@astram/identity 0.3.1 → 0.5.0

package/dist/features/service-account/service-account.store.js

@@ -0,0 +1,158 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ServiceAccountStore = void 0;
+const APP = 'shield_app';
+/** Normalize a JSON-array column (driver returns array OR string) → string[]. Fail-safe to []. */
+function jsonArray(v) {
+    const arr = Array.isArray(v)
+        ? v
+        : typeof v === 'string'
+            ? (() => {
+                try {
+                    return JSON.parse(v);
+                }
+                catch {
+                    return [];
+                }
+            })()
+            : [];
+    return Array.isArray(arr) ? arr.filter((x) => typeof x === 'string') : [];
+}
+function toRow(r) {
+    return {
+        id: r.sa_id,
+        tenantId: r.sa_tenant_id,
+        label: r.sa_label,
+        scopeSubtreeNodeIds: jsonArray(r.sa_scope_subtree),
+        roleIds: jsonArray(r.sa_role_ids),
+        status: r.sa_status,
+        createdBy: r.sa_created_by,
+        createdAtMs: Number(r.sa_created_at_ms),
+        updatedAtMs: r.sa_updated_at_ms === null ? null : Number(r.sa_updated_at_ms),
+    };
+}
+/**
+ * Build the own-tenant `AND sa_tenant_id IN (?, …)` fragment for a non-root caller. Root → no
+ * fragment (spans all). A non-root with an empty subtree yields `AND 1=0` (matches nothing —
+ * fail-closed). Node ids are `?`-bound. The caller splices `params` where `sql` sits.
+ */
+function tenantScope(scope) {
+    if (scope.isRoot)
+        return { sql: '', params: [] };
+    if (scope.nodeIds.length === 0)
+        return { sql: ' AND 1=0', params: [] };
+    const ph = scope.nodeIds.map(() => '?').join(', ');
+    return { sql: ` AND sa_tenant_id IN (${ph})`, params: [...scope.nodeIds] };
+}
+const COLS = 'sa_id, sa_tenant_id, sa_label, sa_scope_subtree, sa_role_ids, sa_status, sa_created_by, sa_created_at_ms, sa_updated_at_ms';
+/** Dedupe an id list keeping first-seen order (drops empties). */
+function uniqueIds(ids) {
+    return [...new Set(ids.filter((x) => typeof x === 'string' && x.length > 0))];
+}
+class ServiceAccountStore {
+    pool;
+    constructor(pool) {
+        this.pool = pool;
+    }
+    // ── directory reads (names for the picker, the view labels and the ceiling messages) ─────
+    // Read-only lookups over the global role catalog + the company tree (`shield_app.roles`,
+    // `shield_app.companies`). Ids are `?`-bound; an empty id list short-circuits (no query).
+    /** Roles by id (unknown ids are simply absent — the caller supplies a fallback label). */
+    async rolesByIds(ids) {
+        const u = uniqueIds(ids);
+        if (u.length === 0)
+            return [];
+        const rows = (await this.pool.query(`SELECT r_uuid AS id, r_name AS name FROM \`${APP}\`.\`roles\` WHERE r_uuid IN (${u.map(() => '?').join(', ')}) ORDER BY r_name`, u));
+        return rows.map((r) => ({ id: r.id, name: r.name }));
+    }
+    /** Every role in the catalog (ROOT's assignable set). */
+    async allRoles() {
+        const rows = (await this.pool.query(`SELECT r_uuid AS id, r_name AS name FROM \`${APP}\`.\`roles\` ORDER BY r_name`, []));
+        return rows.map((r) => ({ id: r.id, name: r.name }));
+    }
+    /** Companies (scope nodes) by id, with their parent handle. Unknown ids are absent. */
+    async nodesByIds(ids) {
+        const u = uniqueIds(ids);
+        if (u.length === 0)
+            return [];
+        const rows = (await this.pool.query(`SELECT c_uuid AS id, c_name AS name, c_parent_uuid AS parentId FROM \`${APP}\`.\`companies\` WHERE c_uuid IN (${u.map(() => '?').join(', ')}) ORDER BY c_name`, u));
+        return rows.map((r) => ({ id: r.id, name: r.name, parentId: r.parentId ?? null }));
+    }
+    /** Every company (ROOT's assignable scope — root reaches all). */
+    async allNodes() {
+        const rows = (await this.pool.query(`SELECT c_uuid AS id, c_name AS name, c_parent_uuid AS parentId FROM \`${APP}\`.\`companies\` ORDER BY c_name`, []));
+        return rows.map((r) => ({ id: r.id, name: r.name, parentId: r.parentId ?? null }));
+    }
+    /** List the caller's own-tenant accounts (newest first). Root sees all. */
+    async list(scope) {
+        const t = tenantScope(scope);
+        const rows = (await this.pool.query(`SELECT ${COLS} FROM \`${APP}\`.\`service_account\` WHERE 1=1${t.sql} ORDER BY sa_created_at_ms DESC`, t.params));
+        return rows.map(toRow);
+    }
+    /** Fetch one account BY id, scoped to the caller's subtree. Cross-tenant/unknown → null (404). */
+    async getById(id, scope) {
+        const t = tenantScope(scope);
+        const rows = (await this.pool.query(`SELECT ${COLS} FROM \`${APP}\`.\`service_account\` WHERE sa_id = ?${t.sql} LIMIT 1`, [id, ...t.params]));
+        return rows[0] ? toRow(rows[0]) : null;
+    }
+    /**
+     * Insert a new account. `tenantId` is server-stamped (from the session) — never client input.
+     * `scopeSubtreeNodeIds`/`roleIds` are stored as JSON. Idempotency is the caller's (a fresh uuid
+     * per create); the id is unique by construction.
+     */
+    async insert(input) {
+        await this.pool.query(`INSERT INTO \`${APP}\`.\`service_account\`
+         (sa_id, sa_tenant_id, sa_label, sa_scope_subtree, sa_role_ids, sa_status,
+          sa_created_by, sa_created_at_ms, sa_updated_at_ms)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL)`, [
+            input.id,
+            input.tenantId,
+            input.label,
+            JSON.stringify([...input.scopeSubtreeNodeIds]),
+            JSON.stringify([...input.roleIds]),
+            input.status,
+            input.createdBy,
+            input.createdAtMs,
+        ]);
+    }
+    /**
+     * Update an account's mutable fields (label/scope/roles/status), scoped to the caller's subtree.
+     * Returns the number of rows changed — 0 means the id was not in the caller's subtree (→ 404).
+     * Only the provided fields are set; `sa_updated_at_ms` is always stamped.
+     */
+    async update(id, scope, patch, updatedAtMs, 
+    /**
+     * Optimistic guard: when given, the row is only written if `sa_updated_at_ms` still equals this
+     * value (NULL-safe). A concurrent edit makes it return 0, so a read-modify-write can't resurrect
+     * access another admin just removed.
+     */
+    expectedUpdatedAtMs) {
+        const sets = [];
+        const params = [];
+        if (patch.label !== undefined) {
+            sets.push('sa_label = ?');
+            params.push(patch.label);
+        }
+        if (patch.scopeSubtreeNodeIds !== undefined) {
+            sets.push('sa_scope_subtree = ?');
+            params.push(JSON.stringify([...patch.scopeSubtreeNodeIds]));
+        }
+        if (patch.roleIds !== undefined) {
+            sets.push('sa_role_ids = ?');
+            params.push(JSON.stringify([...patch.roleIds]));
+        }
+        if (patch.status !== undefined) {
+            sets.push('sa_status = ?');
+            params.push(patch.status);
+        }
+        // Always stamp the edit time (even for a no-field patch, which the service disallows anyway).
+        sets.push('sa_updated_at_ms = ?');
+        params.push(updatedAtMs);
+        const t = tenantScope(scope);
+        const guard = expectedUpdatedAtMs !== undefined ? ' AND sa_updated_at_ms <=> ?' : '';
+        const guardParams = expectedUpdatedAtMs !== undefined ? [expectedUpdatedAtMs] : [];
+        const res = (await this.pool.query(`UPDATE \`${APP}\`.\`service_account\` SET ${sets.join(', ')} WHERE sa_id = ?${t.sql}${guard}`, [...params, id, ...t.params, ...guardParams]));
+        return res.affectedRows ?? 0;
+    }
+}
+exports.ServiceAccountStore = ServiceAccountStore;

package/dist/features/share/share.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"share.controller.d.ts","sourceRoot":"","sources":["../../../src/features/share/share.controller.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAqB,MAAM,oBAAoB,CAAC;AAErE,qFAAqF;AACrF,UAAU,aAAa;IACrB,SAAS,EAAE,SAAS,CAAC;CACtB;AAqBD,qBACa,eAAe;IACd,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,YAAY;IAEjD;;;;OAIG;IAGG,IAAI,CACD,GAAG,EAAE,aAAa,EACP,OAAO,CAAC,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM;;;IAYtC;;;;OAIG;IAGG,KAAK,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE,OAAO;;;IAW5D;;;OAGG;IAGG,OAAO,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE,OAAO;;;CAU/D"}
+{"version":3,"file":"share.controller.d.ts","sourceRoot":"","sources":["../../../src/features/share/share.controller.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAqB,MAAM,oBAAoB,CAAC;AAErE,qFAAqF;AACrF,UAAU,aAAa;IACrB,SAAS,EAAE,SAAS,CAAC;CACtB;AAwBD,qBAEa,eAAe;IACd,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,YAAY;IAEjD;;;;OAIG;IAGG,IAAI,CACD,GAAG,EAAE,aAAa,EACP,OAAO,CAAC,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM;;;IAYtC;;;;OAIG;IAGG,KAAK,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE,OAAO;;;IAW5D;;;OAGG;IAGG,OAAO,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE,OAAO;;;CAU/D"}

package/dist/features/share/share.controller.js

@@ -28,6 +28,7 @@ exports.ShareController = void 0;
  */
 const common_1 = require("@nestjs/common");
 const guard_1 = require("@astram/guard");
+const identity_error_interceptor_js_1 = require("../shared/identity-error.interceptor.js");
 const share_service_js_1 = require("./share.service.js");
 /** Validate + narrow a share/unshare body to a {@link ShareRequest} (grantee + action only). */
 function toShareRequest(body) {
@@ -139,5 +140,6 @@ __decorate([
 ], ShareController.prototype, "unshare", null);
 exports.ShareController = ShareController = __decorate([
     (0, common_1.Controller)('identity'),
+    (0, common_1.UseInterceptors)(identity_error_interceptor_js_1.IdentityErrorInterceptor),
     __metadata("design:paramtypes", [share_service_js_1.ShareService])
 ], ShareController);

package/dist/features/share/share.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"share.service.d.ts","sourceRoot":"","sources":["../../../src/features/share/share.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EACV,iBAAiB,EACjB,gBAAgB,EACjB,MAAM,eAAe,CAAC;AAEvB,6FAA6F;AAC7F,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACrF;AAED,4FAA4F;AAC5F,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,KAAK,EAAE;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,gBAAgB,CAAC;QAC9B,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,OAAO,CAAC,KAAK,EAAE;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,gBAAgB,CAAC;QAC9B,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,mBAAmB,CAAC,KAAK,EAAE;QACzB,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CACT,aAAa,CAAC;QACZ,WAAW,EAAE,gBAAgB,CAAC;QAC9B,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC,CACH,CAAC;CACH;AAED,oFAAoF;AACpF,MAAM,WAAW,SAAS;IACxB,yDAAyD;IACzD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,gFAAgF;IAChF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,kGAAkG;AAClG,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,qBAAa,YAAY;IAErB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,MAAM,EAAE,iBAAiB,GAAG,eAAe,EAC3C,MAAM,EAAE,kBAAkB;IAG7C;;;;OAIG;IACG,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAY/D,qFAAqF;IAC/E,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAYjE;;;OAGG;IACG,UAAU,CACd,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC;CAoBjC"}
+{"version":3,"file":"share.service.d.ts","sourceRoot":"","sources":["../../../src/features/share/share.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEzE,6FAA6F;AAC7F,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACrF;AAED,4FAA4F;AAC5F,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,KAAK,EAAE;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,gBAAgB,CAAC;QAC9B,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,OAAO,CAAC,KAAK,EAAE;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,gBAAgB,CAAC;QAC9B,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,mBAAmB,CAAC,KAAK,EAAE;QACzB,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CACT,aAAa,CAAC;QACZ,WAAW,EAAE,gBAAgB,CAAC;QAC9B,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC,CACH,CAAC;CACH;AAED,oFAAoF;AACpF,MAAM,WAAW,SAAS;IACxB,yDAAyD;IACzD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,gFAAgF;IAChF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,kGAAkG;AAClG,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,qBAAa,YAAY;IAErB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,MAAM,EAAE,iBAAiB,GAAG,eAAe,EAC3C,MAAM,EAAE,kBAAkB;IAG7C;;;;OAIG;IACG,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAY/D,qFAAqF;IAC/E,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAYjE;;;OAGG;IACG,UAAU,CACd,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC;CAoBjC"}

package/dist/features/shared/identity-error.interceptor.d.ts

@@ -0,0 +1,24 @@
+/**
+ * IdentityErrorInterceptor — maps engine, ceiling and identity domain errors to HTTP for every
+ * identity route, in ONE place (security hardening Phase 1, ADR-0034 follow-up).
+ *
+ * Before this, an engine `AuthorizationDeniedError` (for example the ADR-0034 create wall's
+ * `create_outside_write_scope`) escaped a controller as an unmapped error → HTTP 500. Each mapping
+ * below uses a fixed, id-free message (ADR-0012): the engine's own message carries reason codes and
+ * detail that are for logs, not clients.
+ *
+ * Applied with `@UseInterceptors(IdentityErrorInterceptor)` on each identity controller. An
+ * `HttpException` (a controller's own 400/403/404) passes through untouched; anything unmapped is
+ * rethrown as-is (Nest's default handling).
+ */
+import { type CallHandler, type ExecutionContext, type NestInterceptor } from '@nestjs/common';
+import { type Observable } from 'rxjs';
+/**
+ * Map one error to the HTTP exception identity answers with, or return it unchanged when it is
+ * not an identity-mapped type. Exported for unit tests and for callers that map by hand.
+ */
+export declare function toIdentityHttpError(err: unknown): unknown;
+export declare class IdentityErrorInterceptor implements NestInterceptor {
+    intercept(_context: ExecutionContext, next: CallHandler): Observable<unknown>;
+}
+//# sourceMappingURL=identity-error.interceptor.d.ts.map

package/dist/features/shared/identity-error.interceptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-error.interceptor.d.ts","sourceRoot":"","sources":["../../../src/features/shared/identity-error.interceptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAQL,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAA0B,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AAqB/D;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAwBzD;AAED,qBACa,wBAAyB,YAAW,eAAe;IAC9D,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC;CAK9E"}

package/dist/features/shared/identity-error.interceptor.js

@@ -0,0 +1,82 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IdentityErrorInterceptor = void 0;
+exports.toIdentityHttpError = toIdentityHttpError;
+/**
+ * IdentityErrorInterceptor — maps engine, ceiling and identity domain errors to HTTP for every
+ * identity route, in ONE place (security hardening Phase 1, ADR-0034 follow-up).
+ *
+ * Before this, an engine `AuthorizationDeniedError` (for example the ADR-0034 create wall's
+ * `create_outside_write_scope`) escaped a controller as an unmapped error → HTTP 500. Each mapping
+ * below uses a fixed, id-free message (ADR-0012): the engine's own message carries reason codes and
+ * detail that are for logs, not clients.
+ *
+ * Applied with `@UseInterceptors(IdentityErrorInterceptor)` on each identity controller. An
+ * `HttpException` (a controller's own 400/403/404) passes through untouched; anything unmapped is
+ * rethrown as-is (Nest's default handling).
+ */
+const common_1 = require("@nestjs/common");
+const rxjs_1 = require("rxjs");
+const engine_1 = require("@astram/engine");
+const core_1 = require("@astram/core");
+const guard_1 = require("@astram/guard");
+const grant_ceiling_js_1 = require("../authz/grant-ceiling.js");
+const scope_closure_service_js_1 = require("../scope/scope-closure.service.js");
+const identity_errors_js_1 = require("./identity-errors.js");
+/** The fixed client message for an engine deny, by reason code (never the engine's own text). */
+function deniedMessage(reason) {
+    if (reason === 'create_outside_write_scope') {
+        return 'You cannot create this record: it is outside the organisations you manage.';
+    }
+    return 'You do not have access to perform this action.';
+}
+/**
+ * Map one error to the HTTP exception identity answers with, or return it unchanged when it is
+ * not an identity-mapped type. Exported for unit tests and for callers that map by hand.
+ */
+function toIdentityHttpError(err) {
+    if (err instanceof common_1.HttpException)
+        return err;
+    if (err instanceof engine_1.AuthorizationDeniedError)
+        return new common_1.ForbiddenException(deniedMessage(err.reason));
+    if (err instanceof grant_ceiling_js_1.GrantCeilingError)
+        return new common_1.ForbiddenException(err.message);
+    if (err instanceof identity_errors_js_1.IdentityForbiddenError)
+        return new common_1.ForbiddenException(err.message);
+    if (err instanceof identity_errors_js_1.IdentityNotFoundError)
+        return new common_1.NotFoundException(err.message);
+    if (err instanceof identity_errors_js_1.IdentityConflictError)
+        return new common_1.ConflictException(err.message);
+    if (err instanceof identity_errors_js_1.IdentityBadRequestError)
+        return new common_1.BadRequestException(err.message);
+    if (err instanceof guard_1.ScopeCycleError) {
+        return new common_1.ConflictException('That move would put an organisation inside its own sub-tree.');
+    }
+    if (err instanceof scope_closure_service_js_1.NodeHasChildrenError) {
+        return new common_1.ConflictException('This organisation still has sub-organisations. Move or delete them first.');
+    }
+    if (err instanceof engine_1.ValidationError) {
+        return new common_1.BadRequestException(`Invalid value for '${err.field}'.`);
+    }
+    if (err instanceof core_1.AuthorizationUnavailableError || err instanceof engine_1.EngineUnavailableError) {
+        return new common_1.ServiceUnavailableException('Authorization is temporarily unavailable. Try again.');
+    }
+    return err;
+}
+let IdentityErrorInterceptor = class IdentityErrorInterceptor {
+    intercept(_context, next) {
+        return next
+            .handle()
+            .pipe((0, rxjs_1.catchError)((err) => (0, rxjs_1.throwError)(() => toIdentityHttpError(err))));
+    }
+};
+exports.IdentityErrorInterceptor = IdentityErrorInterceptor;
+exports.IdentityErrorInterceptor = IdentityErrorInterceptor = __decorate([
+    (0, common_1.Injectable)()
+], IdentityErrorInterceptor);

package/dist/features/shared/identity-errors.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Identity domain errors (security hardening Phase 1). Thrown by identity services, mapped to HTTP
+ * by {@link IdentityErrorInterceptor} in ONE place so every identity route answers the same way.
+ *
+ * Messages are user-facing: they name no raw ids (ADR-0012) and carry no store detail.
+ */
+/** The caller may not perform this action on this target (→ 403). */
+export declare class IdentityForbiddenError extends Error {
+    constructor(message: string);
+}
+/** The target does not exist or is outside the caller's reach (→ 404, no existence leak). */
+export declare class IdentityNotFoundError extends Error {
+    constructor(message: string);
+}
+/** The request conflicts with the current state (cycle, children present, … → 409). */
+export declare class IdentityConflictError extends Error {
+    constructor(message: string);
+}
+/** The request is malformed (→ 400). */
+export declare class IdentityBadRequestError extends Error {
+    constructor(message: string);
+}
+//# sourceMappingURL=identity-errors.d.ts.map

package/dist/features/shared/identity-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-errors.d.ts","sourceRoot":"","sources":["../../../src/features/shared/identity-errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,qEAAqE;AACrE,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAED,6FAA6F;AAC7F,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAED,uFAAuF;AACvF,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAED,wCAAwC;AACxC,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAI5B"}

package/dist/features/shared/identity-errors.js

@@ -0,0 +1,41 @@
+"use strict";
+/**
+ * Identity domain errors (security hardening Phase 1). Thrown by identity services, mapped to HTTP
+ * by {@link IdentityErrorInterceptor} in ONE place so every identity route answers the same way.
+ *
+ * Messages are user-facing: they name no raw ids (ADR-0012) and carry no store detail.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IdentityBadRequestError = exports.IdentityConflictError = exports.IdentityNotFoundError = exports.IdentityForbiddenError = void 0;
+/** The caller may not perform this action on this target (→ 403). */
+class IdentityForbiddenError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'IdentityForbiddenError';
+    }
+}
+exports.IdentityForbiddenError = IdentityForbiddenError;
+/** The target does not exist or is outside the caller's reach (→ 404, no existence leak). */
+class IdentityNotFoundError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'IdentityNotFoundError';
+    }
+}
+exports.IdentityNotFoundError = IdentityNotFoundError;
+/** The request conflicts with the current state (cycle, children present, … → 409). */
+class IdentityConflictError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'IdentityConflictError';
+    }
+}
+exports.IdentityConflictError = IdentityConflictError;
+/** The request is malformed (→ 400). */
+class IdentityBadRequestError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'IdentityBadRequestError';
+    }
+}
+exports.IdentityBadRequestError = IdentityBadRequestError;

package/dist/features/user/session-revocation-check.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Boot check (security hardening Phase 3 review P2). Disabling a user revokes its sessions through
+ * guard's `SHIELD_SESSION_SWEEPER` (provided by the auth surface). When the auth surface is on —
+ * guard's session token binder is visible — but no sweeper is, a disable still drops the user's
+ * roles (version bump + `[]` roles) but cannot end its sessions: say so at boot instead of failing
+ * silently. Auth off → no sessions exist → nothing to warn about.
+ *
+ * @returns `true` when the warning was emitted.
+ */
+export declare function warnIfSessionsUnrevocable(binder: unknown, sweeper: unknown, warn: (message: string) => void): boolean;
+//# sourceMappingURL=session-revocation-check.d.ts.map

package/dist/features/user/session-revocation-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-revocation-check.d.ts","sourceRoot":"","sources":["../../../src/features/user/session-revocation-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GAC9B,OAAO,CAQT"}

package/dist/features/user/session-revocation-check.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.warnIfSessionsUnrevocable = warnIfSessionsUnrevocable;
+/**
+ * Boot check (security hardening Phase 3 review P2). Disabling a user revokes its sessions through
+ * guard's `SHIELD_SESSION_SWEEPER` (provided by the auth surface). When the auth surface is on —
+ * guard's session token binder is visible — but no sweeper is, a disable still drops the user's
+ * roles (version bump + `[]` roles) but cannot end its sessions: say so at boot instead of failing
+ * silently. Auth off → no sessions exist → nothing to warn about.
+ *
+ * @returns `true` when the warning was emitted.
+ */
+function warnIfSessionsUnrevocable(binder, sweeper, warn) {
+    if (binder === undefined || binder === null)
+        return false;
+    if (sweeper !== undefined && sweeper !== null)
+        return false;
+    warn('SHIELD_SESSION_SWEEPER is not available: disabling a user will not revoke its sessions ' +
+        '(its roles still drop on the next request). Provide a sessionSweeper to ShieldModule.forRoot.');
+    return true;
+}

package/dist/features/user/user.controller.d.ts

@@ -1,5 +1,6 @@
 import { UserService } from './user.service.js';
 import { type ListQueryDto } from '../shared/list-query.js';
+import type { AuthedRequest } from '../shared/http.js';
 export declare class UserController {
     private readonly users;
     constructor(users: UserService);
@@ -14,25 +15,29 @@ export declare class UserController {
         page: number;
         limit: number;
     }>;
-    /** Create a user — gated on `identity:user:create`. */
-    createUser(body: {
+    /**
+     * Create a user — gated on `identity:user:create`. Optional `companyUuid` creates the user's
+     * first (active) membership in the same transaction; it must be a company the caller manages.
+     */
+    createUser(req: AuthedRequest, body: {
         username?: string;
+        companyUuid?: string;
     }): Promise<{
         id: import("packages/engine/dist/types.js").RecordId;
     }>;
     /** Read one user — gated on `identity:user:read` (CONTROL-plane; root, the identity
      *  administrator, may read users). */
     getUser(uuid: string): Promise<import("packages/engine/dist/types.js").RecordView | null>;
-    /** Update a user — gated on `identity:user:update`. */
-    updateUser(uuid: string, body: {
+    /** Update a user — gated on `identity:user:update`. Only `username`, `email`, `status` apply. */
+    updateUser(req: AuthedRequest, uuid: string, body: {
         username?: string;
         email?: string;
         status?: string;
     }): Promise<{
         success: boolean;
     }>;
-    /** Delete a user — gated on `identity:user:delete`. */
-    deleteUser(uuid: string): Promise<{
+    /** Delete a user — gated on `identity:user:delete`; the caller must dominate the user. */
+    deleteUser(req: AuthedRequest, uuid: string): Promise<{
         success: boolean;
     }>;
 }

package/dist/features/user/user.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.controller.d.ts","sourceRoot":"","sources":["../../../src/features/user/user.controller.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAK5E,qBACa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,WAAW;IAE/C;;;;OAIG;IAGG,SAAS,CAAU,KAAK,EAAE,YAAY;;;;;;IAM5C,uDAAuD;IAGjD,UAAU,CAAS,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAKpD;0CACsC;IAGtC,OAAO,CAAgB,IAAI,EAAE,MAAM;IAInC,uDAAuD;IAGjD,UAAU,CACC,IAAI,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAMtE,uDAAuD;IAGjD,UAAU,CAAgB,IAAI,EAAE,MAAM;;;CAI7C"}
+{"version":3,"file":"user.controller.d.ts","sourceRoot":"","sources":["../../../src/features/user/user.controller.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAOvD,qBAEa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,WAAW;IAE/C;;;;OAIG;IAGG,SAAS,CAAU,KAAK,EAAE,YAAY;;;;;;IAM5C;;;OAGG;IAGG,UAAU,CACP,GAAG,EAAE,aAAa,EACjB,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAW3D;0CACsC;IAGtC,OAAO,CAAgB,IAAI,EAAE,MAAM;IAInC,iGAAiG;IAG3F,UAAU,CACP,GAAG,EAAE,aAAa,EACV,IAAI,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAUtE,0FAA0F;IAGpF,UAAU,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM;;;CAIxE"}

package/dist/features/user/user.controller.js

@@ -17,9 +17,11 @@ const common_1 = require("@nestjs/common");
 const guard_1 = require("@astram/guard");
 const user_service_js_1 = require("./user.service.js");
 const list_query_js_1 = require("../shared/list-query.js");
+const identity_error_interceptor_js_1 = require("../shared/identity-error.interceptor.js");
 // User management is gated on `identity:user:<action>` grants. `user` is CONTROL-plane
 // for ALL actions — including read: the capped root is the identity administrator (the
-// identity-administrator model), so it may list/read users AND manage them.
+// identity-administrator model), so it may list/read users AND manage them. Changing a user's
+// email or status, or deleting them, also needs the caller to dominate that user (D2).
 let UserController = class UserController {
     users;
     constructor(users) {
@@ -35,9 +37,17 @@ let UserController = class UserController {
         const result = await this.users.listUsers(params);
         return { total: result.total, rows: result.rows, page, limit };
     }
-    /** Create a user — gated on `identity:user:create`. */
-    async createUser(body) {
-        const id = await this.users.createUser(body?.username ?? 'Untitled');
+    /**
+     * Create a user — gated on `identity:user:create`. Optional `companyUuid` creates the user's
+     * first (active) membership in the same transaction; it must be a company the caller manages.
+     */
+    async createUser(req, body) {
+        const id = await this.users.createUser(req.principal, {
+            username: body?.username ?? 'Untitled',
+            ...(typeof body?.companyUuid === 'string' && body.companyUuid.length > 0
+                ? { companyUuid: body.companyUuid }
+                : {}),
+        });
         return { id };
     }
     /** Read one user — gated on `identity:user:read` (CONTROL-plane; root, the identity
@@ -45,14 +55,18 @@ let UserController = class UserController {
     getUser(uuid) {
         return this.users.getUser(uuid);
     }
-    /** Update a user — gated on `identity:user:update`. */
-    async updateUser(uuid, body) {
-        await this.users.updateUser(uuid, body ?? {});
+    /** Update a user — gated on `identity:user:update`. Only `username`, `email`, `status` apply. */
+    async updateUser(req, uuid, body) {
+        await this.users.updateUser(req.principal, uuid, {
+            username: body?.username,
+            email: body?.email,
+            status: body?.status,
+        });
         return { success: true };
     }
-    /** Delete a user — gated on `identity:user:delete`. */
-    async deleteUser(uuid) {
-        await this.users.deleteUser(uuid);
+    /** Delete a user — gated on `identity:user:delete`; the caller must dominate the user. */
+    async deleteUser(req, uuid) {
+        await this.users.deleteUser(req.principal, uuid);
         return { success: true };
     }
 };
@@ -68,9 +82,10 @@ __decorate([
 __decorate([
     (0, common_1.Post)('users'),
     (0, guard_1.Classified)({ typeKey: 'user', action: 'create' }),
-    __param(0, (0, common_1.Body)()),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Body)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [Object, Object]),
     __metadata("design:returntype", Promise)
 ], UserController.prototype, "createUser", null);
 __decorate([
@@ -84,21 +99,24 @@ __decorate([
 __decorate([
     (0, common_1.Put)('users/:uuid'),
     (0, guard_1.Classified)({ typeKey: 'user', action: 'update' }),
-    __param(0, (0, common_1.Param)('uuid')),
-    __param(1, (0, common_1.Body)()),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('uuid')),
+    __param(2, (0, common_1.Body)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String, Object]),
+    __metadata("design:paramtypes", [Object, String, Object]),
     __metadata("design:returntype", Promise)
 ], UserController.prototype, "updateUser", null);
 __decorate([
     (0, common_1.Delete)('users/:uuid'),
     (0, guard_1.Classified)({ typeKey: 'user', action: 'delete' }),
-    __param(0, (0, common_1.Param)('uuid')),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('uuid')),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String]),
+    __metadata("design:paramtypes", [Object, String]),
     __metadata("design:returntype", Promise)
 ], UserController.prototype, "deleteUser", null);
 exports.UserController = UserController = __decorate([
     (0, common_1.Controller)('identity'),
+    (0, common_1.UseInterceptors)(identity_error_interceptor_js_1.IdentityErrorInterceptor),
     __metadata("design:paramtypes", [user_service_js_1.UserService])
 ], UserController);