@astram/identity 0.12.0 → 0.13.0

package/dist/features/authz/record-authorization.d.ts

@@ -16,6 +16,14 @@ import type { FrameworkSchemas } from '@astram/core';
 import { type RecordAuthorizationInputs } from '@astram/guard';
 import type { ObjectTypeInput } from '@astram/engine';
 import type { IdentitySchemaNames } from '../../schema.js';
+/**
+ * A pool-size variable: unset or blank gives `undefined`; otherwise plain digits, a positive safe
+ * integer, or it throws naming the variable (never the value). The single-layout pool budget in
+ * `@astram/guard` (`loadPoolBudget`) applies the same rule, so the budget counts the pools that open.
+ */
+export declare function strictPoolSize(raw: string | undefined, name: string): number | undefined;
+/** The authz pool cap: `APP_AUTHZ_POOL_MAX` (strict), else 4. */
+export declare function authzPoolLimit(env?: NodeJS.ProcessEnv): number;
 /**
  * A lean `mariadb` pool for the authz grant-reads (built from `APP_DB_*` env via guard's
  * `loadDbConfig`). Kept small — these are pre-gate coarse-grant reads, not the main CRUD pool.

package/dist/features/authz/record-authorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"record-authorization.d.ts","sourceRoot":"","sources":["../../../src/features/authz/record-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAgB,EAAE,KAAK,IAAI,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAIL,KAAK,yBAAyB,EAC/B,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAItD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAE3D;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAaxE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,IAAI,EACV,YAAY,GAAE,SAAS,eAAe,EAAO;AAC7C,0FAA0F;AAC1F,OAAO,CAAC,EAAE,mBAAmB,GAC5B,yBAAyB,CAS3B"}
+{"version":3,"file":"record-authorization.d.ts","sourceRoot":"","sources":["../../../src/features/authz/record-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAgB,EAAE,KAAK,IAAI,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAIL,KAAK,yBAAyB,EAC/B,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAItD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAE3D;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAMxF;AAED,iEAAiE;AACjE,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE3E;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAaxE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,IAAI,EACV,YAAY,GAAE,SAAS,eAAe,EAAO;AAC7C,0FAA0F;AAC1F,OAAO,CAAC,EAAE,mBAAmB,GAC5B,yBAAyB,CAS3B"}

package/dist/features/authz/record-authorization.js

@@ -3,6 +3,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.strictPoolSize = strictPoolSize;
+exports.authzPoolLimit = authzPoolLimit;
 exports.createIdentityAuthzPool = createIdentityAuthzPool;
 exports.buildRecordAuthorizationInputs = buildRecordAuthorizationInputs;
 /**
@@ -23,6 +25,24 @@ const guard_1 = require("@astram/guard");
 const objects_js_1 = require("../../objects.js");
 const db_permission_facts_adapter_js_1 = require("./db-permission-facts.adapter.js");
 const session_facts_reader_js_1 = require("./session-facts.reader.js");
+/**
+ * A pool-size variable: unset or blank gives `undefined`; otherwise plain digits, a positive safe
+ * integer, or it throws naming the variable (never the value). The single-layout pool budget in
+ * `@astram/guard` (`loadPoolBudget`) applies the same rule, so the budget counts the pools that open.
+ */
+function strictPoolSize(raw, name) {
+    if (raw === undefined || raw.trim() === '')
+        return undefined;
+    const t = raw.trim();
+    const n = /^[0-9]+$/.test(t) ? Number(t) : Number.NaN;
+    if (!Number.isSafeInteger(n) || n < 1)
+        throw new Error(`${name} must be a positive integer`);
+    return n;
+}
+/** The authz pool cap: `APP_AUTHZ_POOL_MAX` (strict), else 4. */
+function authzPoolLimit(env = process.env) {
+    return strictPoolSize(env.APP_AUTHZ_POOL_MAX, 'APP_AUTHZ_POOL_MAX') ?? 4;
+}
 /**
  * A lean `mariadb` pool for the authz grant-reads (built from `APP_DB_*` env via guard's
  * `loadDbConfig`). Kept small — these are pre-gate coarse-grant reads, not the main CRUD pool.
@@ -39,7 +59,7 @@ function createIdentityAuthzPool(schemas) {
         user: db.user,
         password: db.password,
         database: db.database,
-        connectionLimit: Number(process.env.APP_AUTHZ_POOL_MAX ?? 4),
+        connectionLimit: authzPoolLimit(process.env),
         // Phase 16: APP_DB_TLS / APP_DB_TLS_CA (production accounts are REQUIRE SSL).
         ...(ssl ? { ssl } : {}),
     });

package/dist/features/identity-feature.module.d.ts

@@ -1,6 +1,6 @@
 import { type DynamicModule } from '@nestjs/common';
 import { type FrameworkSchemas } from '@astram/core';
-import { type ObjectTypeInput } from '@astram/engine';
+import { type EngineDbConfig, type ObjectTypeInput } from '@astram/engine';
 /**
  * The boot check behind {@link IDENTITY_DECISION_AUTHORITY_CHECK}: with this module wired, the
  * request path must decide with the authority guard built from this module's inputs. A missing
@@ -30,6 +30,12 @@ export declare function assertFrameworkDatabaseAgrees(identityDatabase: string,
         readonly database?: string;
     };
 } | null | undefined): true;
+/**
+ * Map guard's DbConfig → the engine's EngineDbConfig (adds the pool cap the engine needs). The
+ * database and default user follow `schemas` (the names `forRoot` resolved or was given); an
+ * explicit `APP_DB_USER` / `APP_DB_NAME` still wins (QA P2-5).
+ */
+export declare function engineDbFromEnv(schemas: FrameworkSchemas, env?: NodeJS.ProcessEnv): EngineDbConfig;
 /**
  * IdentityFeatureModule — the framework-owned identity FEATURE surface (company/user/role CRUD;
  * more in later phases) as thin controllers over the engine's RecordsService. The CONSUMER imports

package/dist/features/identity-feature.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-feature.module.d.ts","sourceRoot":"","sources":["../../src/features/identity-feature.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpE,OAAO,EAGL,KAAK,gBAAgB,EAEtB,MAAM,cAAc,CAAC;AACtB,OAAO,EAeL,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AA0GxB;;;;;;GAMG;AACH,wBAAgB,0CAA0C,CAAC,SAAS,EAAE,OAAO,GAAG,IAAI,CAUnF;AAKD;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,GACzC,IAAI,CAuBN;AAKD;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAC3C,gBAAgB,EAAE,MAAM,EACxB,WAAW,EAAE;IAAE,QAAQ,CAAC,EAAE,CAAC,EAAE;QAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GAC/E,IAAI,CAQN;AAwBD;;;;;;;;;;GAUG;AACH,qBACa,qBAAqB;IAChC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,MAAM,CAAC,OAAO,CAAC,EACb,OAAO,EACP,YAAiB,EACjB,OAAO,EAAE,YAAY,GACtB,GAAE;QACD,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5B,YAAY,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;QAC1C,OAAO,CAAC,EAAE,gBAAgB,CAAC;KACvB,GAAG,aAAa;CA2jBvB"}
+{"version":3,"file":"identity-feature.module.d.ts","sourceRoot":"","sources":["../../src/features/identity-feature.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpE,OAAO,EAGL,KAAK,gBAAgB,EAEtB,MAAM,cAAc,CAAC;AACtB,OAAO,EAYL,KAAK,cAAc,EAGnB,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AA2GxB;;;;;;GAMG;AACH,wBAAgB,0CAA0C,CAAC,SAAS,EAAE,OAAO,GAAG,IAAI,CAUnF;AAKD;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,GACzC,IAAI,CAwBN;AAKD;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAC3C,gBAAgB,EAAE,MAAM,EACxB,WAAW,EAAE;IAAE,QAAQ,CAAC,EAAE,CAAC,EAAE;QAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GAC/E,IAAI,CAQN;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,gBAAgB,EACzB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,cAAc,CAqBhB;AAED;;;;;;;;;;GAUG;AACH,qBACa,qBAAqB;IAChC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,MAAM,CAAC,OAAO,CAAC,EACb,OAAO,EACP,YAAiB,EACjB,OAAO,EAAE,YAAY,GACtB,GAAE;QACD,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5B,YAAY,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;QAC1C,OAAO,CAAC,EAAE,gBAAgB,CAAC;KACvB,GAAG,aAAa;CA2jBvB"}

package/dist/features/identity-feature.module.js

@@ -11,6 +11,7 @@ exports.IdentityFeatureModule = void 0;
 exports.assertRequestPathUsesIdentityAuthorization = assertRequestPathUsesIdentityAuthorization;
 exports.assertFrameworkSchemasAgree = assertFrameworkSchemasAgree;
 exports.assertFrameworkDatabaseAgrees = assertFrameworkDatabaseAgrees;
+exports.engineDbFromEnv = engineDbFromEnv;
 const common_1 = require("@nestjs/common");
 const core_1 = require("@nestjs/core");
 const core_2 = require("@astram/core");
@@ -107,7 +108,7 @@ const IDENTITY_FRAMEWORK_SCHEMAS_CHECK = Symbol('IDENTITY_FRAMEWORK_SCHEMAS_CHEC
  * Throws (fail closed) with the namespaces and names only.
  */
 function assertFrameworkSchemasAgree(identity, guard) {
-    const names = (s) => `namespace=${s.namespace} app=${s.app} identity=${s.identity} authz=${s.authz} audit=${s.audit}`;
+    const names = (s) => `namespace=${s.namespace} app=${s.app} identity=${s.identity} authz=${s.authz} audit=${s.audit} layout=${s.layout ?? 'four'}`;
     if (guard === undefined || guard === null) {
         if (identity.isDefault)
             return true;
@@ -117,7 +118,8 @@ function assertFrameworkSchemasAgree(identity, guard) {
     const same = identity.app === guard.app &&
         identity.identity === guard.identity &&
         identity.authz === guard.authz &&
-        identity.audit === guard.audit;
+        identity.audit === guard.audit &&
+        (identity.layout ?? 'four') === (guard.layout ?? 'four');
     if (!same) {
         throw new Error(`IdentityFeatureModule: framework database names disagree — identity ${names(identity)}; ` +
             `guard ${names(guard)}. Pass the same names (or none) to ShieldModule and ` +
@@ -147,8 +149,13 @@ function assertFrameworkDatabaseAgrees(identityDatabase, guardConfig) {
  * database and default user follow `schemas` (the names `forRoot` resolved or was given); an
  * explicit `APP_DB_USER` / `APP_DB_NAME` still wins (QA P2-5).
  */
-function engineDbFromEnv(schemas) {
-    const db = (0, guard_1.loadDbConfig)(process.env, schemas);
+function engineDbFromEnv(schemas, env = process.env) {
+    const db = (0, guard_1.loadDbConfig)(env, schemas);
+    // POOL_MAX_ENGINE, else APP_DB_MAX_CONNECTIONS, else 10; a set but invalid value throws naming
+    // the variable. Guard's single-layout pool budget parses these the same way.
+    const connectionLimit = (0, record_authorization_js_1.strictPoolSize)(env.POOL_MAX_ENGINE, 'POOL_MAX_ENGINE') ??
+        (0, record_authorization_js_1.strictPoolSize)(env.APP_DB_MAX_CONNECTIONS, 'APP_DB_MAX_CONNECTIONS') ??
+        10;
     const ssl = (0, guard_1.mariadbSslOption)(db.tls);
     return {
         host: db.host,
@@ -158,7 +165,7 @@ function engineDbFromEnv(schemas) {
         database: db.database,
         // The engine's runtime CRUD pool cap. A conservative default; the app can raise it later via
         // an explicit EngineModule.forRoot if it needs more. (ADR-0018 budget lives app-side.)
-        connectionLimit: Number(process.env.APP_DB_MAX_CONNECTIONS ?? 10),
+        connectionLimit,
         // Phase 16: APP_DB_TLS / APP_DB_TLS_CA (production accounts are REQUIRE SSL).
         ...(ssl ? { ssl } : {}),
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astram/identity",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "license": "MIT",
   "description": "Astram framework — the framework-owned identity + tenancy model. Hosts the identity @ObjectType classes (user, company, membership, posting), framework-authored identity migrations, and the identity resolver. Top of the dependency graph: depends on @astram/engine (for @ObjectType/@Field decorators) + @astram/guard / @astram/core (for the auth ports).",
   "type": "commonjs",
@@ -36,9 +36,9 @@
   },
   "dependencies": {
     "mariadb": "^3.5.4",
-    "@astram/core": "1.7.0",
-    "@astram/engine": "0.8.0",
-    "@astram/guard": "0.15.0"
+    "@astram/core": "1.8.0",
+    "@astram/guard": "0.16.0",
+    "@astram/engine": "0.9.0"
   },
   "peerDependencies": {
     "@nestjs/common": "^11",