@aiquants/auth-directory-drizzle 0.7.1 → 0.8.0

package/dist/index.mjs

@@ -1,2 +1,2 @@
-import{assertTenantId as Ae}from"@aiquants/authz-core";import{and as Q,asc as $e,eq as N}from"drizzle-orm";function O(e){return e instanceof Date?e:new Date(/(?:Z|[+-]\d{2}:?\d{2})$/.test(e)?e:`${e.replace(" ","T")}Z`)}var X=2100,Ie=100,Se=500;function K(e,n=500){if(!Number.isInteger(n)||n<=0)throw new TypeError(`[@aiquants/auth-directory-drizzle] chunk size must be a positive integer, received ${String(n)}`);let y=[];for(let u=0;u<e.length;u+=n)y.push(e.slice(u,u+n));return y}function U(e,n,y=100){if(!Number.isInteger(n)||n<=0)throw new TypeError(`[@aiquants/auth-directory-drizzle] parametersPerItem must be a positive integer, received ${String(n)}`);if(!Number.isInteger(y)||y<0)throw new TypeError(`[@aiquants/auth-directory-drizzle] reservedParameters must be a non-negative integer, received ${String(y)}`);let u=2100-y,d=Math.floor(u/n);if(d<1)throw new TypeError(`[@aiquants/auth-directory-drizzle] a single item binds ${n} parameters, which exceeds the ${u} available in one statement`);return K(e,d)}var Ke=10,$={tenantId:64,provider:32,externalId:256,externalKey:320,name:256,description:1e3,actor:50},ve=2147483647;function Ne(e){if(e===void 0||!Number.isFinite(e))return null;let n=Math.trunc(e);return n<0?null:n>ve?ve:n}function W(e,n,y){let u=e.trim();if(u==="")throw new TypeError(`[@aiquants/auth-directory-drizzle] ${y} must not be blank`);if(u.length>n)throw new TypeError(`[@aiquants/auth-directory-drizzle] ${y} exceeds its column length (${n}); truncating it would change which rows it owns`);return u}function mr(e,n,y){let u=e,d=y.ensureConnection??(async()=>{}),s=n.TDDirectoryCatalog,g=n.TMDirectoryCatalogObservation,h=w=>{let a=new Map;for(let p of w)a.set(p.externalId,p);return[...a.values()]};return{async replace(w,a,p){await d();let r=W(Ae(w,"replace(tenantId)"),$.tenantId,"tenantId"),t=W(a,$.provider,"provider"),i=W(y.actor,$.actor,"actor"),l=y.now(),f=h(p.map(b=>({tenantId:r,provider:t,externalId:b.externalId.slice(0,$.externalId),externalKey:b.externalKey.slice(0,$.externalKey),name:b.name.slice(0,$.name),description:b.description===void 0?null:b.description.slice(0,$.description),memberCount:Ne(b.memberCount),observedAt:l,createdAt:l,createdBy:i})));return await u.transaction(async b=>{await b.delete(s).where(Q(N(s.tenantId,r),N(s.provider,t)));for(let k of U(f,Ke))await b.insert(s).values(k);await b.delete(g).where(Q(N(g.tenantId,r),N(g.provider,t))),await b.insert(g).values([{tenantId:r,provider:t,observedAt:l,entryCount:f.length,createdAt:l,createdBy:i,updatedAt:l,updatedBy:i}])}),f.length}}}function yr(e,n,y={}){let u=e,d=y.ensureConnection??(async()=>{}),s=n.TDDirectoryCatalog,g=n.TMDirectoryCatalogObservation;return{async read(h,w){await d();let a=W(Ae(h,"read(tenantId)"),$.tenantId,"tenantId"),p=W(w,$.provider,"provider"),r=await u.select({observedAt:g.observedAt,entryCount:g.entryCount,externalId:s.externalId,externalKey:s.externalKey,name:s.name,description:s.description,memberCount:s.memberCount}).from(g).leftJoin(s,Q(N(s.tenantId,g.tenantId),N(s.provider,g.provider))).where(Q(N(g.tenantId,a),N(g.provider,p))).orderBy($e(s.name)),t=r.filter(f=>f.externalId!==null).map(f=>({externalId:String(f.externalId),externalKey:String(f.externalKey),name:String(f.name),...f.description===null?{}:{description:f.description},...f.memberCount===null?{}:{memberCount:Number(f.memberCount)}})),i=r[0];if(i===void 0)return{groups:t,observedAt:null};if(Number(i.entryCount)!==t.length)throw new Error(`[@aiquants/auth-directory-drizzle] catalog is inconsistent for (${a}, ${p}): the observation records ${i.entryCount} entries but ${t.length} rows are present`);let l=O(i.observedAt);if(!Number.isFinite(l.getTime()))throw new Error(`[@aiquants/auth-directory-drizzle] catalog observation for (${a}, ${p}) has an unreadable observed_at`);return{groups:t,observedAt:l}}}}import{AUTHZ_ACTIONS as qe}from"@aiquants/authz-core";var br=(e,n)=>`\u5916\u90E8\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u9023\u643A\u30B0\u30EB\u30FC\u30D7 (${n}) \u306B\u306F\u7BA1\u7406\u30ED\u30FC\u30EB (${e}) \u3092\u6301\u305F\u305B\u3089\u308C\u307E\u305B\u3093\u3002\u4E0A\u6D41\u5074\u306E\u6240\u5C5E\u5909\u66F4\u304C\u305D\u306E\u307E\u307E\u7BA1\u7406\u8005\u306E\u5897\u6E1B\u306B\u306A\u308B\u305F\u3081\u3001\u7BA1\u7406\u8005\u7D4C\u8DEF\u306F\u30ED\u30FC\u30AB\u30EB\u7BA1\u7406\u306E\u30B0\u30EB\u30FC\u30D7\u306B\u9650\u5B9A\u3057\u3066\u3044\u307E\u3059\u3002`;function F(e,n,y,u){return new Set(e.filter(d=>n.has(d.roleId)&&d.appKey===y&&d.resourceKey===u).map(d=>d.action))}function Z(e,n){return new Set(e.filter(y=>y.groupId===n).map(y=>y.roleId))}var H=e=>qe.every(n=>e.has(n)),re=(e,n)=>e.find(y=>y.roleId===n)?.roleKey??`#${n}`;function ee(e,n,y,u){let d=[...n].find(g=>H(F(e,new Set([g]),y,u)));return d!==void 0?re(e,d):[...n].filter(g=>F(e,new Set([g]),y,u).size>0).map(g=>re(e,g)).join(" + ")}function fr(e,n){return Te(e,n)}function Te(e,n){let y=e;return{...e,withTransaction:(u,d)=>y.withTransaction((s,g)=>u(Te(s,n),g),d),async assignGroupRole(u,d,s,g){await y.withTransaction(async(h,w)=>{let a=await h.listGrants(u),p=Z(await h.listGroupRoles(u),d);if(p.add(s),H(F(a,p,n.adminAppKey,n.adminResourceKey))){let r=await n.linkLookup.externalGroupKey(u,d,w);if(r!==null)throw new Error(n.message(ee(a,p,n.adminAppKey,n.adminResourceKey),r))}await h.assignGroupRole(u,d,s,g)})},async updateGrant(u,d,s,g){let h=s.action;if(h===void 0)return y.updateGrant(u,d,s,g);await y.withTransaction(async(w,a)=>{let p=await w.listGrants(u),r=p.find(l=>l.id===d);if(r===void 0)return w.updateGrant(u,d,s,g);let i=(await w.listResources(u)).find(l=>l.id===r.resourceId);if(i?.appKey===n.adminAppKey&&i?.resourceKey===n.adminResourceKey){let l=await w.listGroupRoles(u);for(let f of new Set(l.filter(b=>b.roleId===r.roleId).map(b=>b.groupId))){let b=Z(l,f),k=F(p.filter(x=>x.id!==d),b,n.adminAppKey,n.adminResourceKey);if(b.has(r.roleId)&&k.add(h),!H(k))continue;let v=await n.linkLookup.externalGroupKey(u,f,a);if(v!==null)throw new Error(n.message(ee(p,b,n.adminAppKey,n.adminResourceKey)||re(p,r.roleId),v))}}await w.updateGrant(u,d,s,g)})},async createGrant(u,d,s){await y.withTransaction(async(g,h)=>{let a=(await g.listResources(u)).find(p=>p.id===d.resourceId);if(a?.appKey===n.adminAppKey&&a?.resourceKey===n.adminResourceKey){let p=await g.listGrants(u),r=await g.listGroupRoles(u);for(let t of new Set(r.filter(i=>i.roleId===d.roleId).map(i=>i.groupId))){let i=F(p,Z(r,t),n.adminAppKey,n.adminResourceKey);if(i.add(d.action),!H(i))continue;let l=await n.linkLookup.externalGroupKey(u,t,h);if(l!==null)throw new Error(n.message(ee(p,Z(r,t),n.adminAppKey,n.adminResourceKey)||re(p,d.roleId),l))}}await g.createGrant(u,d,s)})}}}async function wr(e,n,y,u){let d=(await e.listGroupRoles(n)).filter(w=>w.groupId===y);if(d.length===0)return;let s=await e.listGrants(n),g=new Set(d.map(w=>w.roleId));if(!H(F(s,g,u.adminAppKey,u.adminResourceKey)))return;let h=d[0];if(h)throw new Error(u.message(ee(s,g,u.adminAppKey,u.adminResourceKey),h.groupKey))}import{and as Oe,eq as J}from"drizzle-orm";async function te(e,n,y){let{ledger:u,group:d}=n,{tenantId:s,externalUserId:g,email:h}=y;if(g===null&&h==="")return[];let w={ledgerId:u.id,groupId:u.groupId,tenantId:d.tenantId,externalUserId:u.externalUserId},a=async l=>(await e.select(w).from(u).innerJoin(d,Oe(J(d.id,u.groupId),J(d.tenantId,s),J(d.isActive,!0))).where(l)).map(b=>({ledgerId:Number(b.ledgerId),groupId:Number(b.groupId),tenantId:String(b.tenantId),externalUserId:b.externalUserId===null?null:String(b.externalUserId)})),p=l=>{let f=new Map;for(let b of l)f.set(b.ledgerId,{ledgerId:b.ledgerId,groupId:b.groupId,tenantId:b.tenantId});return[...f.values()].sort((b,k)=>b.ledgerId-k.ledgerId)},r=g===null?[]:await a(J(u.externalUserId,g));if(h==="")return p(r);let t=await a(J(u.email,h)),i=l=>l.externalUserId!==null&&l.externalUserId!==g;return p([...r,...t.filter(l=>!i(l))])}import{normalizeAuthEmail as le}from"@aiquants/auth-core";import{assertTenantMembershipPolicy as Ue}from"@aiquants/auth-directory-core";import{assertTenantId as C,assertTenantMatch as ze}from"@aiquants/authz-core";import{and as E,asc as xe,count as ce,eq as S,isNull as ne}from"drizzle-orm";var De=["direct","transitive"];function Y(e){if(!De.includes(e))throw new TypeError(`[@aiquants/auth-directory-drizzle] membershipMode must be one of ${De.join(" | ")}, received ${JSON.stringify(e)}`);return e}function Be(e){let n=typeof e=="object"&&e!==null&&"number"in e?e.number:void 0;return n===2601||n===2627}function Gr(e,n,y,u){let d=e,s=u.ensureConnection??(async()=>{}),g=u.policyCacheTtlMs??0;if(!Number.isFinite(g)||g<0)throw new TypeError(`[@aiquants/auth-directory-drizzle] policyCacheTtlMs must be a non-negative number, received ${String(u.policyCacheTtlMs)}`);let h=new Map,w=o=>h.delete(o),{TDGroupExternalLink:a,TDGroupMemberEmail:p,TDTenantMembershipGroup:r,TDAllowlistGroup:t,TDDirectorySyncRequest:i}=n,{TMGroup:l,TDGroupMember:f}=y;async function b(o,c,m){if((await o.select({groupId:r.groupId}).from(r).where(E(S(r.tenantId,c),S(r.groupId,m),S(r.isBreakGlass,!0)))).length>0)throw new Error(`Group ${m} is a break-glass proof group; a break-glass proof path must be one the synchronization can never touch.`)}async function k(o,c,m){let[I]=await o.select({id:l.id}).from(l).where(E(S(l.id,m),S(l.tenantId,c)));if(!I)throw new Error(`Group not found in tenant: ${m}`)}function v(o,c){return{linkId:Number(o.linkId),groupId:Number(o.groupId),tenantId:String(o.tenantId),provider:String(o.provider),externalId:String(o.externalId),externalKey:String(o.externalKey),membershipMode:Y(String(o.membershipMode)),isSyncEnabled:!!o.isSyncEnabled,...o.syncedAt?{syncedAt:O(o.syncedAt).toISOString()}:{},...o.syncError?{syncError:String(o.syncError)}:{},unresolvedCount:c}}async function x(o,c){let m=await o.select({groupId:p.groupId,n:ce()}).from(p).innerJoin(l,E(S(l.id,p.groupId),S(l.tenantId,c))).where(ne(p.resolvedUserId)).groupBy(p.groupId);return new Map(m.map(I=>[Number(I.groupId),Number(I.n)]))}return{async listLinks(o){C(o,"listLinks(tenantId)"),await s();let c=await d.select({linkId:a.id,groupId:a.groupId,tenantId:a.tenantId,provider:a.provider,externalId:a.externalId,externalKey:a.externalKey,membershipMode:a.membershipMode,isSyncEnabled:a.isSyncEnabled,syncedAt:a.syncedAt,syncError:a.syncError}).from(a).where(S(a.tenantId,o)).orderBy(xe(a.groupId)),m=await x(d,o);return c.map(I=>(ze(o,String(I.tenantId),"listLinks(row.tenantId)"),v(I,m.get(Number(I.groupId))??0)))},async externalGroupKey(o,c,m){C(o,"externalGroupKey(tenantId)"),await s();let[I]=await(m??d).select({externalKey:a.externalKey}).from(a).where(E(S(a.groupId,c),S(a.tenantId,o)));return I?String(I.externalKey):null},async linkGroup(o,c,m,I){C(o,"linkGroup(tenantId)");let A=Y(m.membershipMode),D=m.externalId.trim(),G=le(m.externalKey);if(D===""||G==="")throw new TypeError("[@aiquants/auth-directory-drizzle] externalId and externalKey must be non-empty");await s(),await u.linkable.assertLinkableAndWrite(o,c,async V=>{let M=V;await k(M,o,c),await b(M,o,c),await M.insert(a).output().values({groupId:c,tenantId:o,provider:m.provider,externalId:D,externalKey:G,membershipMode:A,isSyncEnabled:!0,vanishedObservations:0,createdAt:new Date,createdBy:I})}),w(o)},async unlinkGroup(o,c){C(o,"unlinkGroup(tenantId)"),await s(),await d.transaction(async m=>{await k(m,o,c),await m.delete(p).where(S(p.groupId,c)),await m.delete(t).where(E(S(t.groupId,c),S(t.tenantId,o))),await m.delete(a).where(E(S(a.groupId,c),S(a.tenantId,o)))}),w(o)},async setSyncEnabled(o,c,m,I){C(o,"setSyncEnabled(tenantId)"),await s(),await d.update(a).set({isSyncEnabled:m,updatedAt:new Date,updatedBy:I}).output().where(E(S(a.groupId,c),S(a.tenantId,o)))},async requestSync(o,c,m){return C(o,"requestSync(tenantId)"),await s(),d.transaction(async I=>{if(c!==null&&await k(I,o,c),(await I.select({id:i.id}).from(i).where(E(S(i.tenantId,o),c===null?ne(i.groupId):S(i.groupId,c),ne(i.pickedAt)))).length>0)return"already-pending";try{await I.insert(i).output().values({tenantId:o,groupId:c,requestedBy:m,requestedAt:new Date,createdAt:new Date,createdBy:m})}catch(D){if(!Be(D))throw D;return"already-pending"}return"queued"})},async getStatus(o){C(o,"getStatus(tenantId)"),await s();let c=await d.select({groupId:a.groupId,isSyncEnabled:a.isSyncEnabled,syncedAt:a.syncedAt,syncError:a.syncError}).from(a).where(S(a.tenantId,o)),[m]=await d.select({n:ce()}).from(i).where(E(S(i.tenantId,o),ne(i.finishedAt))),I=c.filter(M=>!!M.isSyncEnabled),A=I.map(M=>M.syncedAt?O(M.syncedAt).getTime():null),D=A.length>0&&A.every(M=>M!==null)?Math.min(...A):null,V=c.length>0&&I.length===0||I.length>0&&(D===null||Date.now()-D>u.stalenessThresholdSec*1e3);return{isEnabled:u.isEnabled,provider:u.provider,linkedGroupCount:c.length,...D!==null?{oldestSyncedAt:new Date(D).toISOString()}:{},isStale:V,pausedGroupCount:c.length-I.length,stalenessThresholdSec:u.stalenessThresholdSec,erroredGroupIds:c.filter(M=>!!M.syncError).map(M=>Number(M.groupId)).sort((M,Le)=>M-Le),pendingRequestCount:Number(m?.n??0)}},async loadTenantMembershipPolicy(o){C(o,"loadTenantMembershipPolicy(tenantId)");let c=g>0?h.get(o):void 0;if(c&&Date.now()-c.loadedAt<g)return c.policy;await s();let m=await d.select({groupId:r.groupId,isBreakGlass:r.isBreakGlass,externalLinkId:a.id}).from(r).innerJoin(l,E(S(l.id,r.groupId),S(l.tenantId,o))).leftJoin(a,E(S(a.groupId,r.groupId),S(a.tenantId,o))).where(S(r.tenantId,o));if(m.length===0){let G={kind:"no-proof-required"};return g>0&&h.set(o,{policy:G,loadedAt:Date.now()}),G}let I=m.map(G=>Number(G.groupId)),A=m.filter(G=>!!G.isBreakGlass);for(let G of A)if(G.externalLinkId!==null)throw new Error(`Break-glass group ${Number(G.groupId)} is externally sourced; a break-glass proof path must be one the synchronization can never touch.`);let D={kind:"require-proof",proofGroupIds:I,breakGlassGroupIds:A.map(G=>Number(G.groupId))};return Ue(D,`tenant ${o}`),g>0&&h.set(o,{policy:D,loadedAt:Date.now()}),D},async setTenantMembershipGroup(o,c,m,I){C(o,"setTenantMembershipGroup(tenantId)"),await s(),await d.transaction(async A=>{if(await k(A,o,c),m){let[G]=await A.select({id:a.id}).from(a).where(E(S(a.tenantId,o),S(a.groupId,c)));if(G)throw new Error(`Group ${c} is externally sourced; a break-glass proof path must be one the synchronization can never touch.`)}let D=await A.select({groupId:r.groupId}).from(r).where(E(S(r.tenantId,o),S(r.groupId,c)));if(!m&&!(await A.select({groupId:r.groupId,isBreakGlass:r.isBreakGlass}).from(r).where(S(r.tenantId,o))).filter(M=>Number(M.groupId)!==c).some(M=>!!M.isBreakGlass))throw new Error(`Declaring group ${c} as ordinary proof would leave tenant ${o} with a membership proof but no break-glass path; declare a locally-managed break-glass group first.`);if(D.length>0){await A.update(r).set({isBreakGlass:m,updatedAt:new Date,updatedBy:I}).output().where(E(S(r.tenantId,o),S(r.groupId,c)));return}await A.insert(r).output().values({tenantId:o,groupId:c,isBreakGlass:m,createdAt:new Date,createdBy:I})}),w(o)},async removeTenantMembershipGroup(o,c){C(o,"removeTenantMembershipGroup(tenantId)"),await s(),await d.transaction(async m=>{let A=(await m.select({groupId:r.groupId,isBreakGlass:r.isBreakGlass}).from(r).where(S(r.tenantId,o))).filter(D=>Number(D.groupId)!==c);if(A.length>0&&!A.some(D=>!!D.isBreakGlass))throw new Error(`Removing group ${c} would leave tenant ${o} with a membership proof but no break-glass path.`);await m.delete(r).where(E(S(r.tenantId,o),S(r.groupId,c)))}),w(o)},async setGroupActive(o,c,m,I){C(o,"setGroupActive(tenantId)"),await s(),await d.update(l).set({isActive:m,updatedAt:new Date,updatedBy:I}).output().where(E(S(l.id,c),S(l.tenantId,o)))},async listLedgerGroupIds(o,c){if(C(o,"listLedgerGroupIds(tenantId)"),!u.isEnabled)return[];await s();let m=await te(d,{ledger:p,group:l},{tenantId:o,externalUserId:c.externalUserId?.trim()||null,email:le(c.email)});return[...new Set(m.map(I=>I.groupId))].sort((I,A)=>I-A)},async isEmailAllowedByGroup(o){if(!u.isEnabled)return!1;let c=le(o);if(c==="")return!1;await s();let[m]=await d.select({id:p.id}).from(p).innerJoin(t,S(t.groupId,p.groupId)).innerJoin(l,E(S(l.id,p.groupId),S(l.isActive,!0))).where(S(p.email,c));return!!m},async listAllowlistGroups(o){return C(o,"listAllowlistGroups(tenantId)"),await s(),(await d.select({id:t.id,groupId:t.groupId,groupKey:l.groupKey,groupName:l.name,description:t.description}).from(t).innerJoin(l,E(S(l.id,t.groupId),S(l.tenantId,o))).where(S(t.tenantId,o)).orderBy(xe(l.name))).map(m=>({id:Number(m.id),type:"group",groupId:Number(m.groupId),groupKey:String(m.groupKey),groupName:String(m.groupName),...m.description?{description:String(m.description)}:{},owner:{kind:"tenant",tenantId:o},readOnly:!1}))},async addAllowlistGroup(o,c,m,I){C(o,"addAllowlistGroup(tenantId)"),await s(),await d.transaction(async A=>{await k(A,o,c);let[D]=await A.select({id:a.id}).from(a).where(E(S(a.groupId,c),S(a.tenantId,o)));if(!D)throw new Error(`Group ${c} is locally managed; only externally-sourced groups can gate sign-in, because the decision reads the upstream member ledger.`);await A.insert(t).output().values({tenantId:o,groupId:c,description:m??null,createdAt:new Date,createdBy:I})})},async removeAllowlistGroup(o,c){C(o,"removeAllowlistGroup(tenantId)"),await s(),await d.delete(t).where(E(S(t.id,c),S(t.tenantId,o)))},async countProjectedMembers(o,c){C(o,"countProjectedMembers(tenantId)"),await s();let[m]=await d.select({n:ce()}).from(f).innerJoin(l,E(S(l.id,f.groupId),S(l.tenantId,o))).where(S(f.groupId,c));return Number(m?.n??0)}}}import{normalizeAuthEmail as Fe}from"@aiquants/auth-core";import{assertTenantId as je,assertTenantMatch as We}from"@aiquants/authz-core";async function Lr(e,n){let y=je(n.tenantId,"promoteLedgerForUser(tenantId)");if(!Number.isInteger(n.userId)||n.userId<=0)throw new TypeError(`[@aiquants/auth-directory-drizzle] userId must be a positive integer, received ${String(n.userId)}`);let u=Fe(n.email),d=n.externalUserId?.trim()||null;if(d===null&&u==="")return{addedGroupIds:[],matchedLedgerIds:[]};let s=await e.findLedgerMatches({tenantId:y,externalUserId:d,email:u});if(s.length===0)return{addedGroupIds:[],matchedLedgerIds:[]};for(let a of s)We(y,a.tenantId,"promoteLedgerForUser(findLedgerMatches row)");let g=[...new Set(s.map(a=>a.ledgerId))].sort((a,p)=>a-p),h=[...new Set(s.map(a=>a.groupId))].sort((a,p)=>a-p);return{addedGroupIds:[...await e.attachUserToGroups({tenantId:y,userId:n.userId,ledgerIds:g,groupIds:h})].sort((a,p)=>a-p),matchedLedgerIds:g}}import{assertTenantId as ke}from"@aiquants/authz-core";import{and as pe,eq as me,inArray as oe}from"drizzle-orm";var He=4,Je=100;function Ur(e,n,y,u){let d=e,s=u.ensureConnection??(async()=>{}),g=u.now??(()=>new Date),h=n.TDGroupMemberEmail,{TMGroup:w,TDGroupMember:a}=y;return{async findLedgerMatches(p){return ke(p.tenantId,"findLedgerMatches(tenantId)"),await s(),te(d,{ledger:h,group:w},p)},async attachUserToGroups({tenantId:p,userId:r,ledgerIds:t,groupIds:i}){return ke(p,"attachUserToGroups(tenantId)"),await s(),t.length===0?[]:d.transaction(async l=>{let f=new Set;for(let o of K(i)){let c=await l.select({id:w.id}).from(w).where(pe(oe(w.id,o),me(w.tenantId,p),me(w.isActive,!0)));for(let m of c)f.add(Number(m.id))}let b=i.filter(o=>f.has(o));if(b.length===0)return[];let k=new Set;for(let o of K(b)){let c=await l.select({groupId:a.groupId}).from(a).where(pe(me(a.userId,r),oe(a.groupId,o)));for(let m of c)k.add(Number(m.groupId))}let v=b.filter(o=>!k.has(o)),x=Math.max(1,2100-Je-b.length);for(let o of K(t,x))await l.update(h).set({resolvedUserId:r}).output().where(pe(oe(h.id,o),oe(h.groupId,b)));if(v.length>0){let o=g();for(let c of U(v,He))await l.insert(a).output().values(c.map(m=>({groupId:m,userId:r,createdAt:o,createdBy:u.actor})))}return v})}}}import{AUTHZ_TENANT_COLUMN as z}from"@aiquants/authz-drizzle";import{bigint as _,bit as Re,datetime2 as L,foreignKey as ie,int as ye,mssqlSchema as Ye,nvarchar as T,primaryKey as q,uniqueIndex as B}from"drizzle-orm/mssql-core";var ge="provider",jr=["TDGroupExternalLink","TDTenantMembershipGroup","TDAllowlistGroup","TDDirectorySyncRequest","TDDirectoryCatalog","TMDirectoryCatalogObservation","TMAllowlist"];function Wr(e,n){let y=Ye(e),u=()=>({createdAt:L("created_at"),createdBy:T("created_by",{length:50}),updatedAt:L("updated_at"),updatedBy:T("updated_by",{length:50})}),d=()=>({createdAt:L("created_at"),createdBy:T("created_by",{length:50})}),s=y.table("TDGroupExternalLink",{id:_("id",{mode:"number"}).identity().notNull(),groupId:_("group_id",{mode:"number"}).notNull(),tenantId:T(z,{length:64}).notNull(),provider:T(ge,{length:32}).notNull(),externalId:T("external_id",{length:256}).notNull(),externalKey:T("external_key",{length:320}).notNull(),membershipMode:T("membership_mode",{length:16}).notNull(),isSyncEnabled:Re("is_sync_enabled").notNull(),syncedAt:L("synced_at"),syncError:T("sync_error",{length:1e3}),vanishedObservations:ye("vanished_observations").notNull(),...u()},i=>[q({name:`${e}_TDGroupExternalLink_pk`,columns:[i.id]}),B(`${e}_TDGroupExternalLink_group_uq`).on(i.groupId),B(`${e}_TDGroupExternalLink_external_uq`).on(i.tenantId,i.provider,i.externalId),ie({name:`${e}_TDGroupExternalLink_group_id_fk`,columns:[i.groupId],foreignColumns:[n.groupTable.id]})]),g=y.table("TDGroupMemberEmail",{id:_("id",{mode:"number"}).identity().notNull(),groupId:_("group_id",{mode:"number"}).notNull(),email:T("email",{length:320}).notNull(),externalUserId:T("external_user_id",{length:128}),resolvedUserId:_("resolved_user_id",{mode:"number"}),observedAt:L("observed_at").notNull(),...u()},i=>[q({name:`${e}_TDGroupMemberEmail_pk`,columns:[i.id]}),B(`${e}_TDGroupMemberEmail_group_email_uq`).on(i.groupId,i.email),ie({name:`${e}_TDGroupMemberEmail_group_id_fk`,columns:[i.groupId],foreignColumns:[n.groupTable.id]})]),h=y.table("TDTenantMembershipGroup",{tenantId:T(z,{length:64}).notNull(),groupId:_("group_id",{mode:"number"}).notNull(),isBreakGlass:Re("is_break_glass").notNull(),...d()},i=>[q({name:`${e}_TDTenantMembershipGroup_pk`,columns:[i.tenantId,i.groupId]}),ie({name:`${e}_TDTenantMembershipGroup_group_id_fk`,columns:[i.groupId],foreignColumns:[n.groupTable.id]})]),w=y.table("TDAllowlistGroup",{id:_("id",{mode:"number"}).identity().notNull(),tenantId:T(z,{length:64}).notNull(),groupId:_("group_id",{mode:"number"}).notNull(),description:T("description",{length:512}),...d()},i=>[q({name:`${e}_TDAllowlistGroup_pk`,columns:[i.id]}),B(`${e}_TDAllowlistGroup_tenant_group_uq`).on(i.tenantId,i.groupId),ie({name:`${e}_TDAllowlistGroup_group_id_fk`,columns:[i.groupId],foreignColumns:[n.groupTable.id]})]),a=y.table("TDDirectorySyncRequest",{id:_("id",{mode:"number"}).identity().notNull(),tenantId:T(z,{length:64}).notNull(),groupId:_("group_id",{mode:"number"}),requestedBy:T("requested_by",{length:320}).notNull(),requestedAt:L("requested_at").notNull(),pickedAt:L("picked_at"),finishedAt:L("finished_at"),result:T("result",{length:32}),error:T("error",{length:2e3}),...d()},i=>[q({name:`${e}_TDDirectorySyncRequest_pk`,columns:[i.id]})]),p=y.table("TMAllowlist",{id:_("id",{mode:"number"}).identity().notNull(),tenantId:T(z,{length:64}).notNull(),pattern:T("pattern",{length:256}).notNull(),type:T("type",{length:32}).notNull(),description:T("description",{length:512}),...d()},i=>[q({name:`${e}_TMAllowlist_pk`,columns:[i.id]}),B(`${e}_TMAllowlist_pattern_uq`).on(i.tenantId,i.pattern)]),r=y.table("TDDirectoryCatalog",{id:_("id",{mode:"number"}).identity().notNull(),tenantId:T(z,{length:64}).notNull(),provider:T(ge,{length:32}).notNull(),externalId:T("external_id",{length:256}).notNull(),externalKey:T("external_key",{length:320}).notNull(),name:T("name",{length:256}).notNull(),description:T("description",{length:1e3}),memberCount:ye("member_count"),observedAt:L("observed_at").notNull(),...d()},i=>[q({name:`${e}_TDDirectoryCatalog_pk`,columns:[i.id]}),B(`${e}_TDDirectoryCatalog_external_uq`).on(i.tenantId,i.provider,i.externalId)]),t=y.table("TMDirectoryCatalogObservation",{id:_("id",{mode:"number"}).identity().notNull(),tenantId:T(z,{length:64}).notNull(),provider:T(ge,{length:32}).notNull(),observedAt:L("observed_at").notNull(),entryCount:ye("entry_count").notNull(),...u()},i=>[q({name:`${e}_TMDirectoryCatalogObservation_pk`,columns:[i.id]}),B(`${e}_TMDirectoryCatalogObservation_target_uq`).on(i.tenantId,i.provider)]);return{TDGroupExternalLink:s,TDGroupMemberEmail:g,TDTenantMembershipGroup:h,TDAllowlistGroup:w,TDDirectorySyncRequest:a,TDDirectoryCatalog:r,TMDirectoryCatalogObservation:t,TMAllowlist:p}}import{assertBlastRadiusPolicy as Ve,reconcile as Xe}from"@aiquants/auth-directory-core";function ae(e){if(e instanceof Error&&(e.name==="AbortError"||e.name==="TimeoutError"))return"timeout";let n=typeof e=="object"&&e!==null&&"status"in e?e.status:void 0;return typeof n!="number"?"unknown":n===401||n===403?"denied":n===429||n===408?"rateLimited":n>=500?"upstreamError":"unknown"}var Ee=e=>`${e.length} \u4EF6`,he={denied:"\u8CC7\u683C\u60C5\u5831\u304C\u62D2\u5426\u3055\u308C\u307E\u3057\u305F",rateLimited:"\u547C\u3073\u51FA\u3057\u304C\u5236\u9650\u3055\u308C\u3066\u3044\u307E\u3059",upstreamError:"\u76F8\u624B\u5074\u304C\u5185\u90E8\u30A8\u30E9\u30FC\u3092\u8FD4\u3057\u307E\u3057\u305F",timeout:"\u5FDC\u7B54\u304C\u3042\u308A\u307E\u305B\u3093\u3067\u3057\u305F",localWriteError:"\u66F8\u304D\u8FBC\u307F\u304C\u62D2\u5426\u3055\u308C\u307E\u3057\u305F",unknown:"\u8A73\u7D30\u306F\u30B5\u30FC\u30D0\u30FC\u306E\u30ED\u30B0\u306B\u51FA\u3066\u3044\u307E\u3059"},Me={upstreamUnreadable:e=>`\u4E0A\u6D41\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u306E\u8AAD\u307F\u53D6\u308A\u306B\u5931\u6557\u3057\u307E\u3057\u305F (${he[e]})\u3002`,localWriteFailed:e=>`\u30ED\u30FC\u30AB\u30EB\u3078\u306E\u66F8\u304D\u8FBC\u307F\u306B\u5931\u6557\u3057\u307E\u3057\u305F (${he[e]})\u3002`,resolverIncomplete:(e,n)=>`\u4E0A\u6D41\u304C ${e} \u4EF6\u306E\u30E1\u30F3\u30D0\u30FC\u3092\u8FD4\u3057\u307E\u3057\u305F\u304C\u3001\u7A81\u5408\u7D50\u679C\u306F ${n} \u4EF6\u3067\u3057\u305F\u3002\u4EF6\u6570\u304C\u6E1B\u308B\u7A81\u5408\u306F\u3001\u89E3\u6C7A\u3067\u304D\u306A\u304B\u3063\u305F\u4EBA\u7269\u3092\u300C\u4E0A\u6D41\u304B\u3089\u6D88\u3048\u305F\u300D\u3068\u3057\u3066\u524A\u9664\u3057\u3066\u3057\u307E\u3046\u305F\u3081\u4E2D\u65AD\u3057\u307E\u3057\u305F\u3002\u89E3\u6C7A\u3067\u304D\u306A\u3044\u30E1\u30F3\u30D0\u30FC\u306F\u7701\u7565\u305B\u305A resolvedUserId: null \u3067\u8FD4\u3059\u5FC5\u8981\u304C\u3042\u308A\u307E\u3059\u3002`,groupMissing:(e,n,y)=>`\u4E0A\u6D41\u3067\u30B0\u30EB\u30FC\u30D7\u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093 (${e})\u3002\u9023\u7D9A ${n} \u56DE\u76EE\u3067\u3059\u3002${y} \u56DE\u306B\u9054\u3057\u305F\u6642\u70B9\u3067\u30B0\u30EB\u30FC\u30D7\u3092\u7121\u52B9\u5316\u3057\u307E\u3059\u3002`,groupVanished:(e,n)=>`\u4E0A\u6D41\u3067\u30B0\u30EB\u30FC\u30D7\u304C ${n} \u56DE\u9023\u7D9A\u3067\u898B\u3064\u304B\u308A\u307E\u305B\u3093\u3067\u3057\u305F (${e})\u3002\u30B0\u30EB\u30FC\u30D7\u3092\u7121\u52B9\u5316\u3057\u307E\u3057\u305F\u3002\u4E0A\u6D41\u304C\u5FA9\u65E7\u3059\u308C\u3070\u6B21\u56DE\u306E\u540C\u671F\u3067\u81EA\u52D5\u7684\u306B\u518D\u6709\u52B9\u5316\u3055\u308C\u307E\u3059\u3002`,planRefused:e=>{if(e.reason==="invalid-upstream-data")return`\u540C\u671F\u3092\u4E2D\u65AD\u3057\u307E\u3057\u305F: \u4E0A\u6D41\u306E\u30E1\u30F3\u30D0\u30FC\u4E00\u89A7\u306B\u6271\u3048\u306A\u3044\u30A2\u30C9\u30EC\u30B9\u304C ${Ee(e.offendingEmails)} \u542B\u307E\u308C\u3066\u3044\u307E\u3059\u3002\u5BFE\u8C61\u306F\u30B5\u30FC\u30D0\u30FC\u306E\u30ED\u30B0\u306B\u51FA\u3066\u3044\u307E\u3059\u3002`;let n=e.axis==="membership"?"\u6A29\u9650\u3092\u5931\u3046\u4EBA\u6570":"\u30B5\u30A4\u30F3\u30A4\u30F3\u3067\u304D\u306A\u304F\u306A\u308B\u4EBA\u6570",y=e.axis==="membership"?e.withheldProjectionRemoves.map(String):e.withheldLedgerDeletes;return[`\u540C\u671F\u3092\u4E2D\u65AD\u3057\u307E\u3057\u305F: ${n}\u304C ${e.population} \u4EBA\u4E2D ${e.removalCount} \u4EBA\u306B\u306A\u308A\u307E\u3059`,`(\u4E0A\u9650: ${e.limits.maxRemovalCount} \u4EF6 / \u6BD4\u7387 ${e.limits.maxRemovalRatio})\u3002`,`\u5DEE\u3057\u6B62\u3081\u305F\u5BFE\u8C61: ${Ee(y)} (\u4E00\u89A7\u306F\u30B5\u30FC\u30D0\u30FC\u306E\u30ED\u30B0\u306B\u51FA\u3066\u3044\u307E\u3059)\u3002`,"\u4E0A\u6D41\u5074\u306E\u8A2D\u5B9A\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002\u610F\u56F3\u3057\u305F\u5909\u66F4\u3067\u3042\u308C\u3070\u3001\u3053\u306E\u8EF8\u306E\u4E0A\u9650\u3060\u3051\u3092\u4E00\u6642\u7684\u306B\u5F15\u304D\u4E0A\u3052\u3066\u518D\u5B9F\u884C\u3057\u307E\u3059\u3002"].join(" ")},removalWritesFailed:e=>`${e.length} \u4EF6\u306E\u6240\u5C5E\u89E3\u9664\u304C\u66F8\u304D\u8FBC\u3081\u307E\u305B\u3093\u3067\u3057\u305F (${[...new Set(e.map(n=>he[n.cause]))].join(" / ")})\u3002\u6B21\u56DE\u306E\u5B9F\u884C\u3067\u518D\u8A66\u884C\u3057\u307E\u3059\u3002`,removalsRefused:e=>`${e.length} \u4EF6\u306E\u6240\u5C5E\u89E3\u9664\u304C\u6700\u5F8C\u306E\u7BA1\u7406\u8005\u30AC\u30FC\u30C9\u306B\u3088\u308A\u62D2\u5426\u3055\u308C\u307E\u3057\u305F (\u30E6\u30FC\u30B6\u30FC ${e.map(n=>n.userId).join(", ")})\u3002\u6B8B\u308A\u306E\u5909\u66F4\u306F\u9069\u7528\u6E08\u307F\u3067\u3059\u3002`,foreignProvider:(e,n)=>`\u3053\u306E\u30EA\u30F3\u30AF\u306E\u4F9B\u7D66\u5143\u306F ${e} \u3067\u3059\u304C\u3001\u5B9F\u884C\u4E2D\u306E\u540C\u671F\u306F ${n} \u7528\u3067\u3059\u3002\u5BFE\u5FDC\u3059\u308B\u540C\u671F\u30B8\u30E7\u30D6\u304B\u3089\u5B9F\u884C\u3057\u3066\u304F\u3060\u3055\u3044\u3002`};var be=["aborted","missing","vanished","upstream-failed","local-failed","foreign-provider","not-converged"],Ge=[...be,"already-vanished"];function Zr(e){let{directory:n,repository:y,policy:u,now:d,logger:s}=e,g=e.messages??Me;if(Ve(u),!Number.isInteger(e.vanishedThreshold)||e.vanishedThreshold<1)throw new TypeError(`[@aiquants/auth-directory-drizzle] vanishedThreshold must be a positive integer, received ${String(e.vanishedThreshold)}`);if(typeof e.provider!="string"||e.provider.trim()==="")throw new TypeError("[@aiquants/auth-directory-drizzle] provider must be a non-empty string so links of other providers can be told apart");async function h(r,t){try{await y.recordFailure(r,t)}catch(i){s.error(`[auth-directory] could not record the failure for ${r.externalKey}:`,i)}}async function w(r){try{let t=await n.getGroup(r.externalId);return t===null?{kind:"missing"}:{kind:"ok",group:t,members:await n.listGroupMembers(t,r.membershipMode)}}catch(t){return{kind:"failed",error:t instanceof Error?t:new Error(String(t))}}}async function a(r){if(r.vanishedObservations>=e.vanishedThreshold&&!r.isGroupActive)return s.warn(`[auth-directory] ${r.externalKey} still missing upstream (already deactivated after ${r.vanishedObservations} absences)`),{kind:"already-vanished",link:r};let t=await y.recordVanishedObservation(r,g.groupMissing(r.externalKey,r.vanishedObservations+1,e.vanishedThreshold));return t<e.vanishedThreshold?(s.warn(`[auth-directory] ${r.externalKey} missing upstream (${t}/${e.vanishedThreshold})`),{kind:"missing",link:r,observations:t}):(await y.markGroupInactive(r),await h(r,g.groupVanished(r.externalKey,t)),s.warn(`[auth-directory] ${r.externalKey} deactivated after ${t} consecutive absences`),{kind:"vanished",link:r})}async function p(r){if(r.provider!==e.provider)return await h(r,g.foreignProvider(r.provider,e.provider)),s.warn(`[auth-directory] skipping ${r.externalKey}: belongs to provider ${r.provider}`),{kind:"foreign-provider",link:r};let t=await w(r);if(t.kind==="missing")return a(r);if(t.kind==="failed")return await h(r,g.upstreamUnreadable(ae(t.error))),s.error(`[auth-directory] upstream read failed for ${r.externalKey}:`,t.error),{kind:"upstream-failed",link:r,error:t.error};try{await y.resolveExternalIdentity(r,t.group);let[i,l]=await Promise.all([y.loadGroupSnapshot(r),y.resolveMembers(t.members)]);if(l.length!==t.members.length){let x=g.resolverIncomplete(t.members.length,l.length);return await h(r,x),s.error(`[auth-directory] ${x}`),{kind:"local-failed",link:r,error:new Error(x)}}let f=Xe(i,l,u);if(f.aborted){await h(r,g.planRefused(f.aborted));let x=f.aborted.reason==="invalid-upstream-data"?f.aborted.offendingEmails:f.aborted.axis==="membership"?f.aborted.withheldProjectionRemoves.map(String):f.aborted.withheldLedgerDeletes;return s.warn(`[auth-directory] plan refused for ${r.externalKey}: ${f.aborted.reason}; withheld: ${x.join(", ")}`),{kind:"aborted",link:r,plan:f}}let b=f.ledgerUpserts.length>0||f.ledgerDeletes.length>0||f.projectionAdds.length>0||f.projectionRemoves.length>0,k=d(),v={refusals:[],failures:[]};return b&&(v=await y.applyPlan(r,f,k)),await y.recordSuccess(r,t.group,k),v.refusals.length>0&&(await h(r,g.removalsRefused(v.refusals)),s.warn(`[auth-directory] ${v.refusals.length} removal(s) refused for ${r.externalKey}: users ${v.refusals.map(x=>x.userId).join(", ")}`)),v.failures.length>0&&(await h(r,g.removalWritesFailed(v.failures)),s.warn(`[auth-directory] ${v.failures.length} removal(s) could not be written for ${r.externalKey}: users ${v.failures.map(x=>x.userId).join(", ")}`)),f.unresolvedEmails.length>0&&s.info(`[auth-directory] ${r.externalKey}: ${f.unresolvedEmails.length} upstream member(s) have no local user yet`),v.refusals.length>0||v.failures.length>0?{kind:"not-converged",link:r,plan:f,refusals:v.refusals,failures:v.failures}:b?{kind:"applied",link:r,plan:f}:{kind:"unchanged",link:r}}catch(i){let l=i instanceof Error?i:new Error(String(i));return await h(r,g.localWriteFailed("localWriteError")),s.error(`[auth-directory] local write failed for ${r.externalKey}:`,l),{kind:"local-failed",link:r,error:l}}}return{syncOne:p,async run(r){let t=await y.listSyncableLinks(r),i=[];for(let b of t)try{i.push(await p(b))}catch(k){let v=k instanceof Error?k:new Error(String(k));s.error(`[auth-directory] ${b.externalKey} ended abnormally:`,v),i.push({kind:"local-failed",link:b,error:v})}let l=i.filter(b=>Ge.includes(b.kind)).length,f=i.filter(b=>be.includes(b.kind)).length;return s.info(`[auth-directory] run finished: ${i.length} link(s), ${l} unhealthy (${f} new)`),{outcomes:i,unhealthyCount:l,newlyUnhealthyCount:f}}}}import{assertTenantId as Qe}from"@aiquants/authz-core";import{and as se,asc as Ce,eq as j,isNull as ue}from"drizzle-orm";var Ze="The job that claimed this request ended without recording an outcome; whether the synchronization ran is unknown.",fe=2e3;function ot(e,n,y){let u=e,d=y.ensureConnection??(async()=>{}),s=n.TDDirectorySyncRequest,g=Qe(y.tenantId,"createSyncRequestQueue(tenantId)"),h=y.maxErrorLength??fe;if(!Number.isInteger(h)||h<1||h>fe)throw new TypeError(`[@aiquants/auth-directory-drizzle] maxErrorLength must be an integer within 1..${fe}, received ${String(y.maxErrorLength)}`);let w={async claim(){await d();let a=await u.select({id:s.id}).from(s).where(se(j(s.tenantId,g),ue(s.pickedAt))).orderBy(Ce(s.id));for(let p of a){let t=(await u.update(s).set({pickedAt:y.now()}).output().where(se(j(s.tenantId,g),j(s.id,Number(p.id)),ue(s.pickedAt))))?.[0];if(!t)continue;if(t.requestedBy===void 0||t.requestedBy===null)throw new TypeError(`[@aiquants/auth-directory-drizzle] the driver returned a row without requestedBy for request ${String(t.id)}`);let i=t.groupId??null;return{id:Number(t.id),tenantId:g,groupId:i===null?null:Number(i),requestedBy:String(t.requestedBy)}}return null},async finish(a,p){await d();let r=p.error?p.error.slice(0,h):null;return!!(await u.update(s).set({finishedAt:y.now(),result:p.result,error:r}).output().where(se(j(s.tenantId,g),j(s.id,a),ue(s.finishedAt))))?.length},async listStranded(a){await d();let p=await u.select({id:s.id,pickedAt:s.pickedAt,requestedAt:s.requestedAt}).from(s).where(se(j(s.tenantId,g),ue(s.finishedAt))).orderBy(Ce(s.id)),r=t=>{let i=O(t);return Number.isNaN(i.getTime())||i<a};return{stranded:p.filter(t=>t.pickedAt!==null&&r(t.pickedAt)).map(t=>Number(t.id)),unclaimed:p.filter(t=>t.pickedAt===null&&r(t.requestedAt)).map(t=>Number(t.id))}},async abandonStranded(a){let{stranded:p}=await w.listStranded(a),r=[];for(let t of p)try{await w.finish(t,{result:"failed",error:Ze})&&r.push(t)}catch(i){y.onCloseFailed?.(t,i)}return r}};return w}import{normalizeAuthEmail as de}from"@aiquants/auth-core";import{assertTenantId as _e,assertTenantMatch as er}from"@aiquants/authz-core";import{and as P,eq as R,inArray as we,isNull as rr,notInArray as tr,or as nr}from"drizzle-orm";var or=7,ir=4,Pe=1e3;function ar(e){if(!(e instanceof Error))return!1;let n=e;return n.number===void 0&&n.code===void 0&&e.name==="Error"}function pt(e,n,y,u){let d=e,s=u.ensureConnection??(async()=>{}),g=u.now??(()=>new Date),{TDGroupExternalLink:h,TDGroupMemberEmail:w}=n,{TMGroup:a,TDGroupMember:p}=y,r=u.actor;return{async listSyncableLinks(t){await s();let i=_e(t.tenantId,"listSyncableLinks(tenantId)"),l=[R(h.isSyncEnabled,!0),R(h.tenantId,i)];return t.groupId!==void 0&&l.push(R(h.groupId,t.groupId)),(await d.select({linkId:h.id,groupId:h.groupId,linkTenantId:h.tenantId,groupTenantId:a.tenantId,groupKey:a.groupKey,isGroupActive:a.isActive,provider:h.provider,externalId:h.externalId,externalKey:h.externalKey,membershipMode:h.membershipMode,vanishedObservations:h.vanishedObservations}).from(h).innerJoin(a,P(R(a.id,h.groupId),R(a.tenantId,i))).where(P(...l))).map(b=>(er(String(b.groupTenantId),String(b.linkTenantId),"listSyncableLinks(link.tenantId vs TMGroup.tenant_id)"),{linkId:Number(b.linkId),groupId:Number(b.groupId),groupKey:String(b.groupKey),tenantId:String(b.groupTenantId),provider:String(b.provider),externalId:String(b.externalId),externalKey:String(b.externalKey),membershipMode:Y(String(b.membershipMode)),isGroupActive:!!b.isGroupActive,vanishedObservations:Number(b.vanishedObservations??0)}))},async loadGroupSnapshot(t){await s();let[i,l]=await Promise.all([d.select({email:w.email,externalUserId:w.externalUserId,resolvedUserId:w.resolvedUserId}).from(w).where(R(w.groupId,t.groupId)),d.select({userId:p.userId}).from(p).where(R(p.groupId,t.groupId))]);return{ledger:i.map(f=>({email:String(f.email),...f.externalUserId?{externalUserId:String(f.externalUserId)}:{},resolvedUserId:f.resolvedUserId===null?null:Number(f.resolvedUserId)})),projectedUserIds:l.map(f=>Number(f.userId))}},resolveMembers(t){return u.memberResolver.resolve(t)},async applyPlan(t,i,l){_e(t.tenantId,"applyPlan(link.tenantId)"),await s(),(i.ledgerUpserts.length>0||i.projectionAdds.length>0)&&await d.transaction(async v=>{let x=i.ledgerUpserts.map(m=>({...m,email:de(m.email)})),o=new Map;for(let m of K(x.map(I=>I.email))){let I=await v.select({id:w.id,email:w.email}).from(w).where(P(R(w.groupId,t.groupId),we(w.email,m)));for(let A of I)o.set(String(A.email),Number(A.id))}let c=x.filter(m=>!o.has(m.email));for(let m of U(c,or))await v.insert(w).output().values(m.map(I=>({groupId:t.groupId,email:I.email,externalUserId:I.externalUserId??null,resolvedUserId:I.resolvedUserId,observedAt:l,createdAt:l,createdBy:r})));for(let m of x){let I=o.get(m.email);I!==void 0&&await v.update(w).set({externalUserId:m.externalUserId??null,resolvedUserId:m.resolvedUserId,observedAt:l,updatedAt:l,updatedBy:r}).output().where(R(w.id,I))}for(let m of U(i.projectionAdds,ir)){let I=new Set((await v.select({userId:p.userId}).from(p).where(P(R(p.groupId,t.groupId),we(p.userId,m)))).map(D=>Number(D.userId))),A=m.filter(D=>!I.has(D));A.length>0&&await v.insert(p).output().values(A.map(D=>({groupId:t.groupId,userId:D,createdAt:l,createdBy:r})))}});let f=[],b=[];for(let v of i.projectionRemoves)try{await u.lockoutGuard.guardedWrite(t.tenantId,{removeGroupMembership:{groupId:t.groupId,userId:v}},"remove-group-member",x=>x.delete(p).where(P(R(p.groupId,t.groupId),R(p.userId,v))))}catch(x){ar(x)?f.push({userId:v,applied:!1,refusal:x.message}):b.push({userId:v,cause:ae(x)})}let k=f.map(v=>v.userId);if(i.ledgerDeletes.length>0){let v=Math.max(1,1999-k.length);await d.transaction(async x=>{for(let o of K(i.ledgerDeletes,Math.min(500,v))){let c=k.length>0?nr(rr(w.resolvedUserId),tr(w.resolvedUserId,k)):void 0;await x.delete(w).where(P(R(w.groupId,t.groupId),we(w.email,o),...c?[c]:[]))}})}return{refusals:f,failures:b}},async resolveExternalIdentity(t,i){await s(),!(t.externalId===i.externalId&&t.externalKey===de(i.externalKey))&&await d.update(h).set({externalId:i.externalId,externalKey:de(i.externalKey)}).output().where(P(R(h.id,t.linkId),R(h.tenantId,t.tenantId)))},async recordSuccess(t,i,l){await s(),await d.transaction(async f=>{await f.update(h).set({syncedAt:l,syncError:null,vanishedObservations:0,externalId:i.externalId,externalKey:de(i.externalKey),updatedAt:l,updatedBy:r}).output().where(P(R(h.id,t.linkId),R(h.tenantId,t.tenantId))),t.isGroupActive||await f.update(a).set({isActive:!0,updatedAt:l,updatedBy:r}).output().where(P(R(a.id,t.groupId),R(a.tenantId,t.tenantId)))})},async recordFailure(t,i){await s(),await d.update(h).set({syncError:i.slice(0,Pe),updatedAt:g(),updatedBy:r}).output().where(P(R(h.id,t.linkId),R(h.tenantId,t.tenantId)))},async recordVanishedObservation(t,i){await s();let l=t.vanishedObservations+1;return await d.update(h).set({vanishedObservations:l,syncError:i.slice(0,Pe),updatedAt:g(),updatedBy:r}).output().where(P(R(h.id,t.linkId),R(h.tenantId,t.tenantId))),l},async markGroupInactive(t){await s(),await d.update(a).set({isActive:!1,updatedAt:g(),updatedBy:r}).output().where(P(R(a.id,t.groupId),R(a.tenantId,t.tenantId),R(a.isActive,!0)))}}}export{ge as AUTH_DIRECTORY_PROVIDER_COLUMN,jr as AUTH_DIRECTORY_TENANT_SCOPED_TABLES,Se as MAX_IN_LIST,X as MAX_PARAMETERS,De as MEMBERSHIP_MODES,be as NEWLY_UNHEALTHY_SYNC_OUTCOMES,Ie as RESERVED_PARAMETERS,Ze as STRANDED_REASON,Ge as UNHEALTHY_SYNC_OUTCOMES,wr as assertGroupMayBeLinked,Y as assertMembershipMode,K as chunk,U as chunkByParameters,ae as classifySyncFailure,yr as createDirectoryCatalogReader,mr as createDirectoryCatalogWriter,Gr as createDirectoryLinkStore,Zr as createDirectorySync,pt as createDirectorySyncRepository,Ur as createPromotionRepository,ot as createSyncRequestQueue,br as defaultExternalGroupGuardMessage,Me as defaultSyncMessages,Wr as defineAuthDirectorySchema,te as findLedgerRowsForIdentity,Lr as promoteLedgerForUser,O as toInstant,fr as withExternalGroupGuards};
+import{assertTenantId as Ie}from"@aiquants/authz-core";import{chunkByParameters as Oe,toInstant as Ne}from"@aiquants/mssql";import{and as V,asc as $e,eq as $}from"drizzle-orm";import{runWithTransactionRetry as Ke}from"@aiquants/mssql";function N(r,a){return y=>Ke(d=>r.transaction(l=>d(()=>y(l))),a.transactionRetry)}var qe=10,O={tenantId:64,provider:32,externalId:256,externalKey:320,name:256,description:1e3,actor:50},we=2147483647;function Ue(r){if(r===void 0||!Number.isFinite(r))return null;let a=Math.trunc(r);return a<0?null:a>we?we:a}function j(r,a,y){let d=r.trim();if(d==="")throw new TypeError(`[@aiquants/auth-directory-drizzle] ${y} must not be blank`);if(d.length>a)throw new TypeError(`[@aiquants/auth-directory-drizzle] ${y} exceeds its column length (${a}); truncating it would change which rows it owns`);return d}function Sr(r,a,y){let d=r,l=y.ensureConnection??(async()=>{}),s=N(d,y),h=a.TDDirectoryCatalog,w=a.TMDirectoryCatalogObservation,b=g=>{let i=new Map;for(let t of g)i.set(t.externalId,t);return[...i.values()]};return{async replace(g,i,t){await l();let o=j(Ie(g,"replace(tenantId)"),O.tenantId,"tenantId"),e=j(i,O.provider,"provider"),m=j(y.actor,O.actor,"actor"),u=y.now(),f=b(t.map(S=>({tenantId:o,provider:e,externalId:S.externalId.slice(0,O.externalId),externalKey:S.externalKey.slice(0,O.externalKey),name:S.name.slice(0,O.name),description:S.description===void 0?null:S.description.slice(0,O.description),memberCount:Ue(S.memberCount),observedAt:u,createdAt:u,createdBy:m})));return await s(async S=>{await S.delete(h).where(V($(h.tenantId,o),$(h.provider,e)));for(let T of Oe(f,qe))await S.insert(h).values(T);await S.delete(w).where(V($(w.tenantId,o),$(w.provider,e))),await S.insert(w).values([{tenantId:o,provider:e,observedAt:u,entryCount:f.length,createdAt:u,createdBy:m,updatedAt:u,updatedBy:m}])}),f.length}}}function Tr(r,a,y={}){let d=r,l=y.ensureConnection??(async()=>{}),s=a.TDDirectoryCatalog,h=a.TMDirectoryCatalogObservation;return{async read(w,b){await l();let g=j(Ie(w,"read(tenantId)"),O.tenantId,"tenantId"),i=j(b,O.provider,"provider"),t=await d.select({observedAt:h.observedAt,entryCount:h.entryCount,externalId:s.externalId,externalKey:s.externalKey,name:s.name,description:s.description,memberCount:s.memberCount}).from(h).leftJoin(s,V($(s.tenantId,h.tenantId),$(s.provider,h.provider))).where(V($(h.tenantId,g),$(h.provider,i))).orderBy($e(s.name)),o=t.filter(u=>u.externalId!==null).map(u=>({externalId:String(u.externalId),externalKey:String(u.externalKey),name:String(u.name),...u.description===null?{}:{description:u.description},...u.memberCount===null?{}:{memberCount:Number(u.memberCount)}})),e=t[0];if(e===void 0)return{groups:o,observedAt:null};if(Number(e.entryCount)!==o.length)throw new Error(`[@aiquants/auth-directory-drizzle] catalog is inconsistent for (${g}, ${i}): the observation records ${e.entryCount} entries but ${o.length} rows are present`);let m=Ne(e.observedAt);if(!Number.isFinite(m.getTime()))throw new Error(`[@aiquants/auth-directory-drizzle] catalog observation for (${g}, ${i}) has an unreadable observed_at`);return{groups:o,observedAt:m}}}}import{AUTHZ_ACTIONS as ze}from"@aiquants/authz-core";var xr=(r,a)=>`\u5916\u90E8\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u9023\u643A\u30B0\u30EB\u30FC\u30D7 (${a}) \u306B\u306F\u7BA1\u7406\u30ED\u30FC\u30EB (${r}) \u3092\u6301\u305F\u305B\u3089\u308C\u307E\u305B\u3093\u3002\u4E0A\u6D41\u5074\u306E\u6240\u5C5E\u5909\u66F4\u304C\u305D\u306E\u307E\u307E\u7BA1\u7406\u8005\u306E\u5897\u6E1B\u306B\u306A\u308B\u305F\u3081\u3001\u7BA1\u7406\u8005\u7D4C\u8DEF\u306F\u30ED\u30FC\u30AB\u30EB\u7BA1\u7406\u306E\u30B0\u30EB\u30FC\u30D7\u306B\u9650\u5B9A\u3057\u3066\u3044\u307E\u3059\u3002`;function B(r,a,y,d){return new Set(r.filter(l=>a.has(l.roleId)&&l.appKey===y&&l.resourceKey===d).map(l=>l.action))}function Q(r,a){return new Set(r.filter(y=>y.groupId===a).map(y=>y.roleId))}var W=r=>ze.every(a=>r.has(a)),Z=(r,a)=>r.find(y=>y.roleId===a)?.roleKey??`#${a}`;function X(r,a,y,d){let l=[...a].find(h=>W(B(r,new Set([h]),y,d)));return l!==void 0?Z(r,l):[...a].filter(h=>B(r,new Set([h]),y,d).size>0).map(h=>Z(r,h)).join(" + ")}function kr(r,a){return ve(r,a)}function ve(r,a){let y=r;return{...r,withTransaction:(d,l)=>y.withTransaction((s,h)=>d(ve(s,a),h),l),async assignGroupRole(d,l,s,h){await y.withTransaction(async(w,b)=>{let g=await w.listGrants(d),i=Q(await w.listGroupRoles(d),l);if(i.add(s),W(B(g,i,a.adminAppKey,a.adminResourceKey))){let t=await a.linkLookup.externalGroupKey(d,l,b);if(t!==null)throw new Error(a.message(X(g,i,a.adminAppKey,a.adminResourceKey),t))}await w.assignGroupRole(d,l,s,h)})},async updateGrant(d,l,s,h){let w=s.action;if(w===void 0)return y.updateGrant(d,l,s,h);await y.withTransaction(async(b,g)=>{let i=await b.listGrants(d),t=i.find(m=>m.id===l);if(t===void 0)return b.updateGrant(d,l,s,h);let e=(await b.listResources(d)).find(m=>m.id===t.resourceId);if(e?.appKey===a.adminAppKey&&e?.resourceKey===a.adminResourceKey){let m=await b.listGroupRoles(d);for(let u of new Set(m.filter(f=>f.roleId===t.roleId).map(f=>f.groupId))){let f=Q(m,u),S=B(i.filter(A=>A.id!==l),f,a.adminAppKey,a.adminResourceKey);if(f.has(t.roleId)&&S.add(w),!W(S))continue;let T=await a.linkLookup.externalGroupKey(d,u,g);if(T!==null)throw new Error(a.message(X(i,f,a.adminAppKey,a.adminResourceKey)||Z(i,t.roleId),T))}}await b.updateGrant(d,l,s,h)})},async createGrant(d,l,s){await y.withTransaction(async(h,w)=>{let g=(await h.listResources(d)).find(i=>i.id===l.resourceId);if(g?.appKey===a.adminAppKey&&g?.resourceKey===a.adminResourceKey){let i=await h.listGrants(d),t=await h.listGroupRoles(d);for(let o of new Set(t.filter(e=>e.roleId===l.roleId).map(e=>e.groupId))){let e=B(i,Q(t,o),a.adminAppKey,a.adminResourceKey);if(e.add(l.action),!W(e))continue;let m=await a.linkLookup.externalGroupKey(d,o,w);if(m!==null)throw new Error(a.message(X(i,Q(t,o),a.adminAppKey,a.adminResourceKey)||Z(i,l.roleId),m))}}await h.createGrant(d,l,s)})}}}async function Rr(r,a,y,d){let l=(await r.listGroupRoles(a)).filter(b=>b.groupId===y);if(l.length===0)return;let s=await r.listGrants(a),h=new Set(l.map(b=>b.roleId));if(!W(B(s,h,d.adminAppKey,d.adminResourceKey)))return;let w=l[0];if(w)throw new Error(d.message(X(s,h,d.adminAppKey,d.adminResourceKey),w.groupKey))}import{and as Be,eq as H}from"drizzle-orm";async function ee(r,a,y){let{ledger:d,group:l}=a,{tenantId:s,externalUserId:h,email:w}=y;if(h===null&&w==="")return[];let b={ledgerId:d.id,groupId:d.groupId,tenantId:l.tenantId,externalUserId:d.externalUserId},g=async m=>(await r.select(b).from(d).innerJoin(l,Be(H(l.id,d.groupId),H(l.tenantId,s),H(l.isActive,!0))).where(m)).map(f=>({ledgerId:Number(f.ledgerId),groupId:Number(f.groupId),tenantId:String(f.tenantId),externalUserId:f.externalUserId===null?null:String(f.externalUserId)})),i=m=>{let u=new Map;for(let f of m)u.set(f.ledgerId,{ledgerId:f.ledgerId,groupId:f.groupId,tenantId:f.tenantId});return[...u.values()].sort((f,S)=>f.ledgerId-S.ledgerId)},t=h===null?[]:await g(H(d.externalUserId,h));if(w==="")return i(t);let o=await g(H(d.email,w)),e=m=>m.externalUserId!==null&&m.externalUserId!==h;return i([...t,...o.filter(m=>!e(m))])}import{normalizeAuthEmail as ue}from"@aiquants/auth-core";import{assertTenantMembershipPolicy as Fe}from"@aiquants/auth-directory-core";import{assertTenantId as C,assertTenantMatch as je}from"@aiquants/authz-core";import{toInstant as Te}from"@aiquants/mssql";import{and as E,asc as Ae,count as de,eq as v,isNull as re}from"drizzle-orm";var Se=["direct","transitive"];function J(r){if(!Se.includes(r))throw new TypeError(`[@aiquants/auth-directory-drizzle] membershipMode must be one of ${Se.join(" | ")}, received ${JSON.stringify(r)}`);return r}function We(r){let a=typeof r=="object"&&r!==null&&"number"in r?r.number:void 0;return a===2601||a===2627}function Ur(r,a,y,d){let l=r,s=d.ensureConnection??(async()=>{}),h=N(l,d),w=d.policyCacheTtlMs??0;if(!Number.isFinite(w)||w<0)throw new TypeError(`[@aiquants/auth-directory-drizzle] policyCacheTtlMs must be a non-negative number, received ${String(d.policyCacheTtlMs)}`);let b=new Map,g=n=>b.delete(n),{TDGroupExternalLink:i,TDGroupMemberEmail:t,TDTenantMembershipGroup:o,TDAllowlistGroup:e,TDDirectorySyncRequest:m}=a,{TMGroup:u,TDGroupMember:f}=y;async function S(n,c,p){if((await n.select({groupId:o.groupId}).from(o).where(E(v(o.tenantId,c),v(o.groupId,p),v(o.isBreakGlass,!0)))).length>0)throw new Error(`Group ${p} is a break-glass proof group; a break-glass proof path must be one the synchronization can never touch.`)}async function T(n,c,p){let[I]=await n.select({id:u.id}).from(u).where(E(v(u.id,p),v(u.tenantId,c)));if(!I)throw new Error(`Group not found in tenant: ${p}`)}function A(n,c){return{linkId:Number(n.linkId),groupId:Number(n.groupId),tenantId:String(n.tenantId),provider:String(n.provider),externalId:String(n.externalId),externalKey:String(n.externalKey),membershipMode:J(String(n.membershipMode)),isSyncEnabled:!!n.isSyncEnabled,...n.syncedAt?{syncedAt:Te(n.syncedAt).toISOString()}:{},...n.syncError?{syncError:String(n.syncError)}:{},unresolvedCount:c}}async function _(n,c){let p=await n.select({groupId:t.groupId,n:de()}).from(t).innerJoin(u,E(v(u.id,t.groupId),v(u.tenantId,c))).where(re(t.resolvedUserId)).groupBy(t.groupId);return new Map(p.map(I=>[Number(I.groupId),Number(I.n)]))}return{async listLinks(n){C(n,"listLinks(tenantId)"),await s();let c=await l.select({linkId:i.id,groupId:i.groupId,tenantId:i.tenantId,provider:i.provider,externalId:i.externalId,externalKey:i.externalKey,membershipMode:i.membershipMode,isSyncEnabled:i.isSyncEnabled,syncedAt:i.syncedAt,syncError:i.syncError}).from(i).where(v(i.tenantId,n)).orderBy(Ae(i.groupId)),p=await _(l,n);return c.map(I=>(je(n,String(I.tenantId),"listLinks(row.tenantId)"),A(I,p.get(Number(I.groupId))??0)))},async externalGroupKey(n,c,p){C(n,"externalGroupKey(tenantId)"),await s();let[I]=await(p??l).select({externalKey:i.externalKey}).from(i).where(E(v(i.groupId,c),v(i.tenantId,n)));return I?String(I.externalKey):null},async linkGroup(n,c,p,I){C(n,"linkGroup(tenantId)");let D=J(p.membershipMode),k=p.externalId.trim(),M=ue(p.externalKey);if(k===""||M==="")throw new TypeError("[@aiquants/auth-directory-drizzle] externalId and externalKey must be non-empty");await s(),await d.linkable.assertLinkableAndWrite(n,c,async Y=>{let G=Y;await T(G,n,c),await S(G,n,c),await G.insert(i).output().values({groupId:c,tenantId:n,provider:p.provider,externalId:k,externalKey:M,membershipMode:D,isSyncEnabled:!0,vanishedObservations:0,createdAt:new Date,createdBy:I})}),g(n)},async unlinkGroup(n,c){C(n,"unlinkGroup(tenantId)"),await s(),await h(async p=>{await T(p,n,c),await p.delete(t).where(v(t.groupId,c)),await p.delete(e).where(E(v(e.groupId,c),v(e.tenantId,n))),await p.delete(i).where(E(v(i.groupId,c),v(i.tenantId,n)))}),g(n)},async setSyncEnabled(n,c,p,I){C(n,"setSyncEnabled(tenantId)"),await s(),await l.update(i).set({isSyncEnabled:p,updatedAt:new Date,updatedBy:I}).output().where(E(v(i.groupId,c),v(i.tenantId,n)))},async requestSync(n,c,p){return C(n,"requestSync(tenantId)"),await s(),l.transaction(async I=>{if(c!==null&&await T(I,n,c),(await I.select({id:m.id}).from(m).where(E(v(m.tenantId,n),c===null?re(m.groupId):v(m.groupId,c),re(m.pickedAt)))).length>0)return"already-pending";try{await I.insert(m).output().values({tenantId:n,groupId:c,requestedBy:p,requestedAt:new Date,createdAt:new Date,createdBy:p})}catch(k){if(!We(k))throw k;return"already-pending"}return"queued"})},async getStatus(n){C(n,"getStatus(tenantId)"),await s();let c=await l.select({groupId:i.groupId,isSyncEnabled:i.isSyncEnabled,syncedAt:i.syncedAt,syncError:i.syncError}).from(i).where(v(i.tenantId,n)),[p]=await l.select({n:de()}).from(m).where(E(v(m.tenantId,n),re(m.finishedAt))),I=c.filter(G=>!!G.isSyncEnabled),D=I.map(G=>G.syncedAt?Te(G.syncedAt).getTime():null),k=D.length>0&&D.every(G=>G!==null)?Math.min(...D):null,Y=c.length>0&&I.length===0||I.length>0&&(k===null||Date.now()-k>d.stalenessThresholdSec*1e3);return{isEnabled:d.isEnabled,provider:d.provider,linkedGroupCount:c.length,...k!==null?{oldestSyncedAt:new Date(k).toISOString()}:{},isStale:Y,pausedGroupCount:c.length-I.length,stalenessThresholdSec:d.stalenessThresholdSec,erroredGroupIds:c.filter(G=>!!G.syncError).map(G=>Number(G.groupId)).sort((G,Le)=>G-Le),pendingRequestCount:Number(p?.n??0)}},async loadTenantMembershipPolicy(n){C(n,"loadTenantMembershipPolicy(tenantId)");let c=w>0?b.get(n):void 0;if(c&&Date.now()-c.loadedAt<w)return c.policy;await s();let p=await l.select({groupId:o.groupId,isBreakGlass:o.isBreakGlass,externalLinkId:i.id}).from(o).innerJoin(u,E(v(u.id,o.groupId),v(u.tenantId,n))).leftJoin(i,E(v(i.groupId,o.groupId),v(i.tenantId,n))).where(v(o.tenantId,n));if(p.length===0){let M={kind:"no-proof-required"};return w>0&&b.set(n,{policy:M,loadedAt:Date.now()}),M}let I=p.map(M=>Number(M.groupId)),D=p.filter(M=>!!M.isBreakGlass);for(let M of D)if(M.externalLinkId!==null)throw new Error(`Break-glass group ${Number(M.groupId)} is externally sourced; a break-glass proof path must be one the synchronization can never touch.`);let k={kind:"require-proof",proofGroupIds:I,breakGlassGroupIds:D.map(M=>Number(M.groupId))};return Fe(k,`tenant ${n}`),w>0&&b.set(n,{policy:k,loadedAt:Date.now()}),k},async setTenantMembershipGroup(n,c,p,I){C(n,"setTenantMembershipGroup(tenantId)"),await s(),await h(async D=>{if(await T(D,n,c),p){let[M]=await D.select({id:i.id}).from(i).where(E(v(i.tenantId,n),v(i.groupId,c)));if(M)throw new Error(`Group ${c} is externally sourced; a break-glass proof path must be one the synchronization can never touch.`)}let k=await D.select({groupId:o.groupId}).from(o).where(E(v(o.tenantId,n),v(o.groupId,c)));if(!p&&!(await D.select({groupId:o.groupId,isBreakGlass:o.isBreakGlass}).from(o).where(v(o.tenantId,n))).filter(G=>Number(G.groupId)!==c).some(G=>!!G.isBreakGlass))throw new Error(`Declaring group ${c} as ordinary proof would leave tenant ${n} with a membership proof but no break-glass path; declare a locally-managed break-glass group first.`);if(k.length>0){await D.update(o).set({isBreakGlass:p,updatedAt:new Date,updatedBy:I}).output().where(E(v(o.tenantId,n),v(o.groupId,c)));return}await D.insert(o).output().values({tenantId:n,groupId:c,isBreakGlass:p,createdAt:new Date,createdBy:I})}),g(n)},async removeTenantMembershipGroup(n,c){C(n,"removeTenantMembershipGroup(tenantId)"),await s(),await h(async p=>{let D=(await p.select({groupId:o.groupId,isBreakGlass:o.isBreakGlass}).from(o).where(v(o.tenantId,n))).filter(k=>Number(k.groupId)!==c);if(D.length>0&&!D.some(k=>!!k.isBreakGlass))throw new Error(`Removing group ${c} would leave tenant ${n} with a membership proof but no break-glass path.`);await p.delete(o).where(E(v(o.tenantId,n),v(o.groupId,c)))}),g(n)},async setGroupActive(n,c,p,I){C(n,"setGroupActive(tenantId)"),await s(),await l.update(u).set({isActive:p,updatedAt:new Date,updatedBy:I}).output().where(E(v(u.id,c),v(u.tenantId,n)))},async listLedgerGroupIds(n,c){if(C(n,"listLedgerGroupIds(tenantId)"),!d.isEnabled)return[];await s();let p=await ee(l,{ledger:t,group:u},{tenantId:n,externalUserId:c.externalUserId?.trim()||null,email:ue(c.email)});return[...new Set(p.map(I=>I.groupId))].sort((I,D)=>I-D)},async isEmailAllowedByGroup(n){if(!d.isEnabled)return!1;let c=ue(n);if(c==="")return!1;await s();let[p]=await l.select({id:t.id}).from(t).innerJoin(e,v(e.groupId,t.groupId)).innerJoin(u,E(v(u.id,t.groupId),v(u.isActive,!0))).where(v(t.email,c));return!!p},async listAllowlistGroups(n){return C(n,"listAllowlistGroups(tenantId)"),await s(),(await l.select({id:e.id,groupId:e.groupId,groupKey:u.groupKey,groupName:u.name,description:e.description}).from(e).innerJoin(u,E(v(u.id,e.groupId),v(u.tenantId,n))).where(v(e.tenantId,n)).orderBy(Ae(u.name))).map(p=>({id:Number(p.id),type:"group",groupId:Number(p.groupId),groupKey:String(p.groupKey),groupName:String(p.groupName),...p.description?{description:String(p.description)}:{},owner:{kind:"tenant",tenantId:n},readOnly:!1}))},async addAllowlistGroup(n,c,p,I){C(n,"addAllowlistGroup(tenantId)"),await s(),await h(async D=>{await T(D,n,c);let[k]=await D.select({id:i.id}).from(i).where(E(v(i.groupId,c),v(i.tenantId,n)));if(!k)throw new Error(`Group ${c} is locally managed; only externally-sourced groups can gate sign-in, because the decision reads the upstream member ledger.`);await D.insert(e).output().values({tenantId:n,groupId:c,description:p??null,createdAt:new Date,createdBy:I})})},async removeAllowlistGroup(n,c){C(n,"removeAllowlistGroup(tenantId)"),await s(),await l.delete(e).where(E(v(e.id,c),v(e.tenantId,n)))},async countProjectedMembers(n,c){C(n,"countProjectedMembers(tenantId)"),await s();let[p]=await l.select({n:de()}).from(f).innerJoin(u,E(v(u.id,f.groupId),v(u.tenantId,n))).where(v(f.groupId,c));return Number(p?.n??0)}}}import{normalizeAuthEmail as He}from"@aiquants/auth-core";import{assertTenantId as Je,assertTenantMatch as Ye}from"@aiquants/authz-core";async function jr(r,a){let y=Je(a.tenantId,"promoteLedgerForUser(tenantId)");if(!Number.isInteger(a.userId)||a.userId<=0)throw new TypeError(`[@aiquants/auth-directory-drizzle] userId must be a positive integer, received ${String(a.userId)}`);let d=He(a.email),l=a.externalUserId?.trim()||null;if(l===null&&d==="")return{addedGroupIds:[],matchedLedgerIds:[]};let s=await r.findLedgerMatches({tenantId:y,externalUserId:l,email:d});if(s.length===0)return{addedGroupIds:[],matchedLedgerIds:[]};for(let g of s)Ye(y,g.tenantId,"promoteLedgerForUser(findLedgerMatches row)");let h=[...new Set(s.map(g=>g.ledgerId))].sort((g,i)=>g-i),w=[...new Set(s.map(g=>g.groupId))].sort((g,i)=>g-i);return{addedGroupIds:[...await r.attachUserToGroups({tenantId:y,userId:a.userId,ledgerIds:h,groupIds:w})].sort((g,i)=>g-i),matchedLedgerIds:h}}import{assertTenantId as De}from"@aiquants/authz-core";import{chunk as le,chunkByParameters as Ve,MAX_PARAMETERS as Qe}from"@aiquants/mssql";import{and as ce,eq as pe,inArray as te}from"drizzle-orm";var Xe=4,Ze=100;function Xr(r,a,y,d){let l=r,s=d.ensureConnection??(async()=>{}),h=N(l,d),w=d.now??(()=>new Date),b=a.TDGroupMemberEmail,{TMGroup:g,TDGroupMember:i}=y;return{async findLedgerMatches(t){return De(t.tenantId,"findLedgerMatches(tenantId)"),await s(),ee(l,{ledger:b,group:g},t)},async attachUserToGroups({tenantId:t,userId:o,ledgerIds:e,groupIds:m}){return De(t,"attachUserToGroups(tenantId)"),await s(),e.length===0?[]:h(async u=>{let f=new Set;for(let n of le(m)){let c=await u.select({id:g.id}).from(g).where(ce(te(g.id,n),pe(g.tenantId,t),pe(g.isActive,!0)));for(let p of c)f.add(Number(p.id))}let S=m.filter(n=>f.has(n));if(S.length===0)return[];let T=new Set;for(let n of le(S)){let c=await u.select({groupId:i.groupId}).from(i).where(ce(pe(i.userId,o),te(i.groupId,n)));for(let p of c)T.add(Number(p.groupId))}let A=S.filter(n=>!T.has(n)),_=Math.max(1,Qe-Ze-S.length);for(let n of le(e,_))await u.update(b).set({resolvedUserId:o}).output().where(ce(te(b.id,n),te(b.groupId,S)));if(A.length>0){let n=w();for(let c of Ve(A,Xe))await u.insert(i).output().values(c.map(p=>({groupId:p,userId:o,createdAt:n,createdBy:d.actor})))}return A})}}}import{AUTHZ_TENANT_COLUMN as U}from"@aiquants/authz-drizzle";import{bigint as P,bit as xe,datetime2 as K,foreignKey as ne,int as me,mssqlSchema as er,nvarchar as x,primaryKey as q,uniqueIndex as z}from"drizzle-orm/mssql-core";var ye="provider",tt=["TDGroupExternalLink","TDTenantMembershipGroup","TDAllowlistGroup","TDDirectorySyncRequest","TDDirectoryCatalog","TMDirectoryCatalogObservation","TMAllowlist"];function nt(r,a){let y=er(r),d=()=>({createdAt:K("created_at"),createdBy:x("created_by",{length:50}),updatedAt:K("updated_at"),updatedBy:x("updated_by",{length:50})}),l=()=>({createdAt:K("created_at"),createdBy:x("created_by",{length:50})}),s=y.table("TDGroupExternalLink",{id:P("id",{mode:"number"}).identity().notNull(),groupId:P("group_id",{mode:"number"}).notNull(),tenantId:x(U,{length:64}).notNull(),provider:x(ye,{length:32}).notNull(),externalId:x("external_id",{length:256}).notNull(),externalKey:x("external_key",{length:320}).notNull(),membershipMode:x("membership_mode",{length:16}).notNull(),isSyncEnabled:xe("is_sync_enabled").notNull(),syncedAt:K("synced_at"),syncError:x("sync_error",{length:1e3}),vanishedObservations:me("vanished_observations").notNull(),...d()},e=>[q({name:`${r}_TDGroupExternalLink_pk`,columns:[e.id]}),z(`${r}_TDGroupExternalLink_group_uq`).on(e.groupId),z(`${r}_TDGroupExternalLink_external_uq`).on(e.tenantId,e.provider,e.externalId),ne({name:`${r}_TDGroupExternalLink_group_id_fk`,columns:[e.groupId],foreignColumns:[a.groupTable.id]})]),h=y.table("TDGroupMemberEmail",{id:P("id",{mode:"number"}).identity().notNull(),groupId:P("group_id",{mode:"number"}).notNull(),email:x("email",{length:320}).notNull(),externalUserId:x("external_user_id",{length:128}),resolvedUserId:P("resolved_user_id",{mode:"number"}),observedAt:K("observed_at").notNull(),...d()},e=>[q({name:`${r}_TDGroupMemberEmail_pk`,columns:[e.id]}),z(`${r}_TDGroupMemberEmail_group_email_uq`).on(e.groupId,e.email),ne({name:`${r}_TDGroupMemberEmail_group_id_fk`,columns:[e.groupId],foreignColumns:[a.groupTable.id]})]),w=y.table("TDTenantMembershipGroup",{tenantId:x(U,{length:64}).notNull(),groupId:P("group_id",{mode:"number"}).notNull(),isBreakGlass:xe("is_break_glass").notNull(),...l()},e=>[q({name:`${r}_TDTenantMembershipGroup_pk`,columns:[e.tenantId,e.groupId]}),ne({name:`${r}_TDTenantMembershipGroup_group_id_fk`,columns:[e.groupId],foreignColumns:[a.groupTable.id]})]),b=y.table("TDAllowlistGroup",{id:P("id",{mode:"number"}).identity().notNull(),tenantId:x(U,{length:64}).notNull(),groupId:P("group_id",{mode:"number"}).notNull(),description:x("description",{length:512}),...l()},e=>[q({name:`${r}_TDAllowlistGroup_pk`,columns:[e.id]}),z(`${r}_TDAllowlistGroup_tenant_group_uq`).on(e.tenantId,e.groupId),ne({name:`${r}_TDAllowlistGroup_group_id_fk`,columns:[e.groupId],foreignColumns:[a.groupTable.id]})]),g=y.table("TDDirectorySyncRequest",{id:P("id",{mode:"number"}).identity().notNull(),tenantId:x(U,{length:64}).notNull(),groupId:P("group_id",{mode:"number"}),requestedBy:x("requested_by",{length:320}).notNull(),requestedAt:K("requested_at").notNull(),pickedAt:K("picked_at"),finishedAt:K("finished_at"),result:x("result",{length:32}),error:x("error",{length:2e3}),...l()},e=>[q({name:`${r}_TDDirectorySyncRequest_pk`,columns:[e.id]})]),i=y.table("TMAllowlist",{id:P("id",{mode:"number"}).identity().notNull(),tenantId:x(U,{length:64}).notNull(),pattern:x("pattern",{length:256}).notNull(),type:x("type",{length:32}).notNull(),description:x("description",{length:512}),...l()},e=>[q({name:`${r}_TMAllowlist_pk`,columns:[e.id]}),z(`${r}_TMAllowlist_pattern_uq`).on(e.tenantId,e.pattern)]),t=y.table("TDDirectoryCatalog",{id:P("id",{mode:"number"}).identity().notNull(),tenantId:x(U,{length:64}).notNull(),provider:x(ye,{length:32}).notNull(),externalId:x("external_id",{length:256}).notNull(),externalKey:x("external_key",{length:320}).notNull(),name:x("name",{length:256}).notNull(),description:x("description",{length:1e3}),memberCount:me("member_count"),observedAt:K("observed_at").notNull(),...l()},e=>[q({name:`${r}_TDDirectoryCatalog_pk`,columns:[e.id]}),z(`${r}_TDDirectoryCatalog_external_uq`).on(e.tenantId,e.provider,e.externalId)]),o=y.table("TMDirectoryCatalogObservation",{id:P("id",{mode:"number"}).identity().notNull(),tenantId:x(U,{length:64}).notNull(),provider:x(ye,{length:32}).notNull(),observedAt:K("observed_at").notNull(),entryCount:me("entry_count").notNull(),...d()},e=>[q({name:`${r}_TMDirectoryCatalogObservation_pk`,columns:[e.id]}),z(`${r}_TMDirectoryCatalogObservation_target_uq`).on(e.tenantId,e.provider)]);return{TDGroupExternalLink:s,TDGroupMemberEmail:h,TDTenantMembershipGroup:w,TDAllowlistGroup:b,TDDirectorySyncRequest:g,TDDirectoryCatalog:t,TMDirectoryCatalogObservation:o,TMAllowlist:i}}import{assertBlastRadiusPolicy as rr,reconcile as tr}from"@aiquants/auth-directory-core";function oe(r){if(r instanceof Error&&(r.name==="AbortError"||r.name==="TimeoutError"))return"timeout";let a=typeof r=="object"&&r!==null&&"status"in r?r.status:void 0;return typeof a!="number"?"unknown":a===401||a===403?"denied":a===429||a===408?"rateLimited":a>=500?"upstreamError":"unknown"}var ke=r=>`${r.length} \u4EF6`,ge={denied:"\u8CC7\u683C\u60C5\u5831\u304C\u62D2\u5426\u3055\u308C\u307E\u3057\u305F",rateLimited:"\u547C\u3073\u51FA\u3057\u304C\u5236\u9650\u3055\u308C\u3066\u3044\u307E\u3059",upstreamError:"\u76F8\u624B\u5074\u304C\u5185\u90E8\u30A8\u30E9\u30FC\u3092\u8FD4\u3057\u307E\u3057\u305F",timeout:"\u5FDC\u7B54\u304C\u3042\u308A\u307E\u305B\u3093\u3067\u3057\u305F",localWriteError:"\u66F8\u304D\u8FBC\u307F\u304C\u62D2\u5426\u3055\u308C\u307E\u3057\u305F",unknown:"\u8A73\u7D30\u306F\u30B5\u30FC\u30D0\u30FC\u306E\u30ED\u30B0\u306B\u51FA\u3066\u3044\u307E\u3059"},Re={upstreamUnreadable:r=>`\u4E0A\u6D41\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u306E\u8AAD\u307F\u53D6\u308A\u306B\u5931\u6557\u3057\u307E\u3057\u305F (${ge[r]})\u3002`,localWriteFailed:r=>`\u30ED\u30FC\u30AB\u30EB\u3078\u306E\u66F8\u304D\u8FBC\u307F\u306B\u5931\u6557\u3057\u307E\u3057\u305F (${ge[r]})\u3002`,resolverIncomplete:(r,a)=>`\u4E0A\u6D41\u304C ${r} \u4EF6\u306E\u30E1\u30F3\u30D0\u30FC\u3092\u8FD4\u3057\u307E\u3057\u305F\u304C\u3001\u7A81\u5408\u7D50\u679C\u306F ${a} \u4EF6\u3067\u3057\u305F\u3002\u4EF6\u6570\u304C\u6E1B\u308B\u7A81\u5408\u306F\u3001\u89E3\u6C7A\u3067\u304D\u306A\u304B\u3063\u305F\u4EBA\u7269\u3092\u300C\u4E0A\u6D41\u304B\u3089\u6D88\u3048\u305F\u300D\u3068\u3057\u3066\u524A\u9664\u3057\u3066\u3057\u307E\u3046\u305F\u3081\u4E2D\u65AD\u3057\u307E\u3057\u305F\u3002\u89E3\u6C7A\u3067\u304D\u306A\u3044\u30E1\u30F3\u30D0\u30FC\u306F\u7701\u7565\u305B\u305A resolvedUserId: null \u3067\u8FD4\u3059\u5FC5\u8981\u304C\u3042\u308A\u307E\u3059\u3002`,groupMissing:(r,a,y)=>`\u4E0A\u6D41\u3067\u30B0\u30EB\u30FC\u30D7\u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093 (${r})\u3002\u9023\u7D9A ${a} \u56DE\u76EE\u3067\u3059\u3002${y} \u56DE\u306B\u9054\u3057\u305F\u6642\u70B9\u3067\u30B0\u30EB\u30FC\u30D7\u3092\u7121\u52B9\u5316\u3057\u307E\u3059\u3002`,groupVanished:(r,a)=>`\u4E0A\u6D41\u3067\u30B0\u30EB\u30FC\u30D7\u304C ${a} \u56DE\u9023\u7D9A\u3067\u898B\u3064\u304B\u308A\u307E\u305B\u3093\u3067\u3057\u305F (${r})\u3002\u30B0\u30EB\u30FC\u30D7\u3092\u7121\u52B9\u5316\u3057\u307E\u3057\u305F\u3002\u4E0A\u6D41\u304C\u5FA9\u65E7\u3059\u308C\u3070\u6B21\u56DE\u306E\u540C\u671F\u3067\u81EA\u52D5\u7684\u306B\u518D\u6709\u52B9\u5316\u3055\u308C\u307E\u3059\u3002`,planRefused:r=>{if(r.reason==="invalid-upstream-data")return`\u540C\u671F\u3092\u4E2D\u65AD\u3057\u307E\u3057\u305F: \u4E0A\u6D41\u306E\u30E1\u30F3\u30D0\u30FC\u4E00\u89A7\u306B\u6271\u3048\u306A\u3044\u30A2\u30C9\u30EC\u30B9\u304C ${ke(r.offendingEmails)} \u542B\u307E\u308C\u3066\u3044\u307E\u3059\u3002\u5BFE\u8C61\u306F\u30B5\u30FC\u30D0\u30FC\u306E\u30ED\u30B0\u306B\u51FA\u3066\u3044\u307E\u3059\u3002`;let a=r.axis==="membership"?"\u6A29\u9650\u3092\u5931\u3046\u4EBA\u6570":"\u30B5\u30A4\u30F3\u30A4\u30F3\u3067\u304D\u306A\u304F\u306A\u308B\u4EBA\u6570",y=r.axis==="membership"?r.withheldProjectionRemoves.map(String):r.withheldLedgerDeletes;return[`\u540C\u671F\u3092\u4E2D\u65AD\u3057\u307E\u3057\u305F: ${a}\u304C ${r.population} \u4EBA\u4E2D ${r.removalCount} \u4EBA\u306B\u306A\u308A\u307E\u3059`,`(\u4E0A\u9650: ${r.limits.maxRemovalCount} \u4EF6 / \u6BD4\u7387 ${r.limits.maxRemovalRatio})\u3002`,`\u5DEE\u3057\u6B62\u3081\u305F\u5BFE\u8C61: ${ke(y)} (\u4E00\u89A7\u306F\u30B5\u30FC\u30D0\u30FC\u306E\u30ED\u30B0\u306B\u51FA\u3066\u3044\u307E\u3059)\u3002`,"\u4E0A\u6D41\u5074\u306E\u8A2D\u5B9A\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002\u610F\u56F3\u3057\u305F\u5909\u66F4\u3067\u3042\u308C\u3070\u3001\u3053\u306E\u8EF8\u306E\u4E0A\u9650\u3060\u3051\u3092\u4E00\u6642\u7684\u306B\u5F15\u304D\u4E0A\u3052\u3066\u518D\u5B9F\u884C\u3057\u307E\u3059\u3002"].join(" ")},removalWritesFailed:r=>`${r.length} \u4EF6\u306E\u6240\u5C5E\u89E3\u9664\u304C\u66F8\u304D\u8FBC\u3081\u307E\u305B\u3093\u3067\u3057\u305F (${[...new Set(r.map(a=>ge[a.cause]))].join(" / ")})\u3002\u6B21\u56DE\u306E\u5B9F\u884C\u3067\u518D\u8A66\u884C\u3057\u307E\u3059\u3002`,removalsRefused:r=>`${r.length} \u4EF6\u306E\u6240\u5C5E\u89E3\u9664\u304C\u6700\u5F8C\u306E\u7BA1\u7406\u8005\u30AC\u30FC\u30C9\u306B\u3088\u308A\u62D2\u5426\u3055\u308C\u307E\u3057\u305F (\u30E6\u30FC\u30B6\u30FC ${r.map(a=>a.userId).join(", ")})\u3002\u6B8B\u308A\u306E\u5909\u66F4\u306F\u9069\u7528\u6E08\u307F\u3067\u3059\u3002`,foreignProvider:(r,a)=>`\u3053\u306E\u30EA\u30F3\u30AF\u306E\u4F9B\u7D66\u5143\u306F ${r} \u3067\u3059\u304C\u3001\u5B9F\u884C\u4E2D\u306E\u540C\u671F\u306F ${a} \u7528\u3067\u3059\u3002\u5BFE\u5FDC\u3059\u308B\u540C\u671F\u30B8\u30E7\u30D6\u304B\u3089\u5B9F\u884C\u3057\u3066\u304F\u3060\u3055\u3044\u3002`};var he=["aborted","missing","vanished","upstream-failed","local-failed","foreign-provider","not-converged"],Ee=[...he,"already-vanished"];function lt(r){let{directory:a,repository:y,policy:d,now:l,logger:s}=r,h=r.messages??Re;if(rr(d),!Number.isInteger(r.vanishedThreshold)||r.vanishedThreshold<1)throw new TypeError(`[@aiquants/auth-directory-drizzle] vanishedThreshold must be a positive integer, received ${String(r.vanishedThreshold)}`);if(typeof r.provider!="string"||r.provider.trim()==="")throw new TypeError("[@aiquants/auth-directory-drizzle] provider must be a non-empty string so links of other providers can be told apart");async function w(t,o){try{await y.recordFailure(t,o)}catch(e){s.error(`[auth-directory] could not record the failure for ${t.externalKey}:`,e)}}async function b(t){try{let o=await a.getGroup(t.externalId);return o===null?{kind:"missing"}:{kind:"ok",group:o,members:await a.listGroupMembers(o,t.membershipMode)}}catch(o){return{kind:"failed",error:o instanceof Error?o:new Error(String(o))}}}async function g(t){if(t.vanishedObservations>=r.vanishedThreshold&&!t.isGroupActive)return s.warn(`[auth-directory] ${t.externalKey} still missing upstream (already deactivated after ${t.vanishedObservations} absences)`),{kind:"already-vanished",link:t};let o=await y.recordVanishedObservation(t,h.groupMissing(t.externalKey,t.vanishedObservations+1,r.vanishedThreshold));return o<r.vanishedThreshold?(s.warn(`[auth-directory] ${t.externalKey} missing upstream (${o}/${r.vanishedThreshold})`),{kind:"missing",link:t,observations:o}):(await y.markGroupInactive(t),await w(t,h.groupVanished(t.externalKey,o)),s.warn(`[auth-directory] ${t.externalKey} deactivated after ${o} consecutive absences`),{kind:"vanished",link:t})}async function i(t){if(t.provider!==r.provider)return await w(t,h.foreignProvider(t.provider,r.provider)),s.warn(`[auth-directory] skipping ${t.externalKey}: belongs to provider ${t.provider}`),{kind:"foreign-provider",link:t};let o=await b(t);if(o.kind==="missing")return g(t);if(o.kind==="failed")return await w(t,h.upstreamUnreadable(oe(o.error))),s.error(`[auth-directory] upstream read failed for ${t.externalKey}:`,o.error),{kind:"upstream-failed",link:t,error:o.error};try{await y.resolveExternalIdentity(t,o.group);let[e,m]=await Promise.all([y.loadGroupSnapshot(t),y.resolveMembers(o.members)]);if(m.length!==o.members.length){let A=h.resolverIncomplete(o.members.length,m.length);return await w(t,A),s.error(`[auth-directory] ${A}`),{kind:"local-failed",link:t,error:new Error(A)}}let u=tr(e,m,d);if(u.aborted){await w(t,h.planRefused(u.aborted));let A=u.aborted.reason==="invalid-upstream-data"?u.aborted.offendingEmails:u.aborted.axis==="membership"?u.aborted.withheldProjectionRemoves.map(String):u.aborted.withheldLedgerDeletes;return s.warn(`[auth-directory] plan refused for ${t.externalKey}: ${u.aborted.reason}; withheld: ${A.join(", ")}`),{kind:"aborted",link:t,plan:u}}let f=u.ledgerUpserts.length>0||u.ledgerDeletes.length>0||u.projectionAdds.length>0||u.projectionRemoves.length>0,S=l(),T={refusals:[],failures:[]};return f&&(T=await y.applyPlan(t,u,S)),await y.recordSuccess(t,o.group,S),T.refusals.length>0&&(await w(t,h.removalsRefused(T.refusals)),s.warn(`[auth-directory] ${T.refusals.length} removal(s) refused for ${t.externalKey}: users ${T.refusals.map(A=>A.userId).join(", ")}`)),T.failures.length>0&&(await w(t,h.removalWritesFailed(T.failures)),s.warn(`[auth-directory] ${T.failures.length} removal(s) could not be written for ${t.externalKey}: users ${T.failures.map(A=>A.userId).join(", ")}`)),u.unresolvedEmails.length>0&&s.info(`[auth-directory] ${t.externalKey}: ${u.unresolvedEmails.length} upstream member(s) have no local user yet`),T.refusals.length>0||T.failures.length>0?{kind:"not-converged",link:t,plan:u,refusals:T.refusals,failures:T.failures}:f?{kind:"applied",link:t,plan:u}:{kind:"unchanged",link:t}}catch(e){let m=e instanceof Error?e:new Error(String(e));return await w(t,h.localWriteFailed("localWriteError")),s.error(`[auth-directory] local write failed for ${t.externalKey}:`,m),{kind:"local-failed",link:t,error:m}}}return{syncOne:i,async run(t){let o=await y.listSyncableLinks(t),e=[];for(let f of o)try{e.push(await i(f))}catch(S){let T=S instanceof Error?S:new Error(String(S));s.error(`[auth-directory] ${f.externalKey} ended abnormally:`,T),e.push({kind:"local-failed",link:f,error:T})}let m=e.filter(f=>Ee.includes(f.kind)).length,u=e.filter(f=>he.includes(f.kind)).length;return s.info(`[auth-directory] run finished: ${e.length} link(s), ${m} unhealthy (${u} new)`),{outcomes:e,unhealthyCount:m,newlyUnhealthyCount:u}}}}import{assertTenantId as nr}from"@aiquants/authz-core";import{toInstant as or}from"@aiquants/mssql";import{and as ie,asc as Ge,eq as F,isNull as ae}from"drizzle-orm";var ir="The job that claimed this request ended without recording an outcome; whether the synchronization ran is unknown.",be=2e3;function gt(r,a,y){let d=r,l=y.ensureConnection??(async()=>{}),s=a.TDDirectorySyncRequest,h=nr(y.tenantId,"createSyncRequestQueue(tenantId)"),w=y.maxErrorLength??be;if(!Number.isInteger(w)||w<1||w>be)throw new TypeError(`[@aiquants/auth-directory-drizzle] maxErrorLength must be an integer within 1..${be}, received ${String(y.maxErrorLength)}`);let b={async claim(){await l();let g=await d.select({id:s.id}).from(s).where(ie(F(s.tenantId,h),ae(s.pickedAt))).orderBy(Ge(s.id));for(let i of g){let o=(await d.update(s).set({pickedAt:y.now()}).output().where(ie(F(s.tenantId,h),F(s.id,Number(i.id)),ae(s.pickedAt))))?.[0];if(!o)continue;if(o.requestedBy===void 0||o.requestedBy===null)throw new TypeError(`[@aiquants/auth-directory-drizzle] the driver returned a row without requestedBy for request ${String(o.id)}`);let e=o.groupId??null;return{id:Number(o.id),tenantId:h,groupId:e===null?null:Number(e),requestedBy:String(o.requestedBy)}}return null},async finish(g,i){await l();let t=i.error?i.error.slice(0,w):null;return!!(await d.update(s).set({finishedAt:y.now(),result:i.result,error:t}).output().where(ie(F(s.tenantId,h),F(s.id,g),ae(s.finishedAt))))?.length},async listStranded(g){await l();let i=await d.select({id:s.id,pickedAt:s.pickedAt,requestedAt:s.requestedAt}).from(s).where(ie(F(s.tenantId,h),ae(s.finishedAt))).orderBy(Ge(s.id)),t=o=>{let e=or(o);return Number.isNaN(e.getTime())||e<g};return{stranded:i.filter(o=>o.pickedAt!==null&&t(o.pickedAt)).map(o=>Number(o.id)),unclaimed:i.filter(o=>o.pickedAt===null&&t(o.requestedAt)).map(o=>Number(o.id))}},async abandonStranded(g){let{stranded:i}=await b.listStranded(g),t=[];for(let o of i)try{await b.finish(o,{result:"failed",error:ir})&&t.push(o)}catch(e){y.onCloseFailed?.(o,e)}return t}};return b}import{normalizeAuthEmail as se}from"@aiquants/auth-core";import{assertTenantId as Me,assertTenantMatch as ar}from"@aiquants/authz-core";import{chunk as Ce,chunkByParameters as _e,MAX_IN_LIST as sr,MAX_PARAMETERS as ur,RESERVED_PARAMETERS as dr}from"@aiquants/mssql";import{and as L,eq as R,inArray as fe,isNull as lr,notInArray as cr,or as pr}from"drizzle-orm";var mr=7,yr=4,Pe=1e3;function gr(r){if(!(r instanceof Error))return!1;let a=r;return a.number===void 0&&a.code===void 0&&r.name==="Error"}function At(r,a,y,d){let l=r,s=d.ensureConnection??(async()=>{}),h=N(l,d),w=d.now??(()=>new Date),{TDGroupExternalLink:b,TDGroupMemberEmail:g}=a,{TMGroup:i,TDGroupMember:t}=y,o=d.actor;return{async listSyncableLinks(e){await s();let m=Me(e.tenantId,"listSyncableLinks(tenantId)"),u=[R(b.isSyncEnabled,!0),R(b.tenantId,m)];return e.groupId!==void 0&&u.push(R(b.groupId,e.groupId)),(await l.select({linkId:b.id,groupId:b.groupId,linkTenantId:b.tenantId,groupTenantId:i.tenantId,groupKey:i.groupKey,isGroupActive:i.isActive,provider:b.provider,externalId:b.externalId,externalKey:b.externalKey,membershipMode:b.membershipMode,vanishedObservations:b.vanishedObservations}).from(b).innerJoin(i,L(R(i.id,b.groupId),R(i.tenantId,m))).where(L(...u))).map(S=>(ar(String(S.groupTenantId),String(S.linkTenantId),"listSyncableLinks(link.tenantId vs TMGroup.tenant_id)"),{linkId:Number(S.linkId),groupId:Number(S.groupId),groupKey:String(S.groupKey),tenantId:String(S.groupTenantId),provider:String(S.provider),externalId:String(S.externalId),externalKey:String(S.externalKey),membershipMode:J(String(S.membershipMode)),isGroupActive:!!S.isGroupActive,vanishedObservations:Number(S.vanishedObservations??0)}))},async loadGroupSnapshot(e){await s();let[m,u]=await Promise.all([l.select({email:g.email,externalUserId:g.externalUserId,resolvedUserId:g.resolvedUserId}).from(g).where(R(g.groupId,e.groupId)),l.select({userId:t.userId}).from(t).where(R(t.groupId,e.groupId))]);return{ledger:m.map(f=>({email:String(f.email),...f.externalUserId?{externalUserId:String(f.externalUserId)}:{},resolvedUserId:f.resolvedUserId===null?null:Number(f.resolvedUserId)})),projectedUserIds:u.map(f=>Number(f.userId))}},resolveMembers(e){return d.memberResolver.resolve(e)},async applyPlan(e,m,u){Me(e.tenantId,"applyPlan(link.tenantId)"),await s(),(m.ledgerUpserts.length>0||m.projectionAdds.length>0)&&await h(async A=>{let _=m.ledgerUpserts.map(p=>({...p,email:se(p.email)})),n=new Map;for(let p of Ce(_.map(I=>I.email))){let I=await A.select({id:g.id,email:g.email}).from(g).where(L(R(g.groupId,e.groupId),fe(g.email,p)));for(let D of I)n.set(String(D.email),Number(D.id))}let c=_.filter(p=>!n.has(p.email));for(let p of _e(c,mr))await A.insert(g).output().values(p.map(I=>({groupId:e.groupId,email:I.email,externalUserId:I.externalUserId??null,resolvedUserId:I.resolvedUserId,observedAt:u,createdAt:u,createdBy:o})));for(let p of _){let I=n.get(p.email);I!==void 0&&await A.update(g).set({externalUserId:p.externalUserId??null,resolvedUserId:p.resolvedUserId,observedAt:u,updatedAt:u,updatedBy:o}).output().where(R(g.id,I))}for(let p of _e(m.projectionAdds,yr)){let I=new Set((await A.select({userId:t.userId}).from(t).where(L(R(t.groupId,e.groupId),fe(t.userId,p)))).map(k=>Number(k.userId))),D=p.filter(k=>!I.has(k));D.length>0&&await A.insert(t).output().values(D.map(k=>({groupId:e.groupId,userId:k,createdAt:u,createdBy:o})))}});let f=[],S=[];for(let A of m.projectionRemoves)try{await d.lockoutGuard.guardedWrite(e.tenantId,{removeGroupMembership:{groupId:e.groupId,userId:A}},"remove-group-member",_=>_.delete(t).where(L(R(t.groupId,e.groupId),R(t.userId,A))))}catch(_){gr(_)?f.push({userId:A,applied:!1,refusal:_.message}):S.push({userId:A,cause:oe(_)})}let T=f.map(A=>A.userId);if(m.ledgerDeletes.length>0){let A=Math.max(1,ur-dr-1-T.length);await h(async _=>{for(let n of Ce(m.ledgerDeletes,Math.min(sr,A))){let c=T.length>0?pr(lr(g.resolvedUserId),cr(g.resolvedUserId,T)):void 0;await _.delete(g).where(L(R(g.groupId,e.groupId),fe(g.email,n),...c?[c]:[]))}})}return{refusals:f,failures:S}},async resolveExternalIdentity(e,m){await s(),!(e.externalId===m.externalId&&e.externalKey===se(m.externalKey))&&await l.update(b).set({externalId:m.externalId,externalKey:se(m.externalKey)}).output().where(L(R(b.id,e.linkId),R(b.tenantId,e.tenantId)))},async recordSuccess(e,m,u){await s(),await h(async f=>{await f.update(b).set({syncedAt:u,syncError:null,vanishedObservations:0,externalId:m.externalId,externalKey:se(m.externalKey),updatedAt:u,updatedBy:o}).output().where(L(R(b.id,e.linkId),R(b.tenantId,e.tenantId))),e.isGroupActive||await f.update(i).set({isActive:!0,updatedAt:u,updatedBy:o}).output().where(L(R(i.id,e.groupId),R(i.tenantId,e.tenantId)))})},async recordFailure(e,m){await s(),await l.update(b).set({syncError:m.slice(0,Pe),updatedAt:w(),updatedBy:o}).output().where(L(R(b.id,e.linkId),R(b.tenantId,e.tenantId)))},async recordVanishedObservation(e,m){await s();let u=e.vanishedObservations+1;return await l.update(b).set({vanishedObservations:u,syncError:m.slice(0,Pe),updatedAt:w(),updatedBy:o}).output().where(L(R(b.id,e.linkId),R(b.tenantId,e.tenantId))),u},async markGroupInactive(e){await s(),await l.update(i).set({isActive:!1,updatedAt:w(),updatedBy:o}).output().where(L(R(i.id,e.groupId),R(i.tenantId,e.tenantId),R(i.isActive,!0)))}}}export{ye as AUTH_DIRECTORY_PROVIDER_COLUMN,tt as AUTH_DIRECTORY_TENANT_SCOPED_TABLES,Se as MEMBERSHIP_MODES,he as NEWLY_UNHEALTHY_SYNC_OUTCOMES,ir as STRANDED_REASON,Ee as UNHEALTHY_SYNC_OUTCOMES,Rr as assertGroupMayBeLinked,J as assertMembershipMode,oe as classifySyncFailure,Tr as createDirectoryCatalogReader,Sr as createDirectoryCatalogWriter,Ur as createDirectoryLinkStore,lt as createDirectorySync,At as createDirectorySyncRepository,Xr as createPromotionRepository,gt as createSyncRequestQueue,xr as defaultExternalGroupGuardMessage,Re as defaultSyncMessages,nt as defineAuthDirectorySchema,ee as findLedgerRowsForIdentity,jr as promoteLedgerForUser,N as transactionRunner,kr as withExternalGroupGuards};
 //# sourceMappingURL=index.mjs.map