@astram/identity 0.3.1 → 0.5.0

package/dist/features/company/company-hierarchy.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"company-hierarchy.service.d.ts","sourceRoot":"","sources":["../../../src/features/company/company-hierarchy.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAkB,MAAM,mCAAmC,CAAC;AAUxF,6FAA6F;AAC7F,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAED,qBAAa,uBAAuB;IAEhC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAHH,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,mBAAmB,EAC5B,KAAK,CAAC,EAAE,SAAS,YAAA,EACjB,GAAG,GAAE,MAAM,MAAiB;IAG/C,0EAA0E;IAC1E,OAAO,CAAC,OAAO;IAIf,uDAAuD;YACzC,KAAK;YAUL,WAAW;IAoBzB,iGAAiG;IAC3F,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAkD3F;;;OAGG;IACG,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAc/D,wFAAwF;IAClF,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGhD"}

package/dist/features/company/company-hierarchy.service.js

@@ -0,0 +1,100 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CompanyHierarchyService = void 0;
+const grant_ceiling_js_1 = require("../authz/grant-ceiling.js");
+const identity_errors_js_1 = require("../shared/identity-errors.js");
+const APP = 'shield_app';
+class CompanyHierarchyService {
+    pool;
+    closure;
+    audit;
+    now;
+    constructor(pool, closure, audit, now = Date.now) {
+        this.pool = pool;
+        this.closure = closure;
+        this.audit = audit;
+        this.now = now;
+    }
+    /** The actor's own root node (the active node its subtree hangs from). */
+    ownRoot(actor) {
+        return actor.activeScopeNodeId ?? actor.tenantId;
+    }
+    /** Names of the given companies (unknown → absent). */
+    async names(q, ids) {
+        const unique = [...new Set(ids)];
+        if (unique.length === 0)
+            return new Map();
+        const rows = (await q.query(`SELECT c_uuid, c_name FROM \`${APP}\`.\`companies\` WHERE c_uuid IN (${unique.map(() => '?').join(', ')})`, unique));
+        return new Map(rows.map((r) => [r.c_uuid, r.c_name]));
+    }
+    async recordAudit(conn, actor, action, attributes) {
+        if (!this.audit)
+            return;
+        await this.audit.record({
+            type: 'admin_action',
+            occurredAtMs: this.now(),
+            actorId: actor.id,
+            tenantId: actor.tenantId,
+            action: { key: action },
+            attributes: { eventType: 'company_hierarchy', ...attributes },
+        }, (sql, params) => conn.query(sql, params));
+    }
+    /** Re-parent `nodeUuid` under `newParentUuid` (null = make it a top-level tenant; root only). */
+    async move(actor, nodeUuid, newParentUuid) {
+        if (typeof nodeUuid !== 'string' || nodeUuid.length === 0) {
+            throw new identity_errors_js_1.IdentityBadRequestError('A company is required.');
+        }
+        if (newParentUuid !== null &&
+            (typeof newParentUuid !== 'string' || newParentUuid.length === 0)) {
+            throw new identity_errors_js_1.IdentityBadRequestError('parentUuid must be a company or null.');
+        }
+        if (actor.isRoot !== true) {
+            const subtree = new Set((0, grant_ceiling_js_1.subtreeOf)(actor));
+            if (!subtree.has(nodeUuid))
+                throw new identity_errors_js_1.IdentityNotFoundError('Company not found.');
+            if (nodeUuid === this.ownRoot(actor)) {
+                throw new identity_errors_js_1.IdentityForbiddenError('You cannot move the organisation your access is rooted at.');
+            }
+            if (newParentUuid === null || !subtree.has(newParentUuid)) {
+                throw new identity_errors_js_1.IdentityForbiddenError('You can only move a company under another company you manage.');
+            }
+        }
+        const names = await this.names(this.pool, [
+            nodeUuid,
+            ...(newParentUuid ? [newParentUuid] : []),
+        ]);
+        if (!names.has(nodeUuid))
+            throw new identity_errors_js_1.IdentityNotFoundError('Company not found.');
+        if (newParentUuid !== null && !names.has(newParentUuid)) {
+            throw new identity_errors_js_1.IdentityNotFoundError('Parent company not found.');
+        }
+        const oldParentRows = (await this.pool.query(`SELECT c_parent_uuid FROM \`${APP}\`.\`companies\` WHERE c_uuid = ? LIMIT 1`, [nodeUuid]));
+        const oldParent = oldParentRows[0]?.c_parent_uuid ?? null;
+        const oldParentName = oldParent
+            ? (await this.names(this.pool, [oldParent])).get(oldParent)
+            : undefined;
+        await this.closure.moveNode(nodeUuid, newParentUuid, (conn) => this.recordAudit(conn, actor, 'company.moved', {
+            company: names.get(nodeUuid),
+            from: oldParent ? (oldParentName ?? '(deleted organisation)') : '(top level)',
+            to: newParentUuid ? names.get(newParentUuid) : '(top level)',
+        }));
+    }
+    /**
+     * Delete a company through `deleteNode` (refuses a node with children; closure rows + ancestor
+     * bump in one transaction). The caller has already checked reach (walled read).
+     */
+    async remove(actor, nodeUuid) {
+        // Security review F6: the same own-root guard as `move` — a sub-admin never deletes the
+        // organisation its access is rooted at.
+        if (actor.isRoot !== true && nodeUuid === this.ownRoot(actor)) {
+            throw new identity_errors_js_1.IdentityForbiddenError('You cannot delete the organisation your access is rooted at.');
+        }
+        const name = (await this.names(this.pool, [nodeUuid])).get(nodeUuid);
+        await this.closure.deleteNode(nodeUuid, (conn) => this.recordAudit(conn, actor, 'company.deleted', { company: name ?? '(unknown)' }));
+    }
+    /** A company was just created: give it closure rows now and bump its ancestors (D5). */
+    async attached(nodeUuid) {
+        await this.closure.attachNode(nodeUuid);
+    }
+}
+exports.CompanyHierarchyService = CompanyHierarchyService;

package/dist/features/company/company.controller.d.ts

@@ -1,5 +1,6 @@
 import { CompanyService } from './company.service.js';
 import { type ListQueryDto } from '../shared/list-query.js';
+import type { AuthedRequest } from '../shared/http.js';
 export declare class CompanyController {
     private readonly companies;
     constructor(companies: CompanyService);
@@ -14,23 +15,40 @@ export declare class CompanyController {
         page: number;
         limit: number;
     }>;
-    /** Create a company (a new tenant) — gated on `identity:company:create`. */
-    createCompany(body: {
+    /**
+     * Create a company — gated on `identity:company:create`. A non-root caller's company is created
+     * UNDER the caller's own organisation (D5); only root creates a top-level tenant.
+     */
+    createCompany(req: AuthedRequest, body: {
         name?: string;
     }): Promise<{
         id: import("packages/engine/dist/types.js").RecordId;
     }>;
     /** Read one company — gated on `identity:company:read`. */
     getCompany(uuid: string): Promise<import("packages/engine/dist/types.js").RecordView | null>;
-    /** Update a company — gated on `identity:company:update`. */
+    /**
+     * Move a company under a new parent — gated on `identity:company:update`. Body
+     * `{ parentUuid: string | null }`. Non-root: the company and the new parent must both be in the
+     * caller's subtree, the company is not the caller's own root, and the parent is not null. A move
+     * that would form a cycle → 409. Declared BEFORE `companies/:uuid` (static sub-path first).
+     */
+    moveCompany(req: AuthedRequest, uuid: string, body: {
+        parentUuid?: string | null;
+    }): Promise<{
+        success: boolean;
+    }>;
+    /**
+     * Update a company's name/status — gated on `identity:company:update`. Any other key
+     * (parentUuid, type, …) is ignored: use `PUT companies/:uuid/parent` to move a company.
+     */
     updateCompany(uuid: string, body: {
         name?: string;
         status?: string;
     }): Promise<{
         success: boolean;
     }>;
-    /** Delete a company — gated on `identity:company:delete`. */
-    deleteCompany(uuid: string): Promise<{
+    /** Delete a company — gated on `identity:company:delete`. A company with sub-companies → 409. */
+    deleteCompany(req: AuthedRequest, uuid: string): Promise<{
         success: boolean;
     }>;
 }

package/dist/features/company/company.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"company.controller.d.ts","sourceRoot":"","sources":["../../../src/features/company/company.controller.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAE5E,qBACa,iBAAiB;IAChB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,cAAc;IAEtD;;;;OAIG;IAGG,aAAa,CAAU,KAAK,EAAE,YAAY;;;;;;IAMhD,4EAA4E;IAGtE,aAAa,CAAS,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAKnD,2DAA2D;IAG3D,UAAU,CAAgB,IAAI,EAAE,MAAM;IAItC,6DAA6D;IAGvD,aAAa,CAAgB,IAAI,EAAE,MAAM,EAAU,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAKjG,6DAA6D;IAGvD,aAAa,CAAgB,IAAI,EAAE,MAAM;;;CAIhD"}
+{"version":3,"file":"company.controller.d.ts","sourceRoot":"","sources":["../../../src/features/company/company.controller.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvD,qBAEa,iBAAiB;IAChB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,cAAc;IAEtD;;;;OAIG;IAGG,aAAa,CAAU,KAAK,EAAE,YAAY;;;;;;IAMhD;;;OAGG;IAGG,aAAa,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAK9E,2DAA2D;IAG3D,UAAU,CAAgB,IAAI,EAAE,MAAM;IAItC;;;;;OAKG;IAGG,WAAW,CACR,GAAG,EAAE,aAAa,EACV,IAAI,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;;;IAa9C;;;OAGG;IAGG,aAAa,CACF,IAAI,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAMlD,iGAAiG;IAG3F,aAAa,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM;;;CAI3E"}

package/dist/features/company/company.controller.js

@@ -17,6 +17,7 @@ const common_1 = require("@nestjs/common");
 const guard_1 = require("@astram/guard");
 const company_service_js_1 = require("./company.service.js");
 const list_query_js_1 = require("../shared/list-query.js");
+const identity_error_interceptor_js_1 = require("../shared/identity-error.interceptor.js");
 let CompanyController = class CompanyController {
     companies;
     constructor(companies) {
@@ -32,23 +33,44 @@ let CompanyController = class CompanyController {
         const result = await this.companies.listCompanies(params);
         return { total: result.total, rows: result.rows, page, limit };
     }
-    /** Create a company (a new tenant) — gated on `identity:company:create`. */
-    async createCompany(body) {
-        const id = await this.companies.createCompany(body?.name ?? 'Untitled');
+    /**
+     * Create a company — gated on `identity:company:create`. A non-root caller's company is created
+     * UNDER the caller's own organisation (D5); only root creates a top-level tenant.
+     */
+    async createCompany(req, body) {
+        const id = await this.companies.createCompany(req.principal, body?.name ?? 'Untitled');
         return { id };
     }
     /** Read one company — gated on `identity:company:read`. */
     getCompany(uuid) {
         return this.companies.getCompany(uuid);
     }
-    /** Update a company — gated on `identity:company:update`. */
+    /**
+     * Move a company under a new parent — gated on `identity:company:update`. Body
+     * `{ parentUuid: string | null }`. Non-root: the company and the new parent must both be in the
+     * caller's subtree, the company is not the caller's own root, and the parent is not null. A move
+     * that would form a cycle → 409. Declared BEFORE `companies/:uuid` (static sub-path first).
+     */
+    async moveCompany(req, uuid, body) {
+        if (!body ||
+            !('parentUuid' in body) ||
+            (body.parentUuid !== null && typeof body.parentUuid !== 'string')) {
+            throw new common_1.BadRequestException('parentUuid (a company id, or null) is required');
+        }
+        await this.companies.moveCompany(req.principal, uuid, body.parentUuid ?? null);
+        return { success: true };
+    }
+    /**
+     * Update a company's name/status — gated on `identity:company:update`. Any other key
+     * (parentUuid, type, …) is ignored: use `PUT companies/:uuid/parent` to move a company.
+     */
     async updateCompany(uuid, body) {
-        await this.companies.updateCompany(uuid, body ?? {});
+        await this.companies.updateCompany(uuid, { name: body?.name, status: body?.status });
         return { success: true };
     }
-    /** Delete a company — gated on `identity:company:delete`. */
-    async deleteCompany(uuid) {
-        await this.companies.deleteCompany(uuid);
+    /** Delete a company — gated on `identity:company:delete`. A company with sub-companies → 409. */
+    async deleteCompany(req, uuid) {
+        await this.companies.deleteCompany(req.principal, uuid);
         return { success: true };
     }
 };
@@ -64,9 +86,10 @@ __decorate([
 __decorate([
     (0, common_1.Post)('companies'),
     (0, guard_1.Classified)({ typeKey: 'company', action: 'create' }),
-    __param(0, (0, common_1.Body)()),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Body)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [Object, Object]),
     __metadata("design:returntype", Promise)
 ], CompanyController.prototype, "createCompany", null);
 __decorate([
@@ -77,6 +100,16 @@ __decorate([
     __metadata("design:paramtypes", [String]),
     __metadata("design:returntype", void 0)
 ], CompanyController.prototype, "getCompany", null);
+__decorate([
+    (0, common_1.Put)('companies/:uuid/parent'),
+    (0, guard_1.Classified)({ typeKey: 'company', action: 'update' }),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('uuid')),
+    __param(2, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String, Object]),
+    __metadata("design:returntype", Promise)
+], CompanyController.prototype, "moveCompany", null);
 __decorate([
     (0, common_1.Put)('companies/:uuid'),
     (0, guard_1.Classified)({ typeKey: 'company', action: 'update' }),
@@ -89,12 +122,14 @@ __decorate([
 __decorate([
     (0, common_1.Delete)('companies/:uuid'),
     (0, guard_1.Classified)({ typeKey: 'company', action: 'delete' }),
-    __param(0, (0, common_1.Param)('uuid')),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('uuid')),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String]),
+    __metadata("design:paramtypes", [Object, String]),
     __metadata("design:returntype", Promise)
 ], CompanyController.prototype, "deleteCompany", null);
 exports.CompanyController = CompanyController = __decorate([
     (0, common_1.Controller)('identity'),
+    (0, common_1.UseInterceptors)(identity_error_interceptor_js_1.IdentityErrorInterceptor),
     __metadata("design:paramtypes", [company_service_js_1.CompanyService])
 ], CompanyController);

package/dist/features/company/company.service.d.ts

@@ -1,25 +1,41 @@
 import { RecordsService, type RecordId } from '@astram/engine';
+import type { Principal } from '@astram/core';
 import { type ListParams } from '../shared/list-query.js';
+import { CompanyHierarchyService } from './company-hierarchy.service.js';
 /**
  * CompanyService — company (tenant) CRUD on the paved road, via the framework's
- * RecordsService facade. The facade supplies the acting identity (the request
- * principal) — this service never threads a Principal. No raw SQL, no RECORD_ENGINE.
+ * RecordsService facade (the request principal acts). No raw SQL, no RECORD_ENGINE.
+ *
+ * Hierarchy changes never ride a generic write (security hardening #2): the patch is whitelisted
+ * to `{name, status}`; create, move and delete keep the scope closure consistent through
+ * {@link CompanyHierarchyService}.
  */
 export declare class CompanyService {
     private readonly records;
-    constructor(records: RecordsService);
-    /** Create a company (tenant). */
-    createCompany(name: string): Promise<RecordId>;
+    private readonly hierarchy;
+    constructor(records: RecordsService, hierarchy: CompanyHierarchyService);
+    /**
+     * Create a company. A non-root creator's company is placed UNDER the creator's own node (D5) —
+     * never a new top-level tenant — and the closure is rebuilt + the ancestors bumped at once so
+     * the new node is inside the creator's subtree (their session picks it up at its next refresh).
+     * Root creates a top-level tenant.
+     */
+    createCompany(actor: Principal, name: string): Promise<RecordId>;
+    private readonly logger;
     /** List companies (tenant-scoped by the pipe), with paging/search/sort. */
     listCompanies(params?: ListParams): Promise<import("@astram/engine").RecordPage>;
     /** Read a single company. */
     getCompany(uuid: string): Promise<import("@astram/engine").RecordView | null>;
-    /** Update a company. */
-    updateCompany(uuid: string, patch: {
-        name?: string;
-        status?: string;
-    }): Promise<void>;
-    /** Delete a company. */
-    deleteCompany(uuid: string): Promise<void>;
+    /** Update a company's name/status. Any other key (parentUuid, type, …) is dropped. */
+    updateCompany(uuid: string, patch: Readonly<Record<string, unknown>>): Promise<void>;
+    /** Move a company under a new parent (hierarchy rules + cycle check, see the hierarchy service). */
+    moveCompany(actor: Principal, uuid: string, parentUuid: string | null): Promise<void>;
+    /**
+     * Delete a company: reach is checked through the subtree read wall (out of reach → 404), then
+     * the node is removed through `deleteNode` (refuses a node with children; closure + ancestor
+     * bump + audit in one transaction) — never a raw engine delete that would leave the closure
+     * stale or silently promote children.
+     */
+    deleteCompany(actor: Principal, uuid: string): Promise<void>;
 }
 //# sourceMappingURL=company.service.d.ts.map

package/dist/features/company/company.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"company.service.d.ts","sourceRoot":"","sources":["../../../src/features/company/company.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAK1E;;;;GAIG;AACH,qBACa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,cAAc;IAEpD,iCAAiC;IACjC,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAI9C,2EAA2E;IAC3E,aAAa,CAAC,MAAM,CAAC,EAAE,UAAU;IAIjC,6BAA6B;IAC7B,UAAU,CAAC,IAAI,EAAE,MAAM;IAIvB,wBAAwB;IACxB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrF,wBAAwB;IACxB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAG3C"}
+{"version":3,"file":"company.service.d.ts","sourceRoot":"","sources":["../../../src/features/company/company.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AASzE;;;;;;;GAOG;AACH,qBACa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBADT,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,uBAAuB;IAGrD;;;;;OAKG;IACG,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAetE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmC;IAE1D,2EAA2E;IAC3E,aAAa,CAAC,MAAM,CAAC,EAAE,UAAU;IAOjC,6BAA6B;IAC7B,UAAU,CAAC,IAAI,EAAE,MAAM;IAIvB,sFAAsF;IACtF,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAQpF,oGAAoG;IACpG,WAAW,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrF;;;;;OAKG;IACG,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAKnE"}

package/dist/features/company/company.service.js

@@ -8,27 +8,56 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
+var CompanyService_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CompanyService = void 0;
 const common_1 = require("@nestjs/common");
 const engine_1 = require("@astram/engine");
 const list_query_js_1 = require("../shared/list-query.js");
+const company_hierarchy_service_js_1 = require("./company-hierarchy.service.js");
+const identity_errors_js_1 = require("../shared/identity-errors.js");
 const COMPANY_SEARCH_FIELDS = ['name'];
 const COMPANY_SORT_FIELDS = ['name', 'status', 'createdAt'];
+/** The only company fields a generic patch may change (security hardening #2). */
+const COMPANY_PATCH_KEYS = ['name', 'status'];
 /**
  * CompanyService — company (tenant) CRUD on the paved road, via the framework's
- * RecordsService facade. The facade supplies the acting identity (the request
- * principal) — this service never threads a Principal. No raw SQL, no RECORD_ENGINE.
+ * RecordsService facade (the request principal acts). No raw SQL, no RECORD_ENGINE.
+ *
+ * Hierarchy changes never ride a generic write (security hardening #2): the patch is whitelisted
+ * to `{name, status}`; create, move and delete keep the scope closure consistent through
+ * {@link CompanyHierarchyService}.
  */
-let CompanyService = class CompanyService {
+let CompanyService = CompanyService_1 = class CompanyService {
     records;
-    constructor(records) {
+    hierarchy;
+    constructor(records, hierarchy) {
         this.records = records;
+        this.hierarchy = hierarchy;
     }
-    /** Create a company (tenant). */
-    createCompany(name) {
-        return this.records.create('company', { fields: { name } });
+    /**
+     * Create a company. A non-root creator's company is placed UNDER the creator's own node (D5) —
+     * never a new top-level tenant — and the closure is rebuilt + the ancestors bumped at once so
+     * the new node is inside the creator's subtree (their session picks it up at its next refresh).
+     * Root creates a top-level tenant.
+     */
+    async createCompany(actor, name) {
+        const fields = { name };
+        if (actor.isRoot !== true)
+            fields.parentUuid = actor.activeScopeNodeId ?? actor.tenantId;
+        const id = await this.records.create('company', { fields });
+        try {
+            await this.hierarchy.attached(String(id));
+        }
+        catch (cause) {
+            // The company row is committed; a failed closure rebuild only DELAYS the new node's reach
+            // (fail-closed: no closure row ⇒ nobody's subtree includes it) until the next reconcile.
+            // Answering an error here would invite a duplicate create on retry.
+            this.logger.error(`company closure attach failed: ${cause?.name ?? 'error'}`);
+        }
+        return id;
     }
+    logger = new common_1.Logger(CompanyService_1.name);
     /** List companies (tenant-scoped by the pipe), with paging/search/sort. */
     listCompanies(params) {
         return this.records.list('company', (0, list_query_js_1.buildListQuery)(params, COMPANY_SEARCH_FIELDS, COMPANY_SORT_FIELDS));
@@ -37,17 +66,35 @@ let CompanyService = class CompanyService {
     getCompany(uuid) {
         return this.records.get('company', uuid);
     }
-    /** Update a company. */
+    /** Update a company's name/status. Any other key (parentUuid, type, …) is dropped. */
     updateCompany(uuid, patch) {
-        return this.records.update('company', uuid, { fields: patch });
+        const fields = {};
+        for (const key of COMPANY_PATCH_KEYS) {
+            if (typeof patch?.[key] === 'string')
+                fields[key] = patch[key];
+        }
+        return this.records.update('company', uuid, { fields });
     }
-    /** Delete a company. */
-    deleteCompany(uuid) {
-        return this.records.delete('company', uuid);
+    /** Move a company under a new parent (hierarchy rules + cycle check, see the hierarchy service). */
+    moveCompany(actor, uuid, parentUuid) {
+        return this.hierarchy.move(actor, uuid, parentUuid);
+    }
+    /**
+     * Delete a company: reach is checked through the subtree read wall (out of reach → 404), then
+     * the node is removed through `deleteNode` (refuses a node with children; closure + ancestor
+     * bump + audit in one transaction) — never a raw engine delete that would leave the closure
+     * stale or silently promote children.
+     */
+    async deleteCompany(actor, uuid) {
+        const company = await this.records.get('company', uuid);
+        if (company === null)
+            throw new identity_errors_js_1.IdentityNotFoundError('Company not found.');
+        await this.hierarchy.remove(actor, uuid);
     }
 };
 exports.CompanyService = CompanyService;
-exports.CompanyService = CompanyService = __decorate([
+exports.CompanyService = CompanyService = CompanyService_1 = __decorate([
     (0, common_1.Injectable)(),
-    __metadata("design:paramtypes", [engine_1.RecordsService])
+    __metadata("design:paramtypes", [engine_1.RecordsService,
+        company_hierarchy_service_js_1.CompanyHierarchyService])
 ], CompanyService);

package/dist/features/cross-tenant/cross-tenant-grant.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cross-tenant-grant.controller.d.ts","sourceRoot":"","sources":["../../../src/features/cross-tenant/cross-tenant-grant.controller.ts"],"names":[],"mappings":"AA4CA,OAAO,EAGL,sBAAsB,EAKvB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AAEnF,qFAAqF;AACrF,UAAU,aAAa;IACrB,SAAS,EAAE,SAAS,CAAC;CACtB;AAED,gGAAgG;AAChG,UAAU,iBAAiB;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAmDD,qBACa,0BAA0B;IAEO,OAAO,CAAC,QAAQ,CAAC,WAAW;IACtE,OAAO,CAAC,QAAQ,CAAC,KAAK;gBADqC,WAAW,EAAE,sBAAsB,EAC7E,KAAK,EAAE,2BAA2B;IAGrD;;;;OAIG;IAGG,KAAK,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE,iBAAiB;;;;IA+BtE,yFAAyF;IAGnF,MAAM,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM;;;IASnE;;;;;OAKG;IAGG,MAAM,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM;;;IASnE;;;OAGG;IAGG,KAAK,CAAQ,GAAG,EAAE,aAAa;;;IAKrC;;;;OAIG;IAGG,IAAI,CAAQ,GAAG,EAAE,aAAa;;;;IAQpC,wFAAwF;IAGlF,cAAc;;;CAIrB"}
+{"version":3,"file":"cross-tenant-grant.controller.d.ts","sourceRoot":"","sources":["../../../src/features/cross-tenant/cross-tenant-grant.controller.ts"],"names":[],"mappings":"AA8CA,OAAO,EAGL,sBAAsB,EAKvB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AAEnF,qFAAqF;AACrF,UAAU,aAAa;IACrB,SAAS,EAAE,SAAS,CAAC;CACtB;AAED,gGAAgG;AAChG,UAAU,iBAAiB;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAqDD,qBAEa,0BAA0B;IAEO,OAAO,CAAC,QAAQ,CAAC,WAAW;IACtE,OAAO,CAAC,QAAQ,CAAC,KAAK;gBADqC,WAAW,EAAE,sBAAsB,EAC7E,KAAK,EAAE,2BAA2B;IAGrD;;;;OAIG;IAGG,KAAK,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE,iBAAiB;;;;IA+BtE,yFAAyF;IAGnF,MAAM,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM;;;IASnE;;;;;OAKG;IAGG,MAAM,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM;;;IASnE;;;OAGG;IAGG,KAAK,CAAQ,GAAG,EAAE,aAAa;;;IAKrC;;;;OAIG;IAGG,IAAI,CAAQ,GAAG,EAAE,aAAa;;;;IAQpC,wFAAwF;IAGlF,cAAc;;;CAIrB"}

package/dist/features/cross-tenant/cross-tenant-grant.controller.js

@@ -46,6 +46,7 @@ exports.CrossTenantGrantController = void 0;
  * writer change).
  */
 const common_1 = require("@nestjs/common");
+const identity_error_interceptor_js_1 = require("../shared/identity-error.interceptor.js");
 const guard_1 = require("@astram/guard");
 const cross_tenant_grant_read_service_js_1 = require("./cross-tenant-grant-read.service.js");
 const VALID_GRANTEE_KINDS = ['user', 'role'];
@@ -231,6 +232,7 @@ __decorate([
 ], CrossTenantGrantController.prototype, "offerableTypes", null);
 exports.CrossTenantGrantController = CrossTenantGrantController = __decorate([
     (0, common_1.Controller)('identity'),
+    (0, common_1.UseInterceptors)(identity_error_interceptor_js_1.IdentityErrorInterceptor),
     __param(0, (0, common_1.Inject)(guard_1.SHIELD_CROSS_TENANT_GRANT_WRITER)),
     __metadata("design:paramtypes", [guard_1.CrossTenantGrantWriter,
         cross_tenant_grant_read_service_js_1.CrossTenantGrantReadService])

package/dist/features/identity-feature.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-feature.module.d.ts","sourceRoot":"","sources":["../../src/features/identity-feature.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE5D,OAAO,EAYL,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AAsExB;;;;;;;;;;GAUG;AACH,qBACa,qBAAqB;IAChC;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,OAAO,CAAC,EACb,OAAO,EACP,YAAiB,GAClB,GAAE;QAAE,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,YAAY,CAAC,EAAE,SAAS,eAAe,EAAE,CAAA;KAAO,GAAG,aAAa;CAwTnG"}
+{"version":3,"file":"identity-feature.module.d.ts","sourceRoot":"","sources":["../../src/features/identity-feature.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpE,OAAO,EAYL,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AA6FxB;;;;;;;;;;GAUG;AACH,qBACa,qBAAqB;IAChC;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,OAAO,CAAC,EACb,OAAO,EACP,YAAiB,GAClB,GAAE;QACD,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5B,YAAY,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;KACtC,GAAG,aAAa;CAscvB"}