats","exclude","candidate","emails","delete","size","managerSeatKeys","countManagerSeatsExcluding","CONSOLE_USER_TYPE_LABELS","manager","collaborator","siteMember","CONSOLE_USER_TYPE_HINTS","consoleUserType","isSsoGovernedAccount","user","Boolean","tenantId","canLinkSocialProvider","isOrgWideMembership","membership","orgWide","projectMemberScopeTokens","hostIds","map","memberScopeTokens","stored","scopeTokens","memberCanSee","visibleTo","projectHostMemberRoles","members","projection","$id"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;CAKC,GAUD,SACEA,iBAAiB,EACjBC,kBAAkB,EAClBC,iBAAiB,QACZ,mBAAe;AACtB,SACEC,cAAc,EACdC,eAAe,EACfC,eAAe,QACV,oBAAgB;AAEvB,0EAA0E,GAC1E,OAAO,MAAMC,mBAAmBJ,kBAAiB;AAEjD;;;CAGC,GACD,MAAMK,oBAAoB,IAAIC,IAAI;IAAC;IAAS;IAAO;IAAQ;CAAY;AAEvE,OAAO,SAASC,iBAAiBC,IAAY;IAC3C,OAAOH,kBAAkBI,GAAG,CAACD,KAAKE,WAAW,OAAOX,mBAAmBS;AACzE;AAEA,OAAO,SAASG,eAAeH,IAAY;IACzC,OAAOJ,iBAAiBQ,IAAI,CAACJ,SAAS,CAACD,iBAAiBC;AAC1D;AAEA,uEAAuE,GACvE,OAAO,SAASK,gBAAgBC,IAAY;IAC1C,MAAMN,OAAOV,kBAAkBgB;IAC/B,OAAON,QAAQ,CAACD,iBAAiBC,QAAQA,OAAO;AAClD;AAEA,OAAO,MAAMO,YAAgC;IAC3C;IACA;IACA;IACA;CACD,CAAA;AAED,MAAMC,kBAA2C;IAC/CC,OAAO;IACPC,OAAO;IACPC,QAAQ;IACRC,QAAQ;AACV;AAEA,OAAO,SAASC,UAAUC,KAAc;IACtC,OAAO,OAAOA,UAAU,YAAYA,SAASN;AAC/C;AAEA,OAAO,SAASO,eACdC,IAAgC,EAChCC,OAAgB;IAEhB,IAAI,CAACD,QAAQ,CAAEA,CAAAA,QAAQR,eAAc,GAAI,OAAO;IAChD,OAAOA,eAAe,CAACQ,KAAK,IAAIR,eAAe,CAACS,QAAQ;AAC1D;AAEA,oEAAoE,GACpE,OAAO,SAASC,aAAaF,IAAgC;IAC3D,OAAOD,eAAeC,MAAM;AAC9B;AAEA;;;;CAIC,GACD,OAAO,SAASG,YACdC,MAAkD,EAClDC,MAAe;QAKED;IAHjB,MAAMJ,OAAOI,0BAAAA,OAAQJ,IAAI;IACzB,IAAI,CAACH,UAAUG,OAAO,OAAO;IAC7B,IAAIA,SAAS,WAAWA,SAAS,SAAS,OAAO;IACjD,MAAMM,WAAWF,2BAAAA,qBAAAA,OAAQG,UAAU,qBAAlBH,kBAAoB,CAACC,OAAO;IAC7C,IAAIC,UAAU,OAAOA;IACrB,OAAOF,CAAAA,0BAAAA,OAAQI,QAAQ,IAAGR,OAAO;AACnC;AAEA;;;;;;;;;;CAUC,GACD,OAAO,MAAMS,2BAAsD;IACjE;IACA;IACA;CACD,CAAA;AAED;;;;;;;;;CASC,GACD,OAAO,MAAMC,qBAAgD;IAAC;IAAS;CAAS,CAAA;AAEhF;;;;;;;;;CASC,GACD,OAAO,SAASC,aACdP,MAAkD,EAClDC,MAAe;IAEf,MAAML,OAAOG,YAAYC,QAAQC;IACjC,OAAO,CAAC,CAACL,QAAQS,yBAAyBG,QAAQ,CAACZ;AACrD;AAEA;;;;;;;;;;CAUC,GACD,OAAO,SAASa,eACdT,MAAkD,EAClDC,MAAe;IAEf,MAAML,OAAOG,YAAYC,QAAQC;IACjC,OAAO,CAAC,CAACL,QAAQU,mBAAmBE,QAAQ,CAACZ;AAC/C;AAEA;;;;;;;CAOC,GACD,OAAO,SAASc,iBAAiBd,IAAa;IAC5C,OAAOS,yBAAyBG,QAAQ,CAACZ;AAC3C;AAEA,mEAAmE,GACnE,OAAO,SAASe,mBAAmBf,IAAa;IAC9C,OAAOU,mBAAmBE,QAAQ,CAACZ;AACrC;AAEA;;;;;;;;;;;;;;;CAeC,GACD,OAAO,SAASgB,gBACdZ,MAAkD;IAElD,IAAI,CAACA,QAAQ,OAAO;IACpB,MAAMJ,OAAOI,OAAOJ,IAAI;IACxB,IAAIA,SAAS,WAAWA,SAAS,SAAS,OAAO;IACjD,IAAII,OAAOI,QAAQ,KAAK,MAAM,OAAO;IACrC,MAAMS,UAAUb,OAAOG,UAAU;IACjC,OACEH,OAAOI,QAAQ,KAAKU,aAAa,CAACC,OAAOC,IAAI,CAACH,kBAAAA,UAAW,CAAC,GAAGI,MAAM;AAEvE;AAEA;;;;;;;;;;;;;;;;;;CAkBC,GACD,OAAO,SAASC,kBACdC,OAAkE;IAElE,IAAIC,QAAQ;IACZ,KAAK,MAAMC,SAASF,QAAS,IAAIP,gBAAgBS,QAAQD,SAAS;IAClE,OAAOA;AACT;AAkBA;;;;;;;;;;;;;;CAcC,GACD,SAASE,oBAAoBD,KAA4B;IACvD,MAAME,QACJ,OAAOF,MAAME,KAAK,KAAK,WAAWF,MAAME,KAAK,CAACC,IAAI,GAAG1C,WAAW,KAAK;IACvE,IAAIyC,OAAO,OAAOA;IAClB,MAAME,MAAM,OAAOJ,MAAMI,GAAG,KAAK,WAAWJ,MAAMI,GAAG,CAACD,IAAI,KAAK;IAC/D,OAAOC,MAAM,CAAC,IAAI,EAAEA,KAAK,GAAG;AAC9B;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6BC,GACD,OAAO,SAASC,qBACdP,OAAgE,EAChElB,MAAc;IAEd,MAAMe,OAAO,IAAItC;IACjB,IAAI,CAACuB,QAAQ,OAAOe;IACpB,KAAK,MAAMK,SAASF,QAAS;YAKtBE;QAJL,IAAI,CAACA,OAAO;QACZ,sEAAsE;QACtE,0EAA0E;QAC1E,IAAIT,gBAAgBS,QAAmC;QACvD,IAAI,GAACA,oBAAAA,MAAMlB,UAAU,qBAAhBkB,iBAAkB,CAACpB,OAAO,GAAE;QACjC,MAAM0B,MAAML,oBAAoBD;QAChC,IAAIM,KAAKX,KAAKY,GAAG,CAACD;IACpB;IACA,OAAOX;AACT;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8BC,GACD,OAAO,SAASa,uBACdV,OAAgE,EAChElB,MAAc,EACd6B,OAKC;;IAED,MAAMd,OAAOU,qBAAqBP,SAASlB;IAC3C,KAAK,MAAM8B,aAAa;QAACD,2BAAAA,QAASP,KAAK;mBAAMO,2BAAAA,QAASE,MAAM,mBAAI,EAAE;KAAE,CAAE;QACpE,MAAMT,QAAQ,OAAOQ,cAAc,WAAWA,UAAUP,IAAI,GAAG1C,WAAW,KAAK;QAC/E,IAAIyC,OAAOP,KAAKiB,MAAM,CAACV;IACzB;IACA,MAAME,MAAM,QAAOK,2BAAAA,QAASL,GAAG,MAAK,WAAWK,QAAQL,GAAG,CAACD,IAAI,KAAK;IACpE,IAAIC,KAAKT,KAAKiB,MAAM,CAAC,CAAC,IAAI,EAAER,KAAK;IACjC,OAAOT,KAAKkB,IAAI;AAClB;AAEA;;;;;;;;;;;;CAYC,GACD,OAAO,SAASC,gBACdhB,OAAgE;IAEhE,MAAMH,OAAO,IAAItC;IACjB,KAAK,MAAM2C,SAASF,QAAS;QAC3B,IAAI,CAACE,OAAO;QACZ,IAAI,CAACT,gBAAgBS,QAAmC;QACxD,MAAMM,MAAML,oBAAoBD;QAChC,IAAIM,KAAKX,KAAKY,GAAG,CAACD;IACpB;IACA,OAAOX;AACT;AAEA;;;;;;;;;;;;;;;;;;;;CAoBC,GACD,OAAO,SAASoB,2BACdjB,OAAgE,EAChEW,OAKC;;IAED,MAAMd,OAAOmB,gBAAgBhB;IAC7B,KAAK,MAAMY,aAAa;QAACD,2BAAAA,QAASP,KAAK;mBAAMO,2BAAAA,QAASE,MAAM,mBAAI,EAAE;KAAE,CAAE;QACpE,MAAMT,QAAQ,OAAOQ,cAAc,WAAWA,UAAUP,IAAI,GAAG1C,WAAW,KAAK;QAC/E,IAAIyC,OAAOP,KAAKiB,MAAM,CAACV;IACzB;IACA,MAAME,MAAM,QAAOK,2BAAAA,QAASL,GAAG,MAAK,WAAWK,QAAQL,GAAG,CAACD,IAAI,KAAK;IACpE,IAAIC,KAAKT,KAAKiB,MAAM,CAAC,CAAC,IAAI,EAAER,KAAK;IACjC,OAAOT,KAAKkB,IAAI;AAClB;AAwBA,OAAO,MAAMG,2BAA4D;IACvEC,SAAS;IACTC,cAAc;IACdC,YAAY;AACd,EAAC;AAED,2EAA2E,GAC3E,OAAO,MAAMC,0BAA2D;IACtEH,SACE;IACFC,cACE,0EACA;IACFC,YACE,2EACA;AACJ,EAAC;AAED;;;;;;CAMC,GACD,OAAO,SAASE,gBACd1C,MAAkD;IAElD,OAAOY,gBAAgBZ,UAAU,YAAY;AAC/C;AAEA;;;;;;;CAOC,GACD,OAAO,SAAS2C,qBACdC,IAAqD;IAErD,OAAOC,QAAQD,wBAAAA,KAAME,QAAQ;AAC/B;AAEA;;;;;;;;;;;;;;;;;CAiBC,GACD,OAAO,SAASC,sBACdH,IAAqD;IAErD,OAAO,CAACD,qBAAqBC;AAC/B;AAEA;;;;;;;;;;;;;;;;;;CAkBC,GACD,OAAO,SAASI,oBACdC,UAGa;IAEb,IAAI,CAACA,YAAY,OAAO;IACxB,IAAIA,WAAWrD,IAAI,KAAK,WAAWqD,WAAWrD,IAAI,KAAK,SAAS,OAAO;IACvE,OAAOqD,WAAWC,OAAO,KAAK;AAChC;AAEA;;;;;;;;;;;;;;;;CAgBC,GACD,OAAO,SAASC,yBACdnD,MAAkD;;IAElD,IAAIY,gBAAgBZ,SAAS,OAAO;QAAC1B;KAAgB;IACrD,MAAM8E,UAAUrC,OAAOC,IAAI,SAAChB,0BAAAA,OAAQG,UAAU,mBAAI,CAAC;IACnD,OAAO;QAAC7B;WAAoB8E,QAAQC,GAAG,CAAChF;KAAgB;AAC1D;AAEA;;;;;;;;;;;;;;;;CAgBC,GACD,OAAO,SAASiF,kBACdtD,MAAkD;IAElD,MAAMuD,SAASvD,0BAAAA,OAAQwD,WAAW;IAClC,OAAOD,CAAAA,0BAAAA,OAAQtC,MAAM,IAAGsC,SAASJ,yBAAyBnD;AAC5D;AAEA;;;;;;;;;;;;;;;;;;CAkBC,GACD,OAAO,SAASyD,aACdzD,MAAkD,EAClD0D,SAA+C;IAE/C,IAAI9C,gBAAgBZ,SAAS,OAAO;IACpC,OAAOzB,gBAAgBmF,oBAAAA,YAAa5C,WAAWwC,kBAAkBtD;AACnE;AAEA;;;;;CAKC,GACD,OAAO,SAAS2D,uBACdC,OAAiE,EACjE3D,MAAe;IAEf,MAAM4D,aAA6C,CAAC;IACpD,KAAK,MAAM7D,UAAU4D,QAAS;QAC5B,MAAMhE,OAAOG,YAAYC,QAAQC;QACjC,IAAIL,MAAMiE,UAAU,CAAC7D,OAAO8D,GAAG,CAAC,GAAGlE;IACrC;IACA,OAAOiE;AACT"}