@astram/identity 0.3.1 → 0.5.0

package/dist/features/identity-feature.module.js

@@ -16,6 +16,7 @@ const objects_js_1 = require("../objects.js");
 const index_js_1 = require("./access/index.js");
 const company_service_js_1 = require("./company/company.service.js");
 const company_controller_js_1 = require("./company/company.controller.js");
+const company_hierarchy_service_js_1 = require("./company/company-hierarchy.service.js");
 const role_service_js_1 = require("./role/role.service.js");
 const role_controller_js_1 = require("./role/role.controller.js");
 const user_service_js_1 = require("./user/user.service.js");
@@ -30,13 +31,18 @@ const posting_version_bump_js_1 = require("./membership/posting-version-bump.js"
 const permission_version_bumper_js_1 = require("./authz/permission-version.bumper.js");
 const record_authorization_js_1 = require("./authz/record-authorization.js");
 const db_permission_facts_adapter_js_1 = require("./authz/db-permission-facts.adapter.js");
+const session_revocation_check_js_1 = require("./user/session-revocation-check.js");
 const access_bundle_store_js_1 = require("./authz/access-bundle-store.js");
 const grant_admin_service_js_1 = require("./authz/grant-admin.service.js");
 const grant_admin_controller_js_1 = require("./authz/grant-admin.controller.js");
+const grant_ceiling_js_1 = require("./authz/grant-ceiling.js");
 const policy_service_js_1 = require("./policy/policy.service.js");
 const policy_controller_js_1 = require("./policy/policy.controller.js");
 const share_service_js_1 = require("./share/share.service.js");
 const share_controller_js_1 = require("./share/share.controller.js");
+const service_account_store_js_1 = require("./service-account/service-account.store.js");
+const service_account_service_js_1 = require("./service-account/service-account.service.js");
+const service_account_controller_js_1 = require("./service-account/service-account.controller.js");
 const catalog_reconcile_job_js_1 = require("./authz/catalog-reconcile.job.js");
 const access_bundle_reconcile_job_js_1 = require("./authz/access-bundle-reconcile.job.js");
 const catalog_bootstrap_provider_js_1 = require("./authz/catalog-bootstrap.provider.js");
@@ -48,6 +54,10 @@ const audit_controller_js_1 = require("./audit/audit.controller.js");
 const cross_tenant_grant_read_service_js_1 = require("./cross-tenant/cross-tenant-grant-read.service.js");
 const cross_tenant_grant_controller_js_1 = require("./cross-tenant/cross-tenant-grant.controller.js");
 const grant_authorize_js_1 = require("./cross-tenant/grant-authorize.js");
+/** DI token of the provider that links the guard's Redis version cache to the bumper (ADR-0035). */
+const IDENTITY_VERSION_PUBLISHER_LINK = Symbol('IDENTITY_VERSION_PUBLISHER_LINK');
+/** DI token of the boot check that warns when a user disable cannot revoke sessions. */
+const IDENTITY_SESSION_REVOCATION_CHECK = Symbol('IDENTITY_SESSION_REVOCATION_CHECK');
 /** Map guard's env DbConfig → the engine's EngineDbConfig (adds the pool cap the engine needs). */
 function engineDbFromEnv() {
     const db = (0, guard_1.loadDbConfig)();
@@ -97,20 +107,46 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
         const bumper = new permission_version_bumper_js_1.PermissionVersionBumper();
         const postingVersionBump = {
             bumpTenant: (tenantUuid) => bumper.bumpForTenant(tenantUuid, authzPool),
+            // A user disabled/re-enabled: every membership tenant (autocommit pool → published at once).
+            bumpForUser: (userUuid) => bumper.bumpForUser(userUuid, authzPool),
         };
+        // The core ModuleRegistry the catalog reconcile job needs, built from the identity
+        // object registrations (guard's bridge reflects decorated classes → registry). Built BEFORE
+        // the grant-admin service so the GrantCeiling (ADR-0029) can share it as the key universe.
+        const identityRegistry = (0, guard_1.buildIdentityModuleRegistry)([...objects_js_1.identityObjects]);
         // The grant-admin collaborators built at forRoot() over the shared pool (mirrors the
-        // postingVersionBump closure pattern above).
+        // postingVersionBump closure pattern above). GrantCeiling (ADR-0029) enforces the
+        // self-escalation ceiling: a non-root grantor may only grant a key they themselves hold —
+        // resolved over the SAME authz pool + registry the object-type gate uses (one source of
+        // truth for "what a principal holds"). ALWAYS wired here, so production always enforces.
         const accessBundleStore = new access_bundle_store_js_1.AccessBundleStore(authzPool);
-        const grantAdminService = new grant_admin_service_js_1.GrantAdminService(authzPool, bumper, accessBundleStore);
+        // The ceiling's key universe includes the consumer's `extraObjects` (the SAME registry shape
+        // `buildIdentityRecordAuthorization(pool, extraObjects)` gives the decision path): otherwise a
+        // role holding a consumer-type key could never be assigned or granted by a non-root admin who
+        // holds that key (review M5) — the security-hardening role-assignment ceiling makes that
+        // reachable from every posting edit. `rootIds` marks platform roots as never dominated.
+        const ceilingRegistry = (0, guard_1.buildIdentityModuleRegistry)([...objects_js_1.identityObjects, ...extraObjects]);
+        // rootIds is passed EXPLICITLY (review F5): `null` states "not configured". The dominance
+        // check still refuses any user flagged `u_is_platform_superuser`, so an unconfigured list
+        // never lets a sub-admin take over a platform administrator.
+        if (rootIds === undefined) {
+            new common_1.Logger('IdentityFeatureModule').warn('rootIds not passed to IdentityFeatureModule.forRoot — pass the same array as ' +
+                'ShieldModule.forRoot({ rootIds }). Platform administrators are still protected via ' +
+                'users.u_is_platform_superuser.');
+        }
+        const grantCeiling = new grant_ceiling_js_1.GrantCeiling(authzPool, ceilingRegistry, rootIds ?? null);
+        // Grant administration is audited on the grant's own transaction (D6, fail-closed).
+        const grantAdminAuditSink = new engine_1.MariaDbAuditSink({}); // shield_audit.audit_log defaults
+        const grantAdminService = new grant_admin_service_js_1.GrantAdminService(authzPool, bumper, accessBundleStore, grantCeiling, grantAdminAuditSink);
         // Scope closure (Task 1.2 of the scoped-hierarchy program): the reconciler + node
         // move/delete maintenance, over the SAME shared authzPool (it reaches BOTH shield_app —
         // companies — and shield_authz — scope_closure). Reuses the SAME `bumper` instance so a
         // moveNode's session-invalidation joins the move's transaction. reconcileClosure() is
         // kicked post-boot by the CatalogBootstrapProvider (mirrors the catalog reconcile).
         const scopeClosureService = new scope_closure_service_js_1.ScopeClosureService(authzPool, bumper);
-        // The core ModuleRegistry the catalog reconcile job needs, built from the identity
-        // object registrations (guard's bridge reflects decorated classes → registry).
-        const identityRegistry = (0, guard_1.buildIdentityModuleRegistry)([...objects_js_1.identityObjects]);
+        // Company hierarchy (security hardening #2): the ONLY path that moves/deletes/attaches a company
+        // node — through the closure service above — audited on the move/delete transaction.
+        const companyHierarchyService = new company_hierarchy_service_js_1.CompanyHierarchyService(authzPool, scopeClosureService, new engine_1.MariaDbAuditSink({}));
         // Audit viewer (Phase 5): the AuditReader + LabelResolver over the SAME shared authzPool
         // (the reader queries shield_audit + the resolver/actor-lookup query shield_app, both
         // reachable by that pool). `auditNameToId` is the actor-name -> uuid reverse lookup for the
@@ -292,6 +328,50 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
             },
         });
         const shareService = new share_service_js_1.ShareService(recordShareWriter, auditLabels);
+        // ── SERVICE ACCOUNTS + API KEYS (ADR-0033, Phase 2) ──────────────────────────────────────
+        // The machine-identity admin surface: create/scope service accounts + issue/rotate/revoke
+        // their `ask_…` API keys. Self-wired here over the SAME shared authzPool (which reaches BOTH
+        // shield_app.service_account — the accounts — AND shield_authz.service_account_key — the hashed
+        // keys). The guard's MariaDbApiKeyStore + Argon2idPasswordHasher back the credential lifecycle;
+        // the service enforces own-tenant + the ADR-0029 ceiling (scope ⊆ mine, roles ⊆ mine).
+        const serviceAccountStore = new service_account_store_js_1.ServiceAccountStore(authzPool);
+        const serviceAccountKeyStore = new guard_1.MariaDbApiKeyStore(authzPool);
+        const serviceAccountHasher = new guard_1.Argon2idPasswordHasher();
+        // Best-effort audit → the SAME shield_audit sink pattern (a sink throw never fails the op).
+        const serviceAccountAuditSink = new engine_1.MariaDbAuditSink({}); // shield_audit.audit_log defaults
+        const serviceAccountAudit = {
+            record: async (event) => {
+                try {
+                    await serviceAccountAuditSink.record({
+                        type: 'admin_action',
+                        occurredAtMs: event.occurredAtMs,
+                        actorId: event.actorId,
+                        tenantId: event.tenantId,
+                        action: { key: event.action },
+                        attributes: { ...event.attributes, eventType: 'service_account' },
+                    }, (sql, params) => authzPool.query(sql, params));
+                }
+                catch {
+                    // Best-effort — an audit failure must never fail a legitimate account/key operation.
+                }
+            },
+        };
+        // Resolve a principal id → username for the "created by" view (no raw uuid). Reuses the same
+        // shield_app.users lookup the audit actor filter uses (inverted). Unknown → null (view falls
+        // back to no name, never an id).
+        const resolveActorName = async (id) => {
+            const rows = (await authzPool.query('SELECT u_username AS name FROM `shield_app`.`users` WHERE u_uuid = ? LIMIT 1', [id]));
+            return rows[0]?.name ?? null;
+        };
+        const serviceAccountService = new service_account_service_js_1.ServiceAccountService(serviceAccountStore, serviceAccountKeyStore, serviceAccountHasher, serviceAccountAudit, resolveActorName, 
+        // The ceiling's roles: in-effect postings (the same source as gate 5 and GrantCeiling).
+        (principalId, tenantId) => (0, db_permission_facts_adapter_js_1.readRoleIdsForTenant)(authzPool, principalId, tenantId));
+        // NOTE: the machine AUTH path (the `ServiceAuthenticator` behind `SHIELD_SERVICE_AUTHENTICATOR`)
+        // is provided by the guard's own AuthModule (under `auth: true`), NOT here — a token provided in
+        // this later, sibling feature module is invisible to the APP_GUARD in ShieldModule (that DI
+        // boundary made an identity-provided authenticator resolve to `undefined` → `ask_…` bearers
+        // 401'd). This module owns only the ACCOUNT ADMIN surface (store + service + controller); the
+        // guard owns authentication. (ADR-0033.)
         return {
             module: IdentityFeatureModule_1,
             imports: [
@@ -332,6 +412,9 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
                 policy_controller_js_1.PolicyController,
                 // Owner shares (Phase 6) — `record-shares` collides with nothing. Appended last.
                 share_controller_js_1.ShareController,
+                // Service accounts (ADR-0033) — `service-accounts/*` collides with nothing; its static
+                // sub-paths (/keys, /keys/rotate, /keys/revoke) sit under `:id` and are method-distinct.
+                service_account_controller_js_1.ServiceAccountController,
             ],
             providers: [
                 company_service_js_1.CompanyService,
@@ -342,9 +425,36 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
                 org_catalog_service_js_1.OrgCatalogService,
                 record_resolver_js_1.RecordResolverService,
                 { provide: posting_version_bump_js_1.POSTING_VERSION_BUMP, useValue: postingVersionBump },
+                // ADR-0035 (GAPS #6): attach the guard's Redis permission-version cache to the ONE shared
+                // bumper, so every committed bump (postings, grants, hierarchy) is published to Redis,
+                // where gate 5 reads it. Provided by the auth surface under `auth: true` (through the
+                // @Global ShieldModule); absent → DB-only bumps, exactly as before.
+                // Phase 3 review P2: with auth on (the token binder is visible) but no session sweeper, a
+                // user disable cannot revoke sessions — warn at boot.
+                {
+                    provide: IDENTITY_SESSION_REVOCATION_CHECK,
+                    useFactory: (binder, sweeper) => (0, session_revocation_check_js_1.warnIfSessionsUnrevocable)(binder, sweeper, (m) => new common_1.Logger('IdentityFeatureModule').warn(m)),
+                    inject: [
+                        { token: guard_1.SHIELD_SESSION_TOKEN_BINDER, optional: true },
+                        { token: guard_1.SHIELD_SESSION_SWEEPER, optional: true },
+                    ],
+                },
+                {
+                    provide: IDENTITY_VERSION_PUBLISHER_LINK,
+                    useFactory: (cache) => {
+                        if (cache)
+                            bumper.attachVersionPublisher(cache);
+                        return cache !== null && cache !== undefined;
+                    },
+                    inject: [{ token: guard_1.SHIELD_PERMISSION_VERSION_CACHE, optional: true }],
+                },
                 // Grant-admin stack — all over the ONE shared authzPool.
                 { provide: access_bundle_store_js_1.AccessBundleStore, useValue: accessBundleStore },
                 { provide: grant_admin_service_js_1.GrantAdminService, useValue: grantAdminService },
+                // The ONE tenant-boundary authority (ADR-0029 ceiling + block A: role assignment, user
+                // dominance, role binding) — injected by RoleService, PostingService and UserService.
+                { provide: grant_ceiling_js_1.GrantCeiling, useValue: grantCeiling },
+                { provide: company_hierarchy_service_js_1.CompanyHierarchyService, useValue: companyHierarchyService },
                 // Audit read stack — built at forRoot() over the ONE shared authzPool, provided as a
                 // useValue (like GrantAdminService) so it carries the hand-built reader/resolver/lookup.
                 { provide: audit_read_service_js_1.AuditReadService, useValue: auditReadService },
@@ -359,9 +469,16 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
                 // Owner shares (Phase 6) — the ShareService over the framework RecordShareWriter + the
                 // DirectoryLabelResolver (name resolution). useValue, all over the shared authzPool.
                 { provide: share_service_js_1.ShareService, useValue: shareService },
+                // Service accounts (ADR-0033) — the ServiceAccountService over the shared authzPool +
+                // guard key-store/hasher, and the ServiceAuthenticator under the guard's token so the
+                // enforcement guard can authenticate `ask_…` bearers out-of-the-box. Both useValue.
+                { provide: service_account_service_js_1.ServiceAccountService, useValue: serviceAccountService },
                 // The mutating half of auto-catalog: a single CatalogReconcileJob (post-boot pass +
                 // cron), over the shared pool + the identity registry.
-                { provide: catalog_reconcile_job_js_1.CatalogReconcileJob, useValue: new catalog_reconcile_job_js_1.CatalogReconcileJob(authzPool, identityRegistry) },
+                {
+                    provide: catalog_reconcile_job_js_1.CatalogReconcileJob,
+                    useValue: new catalog_reconcile_job_js_1.CatalogReconcileJob(authzPool, identityRegistry),
+                },
                 // The bundle half: reconciles the merged AccessBundleSpec[] (ENGINE_ALL_ACCESS_BUNDLES,
                 // reflected by the engine from identityAccessBundles) into shield_authz.access_bundle.
                 {

package/dist/features/membership/membership.controller.d.ts

@@ -1,6 +1,7 @@
 import { MembershipService } from './membership.service.js';
 import { PostingService, type PostingInput } from './posting.service.js';
 import { RecordResolverService } from '../shared/record-resolver.js';
+import { type AuthedRequest } from '../shared/http.js';
 /** A membership card for the API, with EVERY uuid resolved to a display name. */
 interface MembershipCardDto {
     /** The membership id — used as a route param / react key, NEVER as a display field. */
@@ -39,7 +40,7 @@ export declare class MembershipController {
         memberships: MembershipCardDto[];
     }>;
     /** Add the user to a company (creates an inactive membership card). */
-    addUserMembership(userUuid: string, body: {
+    addUserMembership(req: AuthedRequest, userUuid: string, body: {
         companyUuid?: string;
     }): Promise<{
         id: import("@astram/engine").RecordId;
@@ -49,19 +50,19 @@ export declare class MembershipController {
      * invariant); `status` is a plain field update. Activating requires the owning user so
      * the invariant can deactivate the user's OTHER memberships.
      */
-    updateMembership(membershipUuid: string, body: {
+    updateMembership(req: AuthedRequest, membershipUuid: string, body: {
         isActive?: boolean;
         status?: string;
         userUuid?: string;
     }): Promise<{
         success: boolean;
     }>;
-    /** Remove a membership card (its postings cascade at the DB). */
-    removeMembership(membershipUuid: string): Promise<{
+    /** Remove a membership card (its postings cascade at the DB). A peer's needs dominance. */
+    removeMembership(req: AuthedRequest, membershipUuid: string): Promise<{
         success: boolean;
     }>;
     /** Atomically replace a membership's full posting set (the diff sync). */
-    replacePostings(membershipUuid: string, body: {
+    replacePostings(req: AuthedRequest, membershipUuid: string, body: {
         postings?: PostingInput[];
     }): Promise<{
         success: boolean;

package/dist/features/membership/membership.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"membership.controller.d.ts","sourceRoot":"","sources":["../../../src/features/membership/membership.controller.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,KAAK,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAGrE,iFAAiF;AACjF,UAAU,iBAAiB;IACzB,uFAAuF;IACvF,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED,4EAA4E;AAC5E,UAAU,cAAc;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,kFAAkF;IAClF,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AASD,qBACa,oBAAoB;IAE7B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAFR,WAAW,EAAE,iBAAiB,EAC9B,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,qBAAqB;IAGlD;;;;;OAKG;IAGG,mBAAmB,CAAoB,QAAQ,EAAE,MAAM;;;IA0C7D,uEAAuE;IAGjE,iBAAiB,CACF,QAAQ,EAAE,MAAM,EAC3B,IAAI,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAMxC;;;;OAIG;IAGG,gBAAgB,CACK,cAAc,EAAE,MAAM,EACvC,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAc1E,iEAAiE;IAG3D,gBAAgB,CAA0B,cAAc,EAAE,MAAM;;;IAKtE,0EAA0E;IAGpE,eAAe,CACM,cAAc,EAAE,MAAM,EACvC,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,YAAY,EAAE,CAAA;KAAE;;;IAM7C;;;;OAIG;YACW,WAAW;CAM1B"}
+{"version":3,"file":"membership.controller.d.ts","sourceRoot":"","sources":["../../../src/features/membership/membership.controller.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,KAAK,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAqB,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAG1E,iFAAiF;AACjF,UAAU,iBAAiB;IACzB,uFAAuF;IACvF,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED,4EAA4E;AAC5E,UAAU,cAAc;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,kFAAkF;IAClF,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAYD,qBAEa,oBAAoB;IAE7B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAFR,WAAW,EAAE,iBAAiB,EAC9B,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,qBAAqB;IAGlD;;;;;OAKG;IAGG,mBAAmB,CAAoB,QAAQ,EAAE,MAAM;;;IA0C7D,uEAAuE;IAGjE,iBAAiB,CACd,GAAG,EAAE,aAAa,EACN,QAAQ,EAAE,MAAM,EAC3B,IAAI,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAUxC;;;;OAIG;IAGG,gBAAgB,CACb,GAAG,EAAE,aAAa,EACA,cAAc,EAAE,MAAM,EACvC,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAgB1E,2FAA2F;IAGrF,gBAAgB,CACb,GAAG,EAAE,aAAa,EACA,cAAc,EAAE,MAAM;;;IAMjD,0EAA0E;IAGpE,eAAe,CACZ,GAAG,EAAE,aAAa,EACA,cAAc,EAAE,MAAM,EACvC,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,YAAY,EAAE,CAAA;KAAE;;;IAO7C;;;;OAIG;YACW,WAAW;CAM1B"}

package/dist/features/membership/membership.controller.js

@@ -19,12 +19,16 @@ const membership_service_js_1 = require("./membership.service.js");
 const posting_service_js_1 = require("./posting.service.js");
 const record_resolver_js_1 = require("../shared/record-resolver.js");
 const http_js_1 = require("../shared/http.js");
+const identity_error_interceptor_js_1 = require("../shared/identity-error.interceptor.js");
 // ── Memberships + postings ───────────────────────────────────────────────────
 //
 // Gated on the `company_membership` / `membership_posting` grants via `@Classified`
 // + the engine's mandatory in-pipe gate. Both are DATA-plane types, so the capped root
 // is denied them by construction — the membership admin surface is grant-driven, not
-// root-driven. Real per-company-admin scoping is a later permission-engine concern.
+// root-driven. Per-company-admin scoping is structural: reads, updates and deletes are walled
+// to the caller's subtree (ADR-0027/0030), creates by the ADR-0034 create wall; adding an
+// existing user needs that user already in the subtree (D4), and posting a role runs the
+// role-assignment ceiling + binding rule (#11). Errors map via IdentityErrorInterceptor.
 let MembershipController = class MembershipController {
     memberships;
     postings;
@@ -78,8 +82,8 @@ let MembershipController = class MembershipController {
         return { memberships: cards };
     }
     /** Add the user to a company (creates an inactive membership card). */
-    async addUserMembership(userUuid, body) {
-        const id = await this.memberships.addMembership(userUuid, body?.companyUuid ?? '');
+    async addUserMembership(req, userUuid, body) {
+        const id = await this.memberships.addMembership(req.principal, userUuid, body?.companyUuid ?? '');
         return { id };
     }
     /**
@@ -87,26 +91,29 @@ let MembershipController = class MembershipController {
      * invariant); `status` is a plain field update. Activating requires the owning user so
      * the invariant can deactivate the user's OTHER memberships.
      */
-    async updateMembership(membershipUuid, body) {
+    async updateMembership(req, membershipUuid, body) {
         if (body?.isActive === true) {
             if (!body.userUuid) {
                 throw new common_1.ForbiddenException('userUuid is required to activate a membership');
             }
-            await this.memberships.setActive(membershipUuid, body.userUuid);
+            await this.memberships.setActive(req.principal, membershipUuid, body.userUuid);
         }
         if (typeof body?.status === 'string') {
-            await this.memberships.updateMembership(membershipUuid, { status: body.status });
+            await this.memberships.updateMembership(req.principal, membershipUuid, {
+                status: body.status,
+            });
         }
         return { success: true };
     }
-    /** Remove a membership card (its postings cascade at the DB). */
-    async removeMembership(membershipUuid) {
-        await this.memberships.removeMembership(membershipUuid);
+    /** Remove a membership card (its postings cascade at the DB). A peer's needs dominance. */
+    async removeMembership(req, membershipUuid) {
+        await this.memberships.removeMembership(req.principal, membershipUuid);
         return { success: true };
     }
     /** Atomically replace a membership's full posting set (the diff sync). */
-    async replacePostings(membershipUuid, body) {
-        await this.postings.replacePostings(membershipUuid, body?.postings ?? []);
+    async replacePostings(req, membershipUuid, body) {
+        const postings = Array.isArray(body?.postings) ? body.postings : [];
+        await this.postings.replacePostings(req.principal, membershipUuid, postings);
         return { success: true };
     }
     /**
@@ -134,40 +141,45 @@ __decorate([
 __decorate([
     (0, common_1.Post)('users/:userUuid/memberships'),
     (0, guard_1.Classified)({ typeKey: 'company_membership', action: 'create' }),
-    __param(0, (0, common_1.Param)('userUuid')),
-    __param(1, (0, common_1.Body)()),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('userUuid')),
+    __param(2, (0, common_1.Body)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String, Object]),
+    __metadata("design:paramtypes", [Object, String, Object]),
     __metadata("design:returntype", Promise)
 ], MembershipController.prototype, "addUserMembership", null);
 __decorate([
     (0, common_1.Put)('memberships/:membershipUuid'),
     (0, guard_1.Classified)({ typeKey: 'company_membership', action: 'update' }),
-    __param(0, (0, common_1.Param)('membershipUuid')),
-    __param(1, (0, common_1.Body)()),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('membershipUuid')),
+    __param(2, (0, common_1.Body)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String, Object]),
+    __metadata("design:paramtypes", [Object, String, Object]),
     __metadata("design:returntype", Promise)
 ], MembershipController.prototype, "updateMembership", null);
 __decorate([
     (0, common_1.Delete)('memberships/:membershipUuid'),
     (0, guard_1.Classified)({ typeKey: 'company_membership', action: 'delete' }),
-    __param(0, (0, common_1.Param)('membershipUuid')),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('membershipUuid')),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String]),
+    __metadata("design:paramtypes", [Object, String]),
     __metadata("design:returntype", Promise)
 ], MembershipController.prototype, "removeMembership", null);
 __decorate([
     (0, common_1.Put)('memberships/:membershipUuid/postings'),
     (0, guard_1.Classified)({ typeKey: 'membership_posting', action: 'update' }),
-    __param(0, (0, common_1.Param)('membershipUuid')),
-    __param(1, (0, common_1.Body)()),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('membershipUuid')),
+    __param(2, (0, common_1.Body)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String, Object]),
+    __metadata("design:paramtypes", [Object, String, Object]),
     __metadata("design:returntype", Promise)
 ], MembershipController.prototype, "replacePostings", null);
 exports.MembershipController = MembershipController = __decorate([
     (0, common_1.Controller)('identity'),
+    (0, common_1.UseInterceptors)(identity_error_interceptor_js_1.IdentityErrorInterceptor),
     __metadata("design:paramtypes", [membership_service_js_1.MembershipService,
         posting_service_js_1.PostingService,
         record_resolver_js_1.RecordResolverService])

package/dist/features/membership/membership.service.d.ts

@@ -11,17 +11,20 @@
  * `cm_is_active`; `setActive` is the guard.
  */
 import { RecordsService, type RecordId, type RecordView } from '@astram/engine';
+import type { Principal } from '@astram/core';
 import { type PostingVersionBump } from './posting-version-bump.js';
+import { GrantCeiling } from '../authz/grant-ceiling.js';
 export declare class MembershipService {
     private readonly records;
+    private readonly ceiling;
     private readonly versionBump?;
-    constructor(records: RecordsService, versionBump?: (PostingVersionBump | null) | undefined);
+    constructor(records: RecordsService, ceiling: GrantCeiling, versionBump?: (PostingVersionBump | null) | undefined);
     /**
-     * Read a membership's tenant (its `companyUuid`) through the pipe, or `null` when
-     * unresolvable (→ no bump; fail-safe, never guesses a tenant). Used to target the
-     * permission-version bump at the company whose coarse grants a mutation changed.
+     * Read a membership through the subtree wall (404 when out of reach) and, unless the actor is
+     * acting on their OWN membership, require the actor to dominate its user (security review): a
+     * sub-admin must not delete, suspend or re-activate a more privileged peer's membership.
      */
-    private tenantOf;
+    private reachMember;
     /**
      * Bump the permission version for each DISTINCT tenant in `tenantUuids` (best-effort +
      * fail-safe): the mutation already succeeded, so a bump hiccup must NOT surface as an
@@ -37,17 +40,17 @@ export declare class MembershipService {
      * hits the DB's UNIQUE constraint and the engine's error surfaces to the caller (NOT
      * swallowed here). `createdBy` is stamped server-side (actorId-trusted).
      */
-    addMembership(userUuid: string, companyUuid: string): Promise<RecordId>;
+    addMembership(actor: Principal, userUuid: string, companyUuid: string): Promise<RecordId>;
     /** List a user's membership cards (tenant-scoped by the pipe). */
     listMemberships(userUuid: string): Promise<readonly RecordView[]>;
     /**
      * Flip which of the user's memberships is active — the ONE-ACTIVE invariant. The service
      * is the guard because the DB has no partial-unique on `cm_is_active`.
      *
-     * ⚠️ ORDER IS LOAD-BEARING (fail-safe against a LOGIN LOCKOUT). The engine's `list` has
-     * no ORDER BY (PKs are random uuids → arbitrary row order) and each `update` is its OWN
-     * transaction (no cross-call atomicity). So this MUST activate the TARGET FIRST, then
-     * deactivate the others:
+     * ⚠️ ORDER IS LOAD-BEARING (fail-safe against a LOGIN LOCKOUT). Each `update` is its OWN
+     * transaction (no cross-call atomicity), and the engine's `list` order (PK-ordered since the
+     * Phase 3 tiebreaker) says nothing about which membership is the target. So this MUST
+     * activate the TARGET FIRST, then deactivate the others:
      *   - Worst case of a mid-loop failure is then a transient TWO-active window, which is
      *     RECOVERABLE — the credential resolver reads `is_active=1 LIMIT 1`, so it still
      *     resolves a tenant and login works.
@@ -58,16 +61,19 @@ export declare class MembershipService {
      * Guard: if `membershipUuid` is NOT one of the user's memberships, throw — otherwise the
      * loop would deactivate everything and activate nothing (also a zero-active lockout).
      */
-    setActive(membershipUuid: string, userUuid: string): Promise<void>;
+    setActive(actor: Principal, membershipUuid: string, userUuid: string): Promise<void>;
     /**
      * Update a membership's mutable non-activity fields (currently `status`). Activity is
      * flipped only via `setActive` to preserve the one-active invariant, so `isActive` is
      * intentionally NOT a patch key here.
      */
-    updateMembership(membershipUuid: string, patch: {
+    updateMembership(actor: Principal, membershipUuid: string, patch: {
         status?: string;
     }): Promise<void>;
-    /** Remove a membership card (its postings cascade at the DB via FK ON DELETE CASCADE). */
-    removeMembership(membershipUuid: string): Promise<void>;
+    /**
+     * Remove a membership card (its postings cascade at the DB via FK ON DELETE CASCADE). A peer's
+     * membership needs dominance over the peer (security review); your own does not.
+     */
+    removeMembership(actor: Principal, membershipUuid: string): Promise<void>;
 }
 //# sourceMappingURL=membership.service.d.ts.map

package/dist/features/membership/membership.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"membership.service.d.ts","sourceRoot":"","sources":["../../../src/features/membership/membership.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EAAwB,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE1F,qBACa,iBAAiB;IAE1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAQxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBARZ,OAAO,EAAE,cAAc,EAQvB,WAAW,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA;IAG1D;;;;OAIG;YACW,QAAQ;IAUtB;;;;;;OAMG;YACW,WAAW;IAYzB;;;;;;OAMG;IACH,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAMvE,kEAAkE;IAC5D,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC;IAKvE;;;;;;;;;;;;;;;;;OAiBG;IACG,SAAS,CAAC,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAqCxE;;;;OAIG;IACH,gBAAgB,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAWnF,0FAA0F;IACpF,gBAAgB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAU9D"}
+{"version":3,"file":"membership.service.d.ts","sourceRoot":"","sources":["../../../src/features/membership/membership.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAwB,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE1F,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD,qBACa,iBAAiB;IAE1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAGxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAQxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAXZ,OAAO,EAAE,cAAc,EAGvB,OAAO,EAAE,YAAY,EAQrB,WAAW,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA;IAG1D;;;;OAIG;YACW,WAAW;IAQzB;;;;;;OAMG;YACW,WAAW;IAYzB;;;;;;OAMG;IACG,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAkB/F,kEAAkE;IAC5D,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC;IAKvE;;;;;;;;;;;;;;;;;OAiBG;IACG,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAsC1F;;;;OAIG;IACG,gBAAgB,CACpB,KAAK,EAAE,SAAS,EAChB,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GACzB,OAAO,CAAC,IAAI,CAAC;IAchB;;;OAGG;IACG,gBAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAYhF"}

package/dist/features/membership/membership.service.js

@@ -28,27 +28,33 @@ exports.MembershipService = void 0;
 const common_1 = require("@nestjs/common");
 const engine_1 = require("@astram/engine");
 const posting_version_bump_js_1 = require("./posting-version-bump.js");
+const identity_errors_js_1 = require("../shared/identity-errors.js");
+const grant_ceiling_js_1 = require("../authz/grant-ceiling.js");
 let MembershipService = class MembershipService {
     records;
+    ceiling;
     versionBump;
-    constructor(records, versionBump) {
+    constructor(records, 
+    // Dominance over the member for destructive ops (security review): REQUIRED, so a missing
+    // ceiling fails DI at boot instead of silently skipping the check.
+    ceiling, versionBump) {
         this.records = records;
+        this.ceiling = ceiling;
         this.versionBump = versionBump;
     }
     /**
-     * Read a membership's tenant (its `companyUuid`) through the pipe, or `null` when
-     * unresolvable (→ no bump; fail-safe, never guesses a tenant). Used to target the
-     * permission-version bump at the company whose coarse grants a mutation changed.
+     * Read a membership through the subtree wall (404 when out of reach) and, unless the actor is
+     * acting on their OWN membership, require the actor to dominate its user (security review): a
+     * sub-admin must not delete, suspend or re-activate a more privileged peer's membership.
      */
-    async tenantOf(membershipUuid) {
-        try {
-            const m = await this.records.get('company_membership', membershipUuid);
-            const companyUuid = m?.fields?.companyUuid;
-            return typeof companyUuid === 'string' && companyUuid.length > 0 ? companyUuid : null;
-        }
-        catch {
-            return null;
-        }
+    async reachMember(actor, membershipUuid) {
+        const m = await this.records.get('company_membership', membershipUuid);
+        if (m === null)
+            throw new identity_errors_js_1.IdentityNotFoundError('Membership not found.');
+        const userUuid = typeof m.fields?.userUuid === 'string' ? m.fields.userUuid : '';
+        if (userUuid !== actor.id)
+            await this.ceiling.assertDominates(actor, userUuid);
+        return m;
     }
     /**
      * Bump the permission version for each DISTINCT tenant in `tenantUuids` (best-effort +
@@ -77,7 +83,20 @@ let MembershipService = class MembershipService {
      * hits the DB's UNIQUE constraint and the engine's error surfaces to the caller (NOT
      * swallowed here). `createdBy` is stamped server-side (actorId-trusted).
      */
-    addMembership(userUuid, companyUuid) {
+    async addMembership(actor, userUuid, companyUuid) {
+        // D4 (security hardening #4): a non-root actor may attach only a user ALREADY inside its
+        // subtree — the user's walled read (a user is in scope iff it has a membership in the
+        // actor's subtree) must see it. Pulling a foreign tenant's user in would make them
+        // "dominated" by the actor (the #4 + #3 email-takeover chain). A brand-new user joins
+        // through `POST /identity/users { companyUuid }` (created + attached in one transaction).
+        // Root is data-plane-denied on memberships by the engine anyway.
+        if (actor.isRoot !== true) {
+            const user = await this.records.get('user', userUuid);
+            if (user === null)
+                throw new identity_errors_js_1.IdentityNotFoundError('User not found.');
+        }
+        // The company itself is checked by the engine's ADR-0034 create wall: a company outside
+        // the actor's subtree ⇒ AuthorizationDeniedError (→ 403) and the INSERT rolls back.
         return this.records.create('company_membership', {
             fields: { userUuid, companyUuid, isActive: false, status: 'active' },
         });
@@ -91,10 +110,10 @@ let MembershipService = class MembershipService {
      * Flip which of the user's memberships is active — the ONE-ACTIVE invariant. The service
      * is the guard because the DB has no partial-unique on `cm_is_active`.
      *
-     * ⚠️ ORDER IS LOAD-BEARING (fail-safe against a LOGIN LOCKOUT). The engine's `list` has
-     * no ORDER BY (PKs are random uuids → arbitrary row order) and each `update` is its OWN
-     * transaction (no cross-call atomicity). So this MUST activate the TARGET FIRST, then
-     * deactivate the others:
+     * ⚠️ ORDER IS LOAD-BEARING (fail-safe against a LOGIN LOCKOUT). Each `update` is its OWN
+     * transaction (no cross-call atomicity), and the engine's `list` order (PK-ordered since the
+     * Phase 3 tiebreaker) says nothing about which membership is the target. So this MUST
+     * activate the TARGET FIRST, then deactivate the others:
      *   - Worst case of a mid-loop failure is then a transient TWO-active window, which is
      *     RECOVERABLE — the credential resolver reads `is_active=1 LIMIT 1`, so it still
      *     resolves a tenant and login works.
@@ -105,13 +124,17 @@ let MembershipService = class MembershipService {
      * Guard: if `membershipUuid` is NOT one of the user's memberships, throw — otherwise the
      * loop would deactivate everything and activate nothing (also a zero-active lockout).
      */
-    async setActive(membershipUuid, userUuid) {
+    async setActive(actor, membershipUuid, userUuid) {
+        // Flipping activation de-activates the user's OTHER memberships: for a peer, the actor must
+        // dominate them (security review). Your own activation stays allowed.
+        if (userUuid !== actor.id)
+            await this.ceiling.assertDominates(actor, userUuid);
         const page = await this.records.list('company_membership', { where: { userUuid } });
         const target = page.rows.find((m) => m.id === membershipUuid);
         if (!target) {
             // Not this user's membership → refuse rather than leave the user with ZERO active
-            // (a login lockout). Fail-closed.
-            throw new common_1.NotFoundException(`membership ${membershipUuid} does not belong to user ${userUuid}`);
+            // (a login lockout). Fail-closed. No ids in the message (ADR-0012).
+            throw new identity_errors_js_1.IdentityNotFoundError('Membership not found.');
         }
         // 1) TARGET FIRST — guarantees an active membership exists before any deactivation, so
         //    a mid-failure below leaves TWO active (recoverable), never ZERO (lockout).
@@ -142,7 +165,11 @@ let MembershipService = class MembershipService {
      * flipped only via `setActive` to preserve the one-active invariant, so `isActive` is
      * intentionally NOT a patch key here.
      */
-    updateMembership(membershipUuid, patch) {
+    async updateMembership(actor, membershipUuid, patch) {
+        await this.reachMember(actor, membershipUuid); // 404 / dominance over a peer
+        const fields = {};
+        if (typeof patch?.status === 'string')
+            fields.status = patch.status;
         // NO version bump here (ADR-0011): this patches `status` ONLY — `isActive` is
         // deliberately not a patch key (activity flips solely via `setActive`, which bumps),
         // and the controller only ever passes `{ status }`. Coarse-grant resolution gates on
@@ -150,16 +177,21 @@ let MembershipService = class MembershipService {
         // resolve → the warm cache stays correct → no invalidation needed. If a future patch key
         // is ever added here that CAN change which roles/postings resolve, it MUST bump the
         // membership's tenant (mirror `setActive`).
-        return this.records.update('company_membership', membershipUuid, { fields: patch });
+        await this.records.update('company_membership', membershipUuid, { fields });
     }
-    /** Remove a membership card (its postings cascade at the DB via FK ON DELETE CASCADE). */
-    async removeMembership(membershipUuid) {
+    /**
+     * Remove a membership card (its postings cascade at the DB via FK ON DELETE CASCADE). A peer's
+     * membership needs dominance over the peer (security review); your own does not.
+     */
+    async removeMembership(actor, membershipUuid) {
         // ADR-0011 STALENESS FIX: resolve the membership's tenant BEFORE the delete (it's
         // unreadable afterwards). If the membership was active, deleting it (postings cascade)
         // removes the user's role grants in that company — a coarse-grant change — so bump that
         // tenant AFTER the delete succeeds. Best-effort/fail-safe (bumpTenants swallows). A
         // membership belongs to exactly one company → one tenant bump.
-        const tenant = await this.tenantOf(membershipUuid);
+        const m = await this.reachMember(actor, membershipUuid);
+        const c = m.fields?.companyUuid;
+        const tenant = typeof c === 'string' && c.length > 0 ? c : null;
         await this.records.delete('company_membership', membershipUuid);
         await this.bumpTenants([tenant]);
     }
@@ -167,7 +199,8 @@ let MembershipService = class MembershipService {
 exports.MembershipService = MembershipService;
 exports.MembershipService = MembershipService = __decorate([
     (0, common_1.Injectable)(),
-    __param(1, (0, common_1.Optional)()),
-    __param(1, (0, common_1.Inject)(posting_version_bump_js_1.POSTING_VERSION_BUMP)),
-    __metadata("design:paramtypes", [engine_1.RecordsService, Object])
+    __param(2, (0, common_1.Optional)()),
+    __param(2, (0, common_1.Inject)(posting_version_bump_js_1.POSTING_VERSION_BUMP)),
+    __metadata("design:paramtypes", [engine_1.RecordsService,
+        grant_ceiling_js_1.GrantCeiling, Object])
 ], MembershipService);