@astram/identity 0.12.0 → 0.14.0

package/dist/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DbMembershipChecker = exports.DbScopeSubtreeResolver = exports.AlsSessionFactsReader = exports.FilesService = exports.IdentityFeatureModule = exports.buildIdentityAuthKeys = exports.identityControlPlaneKeys = exports.identityAuthActionKeys = exports.identityObjects = exports.identityMigrationsDir = exports.StoredFile = exports.ServiceAccount = exports.CompanyBranch = exports.CompanyDepartment = exports.MembershipPosting = exports.CompanyMembership = exports.Branch = exports.Department = exports.Role = exports.User = exports.Company = void 0;
+exports.DbMembershipChecker = exports.DbScopeSubtreeResolver = exports.AlsSessionFactsReader = exports.FilesService = exports.OrgBootstrapError = exports.runOrgBootstrap = exports.IdentityFeatureModule = exports.buildIdentityAuthKeys = exports.identityControlPlaneKeys = exports.identityAuthActionKeys = exports.identityObjects = exports.identityMigrationsDir = exports.StoredFile = exports.ServiceAccount = exports.CompanyBranch = exports.CompanyDepartment = exports.MembershipPosting = exports.CompanyMembership = exports.Branch = exports.Department = exports.Role = exports.User = exports.Company = void 0;
 /**
  * @astram/identity — the framework-owned identity + tenancy model.
  * The 9 identity object classes (relocated from the consumer app in Sub-plan B) +
@@ -60,6 +60,14 @@ Object.defineProperty(exports, "buildIdentityAuthKeys", { enumerable: true, get:
  */
 var identity_feature_module_js_1 = require("./features/identity-feature.module.js");
 Object.defineProperty(exports, "IdentityFeatureModule", { enumerable: true, get: function () { return identity_feature_module_js_1.IdentityFeatureModule; } });
+/**
+ * The org bootstrap (G-009): `runOrgBootstrap(app, { file, apply })` applies a declarative org file
+ * (roots, company tree, roles, users, postings) through the framework's own services, as the declared
+ * operation `shield:org-bootstrap`. Run at deploy time against the app's own `AppModule` context.
+ */
+var run_org_bootstrap_js_1 = require("./features/org-bootstrap/run-org-bootstrap.js");
+Object.defineProperty(exports, "runOrgBootstrap", { enumerable: true, get: function () { return run_org_bootstrap_js_1.runOrgBootstrap; } });
+Object.defineProperty(exports, "OrgBootstrapError", { enumerable: true, get: function () { return run_org_bootstrap_js_1.OrgBootstrapError; } });
 /**
  * Stored files (file-storage SPEC §5 I-K): `store` / `open` / `remove` on the engine pipe, provided
  * and exported by `IdentityFeatureModule`. Apps call it from their own `@Classified` routes.

package/dist/internal.d.ts

@@ -8,4 +8,6 @@
  * subpath everywhere else. Feature code never holds a pool: it uses the RecordEngine.
  */
 export { createIdentityAuthzPool } from './features/authz/record-authorization.js';
+export { transitionRoleOwner } from './features/role/role-owner-transition.js';
+export type { RoleOwnerAudit, RoleOwnerQuery } from './features/role/role-owner-transition.js';
 //# sourceMappingURL=internal.d.ts.map

package/dist/internal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"internal.d.ts","sourceRoot":"","sources":["../src/internal.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC"}
+{"version":3,"file":"internal.d.ts","sourceRoot":"","sources":["../src/internal.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AAC/E,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC"}

package/dist/internal.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createIdentityAuthzPool = void 0;
+exports.transitionRoleOwner = exports.createIdentityAuthzPool = void 0;
 /**
  * @astram/identity/internal — composition-root surface (Phase 8 #5).
  *
@@ -12,3 +12,5 @@ exports.createIdentityAuthzPool = void 0;
  */
 var record_authorization_js_1 = require("./features/authz/record-authorization.js");
 Object.defineProperty(exports, "createIdentityAuthzPool", { enumerable: true, get: function () { return record_authorization_js_1.createIdentityAuthzPool; } });
+var role_owner_transition_js_1 = require("./features/role/role-owner-transition.js");
+Object.defineProperty(exports, "transitionRoleOwner", { enumerable: true, get: function () { return role_owner_transition_js_1.transitionRoleOwner; } });

package/dist/role.object.d.ts

@@ -2,6 +2,7 @@
 export declare class Role {
     uuid: string;
     name: string;
+    ownerCompanyUuid?: string | null;
     createdAt: string;
 }
 //# sourceMappingURL=role.object.d.ts.map

package/dist/role.object.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role.object.d.ts","sourceRoot":"","sources":["../src/role.object.ts"],"names":[],"mappings":"AAGA,8BAA8B;AAC9B,qBAoBa,IAAI;IAEf,IAAI,EAAG,MAAM,CAAC;IAGd,IAAI,EAAG,MAAM,CAAC;IAGd,SAAS,EAAG,MAAM,CAAC;CACpB"}
+{"version":3,"file":"role.object.d.ts","sourceRoot":"","sources":["../src/role.object.ts"],"names":[],"mappings":"AAGA,8BAA8B;AAC9B,qBAoBa,IAAI;IAEf,IAAI,EAAG,MAAM,CAAC;IAGd,IAAI,EAAG,MAAM,CAAC;IAMd,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAGjC,SAAS,EAAG,MAAM,CAAC;CACpB"}

package/dist/role.object.js

@@ -16,6 +16,10 @@ const schema_1 = require("./schema");
 let Role = class Role {
     uuid;
     name;
+    // The company a role was created for (G-009 T14, SPEC R13); NULL = shared (root-created). Create-only
+    // and server-set (RoleService stamps it from the actor); NOT `trusted`, so the engine never
+    // derives it and root's UI-created roles stay unowned. Changed later only by `transitionRoleOwner`.
+    ownerCompanyUuid;
     createdAt;
 };
 exports.Role = Role;
@@ -27,6 +31,10 @@ __decorate([
     (0, engine_1.Field)({ column: 'r_name', type: 'string', required: true }),
     __metadata("design:type", String)
 ], Role.prototype, "name", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'r_owner_company_uuid', type: 'uuid', immutable: true }),
+    __metadata("design:type", Object)
+], Role.prototype, "ownerCompanyUuid", void 0);
 __decorate([
     (0, engine_1.Field)({ column: 'r_created_at', type: 'timestamp' }),
     __metadata("design:type", String)

package/migrations/1710000000101-AddRoleOwnerCompany.cjs

@@ -0,0 +1,98 @@
+/**
+ * Framework identity migration — `roles.r_owner_company_uuid` (G-009 T14, AC-19; SPEC R13).
+ *
+ * WHY: `roles` was a global catalog with no owner, so a company delete could not say which roles
+ * were its own. The owner is the company (tenant node) a role was created for; NULL = shared
+ * (root-created, or unowned). It is create-only at the engine (immutable); the only later change
+ * is the audited `transitionRoleOwner` seam (company -> NULL on a company delete, NULL -> company
+ * for an owner claim).
+ *
+ * Steps (idempotent; a half-applied state is completed, nothing is dropped or overwritten):
+ *   1. ADD the nullable column when absent.
+ *   2. ADD `idx_roles_owner_company` when absent (the FK needs it; the delete's owned-roles read).
+ *   3. ADD `FK_roles_owner_company` -> `companies (c_uuid)` ON DELETE SET NULL when absent. The
+ *      app clears owners itself on a company delete (audited); SET NULL is only the backstop.
+ *   4. BACK-FILL unowned roles bound ONLY inside ONE top-level tenant's subtree (postings ->
+ *      memberships -> companies -> `scope_closure` ancestors with no parent) to that tenant. A role
+ *      bound across several tenants, or bound nowhere, stays NULL. Only `IS NULL` rows are
+ *      touched, so a re-run never overwrites an owner. No ids are hardcoded.
+ *
+ * `down` drops the FK, then the index, then the column, each with IF EXISTS (a second run, or a
+ * database that never had the column, does nothing).
+ */
+
+const { frameworkSchemasForMigration } = require('@astram/core');
+
+const COLUMN = 'r_owner_company_uuid';
+const INDEX = 'idx_roles_owner_company';
+const FK = 'FK_roles_owner_company';
+
+const present = async (query, sql, params) => {
+  const rows = await query(sql, params);
+  return Array.isArray(rows) && rows.length > 0;
+};
+
+async function up(ctx) {
+  const { query } = ctx;
+  const schemas = frameworkSchemasForMigration(ctx, process.env);
+  const APP = schemas.app;
+  const AUTHZ = schemas.authz;
+
+  const hasColumn = await present(
+    query,
+    `SELECT 1 AS n FROM information_schema.COLUMNS
+      WHERE TABLE_SCHEMA = ? AND TABLE_NAME = 'roles' AND COLUMN_NAME = ? LIMIT 1`,
+    [APP, COLUMN],
+  );
+  if (!hasColumn) {
+    await query(`ALTER TABLE \`${APP}\`.\`roles\` ADD COLUMN ${COLUMN} VARCHAR(36) NULL`);
+  }
+
+  const hasIndex = await present(
+    query,
+    `SELECT 1 AS n FROM information_schema.STATISTICS
+      WHERE TABLE_SCHEMA = ? AND TABLE_NAME = 'roles' AND INDEX_NAME = ? LIMIT 1`,
+    [APP, INDEX],
+  );
+  if (!hasIndex) {
+    await query(`CREATE INDEX ${INDEX} ON \`${APP}\`.\`roles\` (${COLUMN})`);
+  }
+
+  const hasFk = await present(
+    query,
+    `SELECT 1 AS n FROM information_schema.REFERENTIAL_CONSTRAINTS
+      WHERE CONSTRAINT_SCHEMA = ? AND TABLE_NAME = 'roles' AND CONSTRAINT_NAME = ? LIMIT 1`,
+    [APP, FK],
+  );
+  if (!hasFk) {
+    await query(`ALTER TABLE \`${APP}\`.\`roles\`
+      ADD CONSTRAINT ${FK} FOREIGN KEY (${COLUMN})
+      REFERENCES \`${APP}\`.\`companies\` (c_uuid) ON DELETE SET NULL`);
+  }
+
+  // Back-fill: exactly one top-level tenant over every posting of the role, else leave NULL.
+  const tenantsOfRole = `SELECT COUNT(DISTINCT sc.ancestor_uuid)
+        FROM \`${APP}\`.\`membership_posting\` mp
+        JOIN \`${APP}\`.\`company_membership\` cm ON cm.cm_uuid = mp.mp_membership_uuid
+        JOIN \`${AUTHZ}\`.\`scope_closure\` sc ON sc.descendant_uuid = cm.cm_company_uuid
+        JOIN \`${APP}\`.\`companies\` top ON top.c_uuid = sc.ancestor_uuid AND top.c_parent_uuid IS NULL
+       WHERE mp.mp_role_uuid = r.r_uuid`;
+  await query(`UPDATE \`${APP}\`.\`roles\` r
+      SET r.${COLUMN} = (SELECT MIN(sc.ancestor_uuid)
+        FROM \`${APP}\`.\`membership_posting\` mp
+        JOIN \`${APP}\`.\`company_membership\` cm ON cm.cm_uuid = mp.mp_membership_uuid
+        JOIN \`${AUTHZ}\`.\`scope_closure\` sc ON sc.descendant_uuid = cm.cm_company_uuid
+        JOIN \`${APP}\`.\`companies\` top ON top.c_uuid = sc.ancestor_uuid AND top.c_parent_uuid IS NULL
+       WHERE mp.mp_role_uuid = r.r_uuid)
+    WHERE r.${COLUMN} IS NULL AND (${tenantsOfRole}) = 1`);
+}
+
+async function down(ctx) {
+  const { query } = ctx;
+  const APP = frameworkSchemasForMigration(ctx, process.env).app;
+  await query(`ALTER TABLE \`${APP}\`.\`roles\` DROP FOREIGN KEY IF EXISTS ${FK}`);
+  await query(`DROP INDEX IF EXISTS ${INDEX} ON \`${APP}\`.\`roles\``);
+  await query(`ALTER TABLE \`${APP}\`.\`roles\` DROP COLUMN IF EXISTS ${COLUMN}`);
+}
+
+module.exports = { up, down };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astram/identity",
-  "version": "0.12.0",
+  "version": "0.14.0",
   "license": "MIT",
   "description": "Astram framework — the framework-owned identity + tenancy model. Hosts the identity @ObjectType classes (user, company, membership, posting), framework-authored identity migrations, and the identity resolver. Top of the dependency graph: depends on @astram/engine (for @ObjectType/@Field decorators) + @astram/guard / @astram/core (for the auth ports).",
   "type": "commonjs",
@@ -36,9 +36,9 @@
   },
   "dependencies": {
     "mariadb": "^3.5.4",
-    "@astram/core": "1.7.0",
-    "@astram/engine": "0.8.0",
-    "@astram/guard": "0.15.0"
+    "@astram/core": "1.8.0",
+    "@astram/engine": "0.10.0",
+    "@astram/guard": "0.17.0"
   },
   "peerDependencies": {
     "@nestjs/common": "^11",