@astram/identity 0.16.0 → 0.17.0

package/dist/features/role/role.service.js

@@ -12,7 +12,8 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.RoleService = void 0;
+exports.RoleService = exports.NO_ROLE_COMPANY = void 0;
+exports.roleNameMessage = roleNameMessage;
 const common_1 = require("@nestjs/common");
 const engine_1 = require("@astram/engine");
 const core_1 = require("@astram/core");
@@ -20,17 +21,64 @@ const list_query_js_1 = require("../shared/list-query.js");
 const grant_ceiling_js_1 = require("../authz/grant-ceiling.js");
 const grant_admin_service_js_1 = require("../authz/grant-admin.service.js");
 const posting_version_bump_js_1 = require("../membership/posting-version-bump.js");
+const identity_errors_js_1 = require("../shared/identity-errors.js");
+const org_unit_name_js_1 = require("../org-structure/org-unit-name.js");
 const ROLE_SEARCH_FIELDS = ['name'];
 const ROLE_SORT_FIELDS = ['name', 'createdAt'];
+/** The 400 of `POST /identity/roles` for a caller with no company to own the role (spec §10). */
+exports.NO_ROLE_COMPANY = 'Choose a company for the role.';
+/** The fixed, user-facing 400 text for a refused role name (the G-012 rule, spec §10). */
+function roleNameMessage(reason) {
+    switch (reason) {
+        case 'control_character':
+            return 'A role name cannot contain control characters.';
+        case 'too_long':
+            return `A role name can be at most ${org_unit_name_js_1.ORG_UNIT_NAME_MAX} characters.`;
+        default:
+            return 'Enter a role name.';
+    }
+}
+/** A role or company row has a single uuid key; a composite id here is a wiring defect. */
+function singleId(id) {
+    if (typeof id !== 'string')
+        throw new TypeError('role/company id is not a single uuid');
+    return id;
+}
+/** A driver foreign-key miss (1452: the owner company does not exist), by errno/code only. */
+function isMissingParent(err) {
+    const e = err;
+    return e.errno === 1452 || e.code === 'ER_NO_REFERENCED_ROW_2';
+}
+/** A driver duplicate-key error, by errno/code only (its message names the value: never echoed). */
+function isDuplicateKey(err) {
+    if (typeof err !== 'object' || err === null)
+        return false;
+    const e = err;
+    return e.errno === 1062 || e.code === 'ER_DUP_ENTRY';
+}
+function nameOf(view) {
+    const name = view.fields?.name;
+    return typeof name === 'string' && name.length > 0 ? name : '(unknown)';
+}
+function ownerOf(view) {
+    const owner = view.fields?.ownerCompanyUuid;
+    return typeof owner === 'string' && owner.length > 0 ? owner : null;
+}
+function duplicate(storedName) {
+    return new identity_errors_js_1.IdentityConflictError(`A role named "${storedName}" already exists in this company.`);
+}
 /**
- * RoleService — role CRUD on the paved road, via the framework's RecordsService
- * facade. The facade supplies the acting identity (the request principal) for the pipe;
- * no raw SQL, no RECORD_ENGINE.
+ * RoleService — role CRUD on the paved road, via the framework's RecordsService facade (the engine
+ * pipe: gate, wall, validate, write, audit). No raw SQL, no RECORD_ENGINE.
  *
- * Roles are a GLOBAL catalog, so renaming or deleting one changes every tenant that uses it (a
- * delete cascades its postings). Security hardening #1 (D1 interim rule): update/delete first pass
- * `GrantCeiling.assertRoleAdministrable` — the role must be bound inside the actor's subtree and
- * nowhere outside it (a shared role is root-only). The engine's write wall still applies after.
+ * G-013 (spec §5.A, ADR-0047): every role is OWNED by one company (`ownerCompanyUuid`, immutable),
+ * stamped here from the reached company (or the caller's active company on the legacy route), never
+ * from a request body (R1). The role object's `readScope` walls every read and write by that owner
+ * (R3: out of reach ⇒ 404; an ownerless legacy row is root only, R5). Names follow the G-012 rule
+ * (`normaliseOrgUnitName`) and are unique within the owner company under the column collation; the
+ * check runs under a lock inside one transaction and the per-company unique index is the backstop
+ * (a driver 1062 ⇒ the same 409, R6). Rename and delete first pass
+ * `GrantCeiling.assertRoleAdministrable` (owner in the actor's subtree, else 404).
  */
 let RoleService = class RoleService {
     records;
@@ -44,40 +92,102 @@ let RoleService = class RoleService {
         this.grants = grants;
     }
     /**
-     * Create a role. The owner is derived here from the actor, never from a client value: a non-root
-     * actor's role is owned by its active company (else its tenant); root's role is shared (no owner).
-     * A root-flagged actor bound to a declared operation (the org bootstrap's `roles` step, Shield #9)
-     * is anchored at the tenant it creates roles for, so its role is owned by that tenant.
-     * No actor (internal callers) ⇒ no owner field.
+     * Create a role (`POST /identity/roles`, kept for existing clients). Owner = the caller's active
+     * company, else its tenant; a caller with neither ⇒ 400 "Choose a company for the role." The
+     * company is then reached and locked exactly as {@link createCompanyRole} does.
+     *
+     * `companyUuid` is for the org bootstrap only (spec §5.E): the bound `roles` step names the
+     * DECLARING company explicitly and holds no company key (gate 7), so that company is not read or
+     * locked here; the engine's create wall checks the owner against the actor's reach, the duplicate
+     * check runs in the transaction and the unique index is the backstop.
      */
-    createRole(name, actor) {
-        const fields = { name };
-        if (actor && (actor.isRoot !== true || (0, engine_1.operationOf)(actor) !== undefined)) {
-            fields.ownerCompanyUuid = actor.activeScopeNodeId ?? actor.tenantId;
+    async createRole(rawName, actor, companyUuid) {
+        const name = this.validName(rawName);
+        if (companyUuid !== undefined) {
+            if (companyUuid.length === 0)
+                throw new identity_errors_js_1.IdentityBadRequestError(exports.NO_ROLE_COMPANY);
+            // Bootstrap-only path (no company read: its gate-7 step holds role keys only). A company that
+            // does not exist fails the owner FK (1452): answered as 404, never the driver error.
+            try {
+                return await this.mappingDuplicates(() => companyUuid, name, () => this.records.transaction((tx) => this.insertRole(tx, companyUuid, name)));
+            }
+            catch (err) {
+                if (isMissingParent(err))
+                    throw new identity_errors_js_1.IdentityNotFoundError('Company not found.');
+                throw err;
+            }
         }
-        return this.records.create('role', { fields });
+        const company = actor.activeScopeNodeId || actor.tenantId;
+        if (typeof company !== 'string' || company.length === 0) {
+            throw new identity_errors_js_1.IdentityBadRequestError(exports.NO_ROLE_COMPANY);
+        }
+        return (await this.createInCompany(company, name)).uuid;
     }
-    /** List roles (tenant-scoped by the pipe), with paging/search/sort. */
+    /**
+     * Create a role in `companyUuid` (`POST /identity/companies/:companyUuid/roles`): normalise the
+     * name; in one transaction lock the company, reach it through the wall (404), refuse a name the
+     * company already holds (409 naming the stored role) and create the role owned by the REACHED
+     * company. Returns `{ uuid, name }` (the stored name).
+     */
+    async createCompanyRole(companyUuid, rawName) {
+        return this.createInCompany(companyUuid, this.validName(rawName));
+    }
+    /**
+     * One company's own roles (`GET /identity/companies/:companyUuid/roles`): the company is reached
+     * through the walled read first (404 when out of reach), then its roles are listed with the same
+     * paging, search and sort allowlists as {@link listRoles}.
+     */
+    async listCompanyRoles(companyUuid, query) {
+        const company = await this.records.get('company', companyUuid);
+        if (company === null)
+            throw new identity_errors_js_1.IdentityNotFoundError('Company not found.');
+        const { page, limit, params } = (0, list_query_js_1.parseListQuery)(query);
+        const listQuery = {
+            ...(0, list_query_js_1.buildListQuery)(params, ROLE_SEARCH_FIELDS, ROLE_SORT_FIELDS),
+            where: { ownerCompanyUuid: singleId(company.id) },
+        };
+        const result = await this.records.list('role', listQuery);
+        return { total: result.total, rows: result.rows, page, limit };
+    }
+    /** List roles (walled by owner through the role object's readScope), with paging/search/sort. */
     listRoles(params) {
         return this.records.list('role', (0, list_query_js_1.buildListQuery)(params, ROLE_SEARCH_FIELDS, ROLE_SORT_FIELDS));
     }
-    /** Read a single role. */
+    /** Read a single role (walled by owner). */
     getRole(uuid) {
         return this.records.get('role', uuid);
     }
-    /** Rename a role — only a role the actor may administer (binding rule). Patch whitelisted. */
+    /**
+     * Rename a role — only a role the actor may administer (owner in reach, else 404). The name goes
+     * through the name rule (400); in one transaction the role row is locked, re-read through the wall
+     * (404; ownerless ⇒ root only), and a name another role of the same company holds is refused (409
+     * naming the stored role). The same name ⇒ no write. Only `name` is ever written.
+     */
     async updateRole(actor, uuid, patch) {
         await this.ceiling.assertRoleAdministrable(actor, uuid);
-        const fields = {};
-        if (typeof patch?.name === 'string')
-            fields.name = patch.name;
-        await this.records.update('role', uuid, { fields });
+        const name = this.validName(patch?.name);
+        let owner = null;
+        await this.mappingDuplicates(() => owner, name, () => this.records.transaction(async (tx) => {
+            await tx.lockForUpdate('role', uuid);
+            const row = await tx.get('role', uuid);
+            if (row === null)
+                throw new identity_errors_js_1.IdentityNotFoundError('Role not found.');
+            owner = ownerOf(row);
+            if (owner === null && actor.isRoot !== true) {
+                throw new identity_errors_js_1.IdentityNotFoundError('Role not found.');
+            }
+            if (row.fields?.name === name)
+                return; // same name: no write
+            if (owner !== null)
+                await this.assertNameFree(tx, owner, name, singleId(row.id));
+            await tx.update('role', row.id, { fields: { name } });
+        }));
     }
     /**
-     * Delete a role — only a role the actor may administer (binding rule) AND whose every holder the
+     * Delete a role — only a role the actor may administer (owner rule) AND whose every holder the
      * actor dominates (Phase 8 #2: the delete cascades the holders' postings, stripping their
      * authority). In ONE transaction: lock the role row (the posting and grant paths lock the same
-     * row first), re-check the binding rule and holder dominance against what is committed now, read
+     * row first), re-check the owner rule and holder dominance against what is committed now, read
      * the holder tenants (before the cascade removes the postings), then delete. After the commit,
      * every holder tenant's permission version is bumped so cached roles drop at the next request.
      * The bump runs after the commit, never before: an earlier bump would let a session reload the
@@ -124,6 +234,73 @@ let RoleService = class RoleService {
             throw new core_1.AuthorizationUnavailableError('permission version bump failed', cause);
         }
     }
+    // ------------------------------------------------------------------------------- internals
+    validName(raw) {
+        const result = (0, org_unit_name_js_1.normaliseOrgUnitName)(raw);
+        if (!result.ok)
+            throw new identity_errors_js_1.IdentityBadRequestError(roleNameMessage(result.reason));
+        return result.value;
+    }
+    /** Lock the company FIRST, reach it through the wall (404), then create the role it owns. */
+    async createInCompany(companyUuid, name) {
+        let owner = companyUuid;
+        const uuid = await this.mappingDuplicates(() => owner, name, () => this.records.transaction(async (tx) => {
+            await tx.lockForUpdate('company', companyUuid);
+            const company = await tx.get('company', companyUuid);
+            if (company === null)
+                throw new identity_errors_js_1.IdentityNotFoundError('Company not found.');
+            owner = singleId(company.id);
+            return this.insertRole(tx, owner, name);
+        }));
+        return { uuid, name };
+    }
+    /** Duplicate check, then the role owned by `owner`, on the caller's transaction. */
+    async insertRole(tx, owner, name) {
+        await this.assertNameFree(tx, owner, name, undefined);
+        return singleId(await tx.create('role', { fields: { name, ownerCompanyUuid: owner } }));
+    }
+    /**
+     * Refuse a name another role of the same company already holds. The engine's equality runs under
+     * the column collation (`utf8mb4_unicode_ci`: case, accents and width fold), so "manager" finds
+     * "Manager"; the 409 names the STORED clashing role.
+     */
+    async assertNameFree(tx, owner, name, self) {
+        const clash = await this.findByName(tx, owner, name, self);
+        if (clash !== undefined)
+            throw duplicate(nameOf(clash));
+    }
+    async findByName(reader, owner, name, self) {
+        const rows = (await reader.list('role', { where: { ownerCompanyUuid: owner, name }, limit: 2 }))
+            .rows;
+        return rows.find((r) => self === undefined || singleId(r.id) !== self);
+    }
+    /**
+     * Run a create/rename; a driver duplicate key (the per-company unique index, the backstop for a
+     * concurrent write) becomes the same 409 naming the stored role. Errno only: the driver's message
+     * holds the value and is never echoed (KI #87).
+     */
+    async mappingDuplicates(owner, name, write) {
+        try {
+            return await write();
+        }
+        catch (err) {
+            if (!isDuplicateKey(err))
+                throw err;
+            let stored = name;
+            const company = owner();
+            if (company !== null) {
+                try {
+                    const clash = await this.findByName(this.records, company, name);
+                    if (clash !== undefined)
+                        stored = nameOf(clash);
+                }
+                catch {
+                    // The 409 stands; the submitted name names the clash.
+                }
+            }
+            throw duplicate(stored);
+        }
+    }
 };
 exports.RoleService = RoleService;
 exports.RoleService = RoleService = __decorate([

package/dist/features/security-policy/security-policy-version-bump.d.ts

@@ -0,0 +1,41 @@
+import type { PermissionVersionBumper } from '../authz/permission-version.bumper.js';
+import type { IdentitySchemaNames } from '../../schema.js';
+/** The query surface used here: the write transaction's own connection (via `transactionQueryOf`). */
+export interface Queryable {
+    query(sql: string, params?: readonly unknown[]): Promise<unknown>;
+}
+type Bumper = Pick<PermissionVersionBumper, 'bumpForTenant' | 'publishCommitted' | 'discardPending'>;
+/**
+ * Permission-version bump for a security-policy write (auth capabilities R2.5, F17): every tenant
+ * whose signed-in users the policy can affect gets its version bumped ON THE WRITE'S TRANSACTION,
+ * so the policy and the bump commit or roll back together, and guard's recompute (task 14) sees
+ * the change on each user's next request. The new versions reach Redis only after the commit
+ * (`publishCommitted`, the ONE `PermissionVersionBumper`, ADR-0035).
+ *
+ * Which tenants:
+ *  - a scoped policy: its node and every descendant (`scope_closure`). A policy at a node applies
+ *    only to sessions ACTIVE at that node or below it (core rule; the version key is the active
+ *    node's), so ancestors are not bumped (review round 1, item I).
+ *  - a platform floor policy: every company (no global version exists). One INSERT-or-increment
+ *    per company inside the transaction; a floor write is a rare root action.
+ *
+ * Any read or bump failure is an `AuthorizationUnavailableError` with a fixed message (503, the
+ * write rolls back): a policy must never commit without its bump.
+ */
+export declare class SecurityPolicyVersionBump {
+    private readonly bumper;
+    private readonly schemas;
+    constructor(bumper: Bumper, schemas: IdentitySchemaNames);
+    /** The tenants a policy at `scopeNodeId` (`null` = platform floor) can affect. */
+    tenantsInScope(scopeNodeId: string | null, conn: Queryable): Promise<string[]>;
+    /** Increment each tenant's permission version on `conn` (published after the commit). */
+    bump(tenants: readonly string[], conn: Queryable): Promise<void>;
+    /** Publish the versions bumped on `conn` — call after the commit. Never throws. */
+    publishCommitted(conn: Queryable): Promise<void>;
+    /** Drop the versions bumped on `conn` — call after a rollback. */
+    discardPending(conn: Queryable): void;
+}
+/** DI token for the {@link SecurityPolicyVersionBump} built in `IdentityFeatureModule.forRoot`. */
+export declare const SECURITY_POLICY_VERSION_BUMP: unique symbol;
+export {};
+//# sourceMappingURL=security-policy-version-bump.d.ts.map

package/dist/features/security-policy/security-policy-version-bump.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-policy-version-bump.d.ts","sourceRoot":"","sources":["../../../src/features/security-policy/security-policy-version-bump.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAE3D,sGAAsG;AACtG,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAED,KAAK,MAAM,GAAG,IAAI,CAChB,uBAAuB,EACvB,eAAe,GAAG,kBAAkB,GAAG,gBAAgB,CACxD,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,yBAAyB;IAElC,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,mBAAmB;IAG/C,kFAAkF;IAC5E,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAmBpF,yFAAyF;IACnF,IAAI,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAQtE,mFAAmF;IACnF,gBAAgB,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAIhD,kEAAkE;IAClE,cAAc,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI;CAGtC;AAED,mGAAmG;AACnG,eAAO,MAAM,4BAA4B,eAAyC,CAAC"}

package/dist/features/security-policy/security-policy-version-bump.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SECURITY_POLICY_VERSION_BUMP = exports.SecurityPolicyVersionBump = void 0;
+const core_1 = require("@astram/core");
+/**
+ * Permission-version bump for a security-policy write (auth capabilities R2.5, F17): every tenant
+ * whose signed-in users the policy can affect gets its version bumped ON THE WRITE'S TRANSACTION,
+ * so the policy and the bump commit or roll back together, and guard's recompute (task 14) sees
+ * the change on each user's next request. The new versions reach Redis only after the commit
+ * (`publishCommitted`, the ONE `PermissionVersionBumper`, ADR-0035).
+ *
+ * Which tenants:
+ *  - a scoped policy: its node and every descendant (`scope_closure`). A policy at a node applies
+ *    only to sessions ACTIVE at that node or below it (core rule; the version key is the active
+ *    node's), so ancestors are not bumped (review round 1, item I).
+ *  - a platform floor policy: every company (no global version exists). One INSERT-or-increment
+ *    per company inside the transaction; a floor write is a rare root action.
+ *
+ * Any read or bump failure is an `AuthorizationUnavailableError` with a fixed message (503, the
+ * write rolls back): a policy must never commit without its bump.
+ */
+class SecurityPolicyVersionBump {
+    bumper;
+    schemas;
+    constructor(bumper, schemas) {
+        this.bumper = bumper;
+        this.schemas = schemas;
+    }
+    /** The tenants a policy at `scopeNodeId` (`null` = platform floor) can affect. */
+    async tenantsInScope(scopeNodeId, conn) {
+        try {
+            if (scopeNodeId === null) {
+                const rows = (await conn.query(`SELECT c_uuid AS tenant FROM \`${this.schemas.app}\`.\`companies\``));
+                return [...new Set(rows.map((r) => r.tenant))];
+            }
+            const closure = `\`${this.schemas.authz}\`.\`scope_closure\``;
+            const down = (await conn.query(`SELECT descendant_uuid AS tenant FROM ${closure} WHERE ancestor_uuid = ?`, [scopeNodeId]));
+            return [...new Set([scopeNodeId, ...down.map((r) => r.tenant)])];
+        }
+        catch {
+            throw new core_1.AuthorizationUnavailableError('security policy scope unavailable');
+        }
+    }
+    /** Increment each tenant's permission version on `conn` (published after the commit). */
+    async bump(tenants, conn) {
+        try {
+            for (const tenant of tenants)
+                await this.bumper.bumpForTenant(tenant, conn);
+        }
+        catch {
+            throw new core_1.AuthorizationUnavailableError('permission version bump failed');
+        }
+    }
+    /** Publish the versions bumped on `conn` — call after the commit. Never throws. */
+    publishCommitted(conn) {
+        return this.bumper.publishCommitted(conn);
+    }
+    /** Drop the versions bumped on `conn` — call after a rollback. */
+    discardPending(conn) {
+        this.bumper.discardPending(conn);
+    }
+}
+exports.SecurityPolicyVersionBump = SecurityPolicyVersionBump;
+/** DI token for the {@link SecurityPolicyVersionBump} built in `IdentityFeatureModule.forRoot`. */
+exports.SECURITY_POLICY_VERSION_BUMP = Symbol('SECURITY_POLICY_VERSION_BUMP');

package/dist/features/security-policy/security-policy.controller.d.ts

@@ -0,0 +1,51 @@
+import { SecurityPolicyService } from './security-policy.service.js';
+import { type ListQueryDto } from '../shared/list-query.js';
+import type { AuthedRequest } from '../shared/http.js';
+interface CreateBody {
+    scopeNodeUuid?: unknown;
+    platform?: unknown;
+    targetKind?: unknown;
+    targetValue?: unknown;
+    graceDays?: unknown;
+}
+interface UpdateBody {
+    targetValue?: unknown;
+    graceDays?: unknown;
+}
+/**
+ * `/identity/security-policies` — mandatory-2FA policies (auth capabilities R2.9). Every route is
+ * `@Classified` on `security_policy` (registered Gated, `identity:security_policy:<action>`); the
+ * R2.6 authority rules, audit and permission-version bump live in {@link SecurityPolicyService}.
+ * Bodies are reduced to the documented fields; the scope node is canonicalised here (400 if not a
+ * uuid). No static sub-paths, so route order does not matter.
+ */
+export declare class SecurityPolicyController {
+    private readonly policies;
+    constructor(policies: SecurityPolicyService);
+    /** List policies — `identity:security_policy:read`; `{ total, rows, page, limit }`. */
+    listPolicies(query: ListQueryDto): Promise<{
+        total: number;
+        rows: import("packages/engine/dist/types.js").RecordView[];
+        page: number;
+        limit: number;
+    }>;
+    /** Read one policy — `identity:security_policy:read`. */
+    getPolicy(uuid: string): Promise<import("packages/engine/dist/types.js").RecordView | null>;
+    /**
+     * Create a policy — `identity:security_policy:create`. Body `{ scopeNodeUuid?, platform?,
+     * targetKind, targetValue?, graceDays? }`; no node ⇒ the caller's active organisation.
+     */
+    createPolicy(req: AuthedRequest, body: CreateBody): Promise<{
+        id: import("packages/engine/dist/types.js").RecordId;
+    }>;
+    /** Change a policy's target or grace — `identity:security_policy:update`. */
+    updatePolicy(req: AuthedRequest, uuid: string, body: UpdateBody): Promise<{
+        success: boolean;
+    }>;
+    /** Delete a policy — `identity:security_policy:delete`. */
+    deletePolicy(req: AuthedRequest, uuid: string): Promise<{
+        success: boolean;
+    }>;
+}
+export {};
+//# sourceMappingURL=security-policy.controller.d.ts.map

package/dist/features/security-policy/security-policy.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-policy.controller.d.ts","sourceRoot":"","sources":["../../../src/features/security-policy/security-policy.controller.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvD,UAAU,UAAU;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,UAAU,UAAU;IAClB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;GAMG;AACH,qBAEa,wBAAwB;IACvB,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,qBAAqB;IAE5D,uFAAuF;IAGjF,YAAY,CAAU,KAAK,EAAE,YAAY;;;;;;IAM/C,yDAAyD;IAGzD,SAAS,CAA0B,IAAI,EAAE,MAAM;IAI/C;;;OAGG;IAGG,YAAY,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE,UAAU;;;IAYtE,6EAA6E;IAGvE,YAAY,CACT,GAAG,EAAE,aAAa,EACA,IAAI,EAAE,MAAM,EAC7B,IAAI,EAAE,UAAU;;;IAS1B,2DAA2D;IAGrD,YAAY,CAAQ,GAAG,EAAE,aAAa,EAA2B,IAAI,EAAE,MAAM;;;CAIpF"}

package/dist/features/security-policy/security-policy.controller.js

@@ -0,0 +1,121 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecurityPolicyController = void 0;
+const common_1 = require("@nestjs/common");
+const guard_1 = require("@astram/guard");
+const security_policy_service_js_1 = require("./security-policy.service.js");
+const list_query_js_1 = require("../shared/list-query.js");
+const identity_error_interceptor_js_1 = require("../shared/identity-error.interceptor.js");
+/**
+ * `/identity/security-policies` — mandatory-2FA policies (auth capabilities R2.9). Every route is
+ * `@Classified` on `security_policy` (registered Gated, `identity:security_policy:<action>`); the
+ * R2.6 authority rules, audit and permission-version bump live in {@link SecurityPolicyService}.
+ * Bodies are reduced to the documented fields; the scope node is canonicalised here (400 if not a
+ * uuid). No static sub-paths, so route order does not matter.
+ */
+let SecurityPolicyController = class SecurityPolicyController {
+    policies;
+    constructor(policies) {
+        this.policies = policies;
+    }
+    /** List policies — `identity:security_policy:read`; `{ total, rows, page, limit }`. */
+    async listPolicies(query) {
+        const { page, limit, params } = (0, list_query_js_1.parseListQuery)(query);
+        const result = await this.policies.listPolicies(params);
+        return { total: result.total, rows: result.rows, page, limit };
+    }
+    /** Read one policy — `identity:security_policy:read`. */
+    getPolicy(uuid) {
+        return this.policies.getPolicy(uuid);
+    }
+    /**
+     * Create a policy — `identity:security_policy:create`. Body `{ scopeNodeUuid?, platform?,
+     * targetKind, targetValue?, graceDays? }`; no node ⇒ the caller's active organisation.
+     */
+    async createPolicy(req, body) {
+        const scopeNodeUuid = (0, guard_1.optionalUuidField)(body?.scopeNodeUuid, 'scopeNodeUuid');
+        const id = await this.policies.createPolicy(req.principal, {
+            ...(scopeNodeUuid !== undefined ? { scopeNodeUuid } : {}),
+            targetKind: body?.targetKind,
+            targetValue: body?.targetValue,
+            graceDays: body?.graceDays,
+            platform: body?.platform,
+        });
+        return { id };
+    }
+    /** Change a policy's target or grace — `identity:security_policy:update`. */
+    async updatePolicy(req, uuid, body) {
+        await this.policies.updatePolicy(req.principal, uuid, {
+            graceDays: body?.graceDays,
+            targetValue: body?.targetValue,
+        });
+        return { success: true };
+    }
+    /** Delete a policy — `identity:security_policy:delete`. */
+    async deletePolicy(req, uuid) {
+        await this.policies.deletePolicy(req.principal, uuid);
+        return { success: true };
+    }
+};
+exports.SecurityPolicyController = SecurityPolicyController;
+__decorate([
+    (0, common_1.Get)('security-policies'),
+    (0, guard_1.Classified)({ typeKey: 'security_policy', action: 'read' }),
+    __param(0, (0, common_1.Query)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], SecurityPolicyController.prototype, "listPolicies", null);
+__decorate([
+    (0, common_1.Get)('security-policies/:uuid'),
+    (0, guard_1.Classified)({ typeKey: 'security_policy', action: 'read' }),
+    __param(0, (0, common_1.Param)('uuid', guard_1.UuidPipe)),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", void 0)
+], SecurityPolicyController.prototype, "getPolicy", null);
+__decorate([
+    (0, common_1.Post)('security-policies'),
+    (0, guard_1.Classified)({ typeKey: 'security_policy', action: 'create' }),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], SecurityPolicyController.prototype, "createPolicy", null);
+__decorate([
+    (0, common_1.Put)('security-policies/:uuid'),
+    (0, guard_1.Classified)({ typeKey: 'security_policy', action: 'update' }),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('uuid', guard_1.UuidPipe)),
+    __param(2, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String, Object]),
+    __metadata("design:returntype", Promise)
+], SecurityPolicyController.prototype, "updatePolicy", null);
+__decorate([
+    (0, common_1.Delete)('security-policies/:uuid'),
+    (0, guard_1.Classified)({ typeKey: 'security_policy', action: 'delete' }),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('uuid', guard_1.UuidPipe)),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String]),
+    __metadata("design:returntype", Promise)
+], SecurityPolicyController.prototype, "deletePolicy", null);
+exports.SecurityPolicyController = SecurityPolicyController = __decorate([
+    (0, common_1.Controller)('identity'),
+    (0, common_1.UseInterceptors)(identity_error_interceptor_js_1.IdentityErrorInterceptor),
+    __metadata("design:paramtypes", [security_policy_service_js_1.SecurityPolicyService])
+], SecurityPolicyController);