@aglyn/plugins-crm 1.0.0-beta.143

package/src/lib/server/org-activity.js

@@ -0,0 +1,120 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * `POST /api/crm/org-activity` — one line in the organization's activity
+ * feed (AGL-2634).
+ *
+ * Body: `{ orgId, action, target: { type, id?, name? } }`. Answers
+ * `{ ok: true }` once the line is appended.
+ *
+ * ## Why a route, when the site feed takes the browser's word for it
+ *
+ * A site's feed at `hosts/{hostId}/activity` is written client-direct: the
+ * bulk bars log "Deleted deal" per row through `useHostActivityLogger`,
+ * under a rule that lets a member holding a content role append. The
+ * organization's feed at `orgs/{orgId}/activity` is not — `allow write: if
+ * false` for every client, because the feed names who did what across every
+ * site and its only reader is `/api/orgs/activity`, gated on `org.auditLog`
+ * with the Admin SDK. So an act performed at the ORGANIZATION level with a
+ * client-direct write — a bulk bar over the org's deals, which writes the
+ * documents from the browser — has no feed it can reach, and the org hub
+ * wrote no line at all for its bulk actions. This is the door: the same
+ * trust the site feed extends to the browser (a verified member, holding
+ * the permission the CRM is gated on), narrowed to the org hub's reach
+ * (org-wide, never a site collaborator) and to the CRM's own record kinds.
+ *
+ * What it does NOT vouch for is that the act happened: like every
+ * client-written feed line, the sentence is the caller's. The routes that
+ * perform an org-level act themselves — the stage move, the merge, the
+ * erasure, the email — write their own line with the Admin SDK and never
+ * call here.
+ */ import { _ as _extends } from "@swc/helpers/_/_extends";
+import { logOrgActivity } from "@aglyn/tenant-data-admin";
+import { CRM_API_ROUTES, CRM_ORG_ACTIVITY_ACTION_MAX, CRM_ORG_ACTIVITY_KINDS } from "../constants/api-routes.js";
+import { authorizeOrgCaller } from "./org-caller.js";
+import { crmSuiteRefusal } from "./suite-gate.js";
+export const CRM_ORG_ACTIVITY_ROUTE = CRM_API_ROUTES.orgActivity;
+function typed(value, max) {
+    return String(value != null ? value : '').trim().slice(0, max);
+}
+const isKind = (value)=>typeof value === 'string' && CRM_ORG_ACTIVITY_KINDS.includes(value);
+export const crmOrgActivityHandler = async (req, res)=>{
+    var _req_body;
+    if (req.method !== 'POST') {
+        res.setHeader('Allow', 'POST');
+        res.status(405).json({
+            error: 'Method not allowed'
+        });
+        return;
+    }
+    const body = typeof req.body === 'string' ? JSON.parse(req.body) : (_req_body = req.body) != null ? _req_body : {};
+    const orgId = typed(body.orgId, 128);
+    const action = typed(body.action, CRM_ORG_ACTIVITY_ACTION_MAX);
+    const target = body.target && typeof body.target === 'object' ? body.target : null;
+    if (!orgId || !action || !target) {
+        res.status(400).json({
+            error: 'Missing orgId, action or target'
+        });
+        return;
+    }
+    if (!isKind(target.type)) {
+        res.status(400).json({
+            error: 'The target names no CRM record kind'
+        });
+        return;
+    }
+    const id = typed(target.id, 200);
+    const name = typed(target.name, 200);
+    try {
+        const caller = await authorizeOrgCaller(req, orgId, {
+            needs: 'data.manage',
+            refusal: 'Logging organization activity requires the data permission across the whole workspace'
+        });
+        if (caller.ok === false) {
+            res.status(caller.status).json({
+                error: caller.error
+            });
+            return;
+        }
+        // The plan after the caller, before the line is written (AGL-2851).
+        const suite = crmSuiteRefusal(caller.org, "Logging a CRM act to the organization's feed");
+        if (suite) {
+            res.status(suite.status).json(suite.body);
+            return;
+        }
+        await logOrgActivity(orgId, {
+            uid: caller.uid,
+            email: caller.email
+        }, action, _extends({
+            type: target.type
+        }, id ? {
+            id
+        } : {}, name ? {
+            name
+        } : {}));
+        res.status(200).json({
+            ok: true
+        });
+    } catch (error) {
+        console.error('[crm] org-activity failed', orgId, error);
+        res.status(500).json({
+            error: 'The activity could not be logged'
+        });
+    }
+};
+export default crmOrgActivityHandler;
+
+//# sourceMappingURL=org-activity.js.map

package/src/lib/server/org-activity.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/crm/src/lib/server/org-activity.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * `POST /api/crm/org-activity` — one line in the organization's activity\n * feed (AGL-2634).\n *\n * Body: `{ orgId, action, target: { type, id?, name? } }`. Answers\n * `{ ok: true }` once the line is appended.\n *\n * ## Why a route, when the site feed takes the browser's word for it\n *\n * A site's feed at `hosts/{hostId}/activity` is written client-direct: the\n * bulk bars log \"Deleted deal\" per row through `useHostActivityLogger`,\n * under a rule that lets a member holding a content role append. The\n * organization's feed at `orgs/{orgId}/activity` is not — `allow write: if\n * false` for every client, because the feed names who did what across every\n * site and its only reader is `/api/orgs/activity`, gated on `org.auditLog`\n * with the Admin SDK. So an act performed at the ORGANIZATION level with a\n * client-direct write — a bulk bar over the org's deals, which writes the\n * documents from the browser — has no feed it can reach, and the org hub\n * wrote no line at all for its bulk actions. This is the door: the same\n * trust the site feed extends to the browser (a verified member, holding\n * the permission the CRM is gated on), narrowed to the org hub's reach\n * (org-wide, never a site collaborator) and to the CRM's own record kinds.\n *\n * What it does NOT vouch for is that the act happened: like every\n * client-written feed line, the sentence is the caller's. The routes that\n * perform an org-level act themselves — the stage move, the merge, the\n * erasure, the email — write their own line with the Admin SDK and never\n * call here.\n */\n\nimport type { PluginApiHandler } from '@aglyn/aglyn/server'\nimport { logOrgActivity } from '@aglyn/tenant-data-admin'\nimport {\n  CRM_API_ROUTES,\n  CRM_ORG_ACTIVITY_ACTION_MAX,\n  CRM_ORG_ACTIVITY_KINDS,\n  type CrmOrgActivityKind,\n} from '../constants/api-routes'\nimport { authorizeOrgCaller } from './org-caller'\nimport { crmSuiteRefusal } from './suite-gate'\n\nexport const CRM_ORG_ACTIVITY_ROUTE = CRM_API_ROUTES.orgActivity\n\n/** The body the org-level bulk bars post. */\nexport interface OrgActivityRequest {\n  orgId: string\n  /** The sentence — \"Owner set on 3 deals\" — as the bar's snackbar said it. */\n  action: string\n  target: {\n    type: CrmOrgActivityKind\n    id?: string\n    name?: string\n  }\n}\n\nfunction typed(value: unknown, max: number): string {\n  return String(value ?? '')\n    .trim()\n    .slice(0, max)\n}\n\nconst isKind = (value: unknown): value is CrmOrgActivityKind =>\n  typeof value === 'string' &&\n  (CRM_ORG_ACTIVITY_KINDS as readonly string[]).includes(value)\n\nexport const crmOrgActivityHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    res.setHeader('Allow', 'POST')\n    res.status(405).json({ error: 'Method not allowed' })\n    return\n  }\n  const body: Partial<OrgActivityRequest> =\n    typeof req.body === 'string' ? JSON.parse(req.body) : (req.body ?? {})\n  const orgId = typed(body.orgId, 128)\n  const action = typed(body.action, CRM_ORG_ACTIVITY_ACTION_MAX)\n  const target = body.target && typeof body.target === 'object' ? body.target : null\n  if (!orgId || !action || !target) {\n    res.status(400).json({ error: 'Missing orgId, action or target' })\n    return\n  }\n  if (!isKind(target.type)) {\n    res.status(400).json({ error: 'The target names no CRM record kind' })\n    return\n  }\n  const id = typed(target.id, 200)\n  const name = typed(target.name, 200)\n\n  try {\n    const caller = await authorizeOrgCaller(req, orgId, {\n      needs: 'data.manage',\n      refusal:\n        'Logging organization activity requires the data permission across the whole workspace',\n    })\n    if (caller.ok === false) {\n      res.status(caller.status).json({ error: caller.error })\n      return\n    }\n    // The plan after the caller, before the line is written (AGL-2851).\n    const suite = crmSuiteRefusal(caller.org, \"Logging a CRM act to the organization's feed\")\n    if (suite) {\n      res.status(suite.status).json(suite.body)\n      return\n    }\n    await logOrgActivity(orgId, { uid: caller.uid, email: caller.email }, action, {\n      type: target.type,\n      ...(id ? { id } : {}),\n      ...(name ? { name } : {}),\n    })\n    res.status(200).json({ ok: true })\n  } catch (error) {\n    console.error('[crm] org-activity failed', orgId, error)\n    res.status(500).json({ error: 'The activity could not be logged' })\n  }\n}\n\nexport default crmOrgActivityHandler\n"],"names":["logOrgActivity","CRM_API_ROUTES","CRM_ORG_ACTIVITY_ACTION_MAX","CRM_ORG_ACTIVITY_KINDS","authorizeOrgCaller","crmSuiteRefusal","CRM_ORG_ACTIVITY_ROUTE","orgActivity","typed","value","max","String","trim","slice","isKind","includes","crmOrgActivityHandler","req","res","method","setHeader","status","json","error","body","JSON","parse","orgId","action","target","type","id","name","caller","needs","refusal","ok","suite","org","uid","email","console"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4BC;AAGD,SAASA,cAAc,QAAQ,2BAA0B;AACzD,SACEC,cAAc,EACdC,2BAA2B,EAC3BC,sBAAsB,QAEjB,6BAAyB;AAChC,SAASC,kBAAkB,QAAQ,kBAAc;AACjD,SAASC,eAAe,QAAQ,kBAAc;AAE9C,OAAO,MAAMC,yBAAyBL,eAAeM,WAAW,CAAA;AAchE,SAASC,MAAMC,KAAc,EAAEC,GAAW;IACxC,OAAOC,OAAOF,gBAAAA,QAAS,IACpBG,IAAI,GACJC,KAAK,CAAC,GAAGH;AACd;AAEA,MAAMI,SAAS,CAACL,QACd,OAAOA,UAAU,YACjB,AAACN,uBAA6CY,QAAQ,CAACN;AAEzD,OAAO,MAAMO,wBAA0C,OAAOC,KAAKC;QAORD;IANzD,IAAIA,IAAIE,MAAM,KAAK,QAAQ;QACzBD,IAAIE,SAAS,CAAC,SAAS;QACvBF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;QACnD;IACF;IACA,MAAMC,OACJ,OAAOP,IAAIO,IAAI,KAAK,WAAWC,KAAKC,KAAK,CAACT,IAAIO,IAAI,KAAKP,YAAAA,IAAIO,IAAI,YAARP,YAAY,CAAC;IACtE,MAAMU,QAAQnB,MAAMgB,KAAKG,KAAK,EAAE;IAChC,MAAMC,SAASpB,MAAMgB,KAAKI,MAAM,EAAE1B;IAClC,MAAM2B,SAASL,KAAKK,MAAM,IAAI,OAAOL,KAAKK,MAAM,KAAK,WAAWL,KAAKK,MAAM,GAAG;IAC9E,IAAI,CAACF,SAAS,CAACC,UAAU,CAACC,QAAQ;QAChCX,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAkC;QAChE;IACF;IACA,IAAI,CAACT,OAAOe,OAAOC,IAAI,GAAG;QACxBZ,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAsC;QACpE;IACF;IACA,MAAMQ,KAAKvB,MAAMqB,OAAOE,EAAE,EAAE;IAC5B,MAAMC,OAAOxB,MAAMqB,OAAOG,IAAI,EAAE;IAEhC,IAAI;QACF,MAAMC,SAAS,MAAM7B,mBAAmBa,KAAKU,OAAO;YAClDO,OAAO;YACPC,SACE;QACJ;QACA,IAAIF,OAAOG,EAAE,KAAK,OAAO;YACvBlB,IAAIG,MAAM,CAACY,OAAOZ,MAAM,EAAEC,IAAI,CAAC;gBAAEC,OAAOU,OAAOV,KAAK;YAAC;YACrD;QACF;QACA,oEAAoE;QACpE,MAAMc,QAAQhC,gBAAgB4B,OAAOK,GAAG,EAAE;QAC1C,IAAID,OAAO;YACTnB,IAAIG,MAAM,CAACgB,MAAMhB,MAAM,EAAEC,IAAI,CAACe,MAAMb,IAAI;YACxC;QACF;QACA,MAAMxB,eAAe2B,OAAO;YAAEY,KAAKN,OAAOM,GAAG;YAAEC,OAAOP,OAAOO,KAAK;QAAC,GAAGZ,QAAQ;YAC5EE,MAAMD,OAAOC,IAAI;WACbC,KAAK;YAAEA;QAAG,IAAI,CAAC,GACfC,OAAO;YAAEA;QAAK,IAAI,CAAC;QAEzBd,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEc,IAAI;QAAK;IAClC,EAAE,OAAOb,OAAO;QACdkB,QAAQlB,KAAK,CAAC,6BAA6BI,OAAOJ;QAClDL,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAmC;IACnE;AACF,EAAC;AAED,eAAeP,sBAAqB"}

package/src/lib/server/org-caller.d.ts

@@ -0,0 +1,110 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * WHO IS CALLING AT THE ORGANIZATION LEVEL (AGL-2634).
+ *
+ * The CRM's host-routed actions — a stage move, a merge, an erasure, an
+ * email — were written for the site hub: each resolves the org FROM the
+ * site, checks the caller's role ON that site, and logs into that site's
+ * feed. The organization-level hub (AGL-2630) mounts the same surfaces with
+ * no site, and for a while every one of those actions ran "as the record's
+ * own capturing site", which left a record nobody's site had captured with
+ * nothing to run as. The org variant of each route authorizes HERE instead:
+ * by the org the body names, for an org-wide member, with the permission
+ * the whole CRM is gated on — the same three facts the org hub's own page
+ * gate checks (`resolveOrgCrmAccess`), so what the console offers and what
+ * the server admits cannot drift.
+ *
+ * A ROLE IS NOT A REACH. A site collaborator is a real member document
+ * carrying `role: 'editor'`, and that role holds `data.manage` — so a gate
+ * that read the permission alone would admit a contractor on one microsite
+ * to act over every site in the agency. `orgWide` is checked first and
+ * separately, and no permission grant restores it; this is the boundary the
+ * host variants get for free from the site role, spelled out for the variant
+ * that has no site.
+ */
+import { type AglynOrganization, type PluginApiRequest } from '@aglyn/aglyn/server';
+/**
+ * Which level a CRM route runs at, read off its body once.
+ *
+ * `orgId` present is the ORGANIZATION variant, whatever else the body
+ * carries: the org-level console always names its org, and a `hostId`
+ * beside it is the record's own site or the site an email leaves from —
+ * never what the caller is authorized against. `hostId` alone is the site
+ * variant every route has always had.
+ */
+export interface CrmRouteScope {
+    level: 'site' | 'org';
+    hostId: string;
+    orgId: string;
+}
+export declare function readCrmRouteScope(body: Record<string, unknown> | null | undefined): CrmRouteScope | null;
+/**
+ * Whether `uid` holds `data.manage` in `orgId`, as the permission catalog
+ * resolves it: the member's role, a custom role and per-member overrides
+ * (AGL-2843).
+ *
+ * Asked of `memberHasOrgPermission`, never of the `permissions` map
+ * `resolveOrgPermissions` returns. That map is the legacy six keys plus the
+ * keys plugins register (`ResolvedOrgPermissionSet`), and `data.manage` is a
+ * catalog key, so it is never in it: a gate that read it there would refuse
+ * everyone but staff. A lookup that fails answers `false`.
+ */
+export declare function holdsDataManage(orgId: string | null | undefined, uid: string): Promise<boolean>;
+export interface OrgCaller {
+    ok: true;
+    uid: string;
+    /** The token's address, or null for an account with none. */
+    email: string | null;
+    /** The token's display name, `''` when it carries none. */
+    name: string;
+    staff: boolean;
+    orgId: string;
+    org: Partial<AglynOrganization>;
+}
+export interface OrgCallerRefusal {
+    ok: false;
+    status: number;
+    error: string;
+}
+/** What the caller must hold over the whole organization. */
+export type OrgCallerRequirement = 
+/** `data.manage`, org-wide — the key the CRM is gated on. Staff pass. */
+'data.manage'
+/** A workspace owner or admin, org-wide. Staff acting alone do NOT pass. */
+ | 'manage-org';
+/**
+ * A verified session, org-wide reach in `orgId`, and the requirement — in
+ * that order, the cheapest refusal first — then the org document, which
+ * every org variant needs for the plan and the consent groups.
+ *
+ * Staff are admitted to the `data.manage` requirement as every CRM route
+ * admits them, and refused the `manage-org` one as the erasure route
+ * refuses them: the workspace is the controller of its people's data and
+ * the instruction to erase has to come from it.
+ */
+export declare function authorizeOrgCaller(req: PluginApiRequest, orgId: string, options: {
+    needs: OrgCallerRequirement;
+    refusal: string;
+}): Promise<OrgCaller | OrgCallerRefusal>;
+/**
+ * Every site of the organization, by document id — the host set an
+ * org-level act sweeps when it needs one (AGL-2634). One equality on
+ * `hosts.orgId`, the query the erasure route already ran, which needs no
+ * composite index.
+ */
+export declare function orgHostIds(firestore: FirebaseFirestore.Firestore, orgId: string): Promise<string[]>;

package/src/lib/server/org-caller.js

@@ -0,0 +1,154 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * WHO IS CALLING AT THE ORGANIZATION LEVEL (AGL-2634).
+ *
+ * The CRM's host-routed actions — a stage move, a merge, an erasure, an
+ * email — were written for the site hub: each resolves the org FROM the
+ * site, checks the caller's role ON that site, and logs into that site's
+ * feed. The organization-level hub (AGL-2630) mounts the same surfaces with
+ * no site, and for a while every one of those actions ran "as the record's
+ * own capturing site", which left a record nobody's site had captured with
+ * nothing to run as. The org variant of each route authorizes HERE instead:
+ * by the org the body names, for an org-wide member, with the permission
+ * the whole CRM is gated on — the same three facts the org hub's own page
+ * gate checks (`resolveOrgCrmAccess`), so what the console offers and what
+ * the server admits cannot drift.
+ *
+ * A ROLE IS NOT A REACH. A site collaborator is a real member document
+ * carrying `role: 'editor'`, and that role holds `data.manage` — so a gate
+ * that read the permission alone would admit a contractor on one microsite
+ * to act over every site in the agency. `orgWide` is checked first and
+ * separately, and no permission grant restores it; this is the boundary the
+ * host variants get for free from the site role, spelled out for the variant
+ * that has no site.
+ */ import { canManageOrg } from "@aglyn/aglyn/server";
+import { firebaseAdmin, getOrgDoc, memberHasOrgPermission, resolveOrgMembership } from "@aglyn/tenant-data-admin";
+import { isRefusedIdToken } from "@aglyn/tenant-data-admin/server/id-token-refusal";
+import { resolveOrgPermissions } from "@aglyn/tenant-runtime/org-permissions";
+export function readCrmRouteScope(body) {
+    var _ref, _ref1;
+    const hostId = String((_ref = body == null ? void 0 : body['hostId']) != null ? _ref : '').trim().slice(0, 128);
+    const orgId = String((_ref1 = body == null ? void 0 : body['orgId']) != null ? _ref1 : '').trim().slice(0, 128);
+    if (orgId) return {
+        level: 'org',
+        hostId,
+        orgId
+    };
+    if (hostId) return {
+        level: 'site',
+        hostId,
+        orgId: ''
+    };
+    return null;
+}
+/**
+ * Whether `uid` holds `data.manage` in `orgId`, as the permission catalog
+ * resolves it: the member's role, a custom role and per-member overrides
+ * (AGL-2843).
+ *
+ * Asked of `memberHasOrgPermission`, never of the `permissions` map
+ * `resolveOrgPermissions` returns. That map is the legacy six keys plus the
+ * keys plugins register (`ResolvedOrgPermissionSet`), and `data.manage` is a
+ * catalog key, so it is never in it: a gate that read it there would refuse
+ * everyone but staff. A lookup that fails answers `false`.
+ */ export async function holdsDataManage(orgId, uid) {
+    if (!orgId) return false;
+    try {
+        var _ref;
+        const membership = await resolveOrgMembership(uid, orgId);
+        const member = (_ref = membership == null ? void 0 : membership.member) != null ? _ref : null;
+        if (!member) return false;
+        return await memberHasOrgPermission(orgId, member, 'data.manage') === true;
+    } catch (unused) {
+        return false;
+    }
+}
+/**
+ * A verified session, org-wide reach in `orgId`, and the requirement — in
+ * that order, the cheapest refusal first — then the org document, which
+ * every org variant needs for the plan and the consent groups.
+ *
+ * Staff are admitted to the `data.manage` requirement as every CRM route
+ * admits them, and refused the `manage-org` one as the erasure route
+ * refuses them: the workspace is the controller of its people's data and
+ * the instruction to erase has to come from it.
+ */ export async function authorizeOrgCaller(req, orgId, options) {
+    var _req_headers_authorization, _ref, _decoded_email, _decoded_name;
+    const authorization = String((_req_headers_authorization = req.headers.authorization) != null ? _req_headers_authorization : '');
+    const idToken = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : undefined;
+    if (!idToken) return {
+        ok: false,
+        status: 401,
+        error: 'Unauthenticated'
+    };
+    let decoded;
+    try {
+        decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken);
+    } catch (error) {
+        // A refused credential is the caller's 401. A failure to check one is
+        // ours and keeps a 5xx, so an outage pages instead of reading as a bad
+        // token (AGL-2852).
+        if (isRefusedIdToken(error)) return {
+            ok: false,
+            status: 401,
+            error: 'Unauthenticated'
+        };
+        console.error('[crm] the organization caller could not be verified', error);
+        return {
+            ok: false,
+            status: 500,
+            error: 'The sign-in could not be checked. Try again.'
+        };
+    }
+    const staff = decoded.staff === true;
+    const membership = await resolveOrgPermissions(decoded.uid, {
+        orgId
+    }).catch(()=>null);
+    const orgWide = Boolean(membership == null ? void 0 : membership.orgWide) && (membership == null ? void 0 : membership.orgId) === orgId;
+    const admitted = options.needs === 'data.manage' ? staff || orgWide && await holdsDataManage(orgId, decoded.uid) : orgWide && canManageOrg((_ref = membership == null ? void 0 : membership.role) != null ? _ref : null);
+    if (!admitted) return {
+        ok: false,
+        status: 403,
+        error: options.refusal
+    };
+    const org = await getOrgDoc(orgId).catch(()=>null);
+    if (!org) return {
+        ok: false,
+        status: 404,
+        error: 'Unknown organization'
+    };
+    return {
+        ok: true,
+        uid: decoded.uid,
+        email: (_decoded_email = decoded.email) != null ? _decoded_email : null,
+        name: String((_decoded_name = decoded.name) != null ? _decoded_name : '').trim().slice(0, 120),
+        staff,
+        orgId,
+        org
+    };
+}
+/**
+ * Every site of the organization, by document id — the host set an
+ * org-level act sweeps when it needs one (AGL-2634). One equality on
+ * `hosts.orgId`, the query the erasure route already ran, which needs no
+ * composite index.
+ */ export async function orgHostIds(firestore, orgId) {
+    const hosts = await firestore.collection('hosts').where('orgId', '==', orgId).get();
+    return hosts.docs.map((doc)=>String(doc.id));
+}
+
+//# sourceMappingURL=org-caller.js.map

package/src/lib/server/org-caller.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/crm/src/lib/server/org-caller.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * WHO IS CALLING AT THE ORGANIZATION LEVEL (AGL-2634).\n *\n * The CRM's host-routed actions — a stage move, a merge, an erasure, an\n * email — were written for the site hub: each resolves the org FROM the\n * site, checks the caller's role ON that site, and logs into that site's\n * feed. The organization-level hub (AGL-2630) mounts the same surfaces with\n * no site, and for a while every one of those actions ran \"as the record's\n * own capturing site\", which left a record nobody's site had captured with\n * nothing to run as. The org variant of each route authorizes HERE instead:\n * by the org the body names, for an org-wide member, with the permission\n * the whole CRM is gated on — the same three facts the org hub's own page\n * gate checks (`resolveOrgCrmAccess`), so what the console offers and what\n * the server admits cannot drift.\n *\n * A ROLE IS NOT A REACH. A site collaborator is a real member document\n * carrying `role: 'editor'`, and that role holds `data.manage` — so a gate\n * that read the permission alone would admit a contractor on one microsite\n * to act over every site in the agency. `orgWide` is checked first and\n * separately, and no permission grant restores it; this is the boundary the\n * host variants get for free from the site role, spelled out for the variant\n * that has no site.\n */\n\nimport { type AglynOrganization, canManageOrg, type PluginApiRequest } from '@aglyn/aglyn/server'\nimport {\n  firebaseAdmin,\n  getOrgDoc,\n  memberHasOrgPermission,\n  resolveOrgMembership,\n} from '@aglyn/tenant-data-admin'\nimport { isRefusedIdToken } from '@aglyn/tenant-data-admin/server/id-token-refusal'\nimport { resolveOrgPermissions } from '@aglyn/tenant-runtime/org-permissions'\n\n/**\n * Which level a CRM route runs at, read off its body once.\n *\n * `orgId` present is the ORGANIZATION variant, whatever else the body\n * carries: the org-level console always names its org, and a `hostId`\n * beside it is the record's own site or the site an email leaves from —\n * never what the caller is authorized against. `hostId` alone is the site\n * variant every route has always had.\n */\nexport interface CrmRouteScope {\n  level: 'site' | 'org'\n  hostId: string\n  orgId: string\n}\n\nexport function readCrmRouteScope(\n  body: Record<string, unknown> | null | undefined,\n): CrmRouteScope | null {\n  const hostId = String(body?.['hostId'] ?? '')\n    .trim()\n    .slice(0, 128)\n  const orgId = String(body?.['orgId'] ?? '')\n    .trim()\n    .slice(0, 128)\n  if (orgId) return { level: 'org', hostId, orgId }\n  if (hostId) return { level: 'site', hostId, orgId: '' }\n  return null\n}\n\n/**\n * Whether `uid` holds `data.manage` in `orgId`, as the permission catalog\n * resolves it: the member's role, a custom role and per-member overrides\n * (AGL-2843).\n *\n * Asked of `memberHasOrgPermission`, never of the `permissions` map\n * `resolveOrgPermissions` returns. That map is the legacy six keys plus the\n * keys plugins register (`ResolvedOrgPermissionSet`), and `data.manage` is a\n * catalog key, so it is never in it: a gate that read it there would refuse\n * everyone but staff. A lookup that fails answers `false`.\n */\nexport async function holdsDataManage(\n  orgId: string | null | undefined,\n  uid: string,\n): Promise<boolean> {\n  if (!orgId) return false\n  try {\n    const membership = await resolveOrgMembership(uid, orgId)\n    const member = membership?.member ?? null\n    if (!member) return false\n    return (await memberHasOrgPermission(orgId, member, 'data.manage')) === true\n  } catch {\n    return false\n  }\n}\n\nexport interface OrgCaller {\n  ok: true\n  uid: string\n  /** The token's address, or null for an account with none. */\n  email: string | null\n  /** The token's display name, `''` when it carries none. */\n  name: string\n  staff: boolean\n  orgId: string\n  org: Partial<AglynOrganization>\n}\n\nexport interface OrgCallerRefusal {\n  ok: false\n  status: number\n  error: string\n}\n\n/** What the caller must hold over the whole organization. */\nexport type OrgCallerRequirement =\n  /** `data.manage`, org-wide — the key the CRM is gated on. Staff pass. */\n  | 'data.manage'\n  /** A workspace owner or admin, org-wide. Staff acting alone do NOT pass. */\n  | 'manage-org'\n\n/**\n * A verified session, org-wide reach in `orgId`, and the requirement — in\n * that order, the cheapest refusal first — then the org document, which\n * every org variant needs for the plan and the consent groups.\n *\n * Staff are admitted to the `data.manage` requirement as every CRM route\n * admits them, and refused the `manage-org` one as the erasure route\n * refuses them: the workspace is the controller of its people's data and\n * the instruction to erase has to come from it.\n */\nexport async function authorizeOrgCaller(\n  req: PluginApiRequest,\n  orgId: string,\n  options: { needs: OrgCallerRequirement; refusal: string },\n): Promise<OrgCaller | OrgCallerRefusal> {\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken) return { ok: false, status: 401, error: 'Unauthenticated' }\n  let decoded: { uid: string; email?: string; name?: string; staff?: unknown }\n  try {\n    decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n  } catch (error) {\n    // A refused credential is the caller's 401. A failure to check one is\n    // ours and keeps a 5xx, so an outage pages instead of reading as a bad\n    // token (AGL-2852).\n    if (isRefusedIdToken(error)) return { ok: false, status: 401, error: 'Unauthenticated' }\n    console.error('[crm] the organization caller could not be verified', error)\n    return { ok: false, status: 500, error: 'The sign-in could not be checked. Try again.' }\n  }\n  const staff = decoded.staff === true\n  const membership = await resolveOrgPermissions(decoded.uid, { orgId }).catch(\n    () => null,\n  )\n  const orgWide = Boolean(membership?.orgWide) && membership?.orgId === orgId\n  const admitted =\n    options.needs === 'data.manage'\n      ? staff || (orgWide && (await holdsDataManage(orgId, decoded.uid)))\n      : orgWide && canManageOrg(membership?.role ?? null)\n  if (!admitted) return { ok: false, status: 403, error: options.refusal }\n  const org = await getOrgDoc(orgId).catch(() => null)\n  if (!org) return { ok: false, status: 404, error: 'Unknown organization' }\n  return {\n    ok: true,\n    uid: decoded.uid,\n    email: decoded.email ?? null,\n    name: String(decoded.name ?? '')\n      .trim()\n      .slice(0, 120),\n    staff,\n    orgId,\n    org,\n  }\n}\n\n/**\n * Every site of the organization, by document id — the host set an\n * org-level act sweeps when it needs one (AGL-2634). One equality on\n * `hosts.orgId`, the query the erasure route already ran, which needs no\n * composite index.\n */\nexport async function orgHostIds(\n  firestore: FirebaseFirestore.Firestore,\n  orgId: string,\n): Promise<string[]> {\n  const hosts = await firestore.collection('hosts').where('orgId', '==', orgId).get()\n  return hosts.docs.map((doc: { id: string }) => String(doc.id))\n}\n"],"names":["canManageOrg","firebaseAdmin","getOrgDoc","memberHasOrgPermission","resolveOrgMembership","isRefusedIdToken","resolveOrgPermissions","readCrmRouteScope","body","hostId","String","trim","slice","orgId","level","holdsDataManage","uid","membership","member","authorizeOrgCaller","req","options","decoded","authorization","headers","idToken","startsWith","length","undefined","ok","status","error","app","auth","verifyIdToken","console","staff","catch","orgWide","Boolean","admitted","needs","role","refusal","org","email","name","orgHostIds","firestore","hosts","collection","where","get","docs","map","doc","id"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;CAsBC,GAED,SAAiCA,YAAY,QAA+B,sBAAqB;AACjG,SACEC,aAAa,EACbC,SAAS,EACTC,sBAAsB,EACtBC,oBAAoB,QACf,2BAA0B;AACjC,SAASC,gBAAgB,QAAQ,mDAAkD;AACnF,SAASC,qBAAqB,QAAQ,wCAAuC;AAiB7E,OAAO,SAASC,kBACdC,IAAgD;;IAEhD,MAAMC,SAASC,eAAOF,wBAAAA,IAAM,CAAC,SAAS,mBAAI,IACvCG,IAAI,GACJC,KAAK,CAAC,GAAG;IACZ,MAAMC,QAAQH,gBAAOF,wBAAAA,IAAM,CAAC,QAAQ,oBAAI,IACrCG,IAAI,GACJC,KAAK,CAAC,GAAG;IACZ,IAAIC,OAAO,OAAO;QAAEC,OAAO;QAAOL;QAAQI;IAAM;IAChD,IAAIJ,QAAQ,OAAO;QAAEK,OAAO;QAAQL;QAAQI,OAAO;IAAG;IACtD,OAAO;AACT;AAEA;;;;;;;;;;CAUC,GACD,OAAO,eAAeE,gBACpBF,KAAgC,EAChCG,GAAW;IAEX,IAAI,CAACH,OAAO,OAAO;IACnB,IAAI;;QACF,MAAMI,aAAa,MAAMb,qBAAqBY,KAAKH;QACnD,MAAMK,iBAASD,8BAAAA,WAAYC,MAAM,mBAAI;QACrC,IAAI,CAACA,QAAQ,OAAO;QACpB,OAAO,AAAC,MAAMf,uBAAuBU,OAAOK,QAAQ,mBAAoB;IAC1E,EAAE,eAAM;QACN,OAAO;IACT;AACF;AA2BA;;;;;;;;;CASC,GACD,OAAO,eAAeC,mBACpBC,GAAqB,EACrBP,KAAa,EACbQ,OAAyD;QAE5BD,kCA+BpBE,gBACMA;IAhCf,MAAMC,gBAAgBb,QAAOU,6BAAAA,IAAII,OAAO,CAACD,aAAa,YAAzBH,6BAA6B;IAC1D,MAAMK,UAAUF,cAAcG,UAAU,CAAC,aACrCH,cAAcX,KAAK,CAAC,UAAUe,MAAM,IACpCC;IACJ,IAAI,CAACH,SAAS,OAAO;QAAEI,IAAI;QAAOC,QAAQ;QAAKC,OAAO;IAAkB;IACxE,IAAIT;IACJ,IAAI;QACFA,UAAU,MAAMrB,cAAc+B,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAACT;IAC3D,EAAE,OAAOM,OAAO;QACd,sEAAsE;QACtE,uEAAuE;QACvE,oBAAoB;QACpB,IAAI1B,iBAAiB0B,QAAQ,OAAO;YAAEF,IAAI;YAAOC,QAAQ;YAAKC,OAAO;QAAkB;QACvFI,QAAQJ,KAAK,CAAC,uDAAuDA;QACrE,OAAO;YAAEF,IAAI;YAAOC,QAAQ;YAAKC,OAAO;QAA+C;IACzF;IACA,MAAMK,QAAQd,QAAQc,KAAK,KAAK;IAChC,MAAMnB,aAAa,MAAMX,sBAAsBgB,QAAQN,GAAG,EAAE;QAAEH;IAAM,GAAGwB,KAAK,CAC1E,IAAM;IAER,MAAMC,UAAUC,QAAQtB,8BAAAA,WAAYqB,OAAO,KAAKrB,CAAAA,8BAAAA,WAAYJ,KAAK,MAAKA;IACtE,MAAM2B,WACJnB,QAAQoB,KAAK,KAAK,gBACdL,SAAUE,WAAY,MAAMvB,gBAAgBF,OAAOS,QAAQN,GAAG,IAC9DsB,WAAWtC,qBAAaiB,8BAAAA,WAAYyB,IAAI,mBAAI;IAClD,IAAI,CAACF,UAAU,OAAO;QAAEX,IAAI;QAAOC,QAAQ;QAAKC,OAAOV,QAAQsB,OAAO;IAAC;IACvE,MAAMC,MAAM,MAAM1C,UAAUW,OAAOwB,KAAK,CAAC,IAAM;IAC/C,IAAI,CAACO,KAAK,OAAO;QAAEf,IAAI;QAAOC,QAAQ;QAAKC,OAAO;IAAuB;IACzE,OAAO;QACLF,IAAI;QACJb,KAAKM,QAAQN,GAAG;QAChB6B,KAAK,GAAEvB,iBAAAA,QAAQuB,KAAK,YAAbvB,iBAAiB;QACxBwB,MAAMpC,QAAOY,gBAAAA,QAAQwB,IAAI,YAAZxB,gBAAgB,IAC1BX,IAAI,GACJC,KAAK,CAAC,GAAG;QACZwB;QACAvB;QACA+B;IACF;AACF;AAEA;;;;;CAKC,GACD,OAAO,eAAeG,WACpBC,SAAsC,EACtCnC,KAAa;IAEb,MAAMoC,QAAQ,MAAMD,UAAUE,UAAU,CAAC,SAASC,KAAK,CAAC,SAAS,MAAMtC,OAAOuC,GAAG;IACjF,OAAOH,MAAMI,IAAI,CAACC,GAAG,CAAC,CAACC,MAAwB7C,OAAO6C,IAAIC,EAAE;AAC9D"}

package/src/lib/server/recipe-routes.d.ts

@@ -0,0 +1,75 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * THE RECIPES, INSTALLED FROM THE ORGANIZATION (AGL-2639).
+ *
+ * On a site, a recipe opens the Actions editor prefilled and writes nothing
+ * until the person saves — the editor is the writer, and the site's own
+ * role is the authority. The organization-level CRM hub has no editor: it
+ * mounts over every site with no site of its own, and an org running five
+ * sites installed "Welcome a new lead" five times by hand. These two routes
+ * are the org hub's door to a site's automations.
+ *
+ * `crm/recipe-install` writes the action a recipe builds into ONE site's
+ * `hosts/{hostId}/actions`, as the site editor would have saved it — the
+ * same builder, the same validator, the same stored shape — and refuses a
+ * second install of the same recipe on the same site by the stamp the
+ * builder puts on it. A server route rather than a client write for three
+ * reasons the browser cannot supply: the document is created by a server
+ * on every plan (the rules close `actions` to client creates, and the
+ * per-site cap is counted here); the stamp is the server's word, not the
+ * caller's; and the site is checked to be one the caller may manage —
+ * at the org level, a site OF THE ORG the caller holds org-wide reach in,
+ * so a host id typed into the body cannot reach a site under another
+ * workspace.
+ *
+ * `crm/recipe-status` reads the stamps back for every site of the org, so
+ * the card can say which sites carry which recipe. An action with no stamp
+ * at all — saved before the stamp existed — is counted, not ignored: it
+ * may well be a recipe, and the reader is told the site "may already have
+ * it" rather than shown a clean slate.
+ *
+ * Both routes serve the site variant too (`hostId` alone, authorized by the
+ * host role that creates actions today), so a site-level caller gets the
+ * same answers; the org variant (`orgId` in the body) is the one the org
+ * hub uses.
+ */
+import { type PluginApiHandler } from '@aglyn/aglyn/server';
+export declare const CRM_RECIPE_INSTALL_ROUTE: "crm/recipe-install";
+export declare const CRM_RECIPE_STATUS_ROUTE: "crm/recipe-status";
+/**
+ * `POST /api/crm/recipe-install`
+ *
+ * The body is a CrmRecipeInstallRequest: the site, the recipe, the form a
+ * recipe that needs one is keyed on, and the org at the organization level.
+ * Answers 201 with a CrmRecipeInstallResult once the action is written, and
+ * 409 when a live action on the site already carries the stamp — naming it,
+ * so the caller can say "already installed" rather than install it twice.
+ *
+ * The write is one transaction: the stamps are read, the duplicate and the
+ * per-site cap are judged, and the document is created — all inside it, so
+ * two installs racing for the same site cannot both land.
+ */
+export declare const crmRecipeInstallHandler: PluginApiHandler;
+/**
+ * `POST /api/crm/recipe-status`
+ *
+ * The body names the organization (`orgId`) for every one of its sites, or
+ * one site (`hostId`) for that site alone. Answers `ok: true` and `sites`,
+ * one CrmRecipeSiteStatus per site swept.
+ */
+export declare const crmRecipeStatusHandler: PluginApiHandler;