@astram/identity 0.4.0 → 0.5.0

package/dist/features/membership/membership.service.d.ts

@@ -11,17 +11,20 @@
  * `cm_is_active`; `setActive` is the guard.
  */
 import { RecordsService, type RecordId, type RecordView } from '@astram/engine';
+import type { Principal } from '@astram/core';
 import { type PostingVersionBump } from './posting-version-bump.js';
+import { GrantCeiling } from '../authz/grant-ceiling.js';
 export declare class MembershipService {
     private readonly records;
+    private readonly ceiling;
     private readonly versionBump?;
-    constructor(records: RecordsService, versionBump?: (PostingVersionBump | null) | undefined);
+    constructor(records: RecordsService, ceiling: GrantCeiling, versionBump?: (PostingVersionBump | null) | undefined);
     /**
-     * Read a membership's tenant (its `companyUuid`) through the pipe, or `null` when
-     * unresolvable (→ no bump; fail-safe, never guesses a tenant). Used to target the
-     * permission-version bump at the company whose coarse grants a mutation changed.
+     * Read a membership through the subtree wall (404 when out of reach) and, unless the actor is
+     * acting on their OWN membership, require the actor to dominate its user (security review): a
+     * sub-admin must not delete, suspend or re-activate a more privileged peer's membership.
      */
-    private tenantOf;
+    private reachMember;
     /**
      * Bump the permission version for each DISTINCT tenant in `tenantUuids` (best-effort +
      * fail-safe): the mutation already succeeded, so a bump hiccup must NOT surface as an
@@ -37,17 +40,17 @@ export declare class MembershipService {
      * hits the DB's UNIQUE constraint and the engine's error surfaces to the caller (NOT
      * swallowed here). `createdBy` is stamped server-side (actorId-trusted).
      */
-    addMembership(userUuid: string, companyUuid: string): Promise<RecordId>;
+    addMembership(actor: Principal, userUuid: string, companyUuid: string): Promise<RecordId>;
     /** List a user's membership cards (tenant-scoped by the pipe). */
     listMemberships(userUuid: string): Promise<readonly RecordView[]>;
     /**
      * Flip which of the user's memberships is active — the ONE-ACTIVE invariant. The service
      * is the guard because the DB has no partial-unique on `cm_is_active`.
      *
-     * ⚠️ ORDER IS LOAD-BEARING (fail-safe against a LOGIN LOCKOUT). The engine's `list` has
-     * no ORDER BY (PKs are random uuids → arbitrary row order) and each `update` is its OWN
-     * transaction (no cross-call atomicity). So this MUST activate the TARGET FIRST, then
-     * deactivate the others:
+     * ⚠️ ORDER IS LOAD-BEARING (fail-safe against a LOGIN LOCKOUT). Each `update` is its OWN
+     * transaction (no cross-call atomicity), and the engine's `list` order (PK-ordered since the
+     * Phase 3 tiebreaker) says nothing about which membership is the target. So this MUST
+     * activate the TARGET FIRST, then deactivate the others:
      *   - Worst case of a mid-loop failure is then a transient TWO-active window, which is
      *     RECOVERABLE — the credential resolver reads `is_active=1 LIMIT 1`, so it still
      *     resolves a tenant and login works.
@@ -58,16 +61,19 @@ export declare class MembershipService {
      * Guard: if `membershipUuid` is NOT one of the user's memberships, throw — otherwise the
      * loop would deactivate everything and activate nothing (also a zero-active lockout).
      */
-    setActive(membershipUuid: string, userUuid: string): Promise<void>;
+    setActive(actor: Principal, membershipUuid: string, userUuid: string): Promise<void>;
     /**
      * Update a membership's mutable non-activity fields (currently `status`). Activity is
      * flipped only via `setActive` to preserve the one-active invariant, so `isActive` is
      * intentionally NOT a patch key here.
      */
-    updateMembership(membershipUuid: string, patch: {
+    updateMembership(actor: Principal, membershipUuid: string, patch: {
         status?: string;
     }): Promise<void>;
-    /** Remove a membership card (its postings cascade at the DB via FK ON DELETE CASCADE). */
-    removeMembership(membershipUuid: string): Promise<void>;
+    /**
+     * Remove a membership card (its postings cascade at the DB via FK ON DELETE CASCADE). A peer's
+     * membership needs dominance over the peer (security review); your own does not.
+     */
+    removeMembership(actor: Principal, membershipUuid: string): Promise<void>;
 }
 //# sourceMappingURL=membership.service.d.ts.map

package/dist/features/membership/membership.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"membership.service.d.ts","sourceRoot":"","sources":["../../../src/features/membership/membership.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EAAwB,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE1F,qBACa,iBAAiB;IAE1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAQxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBARZ,OAAO,EAAE,cAAc,EAQvB,WAAW,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA;IAG1D;;;;OAIG;YACW,QAAQ;IAUtB;;;;;;OAMG;YACW,WAAW;IAYzB;;;;;;OAMG;IACH,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAMvE,kEAAkE;IAC5D,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC;IAKvE;;;;;;;;;;;;;;;;;OAiBG;IACG,SAAS,CAAC,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAqCxE;;;;OAIG;IACH,gBAAgB,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAWnF,0FAA0F;IACpF,gBAAgB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAU9D"}
+{"version":3,"file":"membership.service.d.ts","sourceRoot":"","sources":["../../../src/features/membership/membership.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAwB,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE1F,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD,qBACa,iBAAiB;IAE1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAGxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAQxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAXZ,OAAO,EAAE,cAAc,EAGvB,OAAO,EAAE,YAAY,EAQrB,WAAW,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA;IAG1D;;;;OAIG;YACW,WAAW;IAQzB;;;;;;OAMG;YACW,WAAW;IAYzB;;;;;;OAMG;IACG,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAkB/F,kEAAkE;IAC5D,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC;IAKvE;;;;;;;;;;;;;;;;;OAiBG;IACG,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAsC1F;;;;OAIG;IACG,gBAAgB,CACpB,KAAK,EAAE,SAAS,EAChB,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GACzB,OAAO,CAAC,IAAI,CAAC;IAchB;;;OAGG;IACG,gBAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAYhF"}

package/dist/features/membership/membership.service.js

@@ -28,27 +28,33 @@ exports.MembershipService = void 0;
 const common_1 = require("@nestjs/common");
 const engine_1 = require("@astram/engine");
 const posting_version_bump_js_1 = require("./posting-version-bump.js");
+const identity_errors_js_1 = require("../shared/identity-errors.js");
+const grant_ceiling_js_1 = require("../authz/grant-ceiling.js");
 let MembershipService = class MembershipService {
     records;
+    ceiling;
     versionBump;
-    constructor(records, versionBump) {
+    constructor(records, 
+    // Dominance over the member for destructive ops (security review): REQUIRED, so a missing
+    // ceiling fails DI at boot instead of silently skipping the check.
+    ceiling, versionBump) {
         this.records = records;
+        this.ceiling = ceiling;
         this.versionBump = versionBump;
     }
     /**
-     * Read a membership's tenant (its `companyUuid`) through the pipe, or `null` when
-     * unresolvable (→ no bump; fail-safe, never guesses a tenant). Used to target the
-     * permission-version bump at the company whose coarse grants a mutation changed.
+     * Read a membership through the subtree wall (404 when out of reach) and, unless the actor is
+     * acting on their OWN membership, require the actor to dominate its user (security review): a
+     * sub-admin must not delete, suspend or re-activate a more privileged peer's membership.
      */
-    async tenantOf(membershipUuid) {
-        try {
-            const m = await this.records.get('company_membership', membershipUuid);
-            const companyUuid = m?.fields?.companyUuid;
-            return typeof companyUuid === 'string' && companyUuid.length > 0 ? companyUuid : null;
-        }
-        catch {
-            return null;
-        }
+    async reachMember(actor, membershipUuid) {
+        const m = await this.records.get('company_membership', membershipUuid);
+        if (m === null)
+            throw new identity_errors_js_1.IdentityNotFoundError('Membership not found.');
+        const userUuid = typeof m.fields?.userUuid === 'string' ? m.fields.userUuid : '';
+        if (userUuid !== actor.id)
+            await this.ceiling.assertDominates(actor, userUuid);
+        return m;
     }
     /**
      * Bump the permission version for each DISTINCT tenant in `tenantUuids` (best-effort +
@@ -77,7 +83,20 @@ let MembershipService = class MembershipService {
      * hits the DB's UNIQUE constraint and the engine's error surfaces to the caller (NOT
      * swallowed here). `createdBy` is stamped server-side (actorId-trusted).
      */
-    addMembership(userUuid, companyUuid) {
+    async addMembership(actor, userUuid, companyUuid) {
+        // D4 (security hardening #4): a non-root actor may attach only a user ALREADY inside its
+        // subtree — the user's walled read (a user is in scope iff it has a membership in the
+        // actor's subtree) must see it. Pulling a foreign tenant's user in would make them
+        // "dominated" by the actor (the #4 + #3 email-takeover chain). A brand-new user joins
+        // through `POST /identity/users { companyUuid }` (created + attached in one transaction).
+        // Root is data-plane-denied on memberships by the engine anyway.
+        if (actor.isRoot !== true) {
+            const user = await this.records.get('user', userUuid);
+            if (user === null)
+                throw new identity_errors_js_1.IdentityNotFoundError('User not found.');
+        }
+        // The company itself is checked by the engine's ADR-0034 create wall: a company outside
+        // the actor's subtree ⇒ AuthorizationDeniedError (→ 403) and the INSERT rolls back.
         return this.records.create('company_membership', {
             fields: { userUuid, companyUuid, isActive: false, status: 'active' },
         });
@@ -91,10 +110,10 @@ let MembershipService = class MembershipService {
      * Flip which of the user's memberships is active — the ONE-ACTIVE invariant. The service
      * is the guard because the DB has no partial-unique on `cm_is_active`.
      *
-     * ⚠️ ORDER IS LOAD-BEARING (fail-safe against a LOGIN LOCKOUT). The engine's `list` has
-     * no ORDER BY (PKs are random uuids → arbitrary row order) and each `update` is its OWN
-     * transaction (no cross-call atomicity). So this MUST activate the TARGET FIRST, then
-     * deactivate the others:
+     * ⚠️ ORDER IS LOAD-BEARING (fail-safe against a LOGIN LOCKOUT). Each `update` is its OWN
+     * transaction (no cross-call atomicity), and the engine's `list` order (PK-ordered since the
+     * Phase 3 tiebreaker) says nothing about which membership is the target. So this MUST
+     * activate the TARGET FIRST, then deactivate the others:
      *   - Worst case of a mid-loop failure is then a transient TWO-active window, which is
      *     RECOVERABLE — the credential resolver reads `is_active=1 LIMIT 1`, so it still
      *     resolves a tenant and login works.
@@ -105,13 +124,17 @@ let MembershipService = class MembershipService {
      * Guard: if `membershipUuid` is NOT one of the user's memberships, throw — otherwise the
      * loop would deactivate everything and activate nothing (also a zero-active lockout).
      */
-    async setActive(membershipUuid, userUuid) {
+    async setActive(actor, membershipUuid, userUuid) {
+        // Flipping activation de-activates the user's OTHER memberships: for a peer, the actor must
+        // dominate them (security review). Your own activation stays allowed.
+        if (userUuid !== actor.id)
+            await this.ceiling.assertDominates(actor, userUuid);
         const page = await this.records.list('company_membership', { where: { userUuid } });
         const target = page.rows.find((m) => m.id === membershipUuid);
         if (!target) {
             // Not this user's membership → refuse rather than leave the user with ZERO active
-            // (a login lockout). Fail-closed.
-            throw new common_1.NotFoundException(`membership ${membershipUuid} does not belong to user ${userUuid}`);
+            // (a login lockout). Fail-closed. No ids in the message (ADR-0012).
+            throw new identity_errors_js_1.IdentityNotFoundError('Membership not found.');
         }
         // 1) TARGET FIRST — guarantees an active membership exists before any deactivation, so
         //    a mid-failure below leaves TWO active (recoverable), never ZERO (lockout).
@@ -142,7 +165,11 @@ let MembershipService = class MembershipService {
      * flipped only via `setActive` to preserve the one-active invariant, so `isActive` is
      * intentionally NOT a patch key here.
      */
-    updateMembership(membershipUuid, patch) {
+    async updateMembership(actor, membershipUuid, patch) {
+        await this.reachMember(actor, membershipUuid); // 404 / dominance over a peer
+        const fields = {};
+        if (typeof patch?.status === 'string')
+            fields.status = patch.status;
         // NO version bump here (ADR-0011): this patches `status` ONLY — `isActive` is
         // deliberately not a patch key (activity flips solely via `setActive`, which bumps),
         // and the controller only ever passes `{ status }`. Coarse-grant resolution gates on
@@ -150,16 +177,21 @@ let MembershipService = class MembershipService {
         // resolve → the warm cache stays correct → no invalidation needed. If a future patch key
         // is ever added here that CAN change which roles/postings resolve, it MUST bump the
         // membership's tenant (mirror `setActive`).
-        return this.records.update('company_membership', membershipUuid, { fields: patch });
+        await this.records.update('company_membership', membershipUuid, { fields });
     }
-    /** Remove a membership card (its postings cascade at the DB via FK ON DELETE CASCADE). */
-    async removeMembership(membershipUuid) {
+    /**
+     * Remove a membership card (its postings cascade at the DB via FK ON DELETE CASCADE). A peer's
+     * membership needs dominance over the peer (security review); your own does not.
+     */
+    async removeMembership(actor, membershipUuid) {
         // ADR-0011 STALENESS FIX: resolve the membership's tenant BEFORE the delete (it's
         // unreadable afterwards). If the membership was active, deleting it (postings cascade)
         // removes the user's role grants in that company — a coarse-grant change — so bump that
         // tenant AFTER the delete succeeds. Best-effort/fail-safe (bumpTenants swallows). A
         // membership belongs to exactly one company → one tenant bump.
-        const tenant = await this.tenantOf(membershipUuid);
+        const m = await this.reachMember(actor, membershipUuid);
+        const c = m.fields?.companyUuid;
+        const tenant = typeof c === 'string' && c.length > 0 ? c : null;
         await this.records.delete('company_membership', membershipUuid);
         await this.bumpTenants([tenant]);
     }
@@ -167,7 +199,8 @@ let MembershipService = class MembershipService {
 exports.MembershipService = MembershipService;
 exports.MembershipService = MembershipService = __decorate([
     (0, common_1.Injectable)(),
-    __param(1, (0, common_1.Optional)()),
-    __param(1, (0, common_1.Inject)(posting_version_bump_js_1.POSTING_VERSION_BUMP)),
-    __metadata("design:paramtypes", [engine_1.RecordsService, Object])
+    __param(2, (0, common_1.Optional)()),
+    __param(2, (0, common_1.Inject)(posting_version_bump_js_1.POSTING_VERSION_BUMP)),
+    __metadata("design:paramtypes", [engine_1.RecordsService,
+        grant_ceiling_js_1.GrantCeiling, Object])
 ], MembershipService);

package/dist/features/membership/posting-version-bump.d.ts

@@ -5,6 +5,11 @@
  */
 export interface PostingVersionBump {
     bumpTenant(tenantUuid: string): Promise<void>;
+    /**
+     * OPTIONAL (security hardening Phase 3): bump every tenant the user has a membership in — after
+     * the account itself was disabled or re-enabled. Returns the bumped tenants; throws on failure.
+     */
+    bumpForUser?(userUuid: string): Promise<string[]>;
 }
 export declare const POSTING_VERSION_BUMP: unique symbol;
 //# sourceMappingURL=posting-version-bump.d.ts.map

package/dist/features/membership/posting-version-bump.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"posting-version-bump.d.ts","sourceRoot":"","sources":["../../../src/features/membership/posting-version-bump.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,eAAO,MAAM,oBAAoB,eAAiC,CAAC"}
+{"version":3,"file":"posting-version-bump.d.ts","sourceRoot":"","sources":["../../../src/features/membership/posting-version-bump.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C;;;OAGG;IACH,WAAW,CAAC,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACnD;AAED,eAAO,MAAM,oBAAoB,eAAiC,CAAC"}

package/dist/features/membership/posting.service.d.ts

@@ -6,21 +6,24 @@
  * diffs current-vs-desired and applies the minimal change — delete only what's removed,
  * create only what's added, keep the rest untouched.
  *
- * ── Atomicity / mid-op safety (why delete-then-create is safe here) ──────────────────
- * The engine's feature-facing surface (`RecordsService`) exposes NO cross-call transaction
- * — each of its methods (create/update/delete/list/get) runs in its OWN transaction, and
- * no `externalQueryRunner` seam is handed to features. So `replacePostings` cannot wrap
- * the whole diff in a single DB transaction. Instead it is safe BY CONSTRUCTION:
- *   - Deletes target ONLY rows absent from `desired` (the "removed" set). A KEPT posting
- *     is never a delete target, so it is never removed.
- *   - Creates target ONLY rows absent from `current` (the "added" set).
- * Therefore the membership NEVER lands empty mid-op: even if a create fails after the
- * delete phase, every kept posting is still present (never deleted). Ordering is
- * delete-first, then create; a failure surfaces to the caller (fail-closed) with the
- * kept set intact. (Covered by the mid-op-safety tests in posting.service.spec.ts.)
+ * ── Authority (security hardening #11) ─────────────────────────────────────────────────
+ * A posting IS a role assignment, so before ANY write the actor (the request principal) must:
+ *   - reach the membership (a walled `records.get` → null ⇒ 404; the engine's ADR-0034 create
+ *     wall re-checks the posting's membership company inside the transaction);
+ *   - for every ADDED role: the role is bound within the actor's subtree or not bound at all
+ *     (`GrantCeiling.assertRoleAssignable` — a role also used elsewhere is never assignable),
+ *     and the role's keys are all held by the actor (`assertCanAssignRoles`, ADR-0029 applied to
+ *     assignment). Removals need no ceiling: self-demotion stays allowed.
+ *
+ * ── Atomicity (KI #16) ────────────────────────────────────────────────────────────────
+ * The diff runs inside ONE `records.transaction` (ADR-0034): creates FIRST, then deletes, so a
+ * failure at any point rolls back every posting write of the replace (no partial set, no
+ * window where a removed role is gone but its replacement was refused).
  */
 import { RecordsService, type RecordView } from '@astram/engine';
+import type { Principal } from '@astram/core';
 import { type PostingVersionBump } from './posting-version-bump.js';
+import { GrantCeiling } from '../authz/grant-ceiling.js';
 /**
  * The shape of one desired posting row submitted by the editor. The effective-window
  * bounds arrive from the client as a bare `YYYY-MM-DD` date string (native `<input
@@ -36,24 +39,17 @@ export interface PostingInput {
 }
 export declare class PostingService {
     private readonly records;
+    private readonly ceiling;
     private readonly versionBump?;
-    constructor(records: RecordsService, versionBump?: (PostingVersionBump | null) | undefined);
+    constructor(records: RecordsService, ceiling: GrantCeiling, versionBump?: (PostingVersionBump | null) | undefined);
     /** List a membership's postings (tenant-scoped by the pipe). */
     listPostings(membershipUuid: string): Promise<readonly RecordView[]>;
     /**
      * Replace a membership's full posting set with `desired`, applying the minimal diff.
      * Compares current vs desired by the natural key `roleUuid|departmentUuid|branchUuid`:
-     * deletes removed rows, creates added rows, leaves kept rows untouched. See the file
-     * header for the atomicity / mid-op-safety reasoning (delete-then-create is safe because
-     * kept postings are never delete targets, so the membership never lands empty).
-     */
-    replacePostings(membershipUuid: string, desired: readonly PostingInput[]): Promise<void>;
-    /**
-     * Resolve the tenant (company uuid) a membership belongs to — the tenant whose permission
-     * version a posting change must bump. Reads the parent `company_membership` through the
-     * pipe (tenant-scoped, no raw SQL), returning `companyUuid` or `null` if unresolvable
-     * (then no bump — fail-safe; never guesses a tenant).
+     * creates added rows, deletes removed rows, leaves kept rows untouched. Every authority check
+     * runs BEFORE any write; the writes run in one transaction (see the file header).
      */
-    private resolveMembershipTenant;
+    replacePostings(actor: Principal, membershipUuid: string, desired: readonly PostingInput[]): Promise<void>;
 }
 //# sourceMappingURL=posting.service.d.ts.map

package/dist/features/membership/posting.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"posting.service.d.ts","sourceRoot":"","sources":["../../../src/features/membership/posting.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,EAAE,cAAc,EAAE,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,EAAwB,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE1F;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACvC,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CACzC;AA4DD,qBACa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAKxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBALZ,OAAO,EAAE,cAAc,EAKvB,WAAW,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA;IAG1D,gEAAgE;IAC1D,YAAY,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC;IAK1E;;;;;;OAMG;IACG,eAAe,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,YAAY,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IA4D9F;;;;;OAKG;YACW,uBAAuB;CAStC"}
+{"version":3,"file":"posting.service.d.ts","sourceRoot":"","sources":["../../../src/features/membership/posting.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EAAE,cAAc,EAAE,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAwB,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC1F,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAGzD;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACvC,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CACzC;AA0ED,qBACa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAGxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAKxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBARZ,OAAO,EAAE,cAAc,EAGvB,OAAO,EAAE,YAAY,EAKrB,WAAW,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA;IAG1D,gEAAgE;IAC1D,YAAY,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC;IAK1E;;;;;OAKG;IACG,eAAe,CACnB,KAAK,EAAE,SAAS,EAChB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,SAAS,YAAY,EAAE,GAC/B,OAAO,CAAC,IAAI,CAAC;CAuGjB"}

package/dist/features/membership/posting.service.js

@@ -7,18 +7,19 @@
  * diffs current-vs-desired and applies the minimal change — delete only what's removed,
  * create only what's added, keep the rest untouched.
  *
- * ── Atomicity / mid-op safety (why delete-then-create is safe here) ──────────────────
- * The engine's feature-facing surface (`RecordsService`) exposes NO cross-call transaction
- * — each of its methods (create/update/delete/list/get) runs in its OWN transaction, and
- * no `externalQueryRunner` seam is handed to features. So `replacePostings` cannot wrap
- * the whole diff in a single DB transaction. Instead it is safe BY CONSTRUCTION:
- *   - Deletes target ONLY rows absent from `desired` (the "removed" set). A KEPT posting
- *     is never a delete target, so it is never removed.
- *   - Creates target ONLY rows absent from `current` (the "added" set).
- * Therefore the membership NEVER lands empty mid-op: even if a create fails after the
- * delete phase, every kept posting is still present (never deleted). Ordering is
- * delete-first, then create; a failure surfaces to the caller (fail-closed) with the
- * kept set intact. (Covered by the mid-op-safety tests in posting.service.spec.ts.)
+ * ── Authority (security hardening #11) ─────────────────────────────────────────────────
+ * A posting IS a role assignment, so before ANY write the actor (the request principal) must:
+ *   - reach the membership (a walled `records.get` → null ⇒ 404; the engine's ADR-0034 create
+ *     wall re-checks the posting's membership company inside the transaction);
+ *   - for every ADDED role: the role is bound within the actor's subtree or not bound at all
+ *     (`GrantCeiling.assertRoleAssignable` — a role also used elsewhere is never assignable),
+ *     and the role's keys are all held by the actor (`assertCanAssignRoles`, ADR-0029 applied to
+ *     assignment). Removals need no ceiling: self-demotion stays allowed.
+ *
+ * ── Atomicity (KI #16) ────────────────────────────────────────────────────────────────
+ * The diff runs inside ONE `records.transaction` (ADR-0034): creates FIRST, then deletes, so a
+ * failure at any point rolls back every posting write of the replace (no partial set, no
+ * window where a removed role is gone but its replacement was refused).
  */
 var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -37,8 +38,18 @@ exports.PostingService = void 0;
 const common_1 = require("@nestjs/common");
 const engine_1 = require("@astram/engine");
 const posting_version_bump_js_1 = require("./posting-version-bump.js");
+const grant_ceiling_js_1 = require("../authz/grant-ceiling.js");
+const identity_errors_js_1 = require("../shared/identity-errors.js");
 /** The field keys whose values are effective-window epoch-ms bounds (normalized on write). */
 const WINDOW_KEYS = new Set(['effectiveFrom', 'effectiveUntil']);
+/** The ONLY keys a client posting entry may set (review F4) — never `membershipUuid`. */
+const POSTING_KEYS = [
+    'roleUuid',
+    'departmentUuid',
+    'branchUuid',
+    'effectiveFrom',
+    'effectiveUntil',
+];
 /**
  * Normalize an effective-window bound to epoch-ms (a `number`), or `null` if empty/unparseable.
  * The membership_posting object declares these fields as `number` (BIGINT epoch-ms) so the
@@ -79,7 +90,13 @@ function naturalKey(p) {
  */
 function stripEmpty(input) {
     const out = {};
-    for (const [k, v] of Object.entries(input)) {
+    // Security review F4: only the posting's own fields are taken from the client entry — a
+    // client `membershipUuid` (or `createdBy`, or any unknown key) never reaches the engine; the
+    // caller sets `membershipUuid` from the PATH.
+    for (const k of POSTING_KEYS) {
+        if (!(k in input))
+            continue;
+        const v = input[k];
         if (WINDOW_KEYS.has(k)) {
             const ms = toEpochMs(v);
             if (ms !== null)
@@ -93,9 +110,14 @@ function stripEmpty(input) {
 }
 let PostingService = class PostingService {
     records;
+    ceiling;
     versionBump;
-    constructor(records, versionBump) {
+    constructor(records, 
+    // The role-assignment ceiling + binding rule (security hardening #11). REQUIRED: a missing
+    // ceiling must fail DI at boot, never silently skip the check.
+    ceiling, versionBump) {
         this.records = records;
+        this.ceiling = ceiling;
         this.versionBump = versionBump;
     }
     /** List a membership's postings (tenant-scoped by the pipe). */
@@ -106,45 +128,75 @@ let PostingService = class PostingService {
     /**
      * Replace a membership's full posting set with `desired`, applying the minimal diff.
      * Compares current vs desired by the natural key `roleUuid|departmentUuid|branchUuid`:
-     * deletes removed rows, creates added rows, leaves kept rows untouched. See the file
-     * header for the atomicity / mid-op-safety reasoning (delete-then-create is safe because
-     * kept postings are never delete targets, so the membership never lands empty).
+     * creates added rows, deletes removed rows, leaves kept rows untouched. Every authority check
+     * runs BEFORE any write; the writes run in one transaction (see the file header).
      */
-    async replacePostings(membershipUuid, desired) {
-        const current = (await this.records.list('membership_posting', { where: { membershipUuid } })).rows;
+    async replacePostings(actor, membershipUuid, desired) {
+        for (const d of desired) {
+            if (typeof d?.roleUuid !== 'string' || d.roleUuid.length === 0) {
+                throw new identity_errors_js_1.IdentityBadRequestError('Every assignment needs a role.');
+            }
+        }
+        // 1) Reach: the membership must be visible through the subtree read wall (else 404).
+        const membership = await this.records.get('company_membership', membershipUuid);
+        if (membership === null)
+            throw new identity_errors_js_1.IdentityNotFoundError('Membership not found.');
+        const tenantUuid = typeof membership.fields?.companyUuid === 'string' && membership.fields.companyUuid.length > 0
+            ? membership.fields.companyUuid
+            : null;
+        const current = (await this.records.list('membership_posting', { where: { membershipUuid } }))
+            .rows;
         const desiredKeys = new Set(desired.map(naturalKey));
         const currentKeys = new Set(current.map((r) => naturalKey(r.fields)));
-        // Track whether the diff actually changed anything — only a real add/remove of a role
-        // assignment need invalidate cached permission facts (a no-op replace must not bump).
-        let changed = false;
-        // Delete removed: rows in current whose key is not in desired. Kept rows are skipped.
-        for (const r of current) {
-            const key = naturalKey(r.fields);
-            if (!desiredKeys.has(key)) {
-                await this.records.delete('membership_posting', r.id);
-                changed = true;
-            }
+        const removed = current.filter((r) => !desiredKeys.has(naturalKey(r.fields)));
+        const seenAdded = new Set();
+        const added = desired.filter((d) => {
+            const k = naturalKey(d);
+            if (currentKeys.has(k) || seenAdded.has(k))
+                return false;
+            seenAdded.add(k);
+            return true;
+        });
+        // 2) Authority for every ADDED role, before any write: binding rule, then the ceiling.
+        const addedRoles = [...new Set(added.map((d) => d.roleUuid))];
+        for (const roleUuid of addedRoles) {
+            await this.ceiling.assertRoleAssignable(actor, roleUuid);
         }
-        // Create added: desired rows whose key is not already present. Only real fields are
-        // sent (undefined/null/empty optionals are dropped so the engine gets a clean field map).
-        for (const d of desired) {
-            if (!currentKeys.has(naturalKey(d))) {
-                await this.records.create('membership_posting', {
-                    fields: { membershipUuid, ...stripEmpty(d) },
-                });
-                changed = true;
-            }
+        await this.ceiling.assertCanAssignRoles(actor, addedRoles);
+        // Removing a PEER's postings strips their authority: the actor must dominate the member
+        // (security review). Removing your OWN postings (self-demotion) stays allowed.
+        const memberUuid = typeof membership.fields?.userUuid === 'string' ? membership.fields.userUuid : '';
+        if (removed.length > 0 && memberUuid !== actor.id) {
+            await this.ceiling.assertDominates(actor, memberUuid);
         }
+        if (added.length === 0 && removed.length === 0)
+            return; // no-op replace: no write, no bump
+        // 3) Write atomically: creates first, then deletes (KI #16). Only whitelisted fields are sent,
+        //    and `membershipUuid` always comes from the path (review F4).
+        await this.records.transaction(async (tx) => {
+            // Review F2: serialise against a concurrent grant/posting of the same role. Lock each
+            // added role row on THIS transaction (grant administration locks the same row), then
+            // re-run the binding rule: a binding another tenant committed while we waited is now
+            // visible, and a role that became shared is refused before the INSERT (rolled back).
+            for (const roleUuid of addedRoles) {
+                await tx.lockForUpdate('role', roleUuid);
+                await this.ceiling.assertRoleAssignable(actor, roleUuid);
+            }
+            for (const d of added) {
+                await tx.create('membership_posting', { fields: { ...stripEmpty(d), membershipUuid } });
+            }
+            for (const r of removed) {
+                await tx.delete('membership_posting', r.id);
+            }
+        });
         // ADR-0011 STALENESS FIX: a posting add/remove changes the effective roles (→ coarse
         // grants) of the membership's user in that company, so bump the tenant's permission
         // version — every live session in that tenant then reloads its cached facts on the next
-        // request (a role gain/loss lands within the version bound). Only when something actually
-        // changed, and only when the bump collaborator is wired (absent in unit tests → no-op).
-        // Best-effort + fail-safe: the posting write already succeeded, so a bump failure must
-        // NOT surface as a 500 that hides a successful assignment change — the cache is instead
-        // invalidated by the next legit bump / the facts' natural TTL. We log-swallow it.
-        if (changed && this.versionBump) {
-            const tenantUuid = await this.resolveMembershipTenant(membershipUuid);
+        // request (a role gain/loss lands within the version bound). Only when the bump collaborator
+        // is wired (absent in unit tests → no-op). Best-effort + fail-safe: the posting write already
+        // committed, so a bump failure must NOT surface as a 500 that hides a successful assignment
+        // change — the cache is instead invalidated by the next legit bump / the facts' natural TTL.
+        if (this.versionBump) {
             if (tenantUuid) {
                 try {
                     await this.versionBump.bumpTenant(tenantUuid);
@@ -155,27 +207,12 @@ let PostingService = class PostingService {
             }
         }
     }
-    /**
-     * Resolve the tenant (company uuid) a membership belongs to — the tenant whose permission
-     * version a posting change must bump. Reads the parent `company_membership` through the
-     * pipe (tenant-scoped, no raw SQL), returning `companyUuid` or `null` if unresolvable
-     * (then no bump — fail-safe; never guesses a tenant).
-     */
-    async resolveMembershipTenant(membershipUuid) {
-        try {
-            const m = await this.records.get('company_membership', membershipUuid);
-            const companyUuid = m?.fields?.companyUuid;
-            return typeof companyUuid === 'string' && companyUuid.length > 0 ? companyUuid : null;
-        }
-        catch {
-            return null;
-        }
-    }
 };
 exports.PostingService = PostingService;
 exports.PostingService = PostingService = __decorate([
     (0, common_1.Injectable)(),
-    __param(1, (0, common_1.Optional)()),
-    __param(1, (0, common_1.Inject)(posting_version_bump_js_1.POSTING_VERSION_BUMP)),
-    __metadata("design:paramtypes", [engine_1.RecordsService, Object])
+    __param(2, (0, common_1.Optional)()),
+    __param(2, (0, common_1.Inject)(posting_version_bump_js_1.POSTING_VERSION_BUMP)),
+    __metadata("design:paramtypes", [engine_1.RecordsService,
+        grant_ceiling_js_1.GrantCeiling, Object])
 ], PostingService);

package/dist/features/org-structure/org-catalog.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"org-catalog.controller.d.ts","sourceRoot":"","sources":["../../../src/features/org-structure/org-catalog.controller.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAU7D,qBACa,oBAAoB;IACnB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,iBAAiB;IAEvD,kFAAkF;IAG5E,sBAAsB,CAAuB,WAAW,EAAE,MAAM;;;IAKtE,+EAA+E;IAGzE,mBAAmB,CAAuB,WAAW,EAAE,MAAM;;;CAIpE"}
+{"version":3,"file":"org-catalog.controller.d.ts","sourceRoot":"","sources":["../../../src/features/org-structure/org-catalog.controller.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAU7D,qBAEa,oBAAoB;IACnB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,iBAAiB;IAEvD,kFAAkF;IAG5E,sBAAsB,CAAuB,WAAW,EAAE,MAAM;;;IAKtE,+EAA+E;IAGzE,mBAAmB,CAAuB,WAAW,EAAE,MAAM;;;CAIpE"}

package/dist/features/org-structure/org-catalog.controller.js

@@ -14,6 +14,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OrgCatalogController = void 0;
 const common_1 = require("@nestjs/common");
+const identity_error_interceptor_js_1 = require("../shared/identity-error.interceptor.js");
 const guard_1 = require("@astram/guard");
 const org_catalog_service_js_1 = require("./org-catalog.service.js");
 // ── Company-scoped catalogs (dept/branch option lists for the posting editor) ──
@@ -58,5 +59,6 @@ __decorate([
 ], OrgCatalogController.prototype, "listCompanyBranches", null);
 exports.OrgCatalogController = OrgCatalogController = __decorate([
     (0, common_1.Controller)('identity'),
+    (0, common_1.UseInterceptors)(identity_error_interceptor_js_1.IdentityErrorInterceptor),
     __metadata("design:paramtypes", [org_catalog_service_js_1.OrgCatalogService])
 ], OrgCatalogController);

package/dist/features/org-structure/org-catalog.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"org-catalog.service.d.ts","sourceRoot":"","sources":["../../../src/features/org-structure/org-catalog.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAE7D,qBACa,iBAAiB;IAChB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,cAAc;IAEpD,kFAAkF;IAClF,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAInE,+EAA+E;IAC/E,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAIhE,qFAAqF;YACvE,kBAAkB;CAiBjC"}
+{"version":3,"file":"org-catalog.service.d.ts","sourceRoot":"","sources":["../../../src/features/org-structure/org-catalog.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAE7D,qBACa,iBAAiB;IAChB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,cAAc;IAEpD,kFAAkF;IAClF,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IASnE,+EAA+E;IAC/E,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAIhE,qFAAqF;YACvE,kBAAkB;CAoBjC"}

package/dist/features/org-structure/org-catalog.service.js

@@ -41,7 +41,10 @@ let OrgCatalogService = class OrgCatalogService {
                 continue;
             const view = await this.records.get(catalogTypeKey, refUuid);
             const name = view?.fields?.name;
-            options.push({ uuid: refUuid, name: typeof name === 'string' && name.length > 0 ? name : '(unknown)' });
+            options.push({
+                uuid: refUuid,
+                name: typeof name === 'string' && name.length > 0 ? name : '(unknown)',
+            });
         }
         return options;
     }

package/dist/features/policy/policy.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.controller.d.ts","sourceRoot":"","sources":["../../../src/features/policy/policy.controller.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EACL,aAAa,EAId,MAAM,qBAAqB,CAAC;AAE7B,qFAAqF;AACrF,UAAU,aAAa;IACrB,SAAS,EAAE,SAAS,CAAC;CACtB;AAED,qBACa,gBAAgB;IACf,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,aAAa;IAEpD;;;;;;;;OAQG;IAGG,MAAM,CAAmB,OAAO,CAAC,EAAE,MAAM;IAY/C;;;OAGG;IAGG,IAAI,CAAQ,GAAG,EAAE,aAAa,EAAoB,OAAO,CAAC,EAAE,MAAM;;;IAQxE;;;;;OAKG;IAGG,MAAM,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE,YAAY;;;IAWlE;;;;OAIG;IAGG,MAAM,CAAQ,GAAG,EAAE,aAAa,EAAe,EAAE,EAAE,MAAM;;;CAShE"}
+{"version":3,"file":"policy.controller.d.ts","sourceRoot":"","sources":["../../../src/features/policy/policy.controller.ts"],"names":[],"mappings":"AAkCA,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EACL,aAAa,EAId,MAAM,qBAAqB,CAAC;AAE7B,qFAAqF;AACrF,UAAU,aAAa;IACrB,SAAS,EAAE,SAAS,CAAC;CACtB;AAED,qBAEa,gBAAgB;IACf,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,aAAa;IAEpD;;;;;;;;OAQG;IAGG,MAAM,CAAmB,OAAO,CAAC,EAAE,MAAM;IAY/C;;;OAGG;IAGG,IAAI,CAAQ,GAAG,EAAE,aAAa,EAAoB,OAAO,CAAC,EAAE,MAAM;;;IAQxE;;;;;OAKG;IAGG,MAAM,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE,YAAY;;;IAWlE;;;;OAIG;IAGG,MAAM,CAAQ,GAAG,EAAE,aAAa,EAAe,EAAE,EAAE,MAAM;;;CAShE"}