@astram/identity 0.4.0 → 0.6.0

package/dist/features/company/company.controller.js

@@ -17,6 +17,7 @@ const common_1 = require("@nestjs/common");
 const guard_1 = require("@astram/guard");
 const company_service_js_1 = require("./company.service.js");
 const list_query_js_1 = require("../shared/list-query.js");
+const identity_error_interceptor_js_1 = require("../shared/identity-error.interceptor.js");
 let CompanyController = class CompanyController {
     companies;
     constructor(companies) {
@@ -32,23 +33,44 @@ let CompanyController = class CompanyController {
         const result = await this.companies.listCompanies(params);
         return { total: result.total, rows: result.rows, page, limit };
     }
-    /** Create a company (a new tenant) — gated on `identity:company:create`. */
-    async createCompany(body) {
-        const id = await this.companies.createCompany(body?.name ?? 'Untitled');
+    /**
+     * Create a company — gated on `identity:company:create`. A non-root caller's company is created
+     * UNDER the caller's own organisation (D5); only root creates a top-level tenant.
+     */
+    async createCompany(req, body) {
+        const id = await this.companies.createCompany(req.principal, body?.name ?? 'Untitled');
         return { id };
     }
     /** Read one company — gated on `identity:company:read`. */
     getCompany(uuid) {
         return this.companies.getCompany(uuid);
     }
-    /** Update a company — gated on `identity:company:update`. */
+    /**
+     * Move a company under a new parent — gated on `identity:company:update`. Body
+     * `{ parentUuid: string | null }`. Non-root: the company and the new parent must both be in the
+     * caller's subtree, the company is not the caller's own root, and the parent is not null. A move
+     * that would form a cycle → 409. Declared BEFORE `companies/:uuid` (static sub-path first).
+     */
+    async moveCompany(req, uuid, body) {
+        if (!body ||
+            !('parentUuid' in body) ||
+            (body.parentUuid !== null && typeof body.parentUuid !== 'string')) {
+            throw new common_1.BadRequestException('parentUuid (a company id, or null) is required');
+        }
+        await this.companies.moveCompany(req.principal, uuid, body.parentUuid ?? null);
+        return { success: true };
+    }
+    /**
+     * Update a company's name/status — gated on `identity:company:update`. Any other key
+     * (parentUuid, type, …) is ignored: use `PUT companies/:uuid/parent` to move a company.
+     */
     async updateCompany(uuid, body) {
-        await this.companies.updateCompany(uuid, body ?? {});
+        await this.companies.updateCompany(uuid, { name: body?.name, status: body?.status });
         return { success: true };
     }
-    /** Delete a company — gated on `identity:company:delete`. */
-    async deleteCompany(uuid) {
-        await this.companies.deleteCompany(uuid);
+    /** Delete a company — gated on `identity:company:delete`. A company with sub-companies → 409. */
+    async deleteCompany(req, uuid) {
+        await this.companies.deleteCompany(req.principal, uuid);
         return { success: true };
     }
 };
@@ -64,9 +86,10 @@ __decorate([
 __decorate([
     (0, common_1.Post)('companies'),
     (0, guard_1.Classified)({ typeKey: 'company', action: 'create' }),
-    __param(0, (0, common_1.Body)()),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Body)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [Object, Object]),
     __metadata("design:returntype", Promise)
 ], CompanyController.prototype, "createCompany", null);
 __decorate([
@@ -77,6 +100,16 @@ __decorate([
     __metadata("design:paramtypes", [String]),
     __metadata("design:returntype", void 0)
 ], CompanyController.prototype, "getCompany", null);
+__decorate([
+    (0, common_1.Put)('companies/:uuid/parent'),
+    (0, guard_1.Classified)({ typeKey: 'company', action: 'update' }),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('uuid')),
+    __param(2, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String, Object]),
+    __metadata("design:returntype", Promise)
+], CompanyController.prototype, "moveCompany", null);
 __decorate([
     (0, common_1.Put)('companies/:uuid'),
     (0, guard_1.Classified)({ typeKey: 'company', action: 'update' }),
@@ -89,12 +122,14 @@ __decorate([
 __decorate([
     (0, common_1.Delete)('companies/:uuid'),
     (0, guard_1.Classified)({ typeKey: 'company', action: 'delete' }),
-    __param(0, (0, common_1.Param)('uuid')),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('uuid')),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String]),
+    __metadata("design:paramtypes", [Object, String]),
     __metadata("design:returntype", Promise)
 ], CompanyController.prototype, "deleteCompany", null);
 exports.CompanyController = CompanyController = __decorate([
     (0, common_1.Controller)('identity'),
+    (0, common_1.UseInterceptors)(identity_error_interceptor_js_1.IdentityErrorInterceptor),
     __metadata("design:paramtypes", [company_service_js_1.CompanyService])
 ], CompanyController);

package/dist/features/company/company.service.d.ts

@@ -1,25 +1,41 @@
 import { RecordsService, type RecordId } from '@astram/engine';
+import type { Principal } from '@astram/core';
 import { type ListParams } from '../shared/list-query.js';
+import { CompanyHierarchyService } from './company-hierarchy.service.js';
 /**
  * CompanyService — company (tenant) CRUD on the paved road, via the framework's
- * RecordsService facade. The facade supplies the acting identity (the request
- * principal) — this service never threads a Principal. No raw SQL, no RECORD_ENGINE.
+ * RecordsService facade (the request principal acts). No raw SQL, no RECORD_ENGINE.
+ *
+ * Hierarchy changes never ride a generic write (security hardening #2): the patch is whitelisted
+ * to `{name, status}`; create, move and delete keep the scope closure consistent through
+ * {@link CompanyHierarchyService}.
  */
 export declare class CompanyService {
     private readonly records;
-    constructor(records: RecordsService);
-    /** Create a company (tenant). */
-    createCompany(name: string): Promise<RecordId>;
+    private readonly hierarchy;
+    constructor(records: RecordsService, hierarchy: CompanyHierarchyService);
+    /**
+     * Create a company. A non-root creator's company is placed UNDER the creator's own node (D5) —
+     * never a new top-level tenant — and the closure is rebuilt + the ancestors bumped at once so
+     * the new node is inside the creator's subtree (their session picks it up at its next refresh).
+     * Root creates a top-level tenant.
+     */
+    createCompany(actor: Principal, name: string): Promise<RecordId>;
+    private readonly logger;
     /** List companies (tenant-scoped by the pipe), with paging/search/sort. */
     listCompanies(params?: ListParams): Promise<import("@astram/engine").RecordPage>;
     /** Read a single company. */
     getCompany(uuid: string): Promise<import("@astram/engine").RecordView | null>;
-    /** Update a company. */
-    updateCompany(uuid: string, patch: {
-        name?: string;
-        status?: string;
-    }): Promise<void>;
-    /** Delete a company. */
-    deleteCompany(uuid: string): Promise<void>;
+    /** Update a company's name/status. Any other key (parentUuid, type, …) is dropped. */
+    updateCompany(uuid: string, patch: Readonly<Record<string, unknown>>): Promise<void>;
+    /** Move a company under a new parent (hierarchy rules + cycle check, see the hierarchy service). */
+    moveCompany(actor: Principal, uuid: string, parentUuid: string | null): Promise<void>;
+    /**
+     * Delete a company: reach is checked through the subtree read wall (out of reach → 404), then
+     * the node is removed through `deleteNode` (refuses a node with children; closure + ancestor
+     * bump + audit in one transaction) — never a raw engine delete that would leave the closure
+     * stale or silently promote children.
+     */
+    deleteCompany(actor: Principal, uuid: string): Promise<void>;
 }
 //# sourceMappingURL=company.service.d.ts.map

package/dist/features/company/company.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"company.service.d.ts","sourceRoot":"","sources":["../../../src/features/company/company.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAK1E;;;;GAIG;AACH,qBACa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,cAAc;IAEpD,iCAAiC;IACjC,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAI9C,2EAA2E;IAC3E,aAAa,CAAC,MAAM,CAAC,EAAE,UAAU;IAIjC,6BAA6B;IAC7B,UAAU,CAAC,IAAI,EAAE,MAAM;IAIvB,wBAAwB;IACxB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrF,wBAAwB;IACxB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAG3C"}
+{"version":3,"file":"company.service.d.ts","sourceRoot":"","sources":["../../../src/features/company/company.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AASzE;;;;;;;GAOG;AACH,qBACa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBADT,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,uBAAuB;IAGrD;;;;;OAKG;IACG,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAetE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmC;IAE1D,2EAA2E;IAC3E,aAAa,CAAC,MAAM,CAAC,EAAE,UAAU;IAOjC,6BAA6B;IAC7B,UAAU,CAAC,IAAI,EAAE,MAAM;IAIvB,sFAAsF;IACtF,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAQpF,oGAAoG;IACpG,WAAW,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrF;;;;;OAKG;IACG,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAKnE"}

package/dist/features/company/company.service.js

@@ -8,27 +8,56 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
+var CompanyService_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CompanyService = void 0;
 const common_1 = require("@nestjs/common");
 const engine_1 = require("@astram/engine");
 const list_query_js_1 = require("../shared/list-query.js");
+const company_hierarchy_service_js_1 = require("./company-hierarchy.service.js");
+const identity_errors_js_1 = require("../shared/identity-errors.js");
 const COMPANY_SEARCH_FIELDS = ['name'];
 const COMPANY_SORT_FIELDS = ['name', 'status', 'createdAt'];
+/** The only company fields a generic patch may change (security hardening #2). */
+const COMPANY_PATCH_KEYS = ['name', 'status'];
 /**
  * CompanyService — company (tenant) CRUD on the paved road, via the framework's
- * RecordsService facade. The facade supplies the acting identity (the request
- * principal) — this service never threads a Principal. No raw SQL, no RECORD_ENGINE.
+ * RecordsService facade (the request principal acts). No raw SQL, no RECORD_ENGINE.
+ *
+ * Hierarchy changes never ride a generic write (security hardening #2): the patch is whitelisted
+ * to `{name, status}`; create, move and delete keep the scope closure consistent through
+ * {@link CompanyHierarchyService}.
  */
-let CompanyService = class CompanyService {
+let CompanyService = CompanyService_1 = class CompanyService {
     records;
-    constructor(records) {
+    hierarchy;
+    constructor(records, hierarchy) {
         this.records = records;
+        this.hierarchy = hierarchy;
     }
-    /** Create a company (tenant). */
-    createCompany(name) {
-        return this.records.create('company', { fields: { name } });
+    /**
+     * Create a company. A non-root creator's company is placed UNDER the creator's own node (D5) —
+     * never a new top-level tenant — and the closure is rebuilt + the ancestors bumped at once so
+     * the new node is inside the creator's subtree (their session picks it up at its next refresh).
+     * Root creates a top-level tenant.
+     */
+    async createCompany(actor, name) {
+        const fields = { name };
+        if (actor.isRoot !== true)
+            fields.parentUuid = actor.activeScopeNodeId ?? actor.tenantId;
+        const id = await this.records.create('company', { fields });
+        try {
+            await this.hierarchy.attached(String(id));
+        }
+        catch (cause) {
+            // The company row is committed; a failed closure rebuild only DELAYS the new node's reach
+            // (fail-closed: no closure row ⇒ nobody's subtree includes it) until the next reconcile.
+            // Answering an error here would invite a duplicate create on retry.
+            this.logger.error(`company closure attach failed: ${cause?.name ?? 'error'}`);
+        }
+        return id;
     }
+    logger = new common_1.Logger(CompanyService_1.name);
     /** List companies (tenant-scoped by the pipe), with paging/search/sort. */
     listCompanies(params) {
         return this.records.list('company', (0, list_query_js_1.buildListQuery)(params, COMPANY_SEARCH_FIELDS, COMPANY_SORT_FIELDS));
@@ -37,17 +66,35 @@ let CompanyService = class CompanyService {
     getCompany(uuid) {
         return this.records.get('company', uuid);
     }
-    /** Update a company. */
+    /** Update a company's name/status. Any other key (parentUuid, type, …) is dropped. */
     updateCompany(uuid, patch) {
-        return this.records.update('company', uuid, { fields: patch });
+        const fields = {};
+        for (const key of COMPANY_PATCH_KEYS) {
+            if (typeof patch?.[key] === 'string')
+                fields[key] = patch[key];
+        }
+        return this.records.update('company', uuid, { fields });
     }
-    /** Delete a company. */
-    deleteCompany(uuid) {
-        return this.records.delete('company', uuid);
+    /** Move a company under a new parent (hierarchy rules + cycle check, see the hierarchy service). */
+    moveCompany(actor, uuid, parentUuid) {
+        return this.hierarchy.move(actor, uuid, parentUuid);
+    }
+    /**
+     * Delete a company: reach is checked through the subtree read wall (out of reach → 404), then
+     * the node is removed through `deleteNode` (refuses a node with children; closure + ancestor
+     * bump + audit in one transaction) — never a raw engine delete that would leave the closure
+     * stale or silently promote children.
+     */
+    async deleteCompany(actor, uuid) {
+        const company = await this.records.get('company', uuid);
+        if (company === null)
+            throw new identity_errors_js_1.IdentityNotFoundError('Company not found.');
+        await this.hierarchy.remove(actor, uuid);
     }
 };
 exports.CompanyService = CompanyService;
-exports.CompanyService = CompanyService = __decorate([
+exports.CompanyService = CompanyService = CompanyService_1 = __decorate([
     (0, common_1.Injectable)(),
-    __metadata("design:paramtypes", [engine_1.RecordsService])
+    __metadata("design:paramtypes", [engine_1.RecordsService,
+        company_hierarchy_service_js_1.CompanyHierarchyService])
 ], CompanyService);

package/dist/features/cross-tenant/cross-tenant-grant.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cross-tenant-grant.controller.d.ts","sourceRoot":"","sources":["../../../src/features/cross-tenant/cross-tenant-grant.controller.ts"],"names":[],"mappings":"AA4CA,OAAO,EAGL,sBAAsB,EAKvB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AAEnF,qFAAqF;AACrF,UAAU,aAAa;IACrB,SAAS,EAAE,SAAS,CAAC;CACtB;AAED,gGAAgG;AAChG,UAAU,iBAAiB;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAmDD,qBACa,0BAA0B;IAEO,OAAO,CAAC,QAAQ,CAAC,WAAW;IACtE,OAAO,CAAC,QAAQ,CAAC,KAAK;gBADqC,WAAW,EAAE,sBAAsB,EAC7E,KAAK,EAAE,2BAA2B;IAGrD;;;;OAIG;IAGG,KAAK,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE,iBAAiB;;;;IA+BtE,yFAAyF;IAGnF,MAAM,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM;;;IASnE;;;;;OAKG;IAGG,MAAM,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM;;;IASnE;;;OAGG;IAGG,KAAK,CAAQ,GAAG,EAAE,aAAa;;;IAKrC;;;;OAIG;IAGG,IAAI,CAAQ,GAAG,EAAE,aAAa;;;;IAQpC,wFAAwF;IAGlF,cAAc;;;CAIrB"}
+{"version":3,"file":"cross-tenant-grant.controller.d.ts","sourceRoot":"","sources":["../../../src/features/cross-tenant/cross-tenant-grant.controller.ts"],"names":[],"mappings":"AA8CA,OAAO,EAGL,sBAAsB,EAKvB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AAEnF,qFAAqF;AACrF,UAAU,aAAa;IACrB,SAAS,EAAE,SAAS,CAAC;CACtB;AAED,gGAAgG;AAChG,UAAU,iBAAiB;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAqDD,qBAEa,0BAA0B;IAEO,OAAO,CAAC,QAAQ,CAAC,WAAW;IACtE,OAAO,CAAC,QAAQ,CAAC,KAAK;gBADqC,WAAW,EAAE,sBAAsB,EAC7E,KAAK,EAAE,2BAA2B;IAGrD;;;;OAIG;IAGG,KAAK,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE,iBAAiB;;;;IA+BtE,yFAAyF;IAGnF,MAAM,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM;;;IASnE;;;;;OAKG;IAGG,MAAM,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM;;;IASnE;;;OAGG;IAGG,KAAK,CAAQ,GAAG,EAAE,aAAa;;;IAKrC;;;;OAIG;IAGG,IAAI,CAAQ,GAAG,EAAE,aAAa;;;;IAQpC,wFAAwF;IAGlF,cAAc;;;CAIrB"}

package/dist/features/cross-tenant/cross-tenant-grant.controller.js

@@ -46,6 +46,7 @@ exports.CrossTenantGrantController = void 0;
  * writer change).
  */
 const common_1 = require("@nestjs/common");
+const identity_error_interceptor_js_1 = require("../shared/identity-error.interceptor.js");
 const guard_1 = require("@astram/guard");
 const cross_tenant_grant_read_service_js_1 = require("./cross-tenant-grant-read.service.js");
 const VALID_GRANTEE_KINDS = ['user', 'role'];
@@ -231,6 +232,7 @@ __decorate([
 ], CrossTenantGrantController.prototype, "offerableTypes", null);
 exports.CrossTenantGrantController = CrossTenantGrantController = __decorate([
     (0, common_1.Controller)('identity'),
+    (0, common_1.UseInterceptors)(identity_error_interceptor_js_1.IdentityErrorInterceptor),
     __param(0, (0, common_1.Inject)(guard_1.SHIELD_CROSS_TENANT_GRANT_WRITER)),
     __metadata("design:paramtypes", [guard_1.CrossTenantGrantWriter,
         cross_tenant_grant_read_service_js_1.CrossTenantGrantReadService])

package/dist/features/identity-feature.module.d.ts

@@ -25,6 +25,8 @@ export declare class IdentityFeatureModule {
      *   the framework identity types, so a consumer's own OWNED type (e.g. `note`) is NOT
      *   policy-authorable and NOT shareable ("type '…' is not registered — cannot share").
      *   Passing them here lets an owner share their own records + author policies over them.
+     *   Phase 8 #4: if the action keys of these objects differ from the ones given to
+     *   `buildIdentityRecordAuthorization`, the boot fails with `IdentityRegistryMismatchError`.
      */
     static forRoot({ rootIds, extraObjects, }?: {
         rootIds?: readonly string[];

package/dist/features/identity-feature.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-feature.module.d.ts","sourceRoot":"","sources":["../../src/features/identity-feature.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE5D,OAAO,EAYL,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AA4ExB;;;;;;;;;;GAUG;AACH,qBACa,qBAAqB;IAChC;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,OAAO,CAAC,EACb,OAAO,EACP,YAAiB,GAClB,GAAE;QAAE,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,YAAY,CAAC,EAAE,SAAS,eAAe,EAAE,CAAA;KAAO,GAAG,aAAa;CAmYnG"}
+{"version":3,"file":"identity-feature.module.d.ts","sourceRoot":"","sources":["../../src/features/identity-feature.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpE,OAAO,EAYL,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AA8FxB;;;;;;;;;;GAUG;AACH,qBACa,qBAAqB;IAChC;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,OAAO,CAAC,EACb,OAAO,EACP,YAAiB,GAClB,GAAE;QACD,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5B,YAAY,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;KACtC,GAAG,aAAa;CA8cvB"}

package/dist/features/identity-feature.module.js

@@ -16,6 +16,7 @@ const objects_js_1 = require("../objects.js");
 const index_js_1 = require("./access/index.js");
 const company_service_js_1 = require("./company/company.service.js");
 const company_controller_js_1 = require("./company/company.controller.js");
+const company_hierarchy_service_js_1 = require("./company/company-hierarchy.service.js");
 const role_service_js_1 = require("./role/role.service.js");
 const role_controller_js_1 = require("./role/role.controller.js");
 const user_service_js_1 = require("./user/user.service.js");
@@ -30,6 +31,7 @@ const posting_version_bump_js_1 = require("./membership/posting-version-bump.js"
 const permission_version_bumper_js_1 = require("./authz/permission-version.bumper.js");
 const record_authorization_js_1 = require("./authz/record-authorization.js");
 const db_permission_facts_adapter_js_1 = require("./authz/db-permission-facts.adapter.js");
+const session_revocation_check_js_1 = require("./user/session-revocation-check.js");
 const access_bundle_store_js_1 = require("./authz/access-bundle-store.js");
 const grant_admin_service_js_1 = require("./authz/grant-admin.service.js");
 const grant_admin_controller_js_1 = require("./authz/grant-admin.controller.js");
@@ -52,6 +54,10 @@ const audit_controller_js_1 = require("./audit/audit.controller.js");
 const cross_tenant_grant_read_service_js_1 = require("./cross-tenant/cross-tenant-grant-read.service.js");
 const cross_tenant_grant_controller_js_1 = require("./cross-tenant/cross-tenant-grant.controller.js");
 const grant_authorize_js_1 = require("./cross-tenant/grant-authorize.js");
+/** DI token of the provider that links the guard's Redis version cache to the bumper (ADR-0035). */
+const IDENTITY_VERSION_PUBLISHER_LINK = Symbol('IDENTITY_VERSION_PUBLISHER_LINK');
+/** DI token of the boot check that warns when a user disable cannot revoke sessions. */
+const IDENTITY_SESSION_REVOCATION_CHECK = Symbol('IDENTITY_SESSION_REVOCATION_CHECK');
 /** Map guard's env DbConfig → the engine's EngineDbConfig (adds the pool cap the engine needs). */
 function engineDbFromEnv() {
     const db = (0, guard_1.loadDbConfig)();
@@ -91,8 +97,18 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
      *   the framework identity types, so a consumer's own OWNED type (e.g. `note`) is NOT
      *   policy-authorable and NOT shareable ("type '…' is not registered — cannot share").
      *   Passing them here lets an owner share their own records + author policies over them.
+     *   Phase 8 #4: if the action keys of these objects differ from the ones given to
+     *   `buildIdentityRecordAuthorization`, the boot fails with `IdentityRegistryMismatchError`.
      */
     static forRoot({ rootIds, extraObjects = [], } = {}) {
+        // The ceiling's key universe includes the consumer's `extraObjects` (the SAME registry shape
+        // `buildIdentityRecordAuthorization(pool, extraObjects)` gives the decision path): otherwise a
+        // role holding a consumer-type key could never be assigned or granted by a non-root admin who
+        // holds that key (review M5) — the security-hardening role-assignment ceiling makes that
+        // reachable from every posting edit. Phase 8 #4: the two registries must have the SAME action
+        // keys — checked here, before anything is opened; a mismatch fails the boot.
+        const ceilingRegistry = (0, guard_1.buildIdentityModuleRegistry)([...objects_js_1.identityObjects, ...extraObjects]);
+        (0, record_authorization_js_1.noteIdentityCeilingRegistry)(ceilingRegistry);
         // ONE shared shield_authz pool for the whole grant-admin stack (ADR-0011): the
         // permission-version bumper, the AccessBundleStore, the GrantAdminService, and the two
         // reconcile jobs all run over this single pool (don't open several). Opened once at
@@ -101,6 +117,10 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
         const bumper = new permission_version_bumper_js_1.PermissionVersionBumper();
         const postingVersionBump = {
             bumpTenant: (tenantUuid) => bumper.bumpForTenant(tenantUuid, authzPool),
+            // A user disabled/re-enabled: every membership tenant (autocommit pool → published at once).
+            bumpForUser: (userUuid) => bumper.bumpForUser(userUuid, authzPool),
+            // A role delete (Phase 8 #2): its holder tenants, read before the delete cascades postings.
+            tenantsForRole: (roleUuid) => bumper.tenantsForRole(roleUuid, authzPool),
         };
         // The core ModuleRegistry the catalog reconcile job needs, built from the identity
         // object registrations (guard's bridge reflects decorated classes → registry). Built BEFORE
@@ -112,14 +132,30 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
         // resolved over the SAME authz pool + registry the object-type gate uses (one source of
         // truth for "what a principal holds"). ALWAYS wired here, so production always enforces.
         const accessBundleStore = new access_bundle_store_js_1.AccessBundleStore(authzPool);
-        const grantCeiling = new grant_ceiling_js_1.GrantCeiling(authzPool, identityRegistry);
-        const grantAdminService = new grant_admin_service_js_1.GrantAdminService(authzPool, bumper, accessBundleStore, grantCeiling);
+        // (`ceilingRegistry` is built and parity-checked at the top of forRoot.) `rootIds` marks
+        // platform roots as never dominated.
+        // rootIds is passed EXPLICITLY (review F5): `null` states "not configured". The dominance
+        // check still refuses any user flagged `u_is_platform_superuser`, so an unconfigured list
+        // never lets a sub-admin take over a platform administrator.
+        if (rootIds === undefined) {
+            new common_1.Logger('IdentityFeatureModule').warn('rootIds not passed to IdentityFeatureModule.forRoot — pass the same array as ' +
+                'ShieldModule.forRoot({ rootIds }). Platform administrators are still protected via ' +
+                'users.u_is_platform_superuser.');
+        }
+        const grantCeiling = new grant_ceiling_js_1.GrantCeiling(authzPool, ceilingRegistry, rootIds ?? null);
+        // Grant administration is audited on the grant's own transaction (D6, fail-closed).
+        const grantAdminAuditSink = new engine_1.MariaDbAuditSink({}); // shield_audit.audit_log defaults
+        const grantAdminService = new grant_admin_service_js_1.GrantAdminService(authzPool, bumper, accessBundleStore, grantCeiling, grantAdminAuditSink);
         // Scope closure (Task 1.2 of the scoped-hierarchy program): the reconciler + node
         // move/delete maintenance, over the SAME shared authzPool (it reaches BOTH shield_app —
         // companies — and shield_authz — scope_closure). Reuses the SAME `bumper` instance so a
         // moveNode's session-invalidation joins the move's transaction. reconcileClosure() is
         // kicked post-boot by the CatalogBootstrapProvider (mirrors the catalog reconcile).
         const scopeClosureService = new scope_closure_service_js_1.ScopeClosureService(authzPool, bumper);
+        // Company hierarchy (security hardening #2): the ONLY path that moves/deletes/attaches a company
+        // node — through the closure service above — audited on the move/delete transaction.
+        const companyHierarchyService = new company_hierarchy_service_js_1.CompanyHierarchyService(authzPool, scopeClosureService, grantCeiling, // Phase 8 #3: a company delete must dominate every member
+        new engine_1.MariaDbAuditSink({}));
         // Audit viewer (Phase 5): the AuditReader + LabelResolver over the SAME shared authzPool
         // (the reader queries shield_audit + the resolver/actor-lookup query shield_app, both
         // reachable by that pool). `auditNameToId` is the actor-name -> uuid reverse lookup for the
@@ -138,7 +174,8 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
         // authz.module, the anti-pattern this replaces). A SECOND DecisionAuthority is built over the
         // same record-authorization inputs (matches astram3): the route guard's own decide() is the
         // first; this one backs the writer's server-side re-verification.
-        const crossTenantAuthority = (0, guard_1.buildRecordAuthorization)((0, record_authorization_js_1.buildIdentityRecordAuthorization)(authzPool));
+        // (The non-recording builder: these internal authorities are not the consumer's decision path.)
+        const crossTenantAuthority = (0, guard_1.buildRecordAuthorization)((0, record_authorization_js_1.buildRecordAuthorizationInputs)(authzPool));
         // Record-level LIST SCOPE (Task 3.1, Invariant #8): the engine-facing fn the engine's
         // `list()` ANDs into BOTH the data SELECT and the COUNT — the in-query visible-set filter.
         // Built HERE, over the SAME shared authzPool (guard constructs the un-overridable scope
@@ -146,7 +183,7 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
         // out-of-the-box into `EngineModule.forRoot({ listScope })` below (ADR-0003 injection seam —
         // the engine never imports guard). Fail-closed: a store outage propagates and `list()` fails
         // rather than returning unscoped rows.
-        const listScope = (0, guard_1.buildListScopeFn)((0, record_authorization_js_1.buildIdentityRecordAuthorization)(authzPool));
+        const listScope = (0, guard_1.buildListScopeFn)((0, record_authorization_js_1.buildRecordAuthorizationInputs)(authzPool));
         // The writer's `GrantAuthorizeFn`: decide()-backed, fail-closed (no try/catch — a throw
         // propagates and the writer maps it to a retryable 503). isRoot ← the SAME rootIds the
         // consumer passes to ShieldModule.forRoot (root-correctness for control-plane grants).
@@ -398,9 +435,36 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
                 org_catalog_service_js_1.OrgCatalogService,
                 record_resolver_js_1.RecordResolverService,
                 { provide: posting_version_bump_js_1.POSTING_VERSION_BUMP, useValue: postingVersionBump },
+                // ADR-0035 (GAPS #6): attach the guard's Redis permission-version cache to the ONE shared
+                // bumper, so every committed bump (postings, grants, hierarchy) is published to Redis,
+                // where gate 5 reads it. Provided by the auth surface under `auth: true` (through the
+                // @Global ShieldModule); absent → DB-only bumps, exactly as before.
+                // Phase 3 review P2: with auth on (the token binder is visible) but no session sweeper, a
+                // user disable cannot revoke sessions — warn at boot.
+                {
+                    provide: IDENTITY_SESSION_REVOCATION_CHECK,
+                    useFactory: (binder, sweeper) => (0, session_revocation_check_js_1.warnIfSessionsUnrevocable)(binder, sweeper, (m) => new common_1.Logger('IdentityFeatureModule').warn(m)),
+                    inject: [
+                        { token: guard_1.SHIELD_SESSION_TOKEN_BINDER, optional: true },
+                        { token: guard_1.SHIELD_SESSION_SWEEPER, optional: true },
+                    ],
+                },
+                {
+                    provide: IDENTITY_VERSION_PUBLISHER_LINK,
+                    useFactory: (cache) => {
+                        if (cache)
+                            bumper.attachVersionPublisher(cache);
+                        return cache !== null && cache !== undefined;
+                    },
+                    inject: [{ token: guard_1.SHIELD_PERMISSION_VERSION_CACHE, optional: true }],
+                },
                 // Grant-admin stack — all over the ONE shared authzPool.
                 { provide: access_bundle_store_js_1.AccessBundleStore, useValue: accessBundleStore },
                 { provide: grant_admin_service_js_1.GrantAdminService, useValue: grantAdminService },
+                // The ONE tenant-boundary authority (ADR-0029 ceiling + block A: role assignment, user
+                // dominance, role binding) — injected by RoleService, PostingService and UserService.
+                { provide: grant_ceiling_js_1.GrantCeiling, useValue: grantCeiling },
+                { provide: company_hierarchy_service_js_1.CompanyHierarchyService, useValue: companyHierarchyService },
                 // Audit read stack — built at forRoot() over the ONE shared authzPool, provided as a
                 // useValue (like GrantAdminService) so it carries the hand-built reader/resolver/lookup.
                 { provide: audit_read_service_js_1.AuditReadService, useValue: auditReadService },
@@ -421,7 +485,10 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
                 { provide: service_account_service_js_1.ServiceAccountService, useValue: serviceAccountService },
                 // The mutating half of auto-catalog: a single CatalogReconcileJob (post-boot pass +
                 // cron), over the shared pool + the identity registry.
-                { provide: catalog_reconcile_job_js_1.CatalogReconcileJob, useValue: new catalog_reconcile_job_js_1.CatalogReconcileJob(authzPool, identityRegistry) },
+                {
+                    provide: catalog_reconcile_job_js_1.CatalogReconcileJob,
+                    useValue: new catalog_reconcile_job_js_1.CatalogReconcileJob(authzPool, identityRegistry),
+                },
                 // The bundle half: reconciles the merged AccessBundleSpec[] (ENGINE_ALL_ACCESS_BUNDLES,
                 // reflected by the engine from identityAccessBundles) into shield_authz.access_bundle.
                 {

package/dist/features/membership/membership.controller.d.ts

@@ -1,6 +1,7 @@
 import { MembershipService } from './membership.service.js';
 import { PostingService, type PostingInput } from './posting.service.js';
 import { RecordResolverService } from '../shared/record-resolver.js';
+import { type AuthedRequest } from '../shared/http.js';
 /** A membership card for the API, with EVERY uuid resolved to a display name. */
 interface MembershipCardDto {
     /** The membership id — used as a route param / react key, NEVER as a display field. */
@@ -39,7 +40,7 @@ export declare class MembershipController {
         memberships: MembershipCardDto[];
     }>;
     /** Add the user to a company (creates an inactive membership card). */
-    addUserMembership(userUuid: string, body: {
+    addUserMembership(req: AuthedRequest, userUuid: string, body: {
         companyUuid?: string;
     }): Promise<{
         id: import("@astram/engine").RecordId;
@@ -49,19 +50,19 @@ export declare class MembershipController {
      * invariant); `status` is a plain field update. Activating requires the owning user so
      * the invariant can deactivate the user's OTHER memberships.
      */
-    updateMembership(membershipUuid: string, body: {
+    updateMembership(req: AuthedRequest, membershipUuid: string, body: {
         isActive?: boolean;
         status?: string;
         userUuid?: string;
     }): Promise<{
         success: boolean;
     }>;
-    /** Remove a membership card (its postings cascade at the DB). */
-    removeMembership(membershipUuid: string): Promise<{
+    /** Remove a membership card (its postings cascade at the DB). A peer's needs dominance. */
+    removeMembership(req: AuthedRequest, membershipUuid: string): Promise<{
         success: boolean;
     }>;
     /** Atomically replace a membership's full posting set (the diff sync). */
-    replacePostings(membershipUuid: string, body: {
+    replacePostings(req: AuthedRequest, membershipUuid: string, body: {
         postings?: PostingInput[];
     }): Promise<{
         success: boolean;

package/dist/features/membership/membership.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"membership.controller.d.ts","sourceRoot":"","sources":["../../../src/features/membership/membership.controller.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,KAAK,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAGrE,iFAAiF;AACjF,UAAU,iBAAiB;IACzB,uFAAuF;IACvF,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED,4EAA4E;AAC5E,UAAU,cAAc;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,kFAAkF;IAClF,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AASD,qBACa,oBAAoB;IAE7B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAFR,WAAW,EAAE,iBAAiB,EAC9B,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,qBAAqB;IAGlD;;;;;OAKG;IAGG,mBAAmB,CAAoB,QAAQ,EAAE,MAAM;;;IA0C7D,uEAAuE;IAGjE,iBAAiB,CACF,QAAQ,EAAE,MAAM,EAC3B,IAAI,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAMxC;;;;OAIG;IAGG,gBAAgB,CACK,cAAc,EAAE,MAAM,EACvC,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAc1E,iEAAiE;IAG3D,gBAAgB,CAA0B,cAAc,EAAE,MAAM;;;IAKtE,0EAA0E;IAGpE,eAAe,CACM,cAAc,EAAE,MAAM,EACvC,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,YAAY,EAAE,CAAA;KAAE;;;IAM7C;;;;OAIG;YACW,WAAW;CAM1B"}
+{"version":3,"file":"membership.controller.d.ts","sourceRoot":"","sources":["../../../src/features/membership/membership.controller.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,KAAK,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAqB,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAG1E,iFAAiF;AACjF,UAAU,iBAAiB;IACzB,uFAAuF;IACvF,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED,4EAA4E;AAC5E,UAAU,cAAc;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,kFAAkF;IAClF,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAYD,qBAEa,oBAAoB;IAE7B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAFR,WAAW,EAAE,iBAAiB,EAC9B,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,qBAAqB;IAGlD;;;;;OAKG;IAGG,mBAAmB,CAAoB,QAAQ,EAAE,MAAM;;;IA0C7D,uEAAuE;IAGjE,iBAAiB,CACd,GAAG,EAAE,aAAa,EACN,QAAQ,EAAE,MAAM,EAC3B,IAAI,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAUxC;;;;OAIG;IAGG,gBAAgB,CACb,GAAG,EAAE,aAAa,EACA,cAAc,EAAE,MAAM,EACvC,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAgB1E,2FAA2F;IAGrF,gBAAgB,CACb,GAAG,EAAE,aAAa,EACA,cAAc,EAAE,MAAM;;;IAMjD,0EAA0E;IAGpE,eAAe,CACZ,GAAG,EAAE,aAAa,EACA,cAAc,EAAE,MAAM,EACvC,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,YAAY,EAAE,CAAA;KAAE;;;IAO7C;;;;OAIG;YACW,WAAW;CAM1B"}