@astram/identity 0.4.0 → 0.6.0

package/dist/features/membership/membership.controller.js

@@ -19,12 +19,16 @@ const membership_service_js_1 = require("./membership.service.js");
 const posting_service_js_1 = require("./posting.service.js");
 const record_resolver_js_1 = require("../shared/record-resolver.js");
 const http_js_1 = require("../shared/http.js");
+const identity_error_interceptor_js_1 = require("../shared/identity-error.interceptor.js");
 // ── Memberships + postings ───────────────────────────────────────────────────
 //
 // Gated on the `company_membership` / `membership_posting` grants via `@Classified`
 // + the engine's mandatory in-pipe gate. Both are DATA-plane types, so the capped root
 // is denied them by construction — the membership admin surface is grant-driven, not
-// root-driven. Real per-company-admin scoping is a later permission-engine concern.
+// root-driven. Per-company-admin scoping is structural: reads, updates and deletes are walled
+// to the caller's subtree (ADR-0027/0030), creates by the ADR-0034 create wall; adding an
+// existing user needs that user already in the subtree (D4), and posting a role runs the
+// role-assignment ceiling + binding rule (#11). Errors map via IdentityErrorInterceptor.
 let MembershipController = class MembershipController {
     memberships;
     postings;
@@ -78,8 +82,8 @@ let MembershipController = class MembershipController {
         return { memberships: cards };
     }
     /** Add the user to a company (creates an inactive membership card). */
-    async addUserMembership(userUuid, body) {
-        const id = await this.memberships.addMembership(userUuid, body?.companyUuid ?? '');
+    async addUserMembership(req, userUuid, body) {
+        const id = await this.memberships.addMembership(req.principal, userUuid, body?.companyUuid ?? '');
         return { id };
     }
     /**
@@ -87,26 +91,29 @@ let MembershipController = class MembershipController {
      * invariant); `status` is a plain field update. Activating requires the owning user so
      * the invariant can deactivate the user's OTHER memberships.
      */
-    async updateMembership(membershipUuid, body) {
+    async updateMembership(req, membershipUuid, body) {
         if (body?.isActive === true) {
             if (!body.userUuid) {
                 throw new common_1.ForbiddenException('userUuid is required to activate a membership');
             }
-            await this.memberships.setActive(membershipUuid, body.userUuid);
+            await this.memberships.setActive(req.principal, membershipUuid, body.userUuid);
         }
         if (typeof body?.status === 'string') {
-            await this.memberships.updateMembership(membershipUuid, { status: body.status });
+            await this.memberships.updateMembership(req.principal, membershipUuid, {
+                status: body.status,
+            });
         }
         return { success: true };
     }
-    /** Remove a membership card (its postings cascade at the DB). */
-    async removeMembership(membershipUuid) {
-        await this.memberships.removeMembership(membershipUuid);
+    /** Remove a membership card (its postings cascade at the DB). A peer's needs dominance. */
+    async removeMembership(req, membershipUuid) {
+        await this.memberships.removeMembership(req.principal, membershipUuid);
         return { success: true };
     }
     /** Atomically replace a membership's full posting set (the diff sync). */
-    async replacePostings(membershipUuid, body) {
-        await this.postings.replacePostings(membershipUuid, body?.postings ?? []);
+    async replacePostings(req, membershipUuid, body) {
+        const postings = Array.isArray(body?.postings) ? body.postings : [];
+        await this.postings.replacePostings(req.principal, membershipUuid, postings);
         return { success: true };
     }
     /**
@@ -134,40 +141,45 @@ __decorate([
 __decorate([
     (0, common_1.Post)('users/:userUuid/memberships'),
     (0, guard_1.Classified)({ typeKey: 'company_membership', action: 'create' }),
-    __param(0, (0, common_1.Param)('userUuid')),
-    __param(1, (0, common_1.Body)()),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('userUuid')),
+    __param(2, (0, common_1.Body)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String, Object]),
+    __metadata("design:paramtypes", [Object, String, Object]),
     __metadata("design:returntype", Promise)
 ], MembershipController.prototype, "addUserMembership", null);
 __decorate([
     (0, common_1.Put)('memberships/:membershipUuid'),
     (0, guard_1.Classified)({ typeKey: 'company_membership', action: 'update' }),
-    __param(0, (0, common_1.Param)('membershipUuid')),
-    __param(1, (0, common_1.Body)()),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('membershipUuid')),
+    __param(2, (0, common_1.Body)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String, Object]),
+    __metadata("design:paramtypes", [Object, String, Object]),
     __metadata("design:returntype", Promise)
 ], MembershipController.prototype, "updateMembership", null);
 __decorate([
     (0, common_1.Delete)('memberships/:membershipUuid'),
     (0, guard_1.Classified)({ typeKey: 'company_membership', action: 'delete' }),
-    __param(0, (0, common_1.Param)('membershipUuid')),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('membershipUuid')),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String]),
+    __metadata("design:paramtypes", [Object, String]),
     __metadata("design:returntype", Promise)
 ], MembershipController.prototype, "removeMembership", null);
 __decorate([
     (0, common_1.Put)('memberships/:membershipUuid/postings'),
     (0, guard_1.Classified)({ typeKey: 'membership_posting', action: 'update' }),
-    __param(0, (0, common_1.Param)('membershipUuid')),
-    __param(1, (0, common_1.Body)()),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('membershipUuid')),
+    __param(2, (0, common_1.Body)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String, Object]),
+    __metadata("design:paramtypes", [Object, String, Object]),
     __metadata("design:returntype", Promise)
 ], MembershipController.prototype, "replacePostings", null);
 exports.MembershipController = MembershipController = __decorate([
     (0, common_1.Controller)('identity'),
+    (0, common_1.UseInterceptors)(identity_error_interceptor_js_1.IdentityErrorInterceptor),
     __metadata("design:paramtypes", [membership_service_js_1.MembershipService,
         posting_service_js_1.PostingService,
         record_resolver_js_1.RecordResolverService])

package/dist/features/membership/membership.service.d.ts

@@ -11,17 +11,20 @@
  * `cm_is_active`; `setActive` is the guard.
  */
 import { RecordsService, type RecordId, type RecordView } from '@astram/engine';
+import type { Principal } from '@astram/core';
 import { type PostingVersionBump } from './posting-version-bump.js';
+import { GrantCeiling } from '../authz/grant-ceiling.js';
 export declare class MembershipService {
     private readonly records;
+    private readonly ceiling;
     private readonly versionBump?;
-    constructor(records: RecordsService, versionBump?: (PostingVersionBump | null) | undefined);
+    constructor(records: RecordsService, ceiling: GrantCeiling, versionBump?: (PostingVersionBump | null) | undefined);
     /**
-     * Read a membership's tenant (its `companyUuid`) through the pipe, or `null` when
-     * unresolvable (→ no bump; fail-safe, never guesses a tenant). Used to target the
-     * permission-version bump at the company whose coarse grants a mutation changed.
+     * Read a membership through the subtree wall (404 when out of reach) and, unless the actor is
+     * acting on their OWN membership, require the actor to dominate its user (security review): a
+     * sub-admin must not delete, suspend or re-activate a more privileged peer's membership.
      */
-    private tenantOf;
+    private reachMember;
     /**
      * Bump the permission version for each DISTINCT tenant in `tenantUuids` (best-effort +
      * fail-safe): the mutation already succeeded, so a bump hiccup must NOT surface as an
@@ -37,17 +40,17 @@ export declare class MembershipService {
      * hits the DB's UNIQUE constraint and the engine's error surfaces to the caller (NOT
      * swallowed here). `createdBy` is stamped server-side (actorId-trusted).
      */
-    addMembership(userUuid: string, companyUuid: string): Promise<RecordId>;
+    addMembership(actor: Principal, userUuid: string, companyUuid: string): Promise<RecordId>;
     /** List a user's membership cards (tenant-scoped by the pipe). */
     listMemberships(userUuid: string): Promise<readonly RecordView[]>;
     /**
      * Flip which of the user's memberships is active — the ONE-ACTIVE invariant. The service
      * is the guard because the DB has no partial-unique on `cm_is_active`.
      *
-     * ⚠️ ORDER IS LOAD-BEARING (fail-safe against a LOGIN LOCKOUT). The engine's `list` has
-     * no ORDER BY (PKs are random uuids → arbitrary row order) and each `update` is its OWN
-     * transaction (no cross-call atomicity). So this MUST activate the TARGET FIRST, then
-     * deactivate the others:
+     * ⚠️ ORDER IS LOAD-BEARING (fail-safe against a LOGIN LOCKOUT). Each `update` is its OWN
+     * transaction (no cross-call atomicity), and the engine's `list` order (PK-ordered since the
+     * Phase 3 tiebreaker) says nothing about which membership is the target. So this MUST
+     * activate the TARGET FIRST, then deactivate the others:
      *   - Worst case of a mid-loop failure is then a transient TWO-active window, which is
      *     RECOVERABLE — the credential resolver reads `is_active=1 LIMIT 1`, so it still
      *     resolves a tenant and login works.
@@ -58,16 +61,19 @@ export declare class MembershipService {
      * Guard: if `membershipUuid` is NOT one of the user's memberships, throw — otherwise the
      * loop would deactivate everything and activate nothing (also a zero-active lockout).
      */
-    setActive(membershipUuid: string, userUuid: string): Promise<void>;
+    setActive(actor: Principal, membershipUuid: string, userUuid: string): Promise<void>;
     /**
      * Update a membership's mutable non-activity fields (currently `status`). Activity is
      * flipped only via `setActive` to preserve the one-active invariant, so `isActive` is
      * intentionally NOT a patch key here.
      */
-    updateMembership(membershipUuid: string, patch: {
+    updateMembership(actor: Principal, membershipUuid: string, patch: {
         status?: string;
     }): Promise<void>;
-    /** Remove a membership card (its postings cascade at the DB via FK ON DELETE CASCADE). */
-    removeMembership(membershipUuid: string): Promise<void>;
+    /**
+     * Remove a membership card (its postings cascade at the DB via FK ON DELETE CASCADE). A peer's
+     * membership needs dominance over the peer (security review); your own does not.
+     */
+    removeMembership(actor: Principal, membershipUuid: string): Promise<void>;
 }
 //# sourceMappingURL=membership.service.d.ts.map

package/dist/features/membership/membership.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"membership.service.d.ts","sourceRoot":"","sources":["../../../src/features/membership/membership.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EAAwB,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE1F,qBACa,iBAAiB;IAE1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAQxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBARZ,OAAO,EAAE,cAAc,EAQvB,WAAW,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA;IAG1D;;;;OAIG;YACW,QAAQ;IAUtB;;;;;;OAMG;YACW,WAAW;IAYzB;;;;;;OAMG;IACH,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAMvE,kEAAkE;IAC5D,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC;IAKvE;;;;;;;;;;;;;;;;;OAiBG;IACG,SAAS,CAAC,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAqCxE;;;;OAIG;IACH,gBAAgB,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAWnF,0FAA0F;IACpF,gBAAgB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAU9D"}
+{"version":3,"file":"membership.service.d.ts","sourceRoot":"","sources":["../../../src/features/membership/membership.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAwB,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE1F,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD,qBACa,iBAAiB;IAE1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAGxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAQxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAXZ,OAAO,EAAE,cAAc,EAGvB,OAAO,EAAE,YAAY,EAQrB,WAAW,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA;IAG1D;;;;OAIG;YACW,WAAW;IAQzB;;;;;;OAMG;YACW,WAAW;IAYzB;;;;;;OAMG;IACG,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAkB/F,kEAAkE;IAC5D,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC;IAKvE;;;;;;;;;;;;;;;;;OAiBG;IACG,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAsC1F;;;;OAIG;IACG,gBAAgB,CACpB,KAAK,EAAE,SAAS,EAChB,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GACzB,OAAO,CAAC,IAAI,CAAC;IAchB;;;OAGG;IACG,gBAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAYhF"}

package/dist/features/membership/membership.service.js

@@ -28,27 +28,33 @@ exports.MembershipService = void 0;
 const common_1 = require("@nestjs/common");
 const engine_1 = require("@astram/engine");
 const posting_version_bump_js_1 = require("./posting-version-bump.js");
+const identity_errors_js_1 = require("../shared/identity-errors.js");
+const grant_ceiling_js_1 = require("../authz/grant-ceiling.js");
 let MembershipService = class MembershipService {
     records;
+    ceiling;
     versionBump;
-    constructor(records, versionBump) {
+    constructor(records, 
+    // Dominance over the member for destructive ops (security review): REQUIRED, so a missing
+    // ceiling fails DI at boot instead of silently skipping the check.
+    ceiling, versionBump) {
         this.records = records;
+        this.ceiling = ceiling;
         this.versionBump = versionBump;
     }
     /**
-     * Read a membership's tenant (its `companyUuid`) through the pipe, or `null` when
-     * unresolvable (→ no bump; fail-safe, never guesses a tenant). Used to target the
-     * permission-version bump at the company whose coarse grants a mutation changed.
+     * Read a membership through the subtree wall (404 when out of reach) and, unless the actor is
+     * acting on their OWN membership, require the actor to dominate its user (security review): a
+     * sub-admin must not delete, suspend or re-activate a more privileged peer's membership.
      */
-    async tenantOf(membershipUuid) {
-        try {
-            const m = await this.records.get('company_membership', membershipUuid);
-            const companyUuid = m?.fields?.companyUuid;
-            return typeof companyUuid === 'string' && companyUuid.length > 0 ? companyUuid : null;
-        }
-        catch {
-            return null;
-        }
+    async reachMember(actor, membershipUuid) {
+        const m = await this.records.get('company_membership', membershipUuid);
+        if (m === null)
+            throw new identity_errors_js_1.IdentityNotFoundError('Membership not found.');
+        const userUuid = typeof m.fields?.userUuid === 'string' ? m.fields.userUuid : '';
+        if (userUuid !== actor.id)
+            await this.ceiling.assertDominates(actor, userUuid);
+        return m;
     }
     /**
      * Bump the permission version for each DISTINCT tenant in `tenantUuids` (best-effort +
@@ -77,7 +83,20 @@ let MembershipService = class MembershipService {
      * hits the DB's UNIQUE constraint and the engine's error surfaces to the caller (NOT
      * swallowed here). `createdBy` is stamped server-side (actorId-trusted).
      */
-    addMembership(userUuid, companyUuid) {
+    async addMembership(actor, userUuid, companyUuid) {
+        // D4 (security hardening #4): a non-root actor may attach only a user ALREADY inside its
+        // subtree — the user's walled read (a user is in scope iff it has a membership in the
+        // actor's subtree) must see it. Pulling a foreign tenant's user in would make them
+        // "dominated" by the actor (the #4 + #3 email-takeover chain). A brand-new user joins
+        // through `POST /identity/users { companyUuid }` (created + attached in one transaction).
+        // Root is data-plane-denied on memberships by the engine anyway.
+        if (actor.isRoot !== true) {
+            const user = await this.records.get('user', userUuid);
+            if (user === null)
+                throw new identity_errors_js_1.IdentityNotFoundError('User not found.');
+        }
+        // The company itself is checked by the engine's ADR-0034 create wall: a company outside
+        // the actor's subtree ⇒ AuthorizationDeniedError (→ 403) and the INSERT rolls back.
         return this.records.create('company_membership', {
             fields: { userUuid, companyUuid, isActive: false, status: 'active' },
         });
@@ -91,10 +110,10 @@ let MembershipService = class MembershipService {
      * Flip which of the user's memberships is active — the ONE-ACTIVE invariant. The service
      * is the guard because the DB has no partial-unique on `cm_is_active`.
      *
-     * ⚠️ ORDER IS LOAD-BEARING (fail-safe against a LOGIN LOCKOUT). The engine's `list` has
-     * no ORDER BY (PKs are random uuids → arbitrary row order) and each `update` is its OWN
-     * transaction (no cross-call atomicity). So this MUST activate the TARGET FIRST, then
-     * deactivate the others:
+     * ⚠️ ORDER IS LOAD-BEARING (fail-safe against a LOGIN LOCKOUT). Each `update` is its OWN
+     * transaction (no cross-call atomicity), and the engine's `list` order (PK-ordered since the
+     * Phase 3 tiebreaker) says nothing about which membership is the target. So this MUST
+     * activate the TARGET FIRST, then deactivate the others:
      *   - Worst case of a mid-loop failure is then a transient TWO-active window, which is
      *     RECOVERABLE — the credential resolver reads `is_active=1 LIMIT 1`, so it still
      *     resolves a tenant and login works.
@@ -105,13 +124,17 @@ let MembershipService = class MembershipService {
      * Guard: if `membershipUuid` is NOT one of the user's memberships, throw — otherwise the
      * loop would deactivate everything and activate nothing (also a zero-active lockout).
      */
-    async setActive(membershipUuid, userUuid) {
+    async setActive(actor, membershipUuid, userUuid) {
+        // Flipping activation de-activates the user's OTHER memberships: for a peer, the actor must
+        // dominate them (security review). Your own activation stays allowed.
+        if (userUuid !== actor.id)
+            await this.ceiling.assertDominates(actor, userUuid);
         const page = await this.records.list('company_membership', { where: { userUuid } });
         const target = page.rows.find((m) => m.id === membershipUuid);
         if (!target) {
             // Not this user's membership → refuse rather than leave the user with ZERO active
-            // (a login lockout). Fail-closed.
-            throw new common_1.NotFoundException(`membership ${membershipUuid} does not belong to user ${userUuid}`);
+            // (a login lockout). Fail-closed. No ids in the message (ADR-0012).
+            throw new identity_errors_js_1.IdentityNotFoundError('Membership not found.');
         }
         // 1) TARGET FIRST — guarantees an active membership exists before any deactivation, so
         //    a mid-failure below leaves TWO active (recoverable), never ZERO (lockout).
@@ -142,7 +165,11 @@ let MembershipService = class MembershipService {
      * flipped only via `setActive` to preserve the one-active invariant, so `isActive` is
      * intentionally NOT a patch key here.
      */
-    updateMembership(membershipUuid, patch) {
+    async updateMembership(actor, membershipUuid, patch) {
+        await this.reachMember(actor, membershipUuid); // 404 / dominance over a peer
+        const fields = {};
+        if (typeof patch?.status === 'string')
+            fields.status = patch.status;
         // NO version bump here (ADR-0011): this patches `status` ONLY — `isActive` is
         // deliberately not a patch key (activity flips solely via `setActive`, which bumps),
         // and the controller only ever passes `{ status }`. Coarse-grant resolution gates on
@@ -150,16 +177,21 @@ let MembershipService = class MembershipService {
         // resolve → the warm cache stays correct → no invalidation needed. If a future patch key
         // is ever added here that CAN change which roles/postings resolve, it MUST bump the
         // membership's tenant (mirror `setActive`).
-        return this.records.update('company_membership', membershipUuid, { fields: patch });
+        await this.records.update('company_membership', membershipUuid, { fields });
     }
-    /** Remove a membership card (its postings cascade at the DB via FK ON DELETE CASCADE). */
-    async removeMembership(membershipUuid) {
+    /**
+     * Remove a membership card (its postings cascade at the DB via FK ON DELETE CASCADE). A peer's
+     * membership needs dominance over the peer (security review); your own does not.
+     */
+    async removeMembership(actor, membershipUuid) {
         // ADR-0011 STALENESS FIX: resolve the membership's tenant BEFORE the delete (it's
         // unreadable afterwards). If the membership was active, deleting it (postings cascade)
         // removes the user's role grants in that company — a coarse-grant change — so bump that
         // tenant AFTER the delete succeeds. Best-effort/fail-safe (bumpTenants swallows). A
         // membership belongs to exactly one company → one tenant bump.
-        const tenant = await this.tenantOf(membershipUuid);
+        const m = await this.reachMember(actor, membershipUuid);
+        const c = m.fields?.companyUuid;
+        const tenant = typeof c === 'string' && c.length > 0 ? c : null;
         await this.records.delete('company_membership', membershipUuid);
         await this.bumpTenants([tenant]);
     }
@@ -167,7 +199,8 @@ let MembershipService = class MembershipService {
 exports.MembershipService = MembershipService;
 exports.MembershipService = MembershipService = __decorate([
     (0, common_1.Injectable)(),
-    __param(1, (0, common_1.Optional)()),
-    __param(1, (0, common_1.Inject)(posting_version_bump_js_1.POSTING_VERSION_BUMP)),
-    __metadata("design:paramtypes", [engine_1.RecordsService, Object])
+    __param(2, (0, common_1.Optional)()),
+    __param(2, (0, common_1.Inject)(posting_version_bump_js_1.POSTING_VERSION_BUMP)),
+    __metadata("design:paramtypes", [engine_1.RecordsService,
+        grant_ceiling_js_1.GrantCeiling, Object])
 ], MembershipService);

package/dist/features/membership/posting-version-bump.d.ts

@@ -5,6 +5,18 @@
  */
 export interface PostingVersionBump {
     bumpTenant(tenantUuid: string): Promise<void>;
+    /**
+     * OPTIONAL (security hardening Phase 3): bump every tenant the user has a membership in — after
+     * the account itself was disabled or re-enabled. Returns the bumped tenants; throws on failure.
+     */
+    bumpForUser?(userUuid: string): Promise<string[]>;
+    /**
+     * OPTIONAL (Phase 8 #2): the tenants whose cached grants change when the role goes away — every
+     * tenant where it is actively posted, plus every service account's tenant holding it. Read
+     * BEFORE a role delete (the delete cascades the postings); bump each with `bumpTenant` after the
+     * commit. Throws on failure.
+     */
+    tenantsForRole?(roleUuid: string): Promise<string[]>;
 }
 export declare const POSTING_VERSION_BUMP: unique symbol;
 //# sourceMappingURL=posting-version-bump.d.ts.map

package/dist/features/membership/posting-version-bump.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"posting-version-bump.d.ts","sourceRoot":"","sources":["../../../src/features/membership/posting-version-bump.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,eAAO,MAAM,oBAAoB,eAAiC,CAAC"}
+{"version":3,"file":"posting-version-bump.d.ts","sourceRoot":"","sources":["../../../src/features/membership/posting-version-bump.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C;;;OAGG;IACH,WAAW,CAAC,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAClD;;;;;OAKG;IACH,cAAc,CAAC,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACtD;AAED,eAAO,MAAM,oBAAoB,eAAiC,CAAC"}

package/dist/features/membership/posting.service.d.ts

@@ -6,21 +6,24 @@
  * diffs current-vs-desired and applies the minimal change — delete only what's removed,
  * create only what's added, keep the rest untouched.
  *
- * ── Atomicity / mid-op safety (why delete-then-create is safe here) ──────────────────
- * The engine's feature-facing surface (`RecordsService`) exposes NO cross-call transaction
- * — each of its methods (create/update/delete/list/get) runs in its OWN transaction, and
- * no `externalQueryRunner` seam is handed to features. So `replacePostings` cannot wrap
- * the whole diff in a single DB transaction. Instead it is safe BY CONSTRUCTION:
- *   - Deletes target ONLY rows absent from `desired` (the "removed" set). A KEPT posting
- *     is never a delete target, so it is never removed.
- *   - Creates target ONLY rows absent from `current` (the "added" set).
- * Therefore the membership NEVER lands empty mid-op: even if a create fails after the
- * delete phase, every kept posting is still present (never deleted). Ordering is
- * delete-first, then create; a failure surfaces to the caller (fail-closed) with the
- * kept set intact. (Covered by the mid-op-safety tests in posting.service.spec.ts.)
+ * ── Authority (security hardening #11) ─────────────────────────────────────────────────
+ * A posting IS a role assignment, so before ANY write the actor (the request principal) must:
+ *   - reach the membership (a walled `records.get` → null ⇒ 404; the engine's ADR-0034 create
+ *     wall re-checks the posting's membership company inside the transaction);
+ *   - for every ADDED role: the role is bound within the actor's subtree or not bound at all
+ *     (`GrantCeiling.assertRoleAssignable` — a role also used elsewhere is never assignable),
+ *     and the role's keys are all held by the actor (`assertCanAssignRoles`, ADR-0029 applied to
+ *     assignment). Removals need no ceiling: self-demotion stays allowed.
+ *
+ * ── Atomicity (KI #16) ────────────────────────────────────────────────────────────────
+ * The diff runs inside ONE `records.transaction` (ADR-0034): creates FIRST, then deletes, so a
+ * failure at any point rolls back every posting write of the replace (no partial set, no
+ * window where a removed role is gone but its replacement was refused).
  */
 import { RecordsService, type RecordView } from '@astram/engine';
+import type { Principal } from '@astram/core';
 import { type PostingVersionBump } from './posting-version-bump.js';
+import { GrantCeiling } from '../authz/grant-ceiling.js';
 /**
  * The shape of one desired posting row submitted by the editor. The effective-window
  * bounds arrive from the client as a bare `YYYY-MM-DD` date string (native `<input
@@ -36,24 +39,17 @@ export interface PostingInput {
 }
 export declare class PostingService {
     private readonly records;
+    private readonly ceiling;
     private readonly versionBump?;
-    constructor(records: RecordsService, versionBump?: (PostingVersionBump | null) | undefined);
+    constructor(records: RecordsService, ceiling: GrantCeiling, versionBump?: (PostingVersionBump | null) | undefined);
     /** List a membership's postings (tenant-scoped by the pipe). */
     listPostings(membershipUuid: string): Promise<readonly RecordView[]>;
     /**
      * Replace a membership's full posting set with `desired`, applying the minimal diff.
      * Compares current vs desired by the natural key `roleUuid|departmentUuid|branchUuid`:
-     * deletes removed rows, creates added rows, leaves kept rows untouched. See the file
-     * header for the atomicity / mid-op-safety reasoning (delete-then-create is safe because
-     * kept postings are never delete targets, so the membership never lands empty).
-     */
-    replacePostings(membershipUuid: string, desired: readonly PostingInput[]): Promise<void>;
-    /**
-     * Resolve the tenant (company uuid) a membership belongs to — the tenant whose permission
-     * version a posting change must bump. Reads the parent `company_membership` through the
-     * pipe (tenant-scoped, no raw SQL), returning `companyUuid` or `null` if unresolvable
-     * (then no bump — fail-safe; never guesses a tenant).
+     * creates added rows, deletes removed rows, leaves kept rows untouched. Every authority check
+     * runs BEFORE any write; the writes run in one transaction (see the file header).
      */
-    private resolveMembershipTenant;
+    replacePostings(actor: Principal, membershipUuid: string, desired: readonly PostingInput[]): Promise<void>;
 }
 //# sourceMappingURL=posting.service.d.ts.map

package/dist/features/membership/posting.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"posting.service.d.ts","sourceRoot":"","sources":["../../../src/features/membership/posting.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,EAAE,cAAc,EAAE,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,EAAwB,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE1F;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACvC,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CACzC;AA4DD,qBACa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAKxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBALZ,OAAO,EAAE,cAAc,EAKvB,WAAW,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA;IAG1D,gEAAgE;IAC1D,YAAY,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC;IAK1E;;;;;;OAMG;IACG,eAAe,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,YAAY,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IA4D9F;;;;;OAKG;YACW,uBAAuB;CAStC"}
+{"version":3,"file":"posting.service.d.ts","sourceRoot":"","sources":["../../../src/features/membership/posting.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EAAE,cAAc,EAAE,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAwB,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC1F,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAGzD;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACvC,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CACzC;AA0ED,qBACa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAGxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAKxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBARZ,OAAO,EAAE,cAAc,EAGvB,OAAO,EAAE,YAAY,EAKrB,WAAW,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA;IAG1D,gEAAgE;IAC1D,YAAY,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC;IAK1E;;;;;OAKG;IACG,eAAe,CACnB,KAAK,EAAE,SAAS,EAChB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,SAAS,YAAY,EAAE,GAC/B,OAAO,CAAC,IAAI,CAAC;CAuGjB"}