@astram/identity 0.15.0 → 0.17.0

package/dist/features/authz/role-binding.js

@@ -1,52 +1,39 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.subtreeExists = subtreeExists;
-exports.readRoleBinding = readRoleBinding;
+exports.ROLE_NOT_IN_COMPANY = void 0;
+exports.ownedInSubtree = ownedInSubtree;
+exports.readRoleOwner = readRoleOwner;
+exports.ownerInSubtree = ownerInSubtree;
+const http_js_1 = require("../shared/http.js");
+/** The 400 of a posting or service-account role owned by another company (G-013, spec §10). */
+exports.ROLE_NOT_IN_COMPANY = "The role is not one of this company's roles.";
 /**
- * The shared EXISTS-subtree fragment for a non-root caller's READS (Task 4.2): a role row `r`
- * qualifies only if it is bound (`membership_posting → company_membership`) to a node in the
- * subtree. The caller splices `params` where `sql` sits in the surrounding query.
+ * The grants-summary READ fragment for a non-root caller (G-013): a role row `r` qualifies only if
+ * its owner company is in the caller's subtree (the same owner rule as every other role route;
+ * before G-013 it was "posted to a node in the subtree", which hid owned roles nobody held yet). An
+ * empty subtree matches nothing. The caller splices `params` where `sql` sits in the query.
  */
-function subtreeExists(nodeIds, schemas) {
+function ownedInSubtree(nodeIds) {
+    if (nodeIds.length === 0)
+        return { sql: ' AND 1 = 0', params: [] };
     const ph = nodeIds.map(() => '?').join(', ');
-    const sql = ` AND EXISTS (` +
-        `SELECT 1 FROM \`${schemas.app}\`.\`membership_posting\` mp` +
-        ` JOIN \`${schemas.app}\`.\`company_membership\` cm ON cm.cm_uuid = mp.mp_membership_uuid` +
-        ` WHERE mp.mp_role_uuid = r.r_uuid AND cm.cm_company_uuid IN (${ph}))`;
-    return { sql, params: [...nodeIds] };
+    return { sql: ` AND r.r_owner_company_uuid IN (${ph})`, params: [...nodeIds] };
 }
-/** Coerce a driver aggregate (number | bigint | string | null) to a boolean. */
-function truthy(v) {
-    if (v === null || v === undefined)
-        return false;
-    if (typeof v === 'bigint')
-        return v !== 0n;
-    return Number(v) > 0;
-}
-/**
- * Read where `roleUuid` is bound relative to `nodeIds` (human postings + service accounts) in ONE
- * query. An empty `nodeIds` is treated as "nothing is inside" (every binding is outside) — fail
- * closed, never an `IN ()` syntax error.
- */
-async function readRoleBinding(q, roleUuid, nodeIds, schemas) {
-    const ids = nodeIds.length > 0 ? [...nodeIds] : [];
-    const inList = ids.length > 0 ? ids.map(() => '?').join(', ') : 'NULL';
-    // `x IN (NULL)` is NULL (never true) and `x NOT IN (NULL)` is NULL too, so for an empty list the
-    // outside test is written as a plain existence check instead.
-    const insideExpr = ids.length > 0 ? `b.node IN (${inList})` : '0';
-    const outsideExpr = ids.length > 0 ? `b.node NOT IN (${inList})` : '1';
-    const rows = (await q.query(`SELECT COALESCE(MAX(${insideExpr}), 0) AS bound_inside,
-            COALESCE(MAX(${outsideExpr}), 0) AS bound_outside
-       FROM (
-         SELECT cm.cm_company_uuid AS node
-           FROM \`${schemas.app}\`.\`membership_posting\` mp
-           JOIN \`${schemas.app}\`.\`company_membership\` cm ON cm.cm_uuid = mp.mp_membership_uuid
-          WHERE mp.mp_role_uuid = ?
-         UNION ALL
-         SELECT sa.sa_tenant_id AS node
-           FROM \`${schemas.app}\`.\`service_account\` sa
-          WHERE JSON_CONTAINS(sa.sa_role_ids, JSON_QUOTE(?))
-       ) b`, [...ids, ...ids, roleUuid, roleUuid]));
+/** Read `roleUuid`'s owner company on `q` (a pool or a transaction connection). */
+async function readRoleOwner(q, roleUuid, schemas) {
+    const rows = (await q.query(`SELECT r_owner_company_uuid AS owner FROM \`${schemas.app}\`.\`roles\` WHERE r_uuid = ? LIMIT 1`, [roleUuid]));
     const row = rows[0];
-    return { inside: truthy(row?.bound_inside), outside: truthy(row?.bound_outside) };
+    if (row === undefined)
+        return { exists: false, owner: null };
+    return {
+        exists: true,
+        owner: typeof row.owner === 'string' && row.owner.length > 0 ? row.owner : null,
+    };
+}
+/** Is the stored role owned by a node of `nodeIds`? An ownerless or missing role never is. */
+function ownerInSubtree(role, nodeIds) {
+    if (!role.exists || role.owner === null)
+        return false;
+    const owner = role.owner;
+    return nodeIds.some((n) => (0, http_js_1.sameUuid)(n, owner));
 }

package/dist/features/identity-feature.module.d.ts

@@ -37,17 +37,6 @@ export declare function assertFrameworkDatabaseAgrees(identityDatabase: string,
  * explicit `APP_DB_USER` / `APP_DB_NAME` still wins (QA P2-5).
  */
 export declare function engineDbFromEnv(schemas: FrameworkSchemas, env?: NodeJS.ProcessEnv): EngineDbConfig;
-/**
- * IdentityFeatureModule — the framework-owned identity FEATURE surface (company/user/role CRUD;
- * more in later phases) as thin controllers over the engine's RecordsService. The CONSUMER imports
- * `IdentityFeatureModule.forRoot()` alongside `ShieldModule.forRoot(...)` (ADR-0026) — @astram/guard
- * never imports @astram/identity. `forRoot()` SELF-WIRES the engine (EngineModule.forRoot over the
- * app's APP_DB_* env) + registers the identity objects + mounts the CRUD routes, so the consumer
- * needs no separate engine setup.
- *
- * CONTROLLER ORDER: RoleController is kept ahead of any future grant-admin controller (Phase 4) with
- * a conflicting `GET identity/roles/:uuid` path — a Nest route-precedence constraint.
- */
 export declare class IdentityFeatureModule {
     /**
      * @param rootIds the framework's root allowlist — pass the SAME array given to

package/dist/features/identity-feature.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-feature.module.d.ts","sourceRoot":"","sources":["../../src/features/identity-feature.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpE,OAAO,EAGL,KAAK,gBAAgB,EAEtB,MAAM,cAAc,CAAC;AACtB,OAAO,EAYL,KAAK,cAAc,EAGnB,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AAiDxB,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,yBAAyB,CAAC;AA0E/E;;;;;;GAMG;AACH,wBAAgB,0CAA0C,CAAC,SAAS,EAAE,OAAO,GAAG,IAAI,CAUnF;AAKD;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,GACzC,IAAI,CAwBN;AAKD;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAC3C,gBAAgB,EAAE,MAAM,EACxB,WAAW,EAAE;IAAE,QAAQ,CAAC,EAAE,CAAC,EAAE;QAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GAC/E,IAAI,CAQN;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,gBAAgB,EACzB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,cAAc,CAqBhB;AAED;;;;;;;;;;GAUG;AACH,qBACa,qBAAqB;IAChC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,MAAM,CAAC,OAAO,CAAC,EACb,OAAO,EACP,YAAiB,EACjB,OAAO,EAAE,YAAY,EACrB,MAAM,GACP,GAAE;QACD,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5B,YAAY,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;QAC1C,OAAO,CAAC,EAAE,gBAAgB,CAAC;QAC3B,MAAM,CAAC,EAAE,aAAa,CAAC;KACnB,GAAG,aAAa;CA+lBvB"}
+{"version":3,"file":"identity-feature.module.d.ts","sourceRoot":"","sources":["../../src/features/identity-feature.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpE,OAAO,EAGL,KAAK,gBAAgB,EAEtB,MAAM,cAAc,CAAC;AACtB,OAAO,EAYL,KAAK,cAAc,EAGnB,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AAwDxB,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,yBAAyB,CAAC;AA0G/E;;;;;;GAMG;AACH,wBAAgB,0CAA0C,CAAC,SAAS,EAAE,OAAO,GAAG,IAAI,CAUnF;AAKD;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,GACzC,IAAI,CAwBN;AAKD;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAC3C,gBAAgB,EAAE,MAAM,EACxB,WAAW,EAAE;IAAE,QAAQ,CAAC,EAAE,CAAC,EAAE;QAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GAC/E,IAAI,CAQN;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,gBAAgB,EACzB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,cAAc,CAqBhB;AA2BD,qBACa,qBAAqB;IAChC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,MAAM,CAAC,OAAO,CAAC,EACb,OAAO,EACP,YAAiB,EACjB,OAAO,EAAE,YAAY,EACrB,MAAM,GACP,GAAE;QACD,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5B,YAAY,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;QAC1C,OAAO,CAAC,EAAE,gBAAgB,CAAC;QAC3B,MAAM,CAAC,EAAE,aAAa,CAAC;KACnB,GAAG,aAAa;CA6pBvB"}

package/dist/features/identity-feature.module.js

@@ -34,6 +34,9 @@ const user_controller_js_1 = require("./user/user.controller.js");
 const invite_service_js_1 = require("./user/invite.service.js");
 const invite_config_js_1 = require("./user/invite.config.js");
 const invite_tokens_js_1 = require("./user/invite.tokens.js");
+const user_signin_admin_service_js_1 = require("./user/user-signin-admin.service.js");
+const user_mfa_status_js_1 = require("./user/user-mfa-status.js");
+const signin_admin_tokens_js_1 = require("./user/signin-admin.tokens.js");
 const membership_controller_js_1 = require("./membership/membership.controller.js");
 const membership_service_js_1 = require("./membership/membership.service.js");
 const posting_service_js_1 = require("./membership/posting.service.js");
@@ -51,6 +54,9 @@ const grant_admin_service_js_1 = require("./authz/grant-admin.service.js");
 const grant_admin_controller_js_1 = require("./authz/grant-admin.controller.js");
 const grant_ceiling_js_1 = require("./authz/grant-ceiling.js");
 const policy_service_js_1 = require("./policy/policy.service.js");
+const security_policy_service_js_1 = require("./security-policy/security-policy.service.js");
+const security_policy_controller_js_1 = require("./security-policy/security-policy.controller.js");
+const security_policy_version_bump_js_1 = require("./security-policy/security-policy-version-bump.js");
 const policy_controller_js_1 = require("./policy/policy.controller.js");
 const share_service_js_1 = require("./share/share.service.js");
 const share_controller_js_1 = require("./share/share.controller.js");
@@ -65,6 +71,7 @@ const mariadb_audit_reader_js_1 = require("./audit/mariadb-audit-reader.js");
 const directory_label_resolver_js_1 = require("./audit/directory-label-resolver.js");
 const audit_read_service_js_1 = require("./audit/audit-read.service.js");
 const audit_controller_js_1 = require("./audit/audit.controller.js");
+const auth_audit_sink_js_1 = require("./audit/auth-audit-sink.js");
 const cross_tenant_grant_read_service_js_1 = require("./cross-tenant/cross-tenant-grant-read.service.js");
 const cross_tenant_grant_controller_js_1 = require("./cross-tenant/cross-tenant-grant.controller.js");
 const grant_authorize_js_1 = require("./cross-tenant/grant-authorize.js");
@@ -87,6 +94,28 @@ let IdentityRecordAuthorizationModule = class IdentityRecordAuthorizationModule
 IdentityRecordAuthorizationModule = __decorate([
     (0, common_1.Module)({})
 ], IdentityRecordAuthorizationModule);
+/**
+ * Holds the default auth audit sink (R12.1, B-3), provided GLOBALLY under guard's
+ * `SHIELD_DEFAULT_AUTH_AUDIT_SINK` so guard's `AuthModule` (a sibling that never imports identity)
+ * injects it optionally for `SHIELD_AUDIT_SINK` when the app supplied no `auditSink`. Only this
+ * token is global.
+ */
+let IdentityDefaultAuthAuditSinkModule = class IdentityDefaultAuthAuditSinkModule {
+};
+IdentityDefaultAuthAuditSinkModule = __decorate([
+    (0, common_1.Module)({})
+], IdentityDefaultAuthAuditSinkModule);
+/**
+ * Signals guard that the security-policy feature is registered (auth capabilities R2, task 14):
+ * provided GLOBALLY under guard's `SHIELD_MFA_POLICY_FEATURE`, so guard's `AuthModule` turns on
+ * mandatory-2FA evaluation (login, request-path recompute, device confirm and removal). Only this
+ * token is global.
+ */
+let IdentityMfaPolicyFeatureModule = class IdentityMfaPolicyFeatureModule {
+};
+IdentityMfaPolicyFeatureModule = __decorate([
+    (0, common_1.Module)({})
+], IdentityMfaPolicyFeatureModule);
 /**
  * The boot check behind {@link IDENTITY_DECISION_AUTHORITY_CHECK}: with this module wired, the
  * request path must decide with the authority guard built from this module's inputs. A missing
@@ -187,6 +216,14 @@ function engineDbFromEnv(schemas, env = process.env) {
  * CONTROLLER ORDER: RoleController is kept ahead of any future grant-admin controller (Phase 4) with
  * a conflicting `GET identity/roles/:uuid` path — a Nest route-precedence constraint.
  */
+/** R11.3: guard's mandatory-2FA service, when bound (`null` unless the policy feature is on). */
+function hasStatusesFor(v) {
+    return typeof v?.statusesFor === 'function';
+}
+/** R11.3: guard's MariaDB requirement source with its batched confirmed-device read. */
+function hasConfirmedFactorsOf(v) {
+    return typeof v?.confirmedFactorsOf === 'function';
+}
 let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModule {
     /**
      * @param rootIds the framework's root allowlist — pass the SAME array given to
@@ -290,7 +327,8 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
             const rows = (await authzPool.query(`SELECT u_uuid AS id FROM \`${schemas.app}\`.\`users\` WHERE u_username = ? LIMIT 1`, [name]));
             return rows[0]?.id ?? null;
         };
-        const auditReadService = new audit_read_service_js_1.AuditReadService(auditReader, auditLabels, auditNameToId);
+        // KI #140: the same resolver tells users from service accounts (operations need no lookup).
+        const auditReadService = new audit_read_service_js_1.AuditReadService(auditReader, auditLabels, auditNameToId, auditLabels);
         // Cross-tenant grants (Phase 6): the ENTIRE offer/accept/revoke surface, SELF-WIRED here
         // over the SAME shared authzPool (no consumer code — astram3 hand-built this in its consumer
         // authz.module, the anti-pattern this replaces). A SECOND DecisionAuthority is built over the
@@ -526,6 +564,10 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
         const filesAudit = {
             record: (event) => filesAuditSink.record(event, (sql, params) => authzPool.query(sql, params)),
         };
+        // R12.1 / B-3: guard's auth events (sign-in, failure, logout, MFA devices) default to the SAME
+        // `<audit>.audit_log` (sealed into the per-tenant chain by guard's sealer, ADR-0044). Each row
+        // is one autocommit write on the shared pool, outside any business transaction.
+        const defaultAuthAuditSink = (0, auth_audit_sink_js_1.createDefaultAuthAuditSink)(new engine_1.MariaDbAuditSink(auditSinkConfig), (sql, params) => authzPool.query(sql, params));
         return {
             module: IdentityFeatureModule_1,
             imports: [
@@ -556,6 +598,20 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
                     providers: [{ provide: guard_1.SHIELD_RECORD_AUTHORIZATION, useValue: recordAuthorization }],
                     exports: [guard_1.SHIELD_RECORD_AUTHORIZATION],
                 },
+                // R12.1 / B-3: the default auth audit sink, global so guard's AuthModule sees it.
+                {
+                    module: IdentityDefaultAuthAuditSinkModule,
+                    global: true,
+                    providers: [{ provide: internal_1.SHIELD_DEFAULT_AUTH_AUDIT_SINK, useValue: defaultAuthAuditSink }],
+                    exports: [internal_1.SHIELD_DEFAULT_AUTH_AUDIT_SINK],
+                },
+                // Auth capabilities R2: the security-policy feature is registered, so guard evaluates it.
+                {
+                    module: IdentityMfaPolicyFeatureModule,
+                    global: true,
+                    providers: [{ provide: internal_1.SHIELD_MFA_POLICY_FEATURE, useValue: true }],
+                    exports: [internal_1.SHIELD_MFA_POLICY_FEATURE],
+                },
             ],
             // Route order: RoleController stays AHEAD of GrantAdminController (documented Nest
             // route-precedence constraint — the summary route `access/role-grants` dodges
@@ -583,6 +639,9 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
                 // Stored-file download (file-storage SPEC §3) — `files/:uuid` collides with nothing.
                 // Gated on `stored_file:read`; answers 501 when no object store is bound. Appended last.
                 files_controller_js_1.FilesController,
+                // Mandatory-2FA policies (auth capabilities R2.9) — `security-policies/*` collides with
+                // nothing. Gated on `security_policy:<action>`. Appended last.
+                security_policy_controller_js_1.SecurityPolicyController,
             ],
             providers: [
                 company_service_js_1.CompanyService,
@@ -593,6 +652,13 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
                 org_catalog_service_js_1.OrgCatalogService,
                 record_resolver_js_1.RecordResolverService,
                 { provide: posting_version_bump_js_1.POSTING_VERSION_BUMP, useValue: postingVersionBump },
+                // Mandatory-2FA policies (R2.6, R2.9): the service, and its permission-version bump over
+                // the ONE shared bumper (bumps on the write's transaction, published after the commit).
+                security_policy_service_js_1.SecurityPolicyService,
+                {
+                    provide: security_policy_version_bump_js_1.SECURITY_POLICY_VERSION_BUMP,
+                    useValue: new security_policy_version_bump_js_1.SecurityPolicyVersionBump(bumper, schemas),
+                },
                 // Phase 12 (KI #14): the admin email change goes through guard's ONE email-change helper
                 // (collision refusal + login-hint follow in one transaction), over the shared authz pool.
                 {
@@ -736,6 +802,29 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
                         : null,
                     inject: [{ token: internal_1.SHIELD_ATTEMPT_LIMITER_FACTORY, optional: true }],
                 },
+                // Auth capabilities R11 (task 18): admin sign-in controls (reset 2FA, unlock, end sessions).
+                // The resetter is guard's class over the ONE shared runtime pool (the MFA tables are not the
+                // engine's), with the `auth.mfa.reset_by_admin` row on its transaction; the unlock and
+                // end-sessions rows go through the same audit writer as `user.invited`.
+                user_signin_admin_service_js_1.UserSignInAdminService,
+                { provide: signin_admin_tokens_js_1.IDENTITY_MFA_RESETTER, useValue: new internal_1.MariaDbMfaResetter(authzPool, schemas) },
+                { provide: signin_admin_tokens_js_1.IDENTITY_SIGNIN_ADMIN_AUDIT, useValue: filesAudit },
+                // R11.3: the users list's batched `mfaStatus` (guard's service when the policy feature is on,
+                // else confirmed devices only; nothing wired ⇒ null and rows carry no mfaStatus).
+                {
+                    provide: signin_admin_tokens_js_1.IDENTITY_MFA_STATUS_READER,
+                    useFactory: (service, source) => (0, user_mfa_status_js_1.createUserMfaStatusReader)({
+                        query: (sql, params) => authzPool.query(sql, params),
+                        schemas,
+                        rootIds: rootIds ?? [],
+                        service: hasStatusesFor(service) ? service : null,
+                        devices: hasConfirmedFactorsOf(source) ? source : null,
+                    }),
+                    inject: [
+                        { token: internal_1.SHIELD_MFA_REQUIREMENT, optional: true },
+                        { token: internal_1.SHIELD_MFA_REQUIREMENT_SOURCE, optional: true },
+                    ],
+                },
                 {
                     provide: files_service_js_1.FilesService,
                     useFactory: (records, store) => new files_service_js_1.FilesService(records, store ?? null, filesAudit),

package/dist/features/membership/membership.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"membership.controller.d.ts","sourceRoot":"","sources":["../../../src/features/membership/membership.controller.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,KAAK,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAqB,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAG1E,iFAAiF;AACjF,UAAU,iBAAiB;IACzB,uFAAuF;IACvF,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED,4EAA4E;AAC5E,UAAU,cAAc;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,kFAAkF;IAClF,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAYD,qBAEa,oBAAoB;IAE7B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAFR,WAAW,EAAE,iBAAiB,EAC9B,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,qBAAqB;IAGlD;;;;;OAKG;IAGG,mBAAmB,CAA8B,QAAQ,EAAE,MAAM;;;IA0CvE,uEAAuE;IAGjE,iBAAiB,CACd,GAAG,EAAE,aAAa,EACI,QAAQ,EAAE,MAAM,EACrC,IAAI,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAUxC;;;;OAIG;IAGG,gBAAgB,CACb,GAAG,EAAE,aAAa,EACU,cAAc,EAAE,MAAM,EACjD,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAoB1E,2FAA2F;IAGrF,gBAAgB,CACb,GAAG,EAAE,aAAa,EACU,cAAc,EAAE,MAAM;;;IAM3D,0EAA0E;IAGpE,eAAe,CACZ,GAAG,EAAE,aAAa,EACU,cAAc,EAAE,MAAM,EACjD,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,YAAY,EAAE,CAAA;KAAE;;;IA4B7C;;;;OAIG;YACW,WAAW;CAM1B"}
+{"version":3,"file":"membership.controller.d.ts","sourceRoot":"","sources":["../../../src/features/membership/membership.controller.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,KAAK,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAqB,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAI1E,iFAAiF;AACjF,UAAU,iBAAiB;IACzB,uFAAuF;IACvF,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED,4EAA4E;AAC5E,UAAU,cAAc;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,kFAAkF;IAClF,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAYD,qBAEa,oBAAoB;IAE7B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAFR,WAAW,EAAE,iBAAiB,EAC9B,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,qBAAqB;IAGlD;;;;;OAKG;IAGG,mBAAmB,CAA8B,QAAQ,EAAE,MAAM;;;IA0CvE,uEAAuE;IAGjE,iBAAiB,CACd,GAAG,EAAE,aAAa,EACI,QAAQ,EAAE,MAAM,EACrC,IAAI,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAUxC;;;;OAIG;IAGG,gBAAgB,CACb,GAAG,EAAE,aAAa,EACU,cAAc,EAAE,MAAM,EACjD,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE;;;IA6B1E,2FAA2F;IAGrF,gBAAgB,CACb,GAAG,EAAE,aAAa,EACU,cAAc,EAAE,MAAM;;;IAM3D,0EAA0E;IAGpE,eAAe,CACZ,GAAG,EAAE,aAAa,EACU,cAAc,EAAE,MAAM,EACjD,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,YAAY,EAAE,CAAA;KAAE;;;IA4B7C;;;;OAIG;YACW,WAAW;CAM1B"}

package/dist/features/membership/membership.controller.js

@@ -20,6 +20,7 @@ const posting_service_js_1 = require("./posting.service.js");
 const record_resolver_js_1 = require("../shared/record-resolver.js");
 const http_js_1 = require("../shared/http.js");
 const identity_error_interceptor_js_1 = require("../shared/identity-error.interceptor.js");
+const identity_errors_js_1 = require("../shared/identity-errors.js");
 // ── Memberships + postings ───────────────────────────────────────────────────
 //
 // Gated on the `company_membership` / `membership_posting` grants via `@Classified`
@@ -92,16 +93,29 @@ let MembershipController = class MembershipController {
      * the invariant can deactivate the user's OTHER memberships.
      */
     async updateMembership(req, membershipUuid, body) {
-        if (body?.isActive === true) {
+        const activate = body?.isActive === true;
+        const status = typeof body?.status === 'string' ? body.status : undefined;
+        // G-011: the active membership has status `active`, so this pair can never succeed.
+        // Refused before any write.
+        if (activate && status !== undefined && status !== 'active') {
+            throw new identity_errors_js_1.IdentityBadRequestError('isActive and a non-active status cannot be set together');
+        }
+        let userUuid;
+        if (activate) {
             if (!body.userUuid) {
                 throw new common_1.ForbiddenException('userUuid is required to activate a membership');
             }
-            await this.memberships.setActive(req.principal, membershipUuid, (0, guard_1.uuidField)(body.userUuid, 'userUuid'));
+            userUuid = (0, guard_1.uuidField)(body.userUuid, 'userUuid');
         }
-        if (typeof body?.status === 'string') {
-            await this.memberships.updateMembership(req.principal, membershipUuid, {
-                status: body.status,
-            });
+        // Status `active` first, so one body can set it and then activate.
+        if (status === 'active') {
+            await this.memberships.updateMembership(req.principal, membershipUuid, { status });
+        }
+        if (userUuid !== undefined) {
+            await this.memberships.setActive(req.principal, membershipUuid, userUuid);
+        }
+        if (status !== undefined && status !== 'active') {
+            await this.memberships.updateMembership(req.principal, membershipUuid, { status });
         }
         return { success: true };
     }

package/dist/features/membership/membership.service.d.ts

@@ -9,6 +9,12 @@
  * (exactly one active per user) + `status`. This service owns the ONE invariant the DB
  * cannot express — one-active-per-user — because there is no partial-unique on
  * `cm_is_active`; `setActive` is the guard.
+ *
+ * Second invariant (G-011, F2): the active membership always has status exactly `active`.
+ * Grants read `cm_is_active = 1`, while scope-switch and the profile writer also require
+ * `cm_status = 'active'`; keeping the two in step on every write makes the readers agree.
+ * `setActive` refuses a target whose status is not `active`, and `updateMembership` refuses
+ * moving the active membership off `active`; each checks under a row lock in one transaction.
  */
 import { RecordsService, type RecordId, type RecordView } from '@astram/engine';
 import type { Principal } from '@astram/core';
@@ -56,16 +62,16 @@ export declare class MembershipService {
      * Flip which of the user's memberships is active — the ONE-ACTIVE invariant. The service
      * is the guard because the DB has no partial-unique on `cm_is_active`.
      *
-     * ⚠️ ORDER IS LOAD-BEARING (fail-safe against a LOGIN LOCKOUT). Each `update` is its OWN
-     * transaction (no cross-call atomicity), and the engine's `list` order (PK-ordered since the
-     * Phase 3 tiebreaker) says nothing about which membership is the target. So this MUST
-     * activate the TARGET FIRST, then deactivate the others:
-     *   - Worst case of a mid-loop failure is then a transient TWO-active window, which is
-     *     RECOVERABLE — the credential resolver reads `is_active=1 LIMIT 1`, so it still
-     *     resolves a tenant and login works.
-     *   - The forbidden alternative (deactivate-old-then-activate-target) can leave a
-     *     ZERO-active window on a mid-failure → the resolver returns null → the user is
-     *     LOCKED OUT of login until an admin re-activates. Never do that.
+     * The whole flip commits in ONE transaction (G-011), so a mid-loop failure rolls back and the
+     * user keeps the activation they had. Inside it:
+     *   - every membership of the user is locked in id order, then re-listed, so two concurrent
+     *     flips for the same user queue instead of deadlocking, and a membership added since the
+     *     pre-check is still deactivated;
+     *   - the target's status is re-read under its lock: only status `active` may be activated;
+     *   - the TARGET is activated FIRST, then the others are deactivated. Atomicity makes the
+     *     order a defence in depth now, but keep it: deactivate-first is the order that can leave
+     *     ZERO active (a login lockout: the credential resolver finds no tenant) if atomicity is
+     *     ever lost.
      *
      * Guard: if `membershipUuid` is NOT one of the user's memberships, throw — otherwise the
      * loop would deactivate everything and activate nothing (also a zero-active lockout).

package/dist/features/membership/membership.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"membership.service.d.ts","sourceRoot":"","sources":["../../../src/features/membership/membership.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAwB,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE1F,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AASzD,qBACa,iBAAiB;IAE1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAGxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAQxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAXZ,OAAO,EAAE,cAAc,EAGvB,OAAO,EAAE,YAAY,EAQrB,WAAW,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA;IAG1D;;;;OAIG;YACW,WAAW;IAQzB;;;;;;OAMG;YACW,WAAW;IAYzB;;;;;;OAMG;IACG,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAkB/F;;;;;;;OAOG;IACG,mBAAmB,CACvB,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,QAAQ,CAAC;IAwBpB,kEAAkE;IAC5D,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC;IAKvE;;;;;;;;;;;;;;;;;OAiBG;IACG,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAsC1F;;;;OAIG;IACG,gBAAgB,CACpB,KAAK,EAAE,SAAS,EAChB,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GACzB,OAAO,CAAC,IAAI,CAAC;IAchB;;;OAGG;IACG,gBAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAYhF"}
+{"version":3,"file":"membership.service.d.ts","sourceRoot":"","sources":["../../../src/features/membership/membership.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAwB,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE1F,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAYzD,qBACa,iBAAiB;IAE1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAGxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAQxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAXZ,OAAO,EAAE,cAAc,EAGvB,OAAO,EAAE,YAAY,EAQrB,WAAW,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA;IAG1D;;;;OAIG;YACW,WAAW;IAQzB;;;;;;OAMG;YACW,WAAW;IAYzB;;;;;;OAMG;IACG,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAkB/F;;;;;;;OAOG;IACG,mBAAmB,CACvB,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,QAAQ,CAAC;IAwBpB,kEAAkE;IAC5D,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC;IAKvE;;;;;;;;;;;;;;;;;OAiBG;IACG,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA0D1F;;;;OAIG;IACG,gBAAgB,CACpB,KAAK,EAAE,SAAS,EAChB,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GACzB,OAAO,CAAC,IAAI,CAAC;IA4BhB;;;OAGG;IACG,gBAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAYhF"}

package/dist/features/membership/membership.service.js

@@ -10,6 +10,12 @@
  * (exactly one active per user) + `status`. This service owns the ONE invariant the DB
  * cannot express — one-active-per-user — because there is no partial-unique on
  * `cm_is_active`; `setActive` is the guard.
+ *
+ * Second invariant (G-011, F2): the active membership always has status exactly `active`.
+ * Grants read `cm_is_active = 1`, while scope-switch and the profile writer also require
+ * `cm_status = 'active'`; keeping the two in step on every write makes the readers agree.
+ * `setActive` refuses a target whose status is not `active`, and `updateMembership` refuses
+ * moving the active membership off `active`; each checks under a row lock in one transaction.
  */
 var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -30,6 +36,8 @@ const engine_1 = require("@astram/engine");
 const posting_version_bump_js_1 = require("./posting-version-bump.js");
 const identity_errors_js_1 = require("../shared/identity-errors.js");
 const grant_ceiling_js_1 = require("../authz/grant-ceiling.js");
+/** The only status the active membership may have (case-sensitive, as the readers' predicate). */
+const ACTIVE_STATUS = 'active';
 /** A driver duplicate-key error (errno 1062), recognised by errno/code only, never its message. */
 function isDuplicateKey(err) {
     if (typeof err !== 'object' || err === null)
@@ -150,16 +158,16 @@ let MembershipService = class MembershipService {
      * Flip which of the user's memberships is active — the ONE-ACTIVE invariant. The service
      * is the guard because the DB has no partial-unique on `cm_is_active`.
      *
-     * ⚠️ ORDER IS LOAD-BEARING (fail-safe against a LOGIN LOCKOUT). Each `update` is its OWN
-     * transaction (no cross-call atomicity), and the engine's `list` order (PK-ordered since the
-     * Phase 3 tiebreaker) says nothing about which membership is the target. So this MUST
-     * activate the TARGET FIRST, then deactivate the others:
-     *   - Worst case of a mid-loop failure is then a transient TWO-active window, which is
-     *     RECOVERABLE — the credential resolver reads `is_active=1 LIMIT 1`, so it still
-     *     resolves a tenant and login works.
-     *   - The forbidden alternative (deactivate-old-then-activate-target) can leave a
-     *     ZERO-active window on a mid-failure → the resolver returns null → the user is
-     *     LOCKED OUT of login until an admin re-activates. Never do that.
+     * The whole flip commits in ONE transaction (G-011), so a mid-loop failure rolls back and the
+     * user keeps the activation they had. Inside it:
+     *   - every membership of the user is locked in id order, then re-listed, so two concurrent
+     *     flips for the same user queue instead of deadlocking, and a membership added since the
+     *     pre-check is still deactivated;
+     *   - the target's status is re-read under its lock: only status `active` may be activated;
+     *   - the TARGET is activated FIRST, then the others are deactivated. Atomicity makes the
+     *     order a defence in depth now, but keep it: deactivate-first is the order that can leave
+     *     ZERO active (a login lockout: the credential resolver finds no tenant) if atomicity is
+     *     ever lost.
      *
      * Guard: if `membershipUuid` is NOT one of the user's memberships, throw — otherwise the
      * loop would deactivate everything and activate nothing (also a zero-active lockout).
@@ -176,17 +184,35 @@ let MembershipService = class MembershipService {
             // (a login lockout). Fail-closed. No ids in the message (ADR-0012).
             throw new identity_errors_js_1.IdentityNotFoundError('Membership not found.');
         }
-        // 1) TARGET FIRST — guarantees an active membership exists before any deactivation, so
-        //    a mid-failure below leaves TWO active (recoverable), never ZERO (lockout).
-        await this.records.update('company_membership', target.id, { fields: { isActive: true } });
-        // 2) Deactivate every OTHER membership (skip the target we just activated).
         const deactivated = [];
-        for (const m of page.rows) {
-            if (m.id === membershipUuid)
-                continue;
-            await this.records.update('company_membership', m.id, { fields: { isActive: false } });
-            deactivated.push(m);
-        }
+        await this.records.transaction(async (tx) => {
+            // G-011: lock the user's memberships in id order FIRST (one queue per user, no lock-order
+            // deadlock). The locks are locking reads, so the plain reads below take their snapshot
+            // after them and see every committed change: the re-list (a membership added since the
+            // pre-check is still deactivated) and the target's status.
+            for (const id of page.rows.map((m) => String(m.id)).sort()) {
+                await tx.lockForUpdate('company_membership', id);
+            }
+            const rows = (await tx.list('company_membership', { where: { userUuid } })).rows;
+            if (!rows.some((m) => m.id === membershipUuid)) {
+                throw new identity_errors_js_1.IdentityNotFoundError('Membership not found.');
+            }
+            const current = await tx.get('company_membership', target.id);
+            if (current === null)
+                throw new identity_errors_js_1.IdentityNotFoundError('Membership not found.');
+            if (current.fields?.status !== ACTIVE_STATUS) {
+                throw new identity_errors_js_1.IdentityConflictError('Only a membership with status active can be made the active membership.');
+            }
+            // 1) TARGET FIRST (defence in depth, see the method comment).
+            await tx.update('company_membership', target.id, { fields: { isActive: true } });
+            // 2) Deactivate every OTHER membership (skip the target we just activated).
+            for (const m of rows) {
+                if (m.id === membershipUuid)
+                    continue;
+                await tx.update('company_membership', m.id, { fields: { isActive: false } });
+                deactivated.push(m);
+            }
+        });
         // ADR-0011 STALENESS FIX: activation ADDS the target company's role grants and each
         // deactivation REMOVES that company's grants — a coarse-grant change in BOTH directions.
         // A user's memberships can span DIFFERENT companies, so setActive may affect MULTIPLE
@@ -210,6 +236,8 @@ let MembershipService = class MembershipService {
         const fields = {};
         if (typeof patch?.status === 'string')
             fields.status = patch.status;
+        if (Object.keys(fields).length === 0)
+            return;
         // NO version bump here (ADR-0011): this patches `status` ONLY — `isActive` is
         // deliberately not a patch key (activity flips solely via `setActive`, which bumps),
         // and the controller only ever passes `{ status }`. Coarse-grant resolution gates on
@@ -217,7 +245,19 @@ let MembershipService = class MembershipService {
         // resolve → the warm cache stays correct → no invalidation needed. If a future patch key
         // is ever added here that CAN change which roles/postings resolve, it MUST bump the
         // membership's tenant (mirror `setActive`).
-        await this.records.update('company_membership', membershipUuid, { fields });
+        await this.records.transaction(async (tx) => {
+            // G-011: the active membership keeps status `active`. Lock and re-read on this
+            // transaction so a concurrent `setActive` cannot activate it between check and write.
+            await tx.lockForUpdate('company_membership', membershipUuid);
+            const current = await tx.get('company_membership', membershipUuid);
+            if (current === null)
+                throw new identity_errors_js_1.IdentityNotFoundError('Membership not found.');
+            // TINYINT(1): the engine returns 1/0, not true/false.
+            if (current.fields?.isActive && fields.status !== ACTIVE_STATUS) {
+                throw new identity_errors_js_1.IdentityConflictError('Make another membership active before changing the status of the active one.');
+            }
+            await tx.update('company_membership', membershipUuid, { fields });
+        });
     }
     /**
      * Remove a membership card (its postings cascade at the DB via FK ON DELETE CASCADE). A peer's

package/dist/features/membership/posting.service.d.ts

@@ -10,10 +10,11 @@
  * A posting IS a role assignment, so before ANY write the actor (the request principal) must:
  *   - reach the membership (a walled `records.get` → null ⇒ 404; the engine's ADR-0034 create
  *     wall re-checks the posting's membership company inside the transaction);
- *   - for every ADDED role: the role is bound within the actor's subtree or not bound at all
- *     (`GrantCeiling.assertRoleAssignable` — a role also used elsewhere is never assignable),
- *     and the role's keys are all held by the actor (`assertCanAssignRoles`, ADR-0029 applied to
- *     assignment). Removals need no ceiling: self-demotion stays allowed.
+ *   - for every ADDED role: the role is owned by the membership's company (G-013,
+ *     `GrantCeiling.assertRoleAssignable` — another company's or an ownerless role is a 400, for
+ *     every actor, root included), and the role's keys are all held by the actor
+ *     (`assertCanAssignRoles`, ADR-0029 applied to assignment). Removals need no ceiling:
+ *     self-demotion stays allowed.
  *   - for every ADDED posting: its department and branch belong to the membership's company
  *     (`assertOrgUnitsInCompany`, Phase 9 #13b) — else 400.
  *
@@ -66,10 +67,28 @@ export declare class PostingService {
     private assertEveryRole;
     /** The membership through the subtree read wall (404 when out of reach) and its company. */
     private reachMembership;
-    /** Authority for ADDED postings (binding rule, ceiling, org units); returns the distinct roles. */
+    /** Authority for ADDED postings (owner rule, ceiling, org units); returns the distinct roles. */
     private assertMayAdd;
-    /** Lock each added role row on the transaction, then re-run the binding rule (review F2). */
+    /**
+     * Lock each added role row on the transaction, then re-check the owner rule (review F2, G-013).
+     * A role changes owner only through its company's delete (owner cleared), which also removes the
+     * memberships of that company, so the re-check after the lock sees the committed outcome.
+     */
     private lockAndRecheck;
+    /**
+     * G-012 (spec §5.A, NAES review D): lock every ADDED posting's department and branch row on THIS
+     * transaction (departments then branches, each sorted and de-duplicated: one lock order), then
+     * re-check that each still belongs to the membership's company. A department/branch delete locks
+     * the same row and counts postings after its lock, so the two serialise: delete first ⇒ the unit
+     * (and its junction row, which cascades) is gone and this add is refused with 400; add first ⇒
+     * the delete counts this posting and answers 409. The FK is never reached, so no driver error.
+     *
+     * The re-check reuses `assertOrgUnitsInCompany` (fresh reads on the authz pool, after the lock is
+     * held, so they see the committed delete) rather than an engine read: the org bootstrap's
+     * `postings` step is gate-7 capped to membership types and may not read `department`/`branch`.
+     * The pre-transaction check already passed, so a failure here can only mean the row is gone.
+     */
+    private lockOrgUnits;
     private bumpTenant;
 }
 //# sourceMappingURL=posting.service.d.ts.map

package/dist/features/membership/posting.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"posting.service.d.ts","sourceRoot":"","sources":["../../../src/features/membership/posting.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,EAAE,cAAc,EAAE,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAwB,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC1F,OAAO,EAAE,YAAY,EAA6B,MAAM,2BAA2B,CAAC;AAOpF;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACvC,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CACzC;AA0ED,qBACa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAGxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAKxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBARZ,OAAO,EAAE,cAAc,EAGvB,OAAO,EAAE,YAAY,EAKrB,WAAW,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA;IAG1D,gEAAgE;IAC1D,YAAY,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC;IAK1E;;;;;OAKG;IACG,eAAe,CACnB,KAAK,EAAE,SAAS,EAChB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,SAAS,YAAY,EAAE,GAC/B,OAAO,CAAC,IAAI,CAAC;IAyEhB;;;;;;OAMG;IACG,WAAW,CACf,KAAK,EAAE,SAAS,EAChB,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE,SAAS,YAAY,EAAE,EAC9B,IAAI,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,MAAM,EAAE,CAAA;KAAE,GACpE,OAAO,CAAC,IAAI,CAAC;IA2ChB,OAAO,CAAC,eAAe;IAQvB,4FAA4F;YAC9E,eAAe;IAY7B,mGAAmG;YACrF,YAAY;IAqB1B,6FAA6F;YAC/E,cAAc;YAYd,UAAU;CAkBzB"}
+{"version":3,"file":"posting.service.d.ts","sourceRoot":"","sources":["../../../src/features/membership/posting.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAGH,OAAO,EAAE,cAAc,EAAE,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAwB,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC1F,OAAO,EAAE,YAAY,EAA6B,MAAM,2BAA2B,CAAC;AAOpF;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACvC,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CACzC;AA0ED,qBACa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAGxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAKxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBARZ,OAAO,EAAE,cAAc,EAGvB,OAAO,EAAE,YAAY,EAKrB,WAAW,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA;IAG1D,gEAAgE;IAC1D,YAAY,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC;IAK1E;;;;;OAKG;IACG,eAAe,CACnB,KAAK,EAAE,SAAS,EAChB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,SAAS,YAAY,EAAE,GAC/B,OAAO,CAAC,IAAI,CAAC;IA0EhB;;;;;;OAMG;IACG,WAAW,CACf,KAAK,EAAE,SAAS,EAChB,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE,SAAS,YAAY,EAAE,EAC9B,IAAI,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,MAAM,EAAE,CAAA;KAAE,GACpE,OAAO,CAAC,IAAI,CAAC;IA4ChB,OAAO,CAAC,eAAe;IAQvB,4FAA4F;YAC9E,eAAe;IAY7B,iGAAiG;YACnF,YAAY;IAuB1B;;;;OAIG;YACW,cAAc;IAa5B;;;;;;;;;;;;OAYG;YACW,YAAY;YA+BZ,UAAU;CAkBzB"}