@aglyn/plugins-crm 1.0.0-beta.143

package/src/lib/server/erase-person.js

@@ -0,0 +1,309 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { canManageOrg, CONTACT_ERASURE_REQUESTED_FIELD, normalizeContactEmail, PERSON_ERASURES_COLLECTION, personErasureConfirmationMatches, personErasureId } from "@aglyn/aglyn/server";
+import { personKey } from "@aglyn/aglyn/app-utils/person-key";
+import { firebaseAdmin, getOrgForHost, logHostActivity, logOrgActivity, orgDataCollectionForHost, suppressEmailForHostErasure } from "@aglyn/tenant-data-admin";
+import { resolveOrgPermissions } from "@aglyn/tenant-runtime/org-permissions";
+import { FieldValue } from "firebase-admin/firestore";
+import { authorizeOrgCaller, orgHostIds, readCrmRouteScope } from "./org-caller.js";
+/** The route key, as `registerCrmConsoleApi` registers it. */ export const CRM_ERASE_PERSON_ROUTE = 'crm/erase-person';
+/**
+ * `POST /api/crm/erase-person` — file a privacy erasure for one person
+ * (AGL-2623).
+ *
+ * ## Who may
+ *
+ * A workspace admin or owner — `canManageOrg` on the caller's org role —
+ * and nobody else. Not a site editor with the data permission, who can
+ * detach a contact from their own site but has no standing to remove the
+ * person from every site in the workspace; and not staff acting alone,
+ * because the workspace is the controller of this data and the instruction
+ * has to come from it. Staff who are also admins of the workspace pass on
+ * that role, as anyone would.
+ *
+ * ## What it does, and what it does not
+ *
+ * It files the request and closes the doors; it deletes nothing. The daily
+ * erasure job executes the sweep, so that a workspace's person erasures and
+ * its own erasure run through one job, one audit trail and one queue a
+ * staff member can watch. What happens here, in order:
+ *
+ *   1. The record named by the body is read and its address is what the
+ *      request is about — the body's address must match it, typed, so an
+ *      admin who opened the wrong record is stopped by the confirmation
+ *      rather than by luck.
+ *   2. The request document is written, or found already pending, in
+ *      which case nothing is re-filed and the caller is told so.
+ *   3. Every site of the workspace gets its suppression row NOW, not when
+ *      the job runs: from this moment a capture cannot rebuild the person.
+ *   4. The contact document and each site's lead are stamped with the
+ *      request time, so their pages can say "erasure pending" off the
+ *      document they already read.
+ *   5. The site's activity feed and the platform audit log each get a row
+ *      that names the record by id and the person by hash, never by
+ *      address.
+ *
+ * ## The organization variant (AGL-2634)
+ *
+ * `{ orgId, hostId?, contactId | leadId, email }` from the org-level hub:
+ * the same workspace admin, authorized by the org rather than through a
+ * site they name, so a contact no site captured can be erased from the
+ * page that lists it. The sweep is what it always was — every site of the
+ * org, found by `orgId` — and the row goes to the org's feed. A lead still
+ * names its site, because that is where a lead lives.
+ *
+ * ## By address alone (AGL-2839)
+ *
+ * `{ orgId, email, confirmEmail }` with no record, from the workspace's
+ * Privacy settings: the same workspace admin, for any person the workspace
+ * may hold — including one no page shows, since the CRM that lists records
+ * is included from Starter and a Free workspace has none of it. Nothing is
+ * read to file it: the sweep is keyed by the address, the markers are found
+ * by it, and the typed address must match its second typing, which is the
+ * confirmation a record's address gives the other variants. No plan is
+ * asked on any variant: erasure is an obligation, not a CRM feature.
+ */ export const crmErasePersonHandler = async (req, res)=>{
+    var _req_headers_authorization, _req_body, _body_contactId, _body_leadId;
+    if (req.method !== 'POST') {
+        res.setHeader('Allow', 'POST');
+        res.status(405).json({
+            error: 'Method not allowed'
+        });
+        return;
+    }
+    const authorization = String((_req_headers_authorization = req.headers.authorization) != null ? _req_headers_authorization : '');
+    const idToken = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : undefined;
+    if (!idToken) {
+        res.status(401).json({
+            error: 'Unauthenticated'
+        });
+        return;
+    }
+    const body = typeof req.body === 'string' ? JSON.parse(req.body) : (_req_body = req.body) != null ? _req_body : {};
+    const routeScope = readCrmRouteScope(body);
+    const contactId = String((_body_contactId = body.contactId) != null ? _body_contactId : '').trim();
+    const leadId = String((_body_leadId = body.leadId) != null ? _body_leadId : '').trim();
+    const byAddress = (routeScope == null ? void 0 : routeScope.level) === 'org' && !contactId && !leadId;
+    if (!routeScope || !byAddress && !contactId && !leadId || contactId && leadId) {
+        res.status(400).json({
+            error: 'Name the site and exactly one contact or lead'
+        });
+        return;
+    }
+    const { hostId } = routeScope;
+    if (leadId && !hostId) {
+        res.status(400).json({
+            error: 'Name the site the lead lives under'
+        });
+        return;
+    }
+    const refusal = 'Only a workspace admin can erase a person from the workspace';
+    try {
+        let orgId;
+        let actor;
+        if (routeScope.level === 'org') {
+            const caller = await authorizeOrgCaller(req, routeScope.orgId, {
+                needs: 'manage-org',
+                refusal
+            });
+            if (caller.ok === false) {
+                res.status(caller.status).json({
+                    error: caller.error
+                });
+                return;
+            }
+            orgId = caller.orgId;
+            actor = {
+                uid: caller.uid,
+                email: caller.email
+            };
+        } else {
+            var _decoded_email;
+            const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken);
+            const membership = await resolveOrgPermissions(decoded.uid, {
+                hostId
+            });
+            if (!canManageOrg(membership.role)) {
+                res.status(403).json({
+                    error: refusal
+                });
+                return;
+            }
+            const resolved = await getOrgForHost(hostId);
+            if (!resolved || resolved.orgId !== membership.orgId) {
+                res.status(404).json({
+                    error: 'Unknown site'
+                });
+                return;
+            }
+            orgId = resolved.orgId;
+            actor = {
+                uid: decoded.uid,
+                email: (_decoded_email = decoded.email) != null ? _decoded_email : null
+            };
+        }
+        const firestore = firebaseAdmin.app().firestore();
+        let recordEmail = null;
+        if (byAddress) {
+            recordEmail = normalizeContactEmail(body.email);
+        } else if (contactId) {
+            const contactsRef = routeScope.level === 'org' ? firestore.collection('orgs').doc(orgId).collection('contacts') : await orgDataCollectionForHost(hostId, 'contacts');
+            const contact = await contactsRef.doc(contactId).get();
+            if (!contact.exists) {
+                res.status(404).json({
+                    error: 'Unknown contact'
+                });
+                return;
+            }
+            recordEmail = normalizeContactEmail(contact.get('email'));
+        } else {
+            const lead = await firestore.collection('hosts').doc(hostId).collection('leads').doc(leadId).get();
+            if (!lead.exists) {
+                res.status(404).json({
+                    error: 'Unknown lead'
+                });
+                return;
+            }
+            recordEmail = normalizeContactEmail(lead.get('email'));
+        }
+        const key = recordEmail ? personKey(recordEmail) : null;
+        if (!recordEmail || !key) {
+            res.status(byAddress ? 400 : 422).json({
+                error: byAddress ? 'Enter the email address of the person to erase' : 'This record has no usable email address to erase by'
+            });
+            return;
+        }
+        if (byAddress && !personErasureConfirmationMatches(body.confirmEmail, recordEmail)) {
+            res.status(400).json({
+                error: 'Type the email address a second time, exactly, to confirm the erasure'
+            });
+            return;
+        }
+        if (!byAddress && !personErasureConfirmationMatches(body.email, recordEmail)) {
+            res.status(400).json({
+                error: 'Type the record’s email address exactly to confirm the erasure'
+            });
+            return;
+        }
+        const requestId = personErasureId(orgId, key);
+        const requestRef = firestore.collection(PERSON_ERASURES_COLLECTION).doc(requestId);
+        const existing = await requestRef.get();
+        if (existing.exists && existing.get('status') === 'pending') {
+            var _existing_get;
+            const answer = {
+                ok: true,
+                requestId,
+                pendingSinceMs: Number((_existing_get = existing.get('pendingSinceMs')) != null ? _existing_get : 0),
+                alreadyPending: true
+            };
+            res.status(200).json(answer);
+            return;
+        }
+        const now = Date.now();
+        const request = _extends({
+            orgId,
+            personKey: key,
+            status: 'pending',
+            email: recordEmail,
+            requestedAtMs: now,
+            requestedByUid: actor.uid
+        }, hostId ? {
+            hostId
+        } : {}, contactId ? {
+            contactId
+        } : {}, leadId ? {
+            leadId
+        } : {}, {
+            pendingSinceMs: now
+        });
+        await requestRef.set(_extends({}, request, {
+            // A request re-filed after a failed or completed run starts clean.
+            erasedAtMs: FieldValue.delete(),
+            result: FieldValue.delete(),
+            failedAtMs: FieldValue.delete(),
+            lastError: FieldValue.delete(),
+            updatedAt: FieldValue.serverTimestamp()
+        }), {
+            merge: true
+        });
+        const hostIds = await orgHostIds(firestore, orgId);
+        for (const siteId of hostIds){
+            await suppressEmailForHostErasure({
+                hostId: siteId,
+                email: recordEmail
+            }).catch((error)=>{
+                console.error('[crm] erase-person suppression write failed', siteId, error);
+            });
+            const lead = firestore.collection('hosts').doc(siteId).collection('leads').doc(key);
+            await lead.get().then((snapshot)=>snapshot.exists ? lead.update({
+                    [CONTACT_ERASURE_REQUESTED_FIELD]: now
+                }) : undefined).catch((error)=>{
+                console.error('[crm] erase-person lead marker failed', siteId, error);
+            });
+        }
+        try {
+            const contacts = await firestore.collection('orgs').doc(orgId).collection('contacts').where('email', '==', recordEmail).get();
+            for (const contact of contacts.docs){
+                await contact.ref.update({
+                    [CONTACT_ERASURE_REQUESTED_FIELD]: now
+                });
+            }
+        } catch (error) {
+            console.error('[crm] erase-person contact marker failed', orgId, error);
+        }
+        // The feed the act was performed in: the site's under a site, the
+        // org's at the organization level.
+        const target = {
+            type: contactId ? 'contact' : 'lead',
+            id: contactId || leadId
+        };
+        if (routeScope.level === 'org') {
+            // Filed by address, the line names no record — and never the address.
+            await logOrgActivity(orgId, actor, 'Requested privacy erasure', byAddress ? {
+                type: 'org'
+            } : target).catch(()=>undefined);
+        } else {
+            await logHostActivity(hostId, actor, 'Requested privacy erasure', target).catch(()=>undefined);
+        }
+        await firestore.collection('adminAudit').add({
+            actorUid: actor.uid,
+            action: 'person.erasure-requested',
+            target: `orgs/${orgId}/people/${key}`,
+            before: null,
+            after: {
+                hostId: hostId || null,
+                hosts: hostIds.length,
+                from: byAddress ? 'address' : contactId ? 'contact' : 'lead'
+            },
+            at: FieldValue.serverTimestamp()
+        }).catch(()=>undefined);
+        const answer = {
+            ok: true,
+            requestId,
+            pendingSinceMs: now,
+            alreadyPending: false
+        };
+        res.status(200).json(answer);
+    } catch (error) {
+        console.error('[crm] erase-person failed', routeScope, error);
+        res.status(500).json({
+            error: 'The erasure could not be filed'
+        });
+    }
+};
+
+//# sourceMappingURL=erase-person.js.map

package/src/lib/server/erase-person.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/crm/src/lib/server/erase-person.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  canManageOrg,\n  CONTACT_ERASURE_REQUESTED_FIELD,\n  normalizeContactEmail,\n  PERSON_ERASURES_COLLECTION,\n  personErasureConfirmationMatches,\n  personErasureId,\n  type PersonErasureRequest,\n  type PluginApiHandler,\n} from '@aglyn/aglyn/server'\nimport { personKey } from '@aglyn/aglyn/app-utils/person-key'\nimport {\n  firebaseAdmin,\n  getOrgForHost,\n  logHostActivity,\n  logOrgActivity,\n  orgDataCollectionForHost,\n  suppressEmailForHostErasure,\n} from '@aglyn/tenant-data-admin'\nimport { resolveOrgPermissions } from '@aglyn/tenant-runtime/org-permissions'\nimport { FieldValue } from 'firebase-admin/firestore'\nimport { authorizeOrgCaller, orgHostIds, readCrmRouteScope } from './org-caller'\n\n/** The route key, as `registerCrmConsoleApi` registers it. */\nexport const CRM_ERASE_PERSON_ROUTE = 'crm/erase-person'\n\nexport interface ErasePersonRequestBody {\n  /**\n   * The site the request is filed from. At the organization level\n   * (AGL-2634) the record's own site, or absent for a contact no site has\n   * captured; a LEAD always names one, because a lead lives under its site.\n   */\n  hostId?: string\n  /** The organization, at the organization level (AGL-2634). */\n  orgId?: string\n  /**\n   * At most one of these names the record the request is filed from. Under\n   * a site exactly one does; at the organization level neither may, which\n   * files the request by `email` alone (AGL-2839).\n   */\n  contactId?: string\n  leadId?: string\n  /**\n   * The address as the admin typed it — the confirmation of a record's\n   * address, or, filed by address alone, the person the request is about.\n   */\n  email: string\n  /** Filed by address alone: the address typed a second time. */\n  confirmEmail?: string\n}\n\nexport interface ErasePersonResponse {\n  ok: true\n  requestId: string\n  /** When the request entered the queue. */\n  pendingSinceMs: number\n  /** True when a request for this person was already waiting; nothing was re-filed. */\n  alreadyPending: boolean\n}\n\n/**\n * `POST /api/crm/erase-person` — file a privacy erasure for one person\n * (AGL-2623).\n *\n * ## Who may\n *\n * A workspace admin or owner — `canManageOrg` on the caller's org role —\n * and nobody else. Not a site editor with the data permission, who can\n * detach a contact from their own site but has no standing to remove the\n * person from every site in the workspace; and not staff acting alone,\n * because the workspace is the controller of this data and the instruction\n * has to come from it. Staff who are also admins of the workspace pass on\n * that role, as anyone would.\n *\n * ## What it does, and what it does not\n *\n * It files the request and closes the doors; it deletes nothing. The daily\n * erasure job executes the sweep, so that a workspace's person erasures and\n * its own erasure run through one job, one audit trail and one queue a\n * staff member can watch. What happens here, in order:\n *\n *   1. The record named by the body is read and its address is what the\n *      request is about — the body's address must match it, typed, so an\n *      admin who opened the wrong record is stopped by the confirmation\n *      rather than by luck.\n *   2. The request document is written, or found already pending, in\n *      which case nothing is re-filed and the caller is told so.\n *   3. Every site of the workspace gets its suppression row NOW, not when\n *      the job runs: from this moment a capture cannot rebuild the person.\n *   4. The contact document and each site's lead are stamped with the\n *      request time, so their pages can say \"erasure pending\" off the\n *      document they already read.\n *   5. The site's activity feed and the platform audit log each get a row\n *      that names the record by id and the person by hash, never by\n *      address.\n *\n * ## The organization variant (AGL-2634)\n *\n * `{ orgId, hostId?, contactId | leadId, email }` from the org-level hub:\n * the same workspace admin, authorized by the org rather than through a\n * site they name, so a contact no site captured can be erased from the\n * page that lists it. The sweep is what it always was — every site of the\n * org, found by `orgId` — and the row goes to the org's feed. A lead still\n * names its site, because that is where a lead lives.\n *\n * ## By address alone (AGL-2839)\n *\n * `{ orgId, email, confirmEmail }` with no record, from the workspace's\n * Privacy settings: the same workspace admin, for any person the workspace\n * may hold — including one no page shows, since the CRM that lists records\n * is included from Starter and a Free workspace has none of it. Nothing is\n * read to file it: the sweep is keyed by the address, the markers are found\n * by it, and the typed address must match its second typing, which is the\n * confirmation a record's address gives the other variants. No plan is\n * asked on any variant: erasure is an obligation, not a CRM feature.\n */\nexport const crmErasePersonHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    res.setHeader('Allow', 'POST')\n    res.status(405).json({ error: 'Method not allowed' })\n    return\n  }\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken) {\n    res.status(401).json({ error: 'Unauthenticated' })\n    return\n  }\n  const body: Partial<ErasePersonRequestBody> =\n    typeof req.body === 'string' ? JSON.parse(req.body) : (req.body ?? {})\n  const routeScope = readCrmRouteScope(body as Record<string, unknown>)\n  const contactId = String(body.contactId ?? '').trim()\n  const leadId = String(body.leadId ?? '').trim()\n  const byAddress = routeScope?.level === 'org' && !contactId && !leadId\n  if (!routeScope || (!byAddress && !contactId && !leadId) || (contactId && leadId)) {\n    res.status(400).json({ error: 'Name the site and exactly one contact or lead' })\n    return\n  }\n  const { hostId } = routeScope\n  if (leadId && !hostId) {\n    res.status(400).json({ error: 'Name the site the lead lives under' })\n    return\n  }\n  const refusal = 'Only a workspace admin can erase a person from the workspace'\n\n  try {\n    let orgId: string\n    let actor: { uid: string; email: string | null }\n    if (routeScope.level === 'org') {\n      const caller = await authorizeOrgCaller(req, routeScope.orgId, {\n        needs: 'manage-org',\n        refusal,\n      })\n      if (caller.ok === false) {\n        res.status(caller.status).json({ error: caller.error })\n        return\n      }\n      orgId = caller.orgId\n      actor = { uid: caller.uid, email: caller.email }\n    } else {\n      const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n      const membership = await resolveOrgPermissions(decoded.uid, { hostId })\n      if (!canManageOrg(membership.role)) {\n        res.status(403).json({ error: refusal })\n        return\n      }\n      const resolved = await getOrgForHost(hostId)\n      if (!resolved || resolved.orgId !== membership.orgId) {\n        res.status(404).json({ error: 'Unknown site' })\n        return\n      }\n      orgId = resolved.orgId\n      actor = { uid: decoded.uid, email: decoded.email ?? null }\n    }\n    const firestore = firebaseAdmin.app().firestore()\n\n    let recordEmail: string | null = null\n    if (byAddress) {\n      recordEmail = normalizeContactEmail(body.email)\n    } else if (contactId) {\n      const contactsRef =\n        routeScope.level === 'org'\n          ? firestore.collection('orgs').doc(orgId).collection('contacts')\n          : await orgDataCollectionForHost(hostId, 'contacts')\n      const contact = await contactsRef.doc(contactId).get()\n      if (!contact.exists) {\n        res.status(404).json({ error: 'Unknown contact' })\n        return\n      }\n      recordEmail = normalizeContactEmail(contact.get('email'))\n    } else {\n      const lead = await firestore\n        .collection('hosts')\n        .doc(hostId)\n        .collection('leads')\n        .doc(leadId)\n        .get()\n      if (!lead.exists) {\n        res.status(404).json({ error: 'Unknown lead' })\n        return\n      }\n      recordEmail = normalizeContactEmail(lead.get('email'))\n    }\n    const key = recordEmail ? personKey(recordEmail) : null\n    if (!recordEmail || !key) {\n      res.status(byAddress ? 400 : 422).json({\n        error: byAddress\n          ? 'Enter the email address of the person to erase'\n          : 'This record has no usable email address to erase by',\n      })\n      return\n    }\n    if (byAddress && !personErasureConfirmationMatches(body.confirmEmail, recordEmail)) {\n      res.status(400).json({\n        error: 'Type the email address a second time, exactly, to confirm the erasure',\n      })\n      return\n    }\n    if (!byAddress && !personErasureConfirmationMatches(body.email, recordEmail)) {\n      res.status(400).json({\n        error: 'Type the record’s email address exactly to confirm the erasure',\n      })\n      return\n    }\n\n    const requestId = personErasureId(orgId, key)\n    const requestRef = firestore.collection(PERSON_ERASURES_COLLECTION).doc(requestId)\n    const existing = await requestRef.get()\n    if (existing.exists && existing.get('status') === 'pending') {\n      const answer: ErasePersonResponse = {\n        ok: true,\n        requestId,\n        pendingSinceMs: Number(existing.get('pendingSinceMs') ?? 0),\n        alreadyPending: true,\n      }\n      res.status(200).json(answer)\n      return\n    }\n\n    const now = Date.now()\n    const request: PersonErasureRequest = {\n      orgId,\n      personKey: key,\n      status: 'pending',\n      email: recordEmail,\n      requestedAtMs: now,\n      requestedByUid: actor.uid,\n      ...(hostId ? { hostId } : {}),\n      ...(contactId ? { contactId } : {}),\n      ...(leadId ? { leadId } : {}),\n      pendingSinceMs: now,\n    }\n    await requestRef.set(\n      {\n        ...request,\n        // A request re-filed after a failed or completed run starts clean.\n        erasedAtMs: FieldValue.delete(),\n        result: FieldValue.delete(),\n        failedAtMs: FieldValue.delete(),\n        lastError: FieldValue.delete(),\n        updatedAt: FieldValue.serverTimestamp(),\n      },\n      { merge: true },\n    )\n\n    const hostIds = await orgHostIds(firestore, orgId)\n    for (const siteId of hostIds) {\n      await suppressEmailForHostErasure({ hostId: siteId, email: recordEmail }).catch(\n        (error: unknown) => {\n          console.error('[crm] erase-person suppression write failed', siteId, error)\n        },\n      )\n      const lead = firestore.collection('hosts').doc(siteId).collection('leads').doc(key)\n      await lead\n        .get()\n        .then((snapshot: { exists: boolean }) =>\n          snapshot.exists ? lead.update({ [CONTACT_ERASURE_REQUESTED_FIELD]: now }) : undefined,\n        )\n        .catch((error: unknown) => {\n          console.error('[crm] erase-person lead marker failed', siteId, error)\n        })\n    }\n    try {\n      const contacts = await firestore\n        .collection('orgs')\n        .doc(orgId)\n        .collection('contacts')\n        .where('email', '==', recordEmail)\n        .get()\n      for (const contact of contacts.docs) {\n        await contact.ref.update({ [CONTACT_ERASURE_REQUESTED_FIELD]: now })\n      }\n    } catch (error) {\n      console.error('[crm] erase-person contact marker failed', orgId, error)\n    }\n\n    // The feed the act was performed in: the site's under a site, the\n    // org's at the organization level.\n    const target = { type: contactId ? 'contact' : 'lead', id: contactId || leadId } as const\n    if (routeScope.level === 'org') {\n      // Filed by address, the line names no record — and never the address.\n      await logOrgActivity(\n        orgId,\n        actor,\n        'Requested privacy erasure',\n        byAddress ? { type: 'org' } : target,\n      ).catch(() => undefined)\n    } else {\n      await logHostActivity(hostId, actor, 'Requested privacy erasure', target).catch(\n        () => undefined,\n      )\n    }\n    await firestore\n      .collection('adminAudit')\n      .add({\n        actorUid: actor.uid,\n        action: 'person.erasure-requested',\n        target: `orgs/${orgId}/people/${key}`,\n        before: null,\n        after: {\n          hostId: hostId || null,\n          hosts: hostIds.length,\n          from: byAddress ? 'address' : contactId ? 'contact' : 'lead',\n        },\n        at: FieldValue.serverTimestamp(),\n      })\n      .catch(() => undefined)\n\n    const answer: ErasePersonResponse = {\n      ok: true,\n      requestId,\n      pendingSinceMs: now,\n      alreadyPending: false,\n    }\n    res.status(200).json(answer)\n  } catch (error) {\n    console.error('[crm] erase-person failed', routeScope, error)\n    res.status(500).json({ error: 'The erasure could not be filed' })\n  }\n}\n"],"names":["canManageOrg","CONTACT_ERASURE_REQUESTED_FIELD","normalizeContactEmail","PERSON_ERASURES_COLLECTION","personErasureConfirmationMatches","personErasureId","personKey","firebaseAdmin","getOrgForHost","logHostActivity","logOrgActivity","orgDataCollectionForHost","suppressEmailForHostErasure","resolveOrgPermissions","FieldValue","authorizeOrgCaller","orgHostIds","readCrmRouteScope","CRM_ERASE_PERSON_ROUTE","crmErasePersonHandler","req","res","body","method","setHeader","status","json","error","authorization","String","headers","idToken","startsWith","slice","length","undefined","JSON","parse","routeScope","contactId","trim","leadId","byAddress","level","hostId","refusal","orgId","actor","caller","needs","ok","uid","email","decoded","app","auth","verifyIdToken","membership","role","resolved","firestore","recordEmail","contactsRef","collection","doc","contact","get","exists","lead","key","confirmEmail","requestId","requestRef","existing","answer","pendingSinceMs","Number","alreadyPending","now","Date","request","requestedAtMs","requestedByUid","set","erasedAtMs","delete","result","failedAtMs","lastError","updatedAt","serverTimestamp","merge","hostIds","siteId","catch","console","then","snapshot","update","contacts","where","docs","ref","target","type","id","add","actorUid","action","before","after","hosts","from","at"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,YAAY,EACZC,+BAA+B,EAC/BC,qBAAqB,EACrBC,0BAA0B,EAC1BC,gCAAgC,EAChCC,eAAe,QAGV,sBAAqB;AAC5B,SAASC,SAAS,QAAQ,oCAAmC;AAC7D,SACEC,aAAa,EACbC,aAAa,EACbC,eAAe,EACfC,cAAc,EACdC,wBAAwB,EACxBC,2BAA2B,QACtB,2BAA0B;AACjC,SAASC,qBAAqB,QAAQ,wCAAuC;AAC7E,SAASC,UAAU,QAAQ,2BAA0B;AACrD,SAASC,kBAAkB,EAAEC,UAAU,EAAEC,iBAAiB,QAAQ,kBAAc;AAEhF,4DAA4D,GAC5D,OAAO,MAAMC,yBAAyB,mBAAkB;AAoCxD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuDC,GACD,OAAO,MAAMC,wBAA0C,OAAOC,KAAKC;QAMpCD,4BAS4BA,WAEhCE,iBACHA;IAjBtB,IAAIF,IAAIG,MAAM,KAAK,QAAQ;QACzBF,IAAIG,SAAS,CAAC,SAAS;QACvBH,IAAII,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;QACnD;IACF;IACA,MAAMC,gBAAgBC,QAAOT,6BAAAA,IAAIU,OAAO,CAACF,aAAa,YAAzBR,6BAA6B;IAC1D,MAAMW,UAAUH,cAAcI,UAAU,CAAC,aACrCJ,cAAcK,KAAK,CAAC,UAAUC,MAAM,IACpCC;IACJ,IAAI,CAACJ,SAAS;QACZV,IAAII,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAkB;QAChD;IACF;IACA,MAAML,OACJ,OAAOF,IAAIE,IAAI,KAAK,WAAWc,KAAKC,KAAK,CAACjB,IAAIE,IAAI,KAAKF,YAAAA,IAAIE,IAAI,YAARF,YAAY,CAAC;IACtE,MAAMkB,aAAarB,kBAAkBK;IACrC,MAAMiB,YAAYV,QAAOP,kBAAAA,KAAKiB,SAAS,YAAdjB,kBAAkB,IAAIkB,IAAI;IACnD,MAAMC,SAASZ,QAAOP,eAAAA,KAAKmB,MAAM,YAAXnB,eAAe,IAAIkB,IAAI;IAC7C,MAAME,YAAYJ,CAAAA,8BAAAA,WAAYK,KAAK,MAAK,SAAS,CAACJ,aAAa,CAACE;IAChE,IAAI,CAACH,cAAe,CAACI,aAAa,CAACH,aAAa,CAACE,UAAYF,aAAaE,QAAS;QACjFpB,IAAII,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAgD;QAC9E;IACF;IACA,MAAM,EAAEiB,MAAM,EAAE,GAAGN;IACnB,IAAIG,UAAU,CAACG,QAAQ;QACrBvB,IAAII,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqC;QACnE;IACF;IACA,MAAMkB,UAAU;IAEhB,IAAI;QACF,IAAIC;QACJ,IAAIC;QACJ,IAAIT,WAAWK,KAAK,KAAK,OAAO;YAC9B,MAAMK,SAAS,MAAMjC,mBAAmBK,KAAKkB,WAAWQ,KAAK,EAAE;gBAC7DG,OAAO;gBACPJ;YACF;YACA,IAAIG,OAAOE,EAAE,KAAK,OAAO;gBACvB7B,IAAII,MAAM,CAACuB,OAAOvB,MAAM,EAAEC,IAAI,CAAC;oBAAEC,OAAOqB,OAAOrB,KAAK;gBAAC;gBACrD;YACF;YACAmB,QAAQE,OAAOF,KAAK;YACpBC,QAAQ;gBAAEI,KAAKH,OAAOG,GAAG;gBAAEC,OAAOJ,OAAOI,KAAK;YAAC;QACjD,OAAO;gBAa8BC;YAZnC,MAAMA,UAAU,MAAM9C,cAAc+C,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAACzB;YAC/D,MAAM0B,aAAa,MAAM5C,sBAAsBwC,QAAQF,GAAG,EAAE;gBAAEP;YAAO;YACrE,IAAI,CAAC5C,aAAayD,WAAWC,IAAI,GAAG;gBAClCrC,IAAII,MAAM,CAAC,KAAKC,IAAI,CAAC;oBAAEC,OAAOkB;gBAAQ;gBACtC;YACF;YACA,MAAMc,WAAW,MAAMnD,cAAcoC;YACrC,IAAI,CAACe,YAAYA,SAASb,KAAK,KAAKW,WAAWX,KAAK,EAAE;gBACpDzB,IAAII,MAAM,CAAC,KAAKC,IAAI,CAAC;oBAAEC,OAAO;gBAAe;gBAC7C;YACF;YACAmB,QAAQa,SAASb,KAAK;YACtBC,QAAQ;gBAAEI,KAAKE,QAAQF,GAAG;gBAAEC,KAAK,GAAEC,iBAAAA,QAAQD,KAAK,YAAbC,iBAAiB;YAAK;QAC3D;QACA,MAAMO,YAAYrD,cAAc+C,GAAG,GAAGM,SAAS;QAE/C,IAAIC,cAA6B;QACjC,IAAInB,WAAW;YACbmB,cAAc3D,sBAAsBoB,KAAK8B,KAAK;QAChD,OAAO,IAAIb,WAAW;YACpB,MAAMuB,cACJxB,WAAWK,KAAK,KAAK,QACjBiB,UAAUG,UAAU,CAAC,QAAQC,GAAG,CAAClB,OAAOiB,UAAU,CAAC,cACnD,MAAMpD,yBAAyBiC,QAAQ;YAC7C,MAAMqB,UAAU,MAAMH,YAAYE,GAAG,CAACzB,WAAW2B,GAAG;YACpD,IAAI,CAACD,QAAQE,MAAM,EAAE;gBACnB9C,IAAII,MAAM,CAAC,KAAKC,IAAI,CAAC;oBAAEC,OAAO;gBAAkB;gBAChD;YACF;YACAkC,cAAc3D,sBAAsB+D,QAAQC,GAAG,CAAC;QAClD,OAAO;YACL,MAAME,OAAO,MAAMR,UAChBG,UAAU,CAAC,SACXC,GAAG,CAACpB,QACJmB,UAAU,CAAC,SACXC,GAAG,CAACvB,QACJyB,GAAG;YACN,IAAI,CAACE,KAAKD,MAAM,EAAE;gBAChB9C,IAAII,MAAM,CAAC,KAAKC,IAAI,CAAC;oBAAEC,OAAO;gBAAe;gBAC7C;YACF;YACAkC,cAAc3D,sBAAsBkE,KAAKF,GAAG,CAAC;QAC/C;QACA,MAAMG,MAAMR,cAAcvD,UAAUuD,eAAe;QACnD,IAAI,CAACA,eAAe,CAACQ,KAAK;YACxBhD,IAAII,MAAM,CAACiB,YAAY,MAAM,KAAKhB,IAAI,CAAC;gBACrCC,OAAOe,YACH,mDACA;YACN;YACA;QACF;QACA,IAAIA,aAAa,CAACtC,iCAAiCkB,KAAKgD,YAAY,EAAET,cAAc;YAClFxC,IAAII,MAAM,CAAC,KAAKC,IAAI,CAAC;gBACnBC,OAAO;YACT;YACA;QACF;QACA,IAAI,CAACe,aAAa,CAACtC,iCAAiCkB,KAAK8B,KAAK,EAAES,cAAc;YAC5ExC,IAAII,MAAM,CAAC,KAAKC,IAAI,CAAC;gBACnBC,OAAO;YACT;YACA;QACF;QAEA,MAAM4C,YAAYlE,gBAAgByC,OAAOuB;QACzC,MAAMG,aAAaZ,UAAUG,UAAU,CAAC5D,4BAA4B6D,GAAG,CAACO;QACxE,MAAME,WAAW,MAAMD,WAAWN,GAAG;QACrC,IAAIO,SAASN,MAAM,IAAIM,SAASP,GAAG,CAAC,cAAc,WAAW;gBAIlCO;YAHzB,MAAMC,SAA8B;gBAClCxB,IAAI;gBACJqB;gBACAI,gBAAgBC,QAAOH,gBAAAA,SAASP,GAAG,CAAC,6BAAbO,gBAAkC;gBACzDI,gBAAgB;YAClB;YACAxD,IAAII,MAAM,CAAC,KAAKC,IAAI,CAACgD;YACrB;QACF;QAEA,MAAMI,MAAMC,KAAKD,GAAG;QACpB,MAAME,UAAgC;YACpClC;YACAxC,WAAW+D;YACX5C,QAAQ;YACR2B,OAAOS;YACPoB,eAAeH;YACfI,gBAAgBnC,MAAMI,GAAG;WACrBP,SAAS;YAAEA;QAAO,IAAI,CAAC,GACvBL,YAAY;YAAEA;QAAU,IAAI,CAAC,GAC7BE,SAAS;YAAEA;QAAO,IAAI,CAAC;YAC3BkC,gBAAgBG;;QAElB,MAAMN,WAAWW,GAAG,CAClB,aACKH;YACH,mEAAmE;YACnEI,YAAYtE,WAAWuE,MAAM;YAC7BC,QAAQxE,WAAWuE,MAAM;YACzBE,YAAYzE,WAAWuE,MAAM;YAC7BG,WAAW1E,WAAWuE,MAAM;YAC5BI,WAAW3E,WAAW4E,eAAe;YAEvC;YAAEC,OAAO;QAAK;QAGhB,MAAMC,UAAU,MAAM5E,WAAW4C,WAAWd;QAC5C,KAAK,MAAM+C,UAAUD,QAAS;YAC5B,MAAMhF,4BAA4B;gBAAEgC,QAAQiD;gBAAQzC,OAAOS;YAAY,GAAGiC,KAAK,CAC7E,CAACnE;gBACCoE,QAAQpE,KAAK,CAAC,+CAA+CkE,QAAQlE;YACvE;YAEF,MAAMyC,OAAOR,UAAUG,UAAU,CAAC,SAASC,GAAG,CAAC6B,QAAQ9B,UAAU,CAAC,SAASC,GAAG,CAACK;YAC/E,MAAMD,KACHF,GAAG,GACH8B,IAAI,CAAC,CAACC,WACLA,SAAS9B,MAAM,GAAGC,KAAK8B,MAAM,CAAC;oBAAE,CAACjG,gCAAgC,EAAE6E;gBAAI,KAAK3C,WAE7E2D,KAAK,CAAC,CAACnE;gBACNoE,QAAQpE,KAAK,CAAC,yCAAyCkE,QAAQlE;YACjE;QACJ;QACA,IAAI;YACF,MAAMwE,WAAW,MAAMvC,UACpBG,UAAU,CAAC,QACXC,GAAG,CAAClB,OACJiB,UAAU,CAAC,YACXqC,KAAK,CAAC,SAAS,MAAMvC,aACrBK,GAAG;YACN,KAAK,MAAMD,WAAWkC,SAASE,IAAI,CAAE;gBACnC,MAAMpC,QAAQqC,GAAG,CAACJ,MAAM,CAAC;oBAAE,CAACjG,gCAAgC,EAAE6E;gBAAI;YACpE;QACF,EAAE,OAAOnD,OAAO;YACdoE,QAAQpE,KAAK,CAAC,4CAA4CmB,OAAOnB;QACnE;QAEA,kEAAkE;QAClE,mCAAmC;QACnC,MAAM4E,SAAS;YAAEC,MAAMjE,YAAY,YAAY;YAAQkE,IAAIlE,aAAaE;QAAO;QAC/E,IAAIH,WAAWK,KAAK,KAAK,OAAO;YAC9B,sEAAsE;YACtE,MAAMjC,eACJoC,OACAC,OACA,6BACAL,YAAY;gBAAE8D,MAAM;YAAM,IAAID,QAC9BT,KAAK,CAAC,IAAM3D;QAChB,OAAO;YACL,MAAM1B,gBAAgBmC,QAAQG,OAAO,6BAA6BwD,QAAQT,KAAK,CAC7E,IAAM3D;QAEV;QACA,MAAMyB,UACHG,UAAU,CAAC,cACX2C,GAAG,CAAC;YACHC,UAAU5D,MAAMI,GAAG;YACnByD,QAAQ;YACRL,QAAQ,CAAC,KAAK,EAAEzD,MAAM,QAAQ,EAAEuB,KAAK;YACrCwC,QAAQ;YACRC,OAAO;gBACLlE,QAAQA,UAAU;gBAClBmE,OAAOnB,QAAQ1D,MAAM;gBACrB8E,MAAMtE,YAAY,YAAYH,YAAY,YAAY;YACxD;YACA0E,IAAInG,WAAW4E,eAAe;QAChC,GACCI,KAAK,CAAC,IAAM3D;QAEf,MAAMuC,SAA8B;YAClCxB,IAAI;YACJqB;YACAI,gBAAgBG;YAChBD,gBAAgB;QAClB;QACAxD,IAAII,MAAM,CAAC,KAAKC,IAAI,CAACgD;IACvB,EAAE,OAAO/C,OAAO;QACdoE,QAAQpE,KAAK,CAAC,6BAA6BW,YAAYX;QACvDN,IAAII,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAiC;IACjE;AACF,EAAC"}

package/src/lib/server/import-context.d.ts

@@ -0,0 +1,85 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * WHAT EVERY CSV IMPORT ROUTE ASKS BEFORE IT READS A ROW (AGL-2602, shared
+ * by the companies import since AGL-2621).
+ *
+ * Who is asking and on whose behalf, whether the request is the size a
+ * chunk is allowed to be, and — when a row names an owner — which member
+ * of the org that address is. The contacts route settled each answer; the
+ * companies route needs the same three and must not spell them
+ * differently, because two gates for one permission is how one of them
+ * comes to be wider.
+ *
+ * ## Who may call an import
+ *
+ * The same two gates the rules put on every CRM collection: a site role
+ * on the host the request names, AND the organization's `data.manage`
+ * permission resolved through the member's custom role and overrides. The
+ * Admin SDK evaluates no rules, so this is the enforcement rather than an
+ * echo of it — and `data.manage` rather than the raw role because an owner
+ * who unticked "Manage data" on a custom role meant it. A staff token
+ * passes both gates the way it does on every console route: support
+ * importing a customer's file for them is the support act this exists for.
+ */
+import { type PluginApiHandler } from '@aglyn/aglyn/server';
+/** Everything an import needs about who is asking, or the refusal to send back. */
+export type ImportContext = {
+    ok: true;
+    uid: string;
+    hostId: string;
+    orgId: string;
+    org: Record<string, unknown>;
+    /**
+     * The stamp a record CREATED by this import carries — the org, when
+     * the org widened its default, and otherwise the capturing group.
+     */
+    scopeTokens: string[];
+    /**
+     * The tokens a record must overlap to be SEEN from this site: the
+     * group's own, plus `org`, because an org-wide record is visible to
+     * every site in the account. The reader's set is wider than the
+     * creator's stamp, exactly as it is on the collection listeners.
+     */
+    readTokens: string[];
+} | {
+    ok: false;
+    status: number;
+    body: Record<string, unknown>;
+};
+export type ImportRequest = Parameters<PluginApiHandler>[0];
+/** Who is asking, and on whose behalf. */
+export declare function resolveImportContext(req: ImportRequest): Promise<ImportContext>;
+/** The rows a request may carry, or the refusal to send back. */
+export declare function readImportRows<R>(req: ImportRequest, limits: {
+    maxBodyBytes: number;
+    chunkSize: number;
+}): {
+    rows: R[];
+} | {
+    status: number;
+    error: string;
+};
+/**
+ * The org's members by address, read only when a row names an owner.
+ *
+ * A file with no owner column costs no roster read; a file with one costs
+ * exactly one, however many rows it has.
+ */
+export declare function ownerDirectory(orgId: string, rows: readonly {
+    ownerEmail?: string;
+}[]): Promise<Map<string, string>>;

package/src/lib/server/import-context.js

@@ -0,0 +1,181 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * WHAT EVERY CSV IMPORT ROUTE ASKS BEFORE IT READS A ROW (AGL-2602, shared
+ * by the companies import since AGL-2621).
+ *
+ * Who is asking and on whose behalf, whether the request is the size a
+ * chunk is allowed to be, and — when a row names an owner — which member
+ * of the org that address is. The contacts route settled each answer; the
+ * companies route needs the same three and must not spell them
+ * differently, because two gates for one permission is how one of them
+ * comes to be wider.
+ *
+ * ## Who may call an import
+ *
+ * The same two gates the rules put on every CRM collection: a site role
+ * on the host the request names, AND the organization's `data.manage`
+ * permission resolved through the member's custom role and overrides. The
+ * Admin SDK evaluates no rules, so this is the enforcement rather than an
+ * echo of it — and `data.manage` rather than the raw role because an owner
+ * who unticked "Manage data" on a custom role meant it. A staff token
+ * passes both gates the way it does on every console route: support
+ * importing a customer's file for them is the support act this exists for.
+ */ import { consentGroupScope, crmScopeTokens, ORG_SCOPE_TOKEN } from "@aglyn/aglyn/server";
+import { consentGroupForSite, firebaseAdmin, getOrgForHost, listOrgMembers, memberHasOrgPermission, resolveOrgMembership } from "@aglyn/tenant-data-admin";
+import { crmSuiteRefusal } from "./suite-gate.js";
+/** Who is asking, and on whose behalf. */ export async function resolveImportContext(req) {
+    var _ref, _req_headers_authorization, _hostSnapshot_get, _ref1, _ref2;
+    var _req_body;
+    const hostId = String((_ref = (_req_body = req.body) == null ? void 0 : _req_body.hostId) != null ? _ref : '');
+    if (!hostId) {
+        return {
+            ok: false,
+            status: 400,
+            body: {
+                error: 'Missing hostId'
+            }
+        };
+    }
+    const authorization = String((_req_headers_authorization = req.headers.authorization) != null ? _req_headers_authorization : '');
+    const idToken = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : undefined;
+    if (!idToken) {
+        return {
+            ok: false,
+            status: 401,
+            body: {
+                error: 'Unauthenticated'
+            }
+        };
+    }
+    const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken);
+    const staff = decoded['staff'] === true;
+    const firestore = firebaseAdmin.app().firestore();
+    const hostSnapshot = await firestore.collection('hosts').doc(hostId).get();
+    if (!hostSnapshot.exists) {
+        return {
+            ok: false,
+            status: 404,
+            body: {
+                error: 'Unknown site'
+            }
+        };
+    }
+    const memberRole = ((_hostSnapshot_get = hostSnapshot.get('memberRoles')) != null ? _hostSnapshot_get : {})[decoded.uid];
+    if (!staff && memberRole !== 'admin' && memberRole !== 'editor') {
+        return {
+            ok: false,
+            status: 403,
+            body: {
+                error: 'Not a site admin or editor'
+            }
+        };
+    }
+    const resolved = await getOrgForHost(hostId).catch(()=>null);
+    const orgId = String((_ref1 = resolved == null ? void 0 : resolved.orgId) != null ? _ref1 : '');
+    if (!orgId) {
+        return {
+            ok: false,
+            status: 404,
+            body: {
+                error: 'This site has no organization, so it has no CRM.'
+            }
+        };
+    }
+    const org = (_ref2 = resolved == null ? void 0 : resolved.org) != null ? _ref2 : {};
+    const membership = await resolveOrgMembership(decoded.uid, orgId).catch(()=>null);
+    const member = membership == null ? void 0 : membership.member;
+    if (!staff && (!member || member.orgSuspended === true || !await memberHasOrgPermission(orgId, member, 'data.manage'))) {
+        return {
+            ok: false,
+            status: 403,
+            body: {
+                error: 'Your organization role does not allow managing contacts and ' + 'companies, so it cannot import them.'
+            }
+        };
+    }
+    // Every file this context serves — contacts, companies, deals, tasks and
+    // leads — is the CRM's to import, whoever is asking (AGL-2787).
+    const suite = crmSuiteRefusal(org, 'Importing from a CSV file');
+    if (suite) return {
+        ok: false,
+        status: suite.status,
+        body: suite.body
+    };
+    const group = await consentGroupForSite(hostId);
+    return {
+        ok: true,
+        uid: decoded.uid,
+        hostId,
+        orgId,
+        org,
+        scopeTokens: crmScopeTokens(org, group),
+        readTokens: [
+            ORG_SCOPE_TOKEN,
+            ...consentGroupScope(group)
+        ]
+    };
+}
+/** The rows a request may carry, or the refusal to send back. */ export function readImportRows(req, limits) {
+    var _ref;
+    var _req_rawBody, _req_body;
+    if (((_ref = (_req_rawBody = req.rawBody) == null ? void 0 : _req_rawBody.length) != null ? _ref : 0) > limits.maxBodyBytes) {
+        return {
+            status: 413,
+            error: 'That request is too large. Import the file in smaller pieces.'
+        };
+    }
+    const rows = (_req_body = req.body) == null ? void 0 : _req_body.rows;
+    if (!Array.isArray(rows) || rows.length === 0) {
+        return {
+            status: 400,
+            error: 'No rows to import.'
+        };
+    }
+    if (rows.length > limits.chunkSize) {
+        return {
+            status: 400,
+            error: `At most ${limits.chunkSize} rows per request.`
+        };
+    }
+    if (!rows.every((row)=>row && typeof row === 'object' && !Array.isArray(row))) {
+        return {
+            status: 400,
+            error: 'Every row must be an object.'
+        };
+    }
+    return {
+        rows: rows
+    };
+}
+/**
+ * The org's members by address, read only when a row names an owner.
+ *
+ * A file with no owner column costs no roster read; a file with one costs
+ * exactly one, however many rows it has.
+ */ export async function ownerDirectory(orgId, rows) {
+    const directory = new Map();
+    if (!rows.some((row)=>row.ownerEmail)) return directory;
+    const members = await listOrgMembers(orgId);
+    for (const member of members){
+        var _member_email;
+        const email = String((_member_email = member.email) != null ? _member_email : '').trim().toLowerCase();
+        if (email && member.$id) directory.set(email, String(member.$id));
+    }
+    return directory;
+}
+
+//# sourceMappingURL=import-context.js.map

package/src/lib/server/import-context.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/crm/src/lib/server/import-context.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * WHAT EVERY CSV IMPORT ROUTE ASKS BEFORE IT READS A ROW (AGL-2602, shared\n * by the companies import since AGL-2621).\n *\n * Who is asking and on whose behalf, whether the request is the size a\n * chunk is allowed to be, and — when a row names an owner — which member\n * of the org that address is. The contacts route settled each answer; the\n * companies route needs the same three and must not spell them\n * differently, because two gates for one permission is how one of them\n * comes to be wider.\n *\n * ## Who may call an import\n *\n * The same two gates the rules put on every CRM collection: a site role\n * on the host the request names, AND the organization's `data.manage`\n * permission resolved through the member's custom role and overrides. The\n * Admin SDK evaluates no rules, so this is the enforcement rather than an\n * echo of it — and `data.manage` rather than the raw role because an owner\n * who unticked \"Manage data\" on a custom role meant it. A staff token\n * passes both gates the way it does on every console route: support\n * importing a customer's file for them is the support act this exists for.\n */\n\nimport {\n  consentGroupScope,\n  crmScopeTokens,\n  ORG_SCOPE_TOKEN,\n  type PluginApiHandler,\n} from '@aglyn/aglyn/server'\nimport {\n  consentGroupForSite,\n  firebaseAdmin,\n  getOrgForHost,\n  listOrgMembers,\n  memberHasOrgPermission,\n  resolveOrgMembership,\n} from '@aglyn/tenant-data-admin'\nimport { crmSuiteRefusal } from './suite-gate'\n\n/** Everything an import needs about who is asking, or the refusal to send back. */\nexport type ImportContext =\n  | {\n      ok: true\n      uid: string\n      hostId: string\n      orgId: string\n      org: Record<string, unknown>\n      /**\n       * The stamp a record CREATED by this import carries — the org, when\n       * the org widened its default, and otherwise the capturing group.\n       */\n      scopeTokens: string[]\n      /**\n       * The tokens a record must overlap to be SEEN from this site: the\n       * group's own, plus `org`, because an org-wide record is visible to\n       * every site in the account. The reader's set is wider than the\n       * creator's stamp, exactly as it is on the collection listeners.\n       */\n      readTokens: string[]\n    }\n  | { ok: false; status: number; body: Record<string, unknown> }\n\nexport type ImportRequest = Parameters<PluginApiHandler>[0]\n\n/** Who is asking, and on whose behalf. */\nexport async function resolveImportContext(req: ImportRequest): Promise<ImportContext> {\n  const hostId = String(req.body?.hostId ?? '')\n  if (!hostId) {\n    return { ok: false, status: 400, body: { error: 'Missing hostId' } }\n  }\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken) {\n    return { ok: false, status: 401, body: { error: 'Unauthenticated' } }\n  }\n  const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n  const staff = decoded['staff'] === true\n  const firestore = firebaseAdmin.app().firestore()\n  const hostSnapshot = await firestore.collection('hosts').doc(hostId).get()\n  if (!hostSnapshot.exists) {\n    return { ok: false, status: 404, body: { error: 'Unknown site' } }\n  }\n  const memberRole = (hostSnapshot.get('memberRoles') ?? {})[decoded.uid]\n  if (!staff && memberRole !== 'admin' && memberRole !== 'editor') {\n    return {\n      ok: false,\n      status: 403,\n      body: { error: 'Not a site admin or editor' },\n    }\n  }\n  const resolved = await getOrgForHost(hostId).catch(() => null)\n  const orgId = String(resolved?.orgId ?? '')\n  if (!orgId) {\n    return {\n      ok: false,\n      status: 404,\n      body: { error: 'This site has no organization, so it has no CRM.' },\n    }\n  }\n  const org = (resolved?.org ?? {}) as Record<string, unknown>\n  const membership = await resolveOrgMembership(decoded.uid, orgId).catch(\n    () => null,\n  )\n  const member = membership?.member\n  if (\n    !staff &&\n    (!member ||\n      (member as { orgSuspended?: boolean }).orgSuspended === true ||\n      !(await memberHasOrgPermission(orgId, member, 'data.manage')))\n  ) {\n    return {\n      ok: false,\n      status: 403,\n      body: {\n        error:\n          'Your organization role does not allow managing contacts and ' +\n          'companies, so it cannot import them.',\n      },\n    }\n  }\n  // Every file this context serves — contacts, companies, deals, tasks and\n  // leads — is the CRM's to import, whoever is asking (AGL-2787).\n  const suite = crmSuiteRefusal(org, 'Importing from a CSV file')\n  if (suite) return { ok: false, status: suite.status, body: suite.body }\n  const group = await consentGroupForSite(hostId)\n  return {\n    ok: true,\n    uid: decoded.uid,\n    hostId,\n    orgId,\n    org,\n    scopeTokens: crmScopeTokens(org, group),\n    readTokens: [ORG_SCOPE_TOKEN, ...consentGroupScope(group)],\n  }\n}\n\n/** The rows a request may carry, or the refusal to send back. */\nexport function readImportRows<R>(\n  req: ImportRequest,\n  limits: { maxBodyBytes: number; chunkSize: number },\n): { rows: R[] } | { status: number; error: string } {\n  if ((req.rawBody?.length ?? 0) > limits.maxBodyBytes) {\n    return {\n      status: 413,\n      error: 'That request is too large. Import the file in smaller pieces.',\n    }\n  }\n  const rows = req.body?.rows\n  if (!Array.isArray(rows) || rows.length === 0) {\n    return { status: 400, error: 'No rows to import.' }\n  }\n  if (rows.length > limits.chunkSize) {\n    return {\n      status: 400,\n      error: `At most ${limits.chunkSize} rows per request.`,\n    }\n  }\n  if (!rows.every((row) => row && typeof row === 'object' && !Array.isArray(row))) {\n    return { status: 400, error: 'Every row must be an object.' }\n  }\n  return { rows: rows as R[] }\n}\n\n/**\n * The org's members by address, read only when a row names an owner.\n *\n * A file with no owner column costs no roster read; a file with one costs\n * exactly one, however many rows it has.\n */\nexport async function ownerDirectory(\n  orgId: string,\n  rows: readonly { ownerEmail?: string }[],\n): Promise<Map<string, string>> {\n  const directory = new Map<string, string>()\n  if (!rows.some((row) => row.ownerEmail)) return directory\n  const members = await listOrgMembers(orgId)\n  for (const member of members) {\n    const email = String(member.email ?? '')\n      .trim()\n      .toLowerCase()\n    if (email && member.$id) directory.set(email, String(member.$id))\n  }\n  return directory\n}\n"],"names":["consentGroupScope","crmScopeTokens","ORG_SCOPE_TOKEN","consentGroupForSite","firebaseAdmin","getOrgForHost","listOrgMembers","memberHasOrgPermission","resolveOrgMembership","crmSuiteRefusal","resolveImportContext","req","hostSnapshot","hostId","String","body","ok","status","error","authorization","headers","idToken","startsWith","slice","length","undefined","decoded","app","auth","verifyIdToken","staff","firestore","collection","doc","get","exists","memberRole","uid","resolved","catch","orgId","org","membership","member","orgSuspended","suite","group","scopeTokens","readTokens","readImportRows","limits","rawBody","maxBodyBytes","rows","Array","isArray","chunkSize","every","row","ownerDirectory","directory","Map","some","ownerEmail","members","email","trim","toLowerCase","$id","set"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;CAqBC,GAED,SACEA,iBAAiB,EACjBC,cAAc,EACdC,eAAe,QAEV,sBAAqB;AAC5B,SACEC,mBAAmB,EACnBC,aAAa,EACbC,aAAa,EACbC,cAAc,EACdC,sBAAsB,EACtBC,oBAAoB,QACf,2BAA0B;AACjC,SAASC,eAAe,QAAQ,kBAAc;AA2B9C,wCAAwC,GACxC,OAAO,eAAeC,qBAAqBC,GAAkB;cAK9BA,4BAcTC;QAlBED;IAAtB,MAAME,SAASC,gBAAOH,YAAAA,IAAII,IAAI,qBAARJ,UAAUE,MAAM,mBAAI;IAC1C,IAAI,CAACA,QAAQ;QACX,OAAO;YAAEG,IAAI;YAAOC,QAAQ;YAAKF,MAAM;gBAAEG,OAAO;YAAiB;QAAE;IACrE;IACA,MAAMC,gBAAgBL,QAAOH,6BAAAA,IAAIS,OAAO,CAACD,aAAa,YAAzBR,6BAA6B;IAC1D,MAAMU,UAAUF,cAAcG,UAAU,CAAC,aACrCH,cAAcI,KAAK,CAAC,UAAUC,MAAM,IACpCC;IACJ,IAAI,CAACJ,SAAS;QACZ,OAAO;YAAEL,IAAI;YAAOC,QAAQ;YAAKF,MAAM;gBAAEG,OAAO;YAAkB;QAAE;IACtE;IACA,MAAMQ,UAAU,MAAMtB,cAAcuB,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAACR;IAC/D,MAAMS,QAAQJ,OAAO,CAAC,QAAQ,KAAK;IACnC,MAAMK,YAAY3B,cAAcuB,GAAG,GAAGI,SAAS;IAC/C,MAAMnB,eAAe,MAAMmB,UAAUC,UAAU,CAAC,SAASC,GAAG,CAACpB,QAAQqB,GAAG;IACxE,IAAI,CAACtB,aAAauB,MAAM,EAAE;QACxB,OAAO;YAAEnB,IAAI;YAAOC,QAAQ;YAAKF,MAAM;gBAAEG,OAAO;YAAe;QAAE;IACnE;IACA,MAAMkB,aAAa,EAACxB,oBAAAA,aAAasB,GAAG,CAAC,0BAAjBtB,oBAAmC,CAAC,EAAE,CAACc,QAAQW,GAAG,CAAC;IACvE,IAAI,CAACP,SAASM,eAAe,WAAWA,eAAe,UAAU;QAC/D,OAAO;YACLpB,IAAI;YACJC,QAAQ;YACRF,MAAM;gBAAEG,OAAO;YAA6B;QAC9C;IACF;IACA,MAAMoB,WAAW,MAAMjC,cAAcQ,QAAQ0B,KAAK,CAAC,IAAM;IACzD,MAAMC,QAAQ1B,gBAAOwB,4BAAAA,SAAUE,KAAK,oBAAI;IACxC,IAAI,CAACA,OAAO;QACV,OAAO;YACLxB,IAAI;YACJC,QAAQ;YACRF,MAAM;gBAAEG,OAAO;YAAmD;QACpE;IACF;IACA,MAAMuB,eAAOH,4BAAAA,SAAUG,GAAG,oBAAI,CAAC;IAC/B,MAAMC,aAAa,MAAMlC,qBAAqBkB,QAAQW,GAAG,EAAEG,OAAOD,KAAK,CACrE,IAAM;IAER,MAAMI,SAASD,8BAAAA,WAAYC,MAAM;IACjC,IACE,CAACb,SACA,CAAA,CAACa,UACA,AAACA,OAAsCC,YAAY,KAAK,QACxD,CAAE,MAAMrC,uBAAuBiC,OAAOG,QAAQ,cAAc,GAC9D;QACA,OAAO;YACL3B,IAAI;YACJC,QAAQ;YACRF,MAAM;gBACJG,OACE,iEACA;YACJ;QACF;IACF;IACA,yEAAyE;IACzE,gEAAgE;IAChE,MAAM2B,QAAQpC,gBAAgBgC,KAAK;IACnC,IAAII,OAAO,OAAO;QAAE7B,IAAI;QAAOC,QAAQ4B,MAAM5B,MAAM;QAAEF,MAAM8B,MAAM9B,IAAI;IAAC;IACtE,MAAM+B,QAAQ,MAAM3C,oBAAoBU;IACxC,OAAO;QACLG,IAAI;QACJqB,KAAKX,QAAQW,GAAG;QAChBxB;QACA2B;QACAC;QACAM,aAAa9C,eAAewC,KAAKK;QACjCE,YAAY;YAAC9C;eAAoBF,kBAAkB8C;SAAO;IAC5D;AACF;AAEA,+DAA+D,GAC/D,OAAO,SAASG,eACdtC,GAAkB,EAClBuC,MAAmD;;QAE9CvC,cAMQA;IANb,IAAI,UAACA,eAAAA,IAAIwC,OAAO,qBAAXxC,aAAaa,MAAM,mBAAI,KAAK0B,OAAOE,YAAY,EAAE;QACpD,OAAO;YACLnC,QAAQ;YACRC,OAAO;QACT;IACF;IACA,MAAMmC,QAAO1C,YAAAA,IAAII,IAAI,qBAARJ,UAAU0C,IAAI;IAC3B,IAAI,CAACC,MAAMC,OAAO,CAACF,SAASA,KAAK7B,MAAM,KAAK,GAAG;QAC7C,OAAO;YAAEP,QAAQ;YAAKC,OAAO;QAAqB;IACpD;IACA,IAAImC,KAAK7B,MAAM,GAAG0B,OAAOM,SAAS,EAAE;QAClC,OAAO;YACLvC,QAAQ;YACRC,OAAO,CAAC,QAAQ,EAAEgC,OAAOM,SAAS,CAAC,kBAAkB,CAAC;QACxD;IACF;IACA,IAAI,CAACH,KAAKI,KAAK,CAAC,CAACC,MAAQA,OAAO,OAAOA,QAAQ,YAAY,CAACJ,MAAMC,OAAO,CAACG,OAAO;QAC/E,OAAO;YAAEzC,QAAQ;YAAKC,OAAO;QAA+B;IAC9D;IACA,OAAO;QAAEmC,MAAMA;IAAY;AAC7B;AAEA;;;;;CAKC,GACD,OAAO,eAAeM,eACpBnB,KAAa,EACba,IAAwC;IAExC,MAAMO,YAAY,IAAIC;IACtB,IAAI,CAACR,KAAKS,IAAI,CAAC,CAACJ,MAAQA,IAAIK,UAAU,GAAG,OAAOH;IAChD,MAAMI,UAAU,MAAM1D,eAAekC;IACrC,KAAK,MAAMG,UAAUqB,QAAS;YACPrB;QAArB,MAAMsB,QAAQnD,QAAO6B,gBAAAA,OAAOsB,KAAK,YAAZtB,gBAAgB,IAClCuB,IAAI,GACJC,WAAW;QACd,IAAIF,SAAStB,OAAOyB,GAAG,EAAER,UAAUS,GAAG,CAACJ,OAAOnD,OAAO6B,OAAOyB,GAAG;IACjE;IACA,OAAOR;AACT"}