@astram/guard 0.7.0 → 0.8.0

package/dist/config/app-config.js

@@ -1,16 +1,25 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_REDIS_URL = exports.DEFAULT_DB_CONFIG = exports.SCHEMA_SVC_POOL_HARD_CAP = exports.DEFAULT_POOL_BUDGET = void 0;
+exports.DEFAULT_REDIS_URL = exports.DEFAULT_DB_CONFIG = exports.SCHEMA_SVC_POOL_HARD_CAP = exports.DEFAULT_POOL_BUDGET = exports.DEFAULT_REDIS_COMMAND_TIMEOUT_MS = exports.DEFAULT_LOGIN_IP_LIMIT = void 0;
+exports.isDevOrTestNodeEnv = isDevOrTestNodeEnv;
 exports.loadPoolBudget = loadPoolBudget;
 exports.loadDbConfig = loadDbConfig;
 exports.loadRedisConfig = loadRedisConfig;
 exports.loadSessionLifetimes = loadSessionLifetimes;
+exports.loadLoginIpLimit = loadLoginIpLimit;
 exports.loadRefreshHmacKey = loadRefreshHmacKey;
 exports.assertRefreshHmacKey = assertRefreshHmacKey;
 exports.loadAppConfig = loadAppConfig;
 exports.loadAppConfigAsync = loadAppConfigAsync;
 exports.evaluatePoolBudget = evaluatePoolBudget;
 const core_1 = require("@astram/core");
+/** Plan D3 default: 50 failed logins per client IP per 15 minutes. */
+exports.DEFAULT_LOGIN_IP_LIMIT = {
+    maxAttempts: 50,
+    windowMs: 15 * 60 * 1000,
+};
+/** Default Redis per-command timeout (GAPS #7): the request path fails closed within ~2 s. */
+exports.DEFAULT_REDIS_COMMAND_TIMEOUT_MS = 2000;
 /** Documented MVP single-node defaults (see the class doc + my.cnf). */
 exports.DEFAULT_POOL_BUDGET = {
     workers: 8,
@@ -30,11 +39,27 @@ function parsePort(raw, fallback) {
     const n = Number.parseInt(raw, 10);
     return Number.isInteger(n) && n > 0 && n < 65_536 ? n : fallback;
 }
+/**
+ * The `environment` LABEL (logging / display). NOTE: it maps an UNSET `NODE_ENV` to
+ * `'development'`, so it must NEVER drive a security default — an unset env is not
+ * proof of a dev box. Security-relevant choices (e.g. the dev `LogEmailSender`, which
+ * prints live reset links) read the RAW `NODE_ENV` instead: see
+ * {@link isDevOrTestNodeEnv}.
+ */
 function parseEnvironment(raw) {
     if (raw === 'production' || raw === 'test')
         return raw;
     return 'development';
 }
+/**
+ * `true` ONLY when the RAW `NODE_ENV` is explicitly `'development'` or `'test'`.
+ * Unset, blank, `'production'`, `'staging'` or anything else ⇒ `false`. Used to gate
+ * dev-only defaults that would leak secrets in a real deployment (fail closed: an
+ * unset NODE_ENV is treated as "not dev").
+ */
+function isDevOrTestNodeEnv(raw) {
+    return raw === 'development' || raw === 'test';
+}
 /**
  * Parse a positive integer from env with a fallback. Returns the fallback for
  * missing/blank/non-integer/≤0 values — the boot assertion is the authority on
@@ -126,18 +151,19 @@ function loadDbConfig(env = process.env) {
  * documented default.
  */
 function loadRedisConfig(env = process.env) {
+    const commandTimeoutMs = parsePositiveInt(env.REDIS_COMMAND_TIMEOUT_MS, exports.DEFAULT_REDIS_COMMAND_TIMEOUT_MS);
     const explicit = env.REDIS_URL;
     if (explicit !== undefined && explicit.trim() !== '') {
-        return { url: explicit.trim() };
+        return { url: explicit.trim(), commandTimeoutMs };
     }
     const host = env.REDIS_HOST;
     const port = env.REDIS_PORT;
     if ((host !== undefined && host.trim() !== '') || (port !== undefined && port.trim() !== '')) {
         const h = parseString(host, 'localhost');
         const p = parsePort(port, 6379);
-        return { url: `redis://${h}:${p}` };
+        return { url: `redis://${h}:${p}`, commandTimeoutMs };
     }
-    return { url: exports.DEFAULT_REDIS_URL };
+    return { url: exports.DEFAULT_REDIS_URL, commandTimeoutMs };
 }
 /**
  * Build the optional {@link SessionLifetimeOverrides} from env. Every field is
@@ -162,6 +188,19 @@ function loadSessionLifetimes(env = process.env) {
         overrides.refreshAbsoluteCapMs = cap;
     return overrides;
 }
+/**
+ * Build the per-client-IP login failure limit from env (plan D3). Each field falls back
+ * to {@link DEFAULT_LOGIN_IP_LIMIT} when absent/blank/invalid.
+ * Field ↔ env name:
+ *   maxAttempts ← LOGIN_IP_MAX_FAILURES   (default 50)
+ *   windowMs    ← LOGIN_IP_WINDOW_MS      (default 900000 = 15 min)
+ */
+function loadLoginIpLimit(env = process.env) {
+    return {
+        maxAttempts: parsePositiveInt(env.LOGIN_IP_MAX_FAILURES, exports.DEFAULT_LOGIN_IP_LIMIT.maxAttempts),
+        windowMs: parsePositiveInt(env.LOGIN_IP_WINDOW_MS, exports.DEFAULT_LOGIN_IP_LIMIT.windowMs),
+    };
+}
 /**
  * Read the refresh-token HMAC key from env (raw; `''` when absent/blank). Total —
  * does NOT throw, so {@link loadAppConfig} stays boot-safe for a non-auth scaffold.
@@ -214,6 +253,7 @@ function loadAppConfig(env = process.env) {
         redis: loadRedisConfig(env),
         refreshHmacKey: loadRefreshHmacKey(env),
         lifetimes: loadSessionLifetimes(env),
+        loginIpLimit: loadLoginIpLimit(env),
     };
 }
 /**

package/dist/encryption/local-kek-crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local-kek-crypto.d.ts","sourceRoot":"","sources":["../../src/encryption/local-kek-crypto.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAO5E,qBAAa,cAAe,YAAW,UAAU;;IAG/C;;;OAGG;gBACS,GAAG,EAAE,UAAU;IAOrB,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC;IAI3B,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAIxD,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAI9D,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAI/E,OAAO,CAAC,UAAU,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;CA0BvF"}
+{"version":3,"file":"local-kek-crypto.d.ts","sourceRoot":"","sources":["../../src/encryption/local-kek-crypto.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAO5E,qBAAa,cAAe,YAAW,UAAU;;IAG/C;;;OAGG;gBACS,GAAG,EAAE,UAAU;IAOrB,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC;IAI3B,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAIxD,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAI9D,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAI/E,OAAO,CAAC,UAAU,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;CA2BvF"}

package/dist/enforcement/enforcement.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"enforcement.module.d.ts","sourceRoot":"","sources":["../../src/enforcement/enforcement.module.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;GAcG;AACH,qBAQa,iBAAiB;CAAG"}
+{"version":3,"file":"enforcement.module.d.ts","sourceRoot":"","sources":["../../src/enforcement/enforcement.module.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;GAcG;AACH,qBAgBa,iBAAiB;CAAG"}

package/dist/enforcement/enforcement.module.js

@@ -10,6 +10,7 @@ exports.EnforcementModule = void 0;
 const common_1 = require("@nestjs/common");
 const core_1 = require("@nestjs/core");
 const global_enforcement_guard_js_1 = require("./global-enforcement.guard.js");
+const engine_error_filter_js_1 = require("./engine-error.filter.js");
 /**
  * The SOLE definition of the global `APP_GUARD` binding (ADR-0002).
  *
@@ -35,6 +36,14 @@ exports.EnforcementModule = EnforcementModule = __decorate([
                 provide: core_1.APP_GUARD,
                 useClass: global_enforcement_guard_js_1.GlobalEnforcementGuard,
             },
+            // The framework-wide engine error → HTTP mapping (security hardening Phase 1C): an engine
+            // deny / validation / unavailable error from any consumer controller answers 403 / 400 /
+            // 503 instead of 500. Bound here, beside the one APP_GUARD, so forRoot and forRootAsync
+            // (which both compose this module) register it exactly once.
+            {
+                provide: core_1.APP_FILTER,
+                useClass: engine_error_filter_js_1.EngineErrorFilter,
+            },
         ],
     })
 ], EnforcementModule);

package/dist/enforcement/engine-error.filter.d.ts

@@ -0,0 +1,57 @@
+/**
+ * EngineErrorFilter — the framework-wide mapping of `@astram/engine` errors to HTTP
+ * (security hardening Phase 1C). Registered ONCE as a global `APP_FILTER` by
+ * `ShieldModule.forRoot` / `forRootAsync`.
+ *
+ * A consumer feature controller that writes through `RecordsService` sees the engine's typed,
+ * fail-closed errors. Unmapped, Nest answered every one of them with a 500. This filter answers:
+ *
+ *   AuthorizationDeniedError (incl. ADR-0034 `create_outside_write_scope`) → 403
+ *   ValidationError                                                       → 400
+ *   EngineUnavailableError                                                → 503
+ *
+ * with FIXED, id-free messages (ADR-0012): the engine's own message carries reason codes, record
+ * ids and detail meant for logs, never for clients. There is deliberately no 404 mapping: the
+ * engine has no not-found error, because a missing or other-tenant row is folded into a deny so
+ * that it cannot be probed (`fetch-record.ts`).
+ *
+ * ── WHAT IT LEAVES ALONE ───────────────────────────────────────────────────────────────────
+ * `@Catch` lists only {@link EngineHttpMappableError}, so Nest hands this filter nothing else:
+ * `HttpException`s, `CapabilityNotSupportedError` / `RegistrationError` (framework gaps and
+ * misconfiguration — a 500 is right), and every non-engine error keep Nest's default handling and
+ * any consumer filter. Controller/method filters and interceptors run first, so identity's
+ * `IdentityErrorInterceptor` maps its routes before this filter is consulted.
+ *
+ * ── WHY STRUCTURAL MATCHING (not `instanceof` the engine classes) ──────────────────────────────
+ * Guard depends on `@astram/engine`, but this file is statically imported by `shield.module.ts`,
+ * whose own compiled output is kept free of runtime engine/core requires (see its header). A
+ * structural match also keeps working when a consumer's tree holds two copies of
+ * `@astram/engine` (version skew), where `instanceof` silently fails and the 500 returns. An
+ * error matches only when ALL hold: it is an `Error`, its prototype chain contains a class named
+ * `EngineError` (the engine's base), its `name` is one of the three classes above (the engine
+ * sets `name = new.target.name`), and it carries that class's field (`reason` / `field`). A
+ * third-party error that merely shares a name is not mapped.
+ */
+import { type ArgumentsHost } from '@nestjs/common';
+import { BaseExceptionFilter } from '@nestjs/core';
+type EngineErrorKind = 'denied' | 'invalid' | 'unavailable';
+/** Classify an engine error this filter maps, or `null` for anything else. */
+export declare function classifyEngineError(err: unknown): EngineErrorKind | null;
+/**
+ * The `@Catch` target: Nest selects a filter with `exception instanceof <target>`, and
+ * `Symbol.hasInstance` makes that the structural {@link classifyEngineError} test.
+ */
+export declare class EngineHttpMappableError {
+    static [Symbol.hasInstance](value: unknown): boolean;
+}
+/**
+ * Map an engine error to the HTTP exception the framework answers with, or return it unchanged
+ * when it is not a mapped engine error. Exported for unit tests and for callers mapping by hand.
+ */
+export declare function toEngineHttpError(err: unknown): unknown;
+/** The global filter: answers a mapped engine error through Nest's own HttpException reply. */
+export declare class EngineErrorFilter extends BaseExceptionFilter {
+    catch(exception: unknown, host: ArgumentsHost): void;
+}
+export {};
+//# sourceMappingURL=engine-error.filter.d.ts.map

package/dist/enforcement/engine-error.filter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine-error.filter.d.ts","sourceRoot":"","sources":["../../src/enforcement/engine-error.filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EAML,KAAK,aAAa,EACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEnD,KAAK,eAAe,GAAG,QAAQ,GAAG,SAAS,GAAG,aAAa,CAAC;AAa5D,8EAA8E;AAC9E,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,eAAe,GAAG,IAAI,CAaxE;AAED;;;GAGG;AACH,qBAAa,uBAAuB;IAClC,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;CAGrD;AAKD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAsBvD;AAED,+FAA+F;AAC/F,qBACa,iBAAkB,SAAQ,mBAAmB;IAC/C,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,GAAG,IAAI;CAG9D"}

package/dist/enforcement/engine-error.filter.js

@@ -0,0 +1,118 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EngineErrorFilter = exports.EngineHttpMappableError = void 0;
+exports.classifyEngineError = classifyEngineError;
+exports.toEngineHttpError = toEngineHttpError;
+/**
+ * EngineErrorFilter — the framework-wide mapping of `@astram/engine` errors to HTTP
+ * (security hardening Phase 1C). Registered ONCE as a global `APP_FILTER` by
+ * `ShieldModule.forRoot` / `forRootAsync`.
+ *
+ * A consumer feature controller that writes through `RecordsService` sees the engine's typed,
+ * fail-closed errors. Unmapped, Nest answered every one of them with a 500. This filter answers:
+ *
+ *   AuthorizationDeniedError (incl. ADR-0034 `create_outside_write_scope`) → 403
+ *   ValidationError                                                       → 400
+ *   EngineUnavailableError                                                → 503
+ *
+ * with FIXED, id-free messages (ADR-0012): the engine's own message carries reason codes, record
+ * ids and detail meant for logs, never for clients. There is deliberately no 404 mapping: the
+ * engine has no not-found error, because a missing or other-tenant row is folded into a deny so
+ * that it cannot be probed (`fetch-record.ts`).
+ *
+ * ── WHAT IT LEAVES ALONE ───────────────────────────────────────────────────────────────────
+ * `@Catch` lists only {@link EngineHttpMappableError}, so Nest hands this filter nothing else:
+ * `HttpException`s, `CapabilityNotSupportedError` / `RegistrationError` (framework gaps and
+ * misconfiguration — a 500 is right), and every non-engine error keep Nest's default handling and
+ * any consumer filter. Controller/method filters and interceptors run first, so identity's
+ * `IdentityErrorInterceptor` maps its routes before this filter is consulted.
+ *
+ * ── WHY STRUCTURAL MATCHING (not `instanceof` the engine classes) ──────────────────────────────
+ * Guard depends on `@astram/engine`, but this file is statically imported by `shield.module.ts`,
+ * whose own compiled output is kept free of runtime engine/core requires (see its header). A
+ * structural match also keeps working when a consumer's tree holds two copies of
+ * `@astram/engine` (version skew), where `instanceof` silently fails and the 500 returns. An
+ * error matches only when ALL hold: it is an `Error`, its prototype chain contains a class named
+ * `EngineError` (the engine's base), its `name` is one of the three classes above (the engine
+ * sets `name = new.target.name`), and it carries that class's field (`reason` / `field`). A
+ * third-party error that merely shares a name is not mapped.
+ */
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+/** True when `err`'s prototype chain contains the engine's `EngineError` base class. */
+function isEngineFamily(err) {
+    let proto = Object.getPrototypeOf(err);
+    while (proto !== null && proto !== Error.prototype && proto !== Object.prototype) {
+        const ctor = proto.constructor;
+        if (ctor?.name === 'EngineError')
+            return true;
+        proto = Object.getPrototypeOf(proto);
+    }
+    return false;
+}
+/** Classify an engine error this filter maps, or `null` for anything else. */
+function classifyEngineError(err) {
+    if (!(err instanceof Error) || !isEngineFamily(err))
+        return null;
+    const fields = err;
+    switch (err.name) {
+        case 'AuthorizationDeniedError':
+            return typeof fields.reason === 'string' ? 'denied' : null;
+        case 'ValidationError':
+            return typeof fields.field === 'string' ? 'invalid' : null;
+        case 'EngineUnavailableError':
+            return 'unavailable';
+        default:
+            return null;
+    }
+}
+/**
+ * The `@Catch` target: Nest selects a filter with `exception instanceof <target>`, and
+ * `Symbol.hasInstance` makes that the structural {@link classifyEngineError} test.
+ */
+class EngineHttpMappableError {
+    static [Symbol.hasInstance](value) {
+        return classifyEngineError(value) !== null;
+    }
+}
+exports.EngineHttpMappableError = EngineHttpMappableError;
+/** A field name safe to echo (a declared column-style identifier); anything else is not echoed. */
+const ECHOABLE_FIELD = /^[A-Za-z_][A-Za-z0-9_]{0,63}$/;
+/**
+ * Map an engine error to the HTTP exception the framework answers with, or return it unchanged
+ * when it is not a mapped engine error. Exported for unit tests and for callers mapping by hand.
+ */
+function toEngineHttpError(err) {
+    if (err instanceof common_1.HttpException)
+        return err;
+    switch (classifyEngineError(err)) {
+        case 'denied':
+            return err.reason === 'create_outside_write_scope'
+                ? new common_1.ForbiddenException('You cannot create this record: it is outside the organisations you manage.')
+                : new common_1.ForbiddenException('You do not have access to perform this action.');
+        case 'invalid': {
+            const field = err.field;
+            return new common_1.BadRequestException(ECHOABLE_FIELD.test(field) ? `Invalid value for '${field}'.` : 'Invalid input.');
+        }
+        case 'unavailable':
+            return new common_1.ServiceUnavailableException('This operation is temporarily unavailable. Try again.');
+        default:
+            return err;
+    }
+}
+/** The global filter: answers a mapped engine error through Nest's own HttpException reply. */
+let EngineErrorFilter = class EngineErrorFilter extends core_1.BaseExceptionFilter {
+    catch(exception, host) {
+        super.catch(toEngineHttpError(exception), host);
+    }
+};
+exports.EngineErrorFilter = EngineErrorFilter;
+exports.EngineErrorFilter = EngineErrorFilter = __decorate([
+    (0, common_1.Catch)(EngineHttpMappableError)
+], EngineErrorFilter);

package/dist/enforcement/global-enforcement.guard.d.ts

@@ -1,8 +1,9 @@
 import { CanActivate, ExecutionContext } from '@nestjs/common';
 import { Reflector } from '@nestjs/core';
 import type { CoreDecisionAuthority } from './core-seam.js';
-import type { SessionTokenBinder } from '../request-auth/session-token-binder.js';
+import { type SessionTokenBinder } from '../request-auth/session-token-binder.js';
 import type { ServiceAuthenticator } from '@astram/core';
+import type { ScopeSubtreeResolver } from '../auth/ports/scope-subtree-resolver.js';
 /**
  * Global, fail-closed enforcement guard (ADR-0002) — now with REAL request
  * authorization for classified routes.
@@ -35,9 +36,35 @@ export declare class GlobalEnforcementGuard implements CanActivate {
     private readonly decisionAuthority?;
     private readonly tokenBinder?;
     private readonly serviceAuth?;
-    constructor(reflector: Reflector, decisionAuthority?: CoreDecisionAuthority | undefined, tokenBinder?: SessionTokenBinder | undefined, serviceAuth?: ServiceAuthenticator | undefined);
+    private readonly scopeSubtreeResolver?;
+    constructor(reflector: Reflector, decisionAuthority?: CoreDecisionAuthority | undefined, tokenBinder?: SessionTokenBinder | undefined, serviceAuth?: ServiceAuthenticator | undefined, scopeSubtreeResolver?: (ScopeSubtreeResolver | null) | undefined);
     canActivate(context: ExecutionContext): Promise<boolean>;
     /** The real authorization path for a classified route (fail-closed throughout). */
     private authorizeClassified;
+    /**
+     * Write gate 5's reloaded grants and the live roles onto the session binding (ADR-0035). Session
+     * bindings only: a service-account key has no binding (its roles and scope are read live per
+     * request by the key store). Best-effort and conditional (same session, same tenant, fresher
+     * facts, `XX`): a miss or a Redis error only means the next request reloads again.
+     */
+    private rebindReloadedGrants;
+    /**
+     * Re-derive the session's scope subtree after gate 5 reloaded facts at `reloadedVersion`
+     * (security hardening Phase 1C). Identity bumps a tenant's permission version when a company is
+     * created, moved or deleted under it, so a reload at a version newer than the bound subtree's
+     * stamp means the subtree may be stale: resolve it again with the SAME resolver login uses,
+     * rebind it (token + session entries) and return the principal the handler should see.
+     *
+     * Off the hot path: runs only for a session binding that carries a subtree, with a resolver
+     * wired, and a reload NEWER than its stamp (or no stamp yet — once, then stamped). That is the
+     * only DB read added (one closure query), and only on a version change.
+     *
+     * FAIL-CLOSED, NON-WIDENING: a resolver error, a non-array or an EMPTY result →
+     * {@link SUBTREE_REDERIVE_FAILED}: the bound subtree stays (never replaced by a guess, never
+     * widened), the stamp is not advanced, the reloaded facts are not cached (ADR-0035), and the next
+     * request reloads and retries. `null` = no re-derive was due. A failed Redis rebind still returns the fresh principal for this request
+     * (the DB answer is authoritative); the next reload retries the rebind.
+     */
+    private rederiveSubtreeOnVersionMove;
 }
 //# sourceMappingURL=global-enforcement.guard.d.ts.map

package/dist/enforcement/global-enforcement.guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"global-enforcement.guard.d.ts","sourceRoot":"","sources":["../../src/enforcement/global-enforcement.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,gBAAgB,EAMjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAOzC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAK5D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAQzD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,qBACa,sBAAuB,YAAW,WAAW;IAEtD,OAAO,CAAC,QAAQ,CAAC,SAAS;IAG1B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAGnC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAM7B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAZZ,SAAS,EAAE,SAAS,EAGpB,iBAAiB,CAAC,EAAE,qBAAqB,YAAA,EAGzC,WAAW,CAAC,EAAE,kBAAkB,YAAA,EAMhC,WAAW,CAAC,EAAE,oBAAoB,YAAA;IAG/C,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAuC9D,mFAAmF;YACrE,mBAAmB;CA0FlC"}
+{"version":3,"file":"global-enforcement.guard.d.ts","sourceRoot":"","sources":["../../src/enforcement/global-enforcement.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,gBAAgB,EAMjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAOzC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAK5D,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,yCAAyC,CAAC;AACjD,OAAO,KAAK,EAA2B,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAOlF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAoBpF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,qBACa,sBAAuB,YAAW,WAAW;IAEtD,OAAO,CAAC,QAAQ,CAAC,SAAS;IAG1B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAGnC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAM7B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAM7B,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC;gBAlBrB,SAAS,EAAE,SAAS,EAGpB,iBAAiB,CAAC,EAAE,qBAAqB,YAAA,EAGzC,WAAW,CAAC,EAAE,kBAAkB,YAAA,EAMhC,WAAW,CAAC,EAAE,oBAAoB,YAAA,EAMlC,oBAAoB,CAAC,GAAE,oBAAoB,GAAG,IAAI,aAAA;IAG/D,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAuC9D,mFAAmF;YACrE,mBAAmB;IAyIjC;;;;;OAKG;YACW,oBAAoB;IAuBlC;;;;;;;;;;;;;;;;OAgBG;YACW,4BAA4B;CA8C3C"}

package/dist/enforcement/global-enforcement.guard.js

@@ -18,9 +18,24 @@ const core_1 = require("@nestjs/core");
 const classification_decorator_js_1 = require("./classification.decorator.js");
 const shield_tokens_js_1 = require("../module/shield-tokens.js");
 const tokens_js_1 = require("../request-auth/tokens.js");
+const session_token_binder_js_1 = require("../request-auth/session-token-binder.js");
 const request_principal_js_1 = require("../request-auth/request-principal.js");
+const tokens_js_2 = require("../auth/tokens.js");
 const session_facts_als_js_1 = require("../request-auth/session-facts-als.js");
 const reenroll_allowlist_js_1 = require("./reenroll-allowlist.js");
+/** A subtree re-derive that was due but could not be done (resolver error / empty / junk). */
+const SUBTREE_REDERIVE_FAILED = Symbol('subtree-rederive-failed');
+/**
+ * The binding's cached facts as gate 5 may use them (ADR-0035): absent, or at/past their
+ * `validUntilMs` time bound ⇒ `null` (gate 5 reloads). Never fabricated.
+ */
+function usableCachedFacts(facts, nowMs) {
+    if (facts === undefined)
+        return null;
+    if (typeof facts.validUntilMs === 'number' && nowMs >= facts.validUntilMs)
+        return null;
+    return facts;
+}
 /**
  * Global, fail-closed enforcement guard (ADR-0002) — now with REAL request
  * authorization for classified routes.
@@ -53,11 +68,13 @@ let GlobalEnforcementGuard = class GlobalEnforcementGuard {
     decisionAuthority;
     tokenBinder;
     serviceAuth;
-    constructor(reflector, decisionAuthority, tokenBinder, serviceAuth) {
+    scopeSubtreeResolver;
+    constructor(reflector, decisionAuthority, tokenBinder, serviceAuth, scopeSubtreeResolver) {
         this.reflector = reflector;
         this.decisionAuthority = decisionAuthority;
         this.tokenBinder = tokenBinder;
         this.serviceAuth = serviceAuth;
+        this.scopeSubtreeResolver = scopeSubtreeResolver;
     }
     async canActivate(context) {
         // Only HTTP requests are classified here. Non-HTTP contexts (if ever added)
@@ -92,7 +109,7 @@ let GlobalEnforcementGuard = class GlobalEnforcementGuard {
         // Absent → we cannot authenticate the caller → DENY (never allow-through).
         if (this.tokenBinder === undefined || this.decisionAuthority === undefined) {
             throw new common_1.ForbiddenException('Shield enforcement: this route is @Classified but request authentication is not ' +
-                "enabled (ShieldModule.forRoot({ auth: true })). It is denied by default.");
+                'enabled (ShieldModule.forRoot({ auth: true })). It is denied by default.');
         }
         const req = context.switchToHttp().getRequest();
         const authHeader = req?.headers?.['authorization'];
@@ -138,17 +155,136 @@ let GlobalEnforcementGuard = class GlobalEnforcementGuard {
         // FAIL-CLOSED: no projector wired / absent / malformed binding → `claims.cachedFacts`
         // is undefined → the store carries `cachedFacts: null` → gate 5 DB-reloads (today's
         // behavior). The cache is only ever consulted; it never fabricates a permit.
+        //
+        // RELOAD SIGNAL (security hardening Phase 1C): when gate 5 reloads THIS principal's grants,
+        // the framework-built authority reports the reloaded (authoritative) version here.
+        //
+        // TIME BOUND (ADR-0035): cached facts at or past their `validUntilMs` (the next start or end of
+        // a role posting's window — a change no version bump marks) are treated as ABSENT, so gate 5
+        // reloads them (and the roles with them, below).
+        let reloaded;
+        const usableFacts = usableCachedFacts(claims.cachedFacts, Date.now());
         const factsStore = {
-            cachedFacts: claims.cachedFacts ?? null,
-            permissionsVersion: claims.cachedFacts?.permissionsVersion ?? 0,
+            cachedFacts: usableFacts,
+            permissionsVersion: usableFacts?.permissionsVersion ?? 0,
+            onReload: (principalId, tenantId, grants) => {
+                if (principalId === principal.id && tenantId === principal.tenantId) {
+                    reloaded = grants;
+                }
+            },
         };
         const decision = await session_facts_als_js_1.SHIELD_SESSION_FACTS_ALS.run(factsStore, () => this.decisionAuthority.decide(principal, { key: classification.action }, { level: 'object_type', typeKey: classification.typeKey, tenantId: principal.tenantId }, { isAuthenticated: true }));
+        // The type-level decision above is on the principal's OWN tenant, which every subtree
+        // contains, so it does not depend on the subtree; the handler (engine record checks, the
+        // ADR-0034 create wall) is what reads it. Hence: decide first, then hand the handler the
+        // re-derived principal.
+        //
+        // LIVE ROLES (ADR-0035, GAPS #4): the reload also carries the principal's in-effect roles (when
+        // the app port reports them). The handler gets them on THIS request (role-keyed record rules,
+        // list scope, shares, the engine's record checks all read `req.principal.roleIds`), and the
+        // binding is rewritten with the reloaded facts + roles together, so the next requests are
+        // served from the cache (GAPS #6) with the same live roles.
+        if (reloaded !== undefined) {
+            const liveRoles = (0, session_token_binder_js_1.liveRoleIds)(reloaded);
+            const current = liveRoles !== undefined ? { ...claims, roleIds: liveRoles } : claims;
+            const rederived = await this.rederiveSubtreeOnVersionMove(authHeader, current, reloaded.permissionsVersion);
+            // A subtree re-derive that was due but FAILED (resolver error / empty) keeps the facts
+            // uncached, so the next request reloads and retries it (the Phase 1C retry guarantee).
+            if (rederived !== SUBTREE_REDERIVE_FAILED) {
+                await this.rebindReloadedGrants(authHeader, claims, reloaded, liveRoles);
+            }
+            if (rederived !== null && rederived !== SUBTREE_REDERIVE_FAILED) {
+                req.principal = rederived;
+            }
+            else if (liveRoles !== undefined) {
+                const withRoles = (0, request_principal_js_1.principalFromClaims)(current);
+                if (withRoles !== null)
+                    req.principal = withRoles;
+            }
+        }
         if (decision.effect === 'allow') {
             return true;
         }
         // Deny (or any non-allow) → 403. Do NOT leak the reason detail to the caller.
         throw new common_1.ForbiddenException(`Shield enforcement: access denied for ${classification.action} on ${classification.typeKey}.`);
     }
+    /**
+     * Write gate 5's reloaded grants and the live roles onto the session binding (ADR-0035). Session
+     * bindings only: a service-account key has no binding (its roles and scope are read live per
+     * request by the key store). Best-effort and conditional (same session, same tenant, fresher
+     * facts, `XX`): a miss or a Redis error only means the next request reloads again.
+     */
+    async rebindReloadedGrants(authHeader, claims, grants, liveRoles) {
+        if (this.tokenBinder === undefined)
+            return;
+        if (claims.sessionId === '' || claims.kind === 'service_account')
+            return;
+        const token = (0, request_principal_js_1.extractBearerToken)(authHeader);
+        if (token === null)
+            return;
+        try {
+            await this.tokenBinder.refreshGrants(token, claims.sessionId, claims.tenantId, grants, liveRoles);
+        }
+        catch {
+            // Best-effort: the decision and the handler's principal already use the reloaded grants.
+        }
+    }
+    /**
+     * Re-derive the session's scope subtree after gate 5 reloaded facts at `reloadedVersion`
+     * (security hardening Phase 1C). Identity bumps a tenant's permission version when a company is
+     * created, moved or deleted under it, so a reload at a version newer than the bound subtree's
+     * stamp means the subtree may be stale: resolve it again with the SAME resolver login uses,
+     * rebind it (token + session entries) and return the principal the handler should see.
+     *
+     * Off the hot path: runs only for a session binding that carries a subtree, with a resolver
+     * wired, and a reload NEWER than its stamp (or no stamp yet — once, then stamped). That is the
+     * only DB read added (one closure query), and only on a version change.
+     *
+     * FAIL-CLOSED, NON-WIDENING: a resolver error, a non-array or an EMPTY result →
+     * {@link SUBTREE_REDERIVE_FAILED}: the bound subtree stays (never replaced by a guess, never
+     * widened), the stamp is not advanced, the reloaded facts are not cached (ADR-0035), and the next
+     * request reloads and retries. `null` = no re-derive was due. A failed Redis rebind still returns the fresh principal for this request
+     * (the DB answer is authoritative); the next reload retries the rebind.
+     */
+    async rederiveSubtreeOnVersionMove(authHeader, claims, reloadedVersion) {
+        const resolver = this.scopeSubtreeResolver;
+        if (resolver === undefined || resolver === null || this.tokenBinder === undefined)
+            return null;
+        // Session bindings only: a service-account key has no binding (its scope is read live per
+        // request by the key store) and no session id.
+        if (claims.sessionId === '' || claims.kind === 'service_account')
+            return null;
+        // Only a binding that carries a subtree: an absent one is the self-node fallback (no resolver
+        // or a failed login-time resolve) and stays that way until the next login/refresh.
+        if (claims.scopeSubtreeNodeIds === undefined || claims.scopeSubtreeNodeIds.length === 0) {
+            return null;
+        }
+        const stamp = claims.scopeSubtreeVersion;
+        if (stamp !== undefined && reloadedVersion <= stamp)
+            return null;
+        let subtree;
+        try {
+            const resolved = await resolver.resolveSubtree(claims.tenantId);
+            if (!Array.isArray(resolved) || resolved.length === 0)
+                return SUBTREE_REDERIVE_FAILED;
+            if (resolved.some((n) => typeof n !== 'string' || n.length === 0)) {
+                return SUBTREE_REDERIVE_FAILED;
+            }
+            subtree = [...resolved];
+        }
+        catch {
+            return SUBTREE_REDERIVE_FAILED;
+        }
+        const token = (0, request_principal_js_1.extractBearerToken)(authHeader);
+        if (token !== null) {
+            await this.tokenBinder.rederiveScopeSubtree(token, claims.sessionId, claims.tenantId, subtree, reloadedVersion);
+        }
+        return (0, request_principal_js_1.principalFromClaims)({
+            ...claims,
+            scopeSubtreeNodeIds: subtree,
+            scopeSubtreeVersion: reloadedVersion,
+        });
+    }
 };
 exports.GlobalEnforcementGuard = GlobalEnforcementGuard;
 exports.GlobalEnforcementGuard = GlobalEnforcementGuard = __decorate([
@@ -159,5 +295,7 @@ exports.GlobalEnforcementGuard = GlobalEnforcementGuard = __decorate([
     __param(2, (0, common_1.Inject)(tokens_js_1.SHIELD_SESSION_TOKEN_BINDER)),
     __param(3, (0, common_1.Optional)()),
     __param(3, (0, common_1.Inject)(tokens_js_1.SHIELD_SERVICE_AUTHENTICATOR)),
-    __metadata("design:paramtypes", [core_1.Reflector, Object, Function, Object])
+    __param(4, (0, common_1.Optional)()),
+    __param(4, (0, common_1.Inject)(tokens_js_2.SHIELD_SCOPE_SUBTREE_RESOLVER)),
+    __metadata("design:paramtypes", [core_1.Reflector, Object, Function, Object, Object])
 ], GlobalEnforcementGuard);

package/dist/identity/auth-facts.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-facts.controller.d.ts","sourceRoot":"","sources":["../../src/identity/auth-facts.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAGlF,OAAO,EAAiC,KAAK,kBAAkB,EAAE,KAAK,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAE3I,qBACa,mBAAmB;IAEqB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAChC,OAAO,CAAC,QAAQ,CAAC,KAAK;gBADD,WAAW,EAAE,kBAAkB,GAAG,SAAS,EAC/C,KAAK,EAAE,6BAA6B,GAAG,SAAS;IAK1G,YAAY,CAA2B,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAiB3F,qBAAqB,CAA2B,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAgB3G,qFAAqF;YACvE,YAAY;CAU3B"}
+{"version":3,"file":"auth-facts.controller.d.ts","sourceRoot":"","sources":["../../src/identity/auth-facts.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAaH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAGlF,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,EACnC,MAAM,+BAA+B,CAAC;AAEvC,qBACa,mBAAmB;IAI5B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAG5B,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAHL,WAAW,EAAE,kBAAkB,GAAG,SAAS,EAG3C,KAAK,EAAE,6BAA6B,GAAG,SAAS;IAK7D,YAAY,CACU,aAAa,CAAC,EAAE,MAAM,GAC/C,OAAO,CAAC,kBAAkB,CAAC;IAuBxB,qBAAqB,CACC,aAAa,CAAC,EAAE,MAAM,GAC/C,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAsB/B,qFAAqF;YACvE,YAAY;CAU3B"}

package/dist/identity/permission-facts.adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permission-facts.adapter.d.ts","sourceRoot":"","sources":["../../src/identity/permission-facts.adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAEpC,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AACD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AAED,yFAAyF;AACzF,qBAAa,6BAA8B,SAAQ,KAAK;gBAC1C,OAAO,SAA8B;CAIlD;AAMD,qBAAa,6BAA6B;IAEtC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAHH,IAAI,EAAE,IAAI,EACV,WAAW,EAAE,MAAM,SAAS,MAAM,EAAE,EACpC,gBAAgB,EAAE,SAAS,MAAM,EAAE,EACnC,GAAG,GAAE,MAAM,MAAiB;IAGzC,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAqB/F,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YASlE,oBAAoB;YAcpB,aAAa;YASb,WAAW;IAQzB;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;CAaxB"}
+{"version":3,"file":"permission-facts.adapter.d.ts","sourceRoot":"","sources":["../../src/identity/permission-facts.adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAEpC,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AACD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AAED,yFAAyF;AACzF,qBAAa,6BAA8B,SAAQ,KAAK;gBAC1C,OAAO,SAA8B;CAIlD;AAYD,qBAAa,6BAA6B;IAEtC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAHH,IAAI,EAAE,IAAI,EACV,WAAW,EAAE,MAAM,SAAS,MAAM,EAAE,EACpC,gBAAgB,EAAE,SAAS,MAAM,EAAE,EACnC,GAAG,GAAE,MAAM,MAAiB;IAGzC,UAAU,CACd,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,OAAO,GACd,OAAO,CAAC,kBAAkB,CAAC;IAmBxB,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YASlE,oBAAoB;YAepB,aAAa;YASb,WAAW;IAQzB;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;CAaxB"}

package/dist/identity/permission-facts.adapter.js

@@ -34,9 +34,7 @@ class MariaDbPermissionFactsAdapter {
             const roleIds = await this.readRoleIdsForTenant(principalId, tenantId);
             const granted = roleIds.length > 0 ? await this.readGrantKeys(roleIds) : [];
             const expanded = this.expandGrantKeys(granted);
-            const keys = isRoot
-                ? [...new Set([...expanded, ...this.controlPlaneKeys])]
-                : expanded;
+            const keys = isRoot ? [...new Set([...expanded, ...this.controlPlaneKeys])] : expanded;
             const permissionsVersion = await this.readVersion(tenantId);
             return {
                 principalId,
@@ -65,6 +63,7 @@ class MariaDbPermissionFactsAdapter {
         const nowMs = this.now();
         const rows = (await this.pool.query(`SELECT DISTINCT mp.mp_role_uuid AS role_uuid
          FROM \`shield_app\`.\`company_membership\` cm
+         JOIN \`shield_app\`.\`users\` u ON u.u_uuid = cm.cm_user_uuid AND u.u_status = 'active'
          JOIN \`shield_app\`.\`membership_posting\` mp ON mp.mp_membership_uuid = cm.cm_uuid
         WHERE cm.cm_user_uuid = ? AND cm.cm_company_uuid = ? AND cm.cm_is_active = 1
           AND (mp.mp_effective_from_ms IS NULL OR mp.mp_effective_from_ms <= ?)