@astram/identity 0.5.0 → 0.6.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/features/authz/grant-admin.service.d.ts +24 -1
- package/dist/features/authz/grant-admin.service.d.ts.map +1 -1
- package/dist/features/authz/grant-admin.service.js +88 -1
- package/dist/features/authz/grant-ceiling.d.ts +49 -1
- package/dist/features/authz/grant-ceiling.d.ts.map +1 -1
- package/dist/features/authz/grant-ceiling.js +118 -10
- package/dist/features/authz/permission-version.bumper.d.ts +7 -0
- package/dist/features/authz/permission-version.bumper.d.ts.map +1 -1
- package/dist/features/authz/permission-version.bumper.js +19 -10
- package/dist/features/authz/record-authorization.d.ts +12 -0
- package/dist/features/authz/record-authorization.d.ts.map +1 -1
- package/dist/features/authz/record-authorization.js +49 -0
- package/dist/features/company/company-hierarchy.service.d.ts +65 -3
- package/dist/features/company/company-hierarchy.service.d.ts.map +1 -1
- package/dist/features/company/company-hierarchy.service.js +183 -6
- package/dist/features/identity-feature.module.d.ts +2 -0
- package/dist/features/identity-feature.module.d.ts.map +1 -1
- package/dist/features/identity-feature.module.js +19 -9
- package/dist/features/membership/posting-version-bump.d.ts +7 -0
- package/dist/features/membership/posting-version-bump.d.ts.map +1 -1
- package/dist/features/role/role.service.d.ts +25 -2
- package/dist/features/role/role.service.d.ts.map +1 -1
- package/dist/features/role/role.service.js +57 -4
- package/dist/features/scope/scope-closure.service.d.ts +11 -1
- package/dist/features/scope/scope-closure.service.d.ts.map +1 -1
- package/dist/features/scope/scope-closure.service.js +23 -4
- package/dist/features/service-account/service-account.service.d.ts +15 -0
- package/dist/features/service-account/service-account.service.d.ts.map +1 -1
- package/dist/features/service-account/service-account.service.js +17 -1
- package/dist/features/service-account/service-account.store.d.ts +15 -0
- package/dist/features/service-account/service-account.store.d.ts.map +1 -1
- package/dist/features/service-account/service-account.store.js +29 -0
- package/dist/index.d.ts +7 -5
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +7 -6
- package/dist/internal.d.ts +10 -0
- package/dist/internal.d.ts.map +1 -0
- package/dist/internal.js +13 -0
- package/package.json +14 -3
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"scope-closure.service.d.ts","sourceRoot":"","sources":["../../../src/features/scope/scope-closure.service.ts"],"names":[],"mappings":"AAqCA,OAAO,EAAqC,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AAOlF;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAED,iGAAiG;AACjG,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClE,aAAa,IAAI,OAAO,CACtB,SAAS,GAAG;QACV,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QACxB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QACzB,2FAA2F;QAC3F,OAAO,CAAC,IAAI,IAAI,CAAC;KAClB,CACF,CAAC;CACH;AAOD,wFAAwF;AACxF,MAAM,WAAW,kBAAkB;IACjC,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,+FAA+F;IAC/F,gBAAgB,CAAC,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,qFAAqF;IACrF,cAAc,CAAC,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI,CAAC;CACxC;AAED,qBAAa,mBAAmB;IAE5B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,IAAI,EAAE,SAAS,EACf,MAAM,EAAE,kBAAkB;IAG7C;;;;;;OAMG;IACG,gBAAgB,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAsBvF;;;;;;OAMG;IACG,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAcjD;;;;;;;OAOG;YACW,UAAU;IAwCxB;;;;;;;;;;;;;;;;OAgBG;IACG,QAAQ,CACZ,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,GAAG,IAAI;IAC5B,+FAA+F;IAC/F,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,GACjD,OAAO,CAAC,IAAI,CAAC;IAiFhB
|
|
1
|
+
{"version":3,"file":"scope-closure.service.d.ts","sourceRoot":"","sources":["../../../src/features/scope/scope-closure.service.ts"],"names":[],"mappings":"AAqCA,OAAO,EAAqC,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AAOlF;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAED,iGAAiG;AACjG,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClE,aAAa,IAAI,OAAO,CACtB,SAAS,GAAG;QACV,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QACxB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QACzB,2FAA2F;QAC3F,OAAO,CAAC,IAAI,IAAI,CAAC;KAClB,CACF,CAAC;CACH;AAOD,wFAAwF;AACxF,MAAM,WAAW,kBAAkB;IACjC,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,+FAA+F;IAC/F,gBAAgB,CAAC,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,qFAAqF;IACrF,cAAc,CAAC,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI,CAAC;CACxC;AAED,qBAAa,mBAAmB;IAE5B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,IAAI,EAAE,SAAS,EACf,MAAM,EAAE,kBAAkB;IAG7C;;;;;;OAMG;IACG,gBAAgB,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAsBvF;;;;;;OAMG;IACG,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAcjD;;;;;;;OAOG;YACW,UAAU;IAwCxB;;;;;;;;;;;;;;;;OAgBG;IACG,QAAQ,CACZ,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,GAAG,IAAI;IAC5B,+FAA+F;IAC/F,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,GACjD,OAAO,CAAC,IAAI,CAAC;IAiFhB;;;;;;;;;;;;;;;;OAgBG;IACG,UAAU,CACd,QAAQ,EAAE,MAAM;IAChB,iGAAiG;IACjG,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC;IAClD;;;;OAIG;IACH,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,GAAG,SAAS,MAAM,EAAE,CAAC,GACpE,OAAO,CAAC,IAAI,CAAC;IA6ChB,yFAAyF;YAC3E,SAAS;IAOvB;;;;OAIG;YACW,cAAc;CAiB7B;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,GAAG;IAC7D,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB,CA8BA;AAED,kGAAkG;AAClG,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,QAAQ,EAAE,MAAM;CAQ7B"}
|
|
@@ -246,6 +246,10 @@ class ScopeClosureService {
|
|
|
246
246
|
* subtree, so those admins' cached session subtrees are stale (they'd keep the deleted node in
|
|
247
247
|
* their set) — bump them so they re-derive at the next refresh (same discipline as moveNode's
|
|
248
248
|
* former-parent bump; without it, a parent admin's list/decide would reference a gone node).
|
|
249
|
+
* Also bumps the deleted node's own tenant (Phase 8 #3). `beforeDelete` runs first, on the same
|
|
250
|
+
* transaction, so a caller can lock the node and refuse (rollback) before anything changes; it
|
|
251
|
+
* may also retire rows that depend on the node and return the tenants those changes touched,
|
|
252
|
+
* which are bumped with the rest.
|
|
249
253
|
*
|
|
250
254
|
* v1 SCOPE NOTE: this refuses a node with CHILDREN. Broader resource-orphan cleanup (rows in
|
|
251
255
|
* the many tenant-scoped app tables that reference the deleted node) is out of scope for v1 and
|
|
@@ -253,7 +257,13 @@ class ScopeClosureService {
|
|
|
253
257
|
*/
|
|
254
258
|
async deleteNode(nodeUuid,
|
|
255
259
|
/** Runs on the delete's transaction after the bump (e.g. the audit row) — a throw rolls back. */
|
|
256
|
-
inTransaction
|
|
260
|
+
inTransaction,
|
|
261
|
+
/**
|
|
262
|
+
* Runs on the delete's transaction BEFORE anything is deleted (Phase 8 #3: lock the node, check
|
|
263
|
+
* authority over its members and agents, retire its agents and cross-tenant grants) — a throw
|
|
264
|
+
* rolls back and nothing is deleted or bumped. Returned tenant ids are bumped too.
|
|
265
|
+
*/
|
|
266
|
+
beforeDelete) {
|
|
257
267
|
// Under the tree lock (review F3): a concurrent move cannot hang a child under this node
|
|
258
268
|
// between the children check and the delete.
|
|
259
269
|
await this.inTreeLock(async (conn) => {
|
|
@@ -261,6 +271,7 @@ class ScopeClosureService {
|
|
|
261
271
|
if (children.length > 0) {
|
|
262
272
|
throw new NodeHasChildrenError(nodeUuid);
|
|
263
273
|
}
|
|
274
|
+
const touched = (beforeDelete ? await beforeDelete(conn) : undefined) ?? [];
|
|
264
275
|
// The former-parent ancestry — the deleted node's ancestors (excluding self). They lose the
|
|
265
276
|
// node from their reach → bump so their sessions re-derive. Read BEFORE the delete.
|
|
266
277
|
const formerAncestryRows = (await conn.query(`SELECT ancestor_uuid FROM \`${AUTHZ}\`.\`scope_closure\`
|
|
@@ -270,9 +281,17 @@ class ScopeClosureService {
|
|
|
270
281
|
WHERE ancestor_uuid = ? OR descendant_uuid = ?`, [nodeUuid, nodeUuid]);
|
|
271
282
|
// Remove the company row itself.
|
|
272
283
|
await conn.query(`DELETE FROM \`${APP}\`.\`companies\` WHERE c_uuid = ?`, [nodeUuid]);
|
|
273
|
-
// Bump the former-parent ancestry so their cached subtrees re-derive at next refresh
|
|
274
|
-
|
|
275
|
-
|
|
284
|
+
// Bump the former-parent ancestry so their cached subtrees re-derive at next refresh, and the
|
|
285
|
+
// deleted node's OWN tenant (Phase 8 #3): its memberships and postings cascade away, so
|
|
286
|
+
// sessions cached in it must reload (and find nothing). A leaf has no descendants to bump.
|
|
287
|
+
// Plus the tenants `beforeDelete` touched (e.g. other tenants' agents that lost the node).
|
|
288
|
+
const bumpSet = new Set([
|
|
289
|
+
...formerAncestryRows.map((r) => r.ancestor_uuid),
|
|
290
|
+
nodeUuid,
|
|
291
|
+
...touched,
|
|
292
|
+
]);
|
|
293
|
+
for (const tenant of bumpSet) {
|
|
294
|
+
await this.bumper.bumpForTenant(tenant, conn);
|
|
276
295
|
}
|
|
277
296
|
if (inTransaction)
|
|
278
297
|
await inTransaction(conn);
|
|
@@ -30,6 +30,21 @@ export interface ServiceAccountView {
|
|
|
30
30
|
readonly createdByName: string | null;
|
|
31
31
|
readonly createdAtMs: number;
|
|
32
32
|
readonly updatedAtMs: number | null;
|
|
33
|
+
/** The account's current API key (the highest version), or `null` when none was ever issued. */
|
|
34
|
+
readonly currentKey: ServiceAccountKeyView | null;
|
|
35
|
+
}
|
|
36
|
+
/**
|
|
37
|
+
* The status of an account's current key (Phase 8 #13) — never the secret or its hash.
|
|
38
|
+
* `neverExpires` flags an ACTIVE key with no expiry: either issued before an expiry became
|
|
39
|
+
* mandatory (identity 0.5.0) or issued later with an explicit `neverExpires: true`. The stored row
|
|
40
|
+
* cannot tell the two apart, so both are flagged; review them and rotate with an expiry.
|
|
41
|
+
*/
|
|
42
|
+
export interface ServiceAccountKeyView {
|
|
43
|
+
readonly version: number;
|
|
44
|
+
readonly issuedAtMs: number;
|
|
45
|
+
readonly expiresAtMs: number | null;
|
|
46
|
+
readonly revoked: boolean;
|
|
47
|
+
readonly neverExpires: boolean;
|
|
33
48
|
}
|
|
34
49
|
/** The ONE-TIME key reveal returned by issue/rotate — the only time the raw key exists. */
|
|
35
50
|
export interface IssuedKey {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"service-account.service.d.ts","sourceRoot":"","sources":["../../../src/features/service-account/service-account.service.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhE,OAAO,KAAK,EACV,mBAAmB,EAGnB,UAAU,EACV,eAAe,EAChB,MAAM,4BAA4B,CAAC;AAEpC,gGAAgG;AAChG,qBAAa,2BAA4B,SAAQ,KAAK;;CAKrD;AAED,oFAAoF;AACpF,qBAAa,0BAA2B,SAAQ,KAAK;gBACvC,OAAO,EAAE,MAAM;CAI5B;AAED,4FAA4F;AAC5F,qBAAa,2BAA4B,SAAQ,KAAK;;CAKrD;AAED,0EAA0E;AAC1E,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,EAAE,MAAM;CAI5B;AAED,kGAAkG;AAClG,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,2FAA2F;IAC3F,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;
|
|
1
|
+
{"version":3,"file":"service-account.service.d.ts","sourceRoot":"","sources":["../../../src/features/service-account/service-account.service.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhE,OAAO,KAAK,EACV,mBAAmB,EAGnB,UAAU,EACV,eAAe,EAChB,MAAM,4BAA4B,CAAC;AAEpC,gGAAgG;AAChG,qBAAa,2BAA4B,SAAQ,KAAK;;CAKrD;AAED,oFAAoF;AACpF,qBAAa,0BAA2B,SAAQ,KAAK;gBACvC,OAAO,EAAE,MAAM;CAI5B;AAED,4FAA4F;AAC5F,qBAAa,2BAA4B,SAAQ,KAAK;;CAKrD;AAED,0EAA0E;AAC1E,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,EAAE,MAAM;CAI5B;AAED,kGAAkG;AAClG,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,2FAA2F;IAC3F,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,gGAAgG;IAChG,QAAQ,CAAC,UAAU,EAAE,qBAAqB,GAAG,IAAI,CAAC;CACnD;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAChC;AAED,2FAA2F;AAC3F,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,yFAAyF;AACzF,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,KAAK,EAAE;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAC/C,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB;AAED,kGAAkG;AAClG,MAAM,MAAM,YAAY,GAAG,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAElE,kGAAkG;AAClG,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAC7B,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;AAehC;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACvC;AAED,wBAAgB,SAAS,CACvB,KAAK,EAAE,cAAc,EACrB,WAAW,EAAE,SAAS,MAAM,EAAE,GAC7B,qBAAqB,CAMvB;AAED,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnF;AAED,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnF;AAgDD,0FAA0F;AAC1F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,SAAS,eAAe,EAAE,CAAC;CACjD;AAWD,+FAA+F;AAC/F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,qBAAa,qBAAqB;IAE9B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAcrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAnBH,QAAQ,EAAE,mBAAmB,EAC7B,IAAI,EAAE,WAAW,GAAG;QACnC,UAAU,CAAC,KAAK,EAAE;YAChB,SAAS,EAAE,MAAM,CAAC;YAClB,QAAQ,EAAE,MAAM,CAAC;YACjB,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;YACvC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;YAC3B,UAAU,EAAE,MAAM,CAAC;YACnB,OAAO,EAAE,MAAM,CAAC;YAChB,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;SACrB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAClB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACxD,EACgB,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,mBAAmB,EAC1B,WAAW,EAAE,YAAY,EACzB,SAAS,EAAE,gBAAgB,EAC3B,GAAG,GAAE,MAAM,MAAiB;IAG/C;;;OAGG;YACW,OAAO;IAuCrB;;;OAGG;YACW,UAAU;IAKxB;;;;;;;OAOG;YACW,mBAAmB;IAsCjC;;OAEG;YACW,iBAAiB;IAsB/B;;;;OAIG;YACW,UAAU;IAmBxB;;;;;OAKG;IACG,UAAU,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAiBlE,wEAAwE;IAClE,IAAI,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAKhE,gEAAgE;IAC1D,GAAG,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAOzE;;;;OAIG;IACG,MAAM,CACV,KAAK,EAAE,cAAc,EACrB,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAC7F,OAAO,CAAC,kBAAkB,CAAC;IAuC9B;;;;;;;;;;;;OAYG;IACG,MAAM,CACV,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACxC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5B,MAAM,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;KAChC,GACA,OAAO,CAAC,kBAAkB,CAAC;IAuG9B;;;;;;OAMG;IACG,QAAQ,CACZ,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,SAAS,CAAC;IAOrB;;;OAGG;IACH,OAAO,CAAC,aAAa;IAkBrB;;;;OAIG;IACG,SAAS,CACb,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,SAAS,CAAC;IAOrB,kGAAkG;IAC5F,UAAU,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQlE,mGAAmG;YACrF,OAAO;IAiCrB,+EAA+E;YACjE,SAAS;CAkBxB"}
|
|
@@ -157,12 +157,27 @@ class ServiceAccountService {
|
|
|
157
157
|
async toViews(rows) {
|
|
158
158
|
if (rows.length === 0)
|
|
159
159
|
return [];
|
|
160
|
-
const [roles, nodes] = await Promise.all([
|
|
160
|
+
const [roles, nodes, keys] = await Promise.all([
|
|
161
161
|
this.accounts.rolesByIds(rows.flatMap((r) => r.roleIds)),
|
|
162
162
|
this.accounts.nodesByIds(rows.flatMap((r) => r.scopeSubtreeNodeIds)),
|
|
163
|
+
this.accounts.currentKeys(rows.map((r) => r.id)),
|
|
163
164
|
]);
|
|
164
165
|
const roleName = new Map(roles.map((r) => [r.id, r.name]));
|
|
165
166
|
const nodeName = new Map(nodes.map((n) => [n.id, n.name]));
|
|
167
|
+
const keyOf = new Map(keys.map((k) => [k.accountId, k]));
|
|
168
|
+
const keyView = (id) => {
|
|
169
|
+
const k = keyOf.get(id);
|
|
170
|
+
if (k === undefined)
|
|
171
|
+
return null;
|
|
172
|
+
const revoked = k.revokedAtMs !== null;
|
|
173
|
+
return {
|
|
174
|
+
version: k.version,
|
|
175
|
+
issuedAtMs: k.createdAtMs,
|
|
176
|
+
expiresAtMs: k.expiresAtMs,
|
|
177
|
+
revoked,
|
|
178
|
+
neverExpires: k.expiresAtMs === null && !revoked,
|
|
179
|
+
};
|
|
180
|
+
};
|
|
166
181
|
return Promise.all(rows.map(async (row) => ({
|
|
167
182
|
id: row.id,
|
|
168
183
|
label: row.label,
|
|
@@ -174,6 +189,7 @@ class ServiceAccountService {
|
|
|
174
189
|
createdByName: row.createdBy ? await this.resolveName(row.createdBy) : null,
|
|
175
190
|
createdAtMs: row.createdAtMs,
|
|
176
191
|
updatedAtMs: row.updatedAtMs,
|
|
192
|
+
currentKey: keyView(row.id),
|
|
177
193
|
})));
|
|
178
194
|
}
|
|
179
195
|
/**
|
|
@@ -12,6 +12,14 @@
|
|
|
12
12
|
* stamped `sa_tenant_id` (from the session) on create — never client input.
|
|
13
13
|
*/
|
|
14
14
|
import type { Pool } from 'mariadb';
|
|
15
|
+
/** The status of an account's current key (no hash, no secret). Epoch-ms; `null` = not set. */
|
|
16
|
+
export interface ServiceAccountKeyRow {
|
|
17
|
+
readonly accountId: string;
|
|
18
|
+
readonly version: number;
|
|
19
|
+
readonly expiresAtMs: number | null;
|
|
20
|
+
readonly revokedAtMs: number | null;
|
|
21
|
+
readonly createdAtMs: number;
|
|
22
|
+
}
|
|
15
23
|
/** The caller's reachable subtree (threaded from `req.principal`) — same shape as grant-admin. */
|
|
16
24
|
export interface SubtreeScope {
|
|
17
25
|
readonly nodeIds: readonly string[];
|
|
@@ -51,6 +59,13 @@ export declare class ServiceAccountStore {
|
|
|
51
59
|
nodesByIds(ids: readonly string[]): Promise<ScopeNodeOption[]>;
|
|
52
60
|
/** Every company (ROOT's assignable scope — root reaches all). */
|
|
53
61
|
allNodes(): Promise<ScopeNodeOption[]>;
|
|
62
|
+
/**
|
|
63
|
+
* Phase 8 #13 — the CURRENT key (highest version: the only one the authenticator honours) of
|
|
64
|
+
* each account, from guard's `shield_authz.service_account_key`, in ONE batched read. Status
|
|
65
|
+
* columns only — never the hash. Read-only. Callers pass ids they already read through the
|
|
66
|
+
* own-tenant wall (`list`/`getById`); accounts with no key are simply absent.
|
|
67
|
+
*/
|
|
68
|
+
currentKeys(accountIds: readonly string[]): Promise<ServiceAccountKeyRow[]>;
|
|
54
69
|
/** List the caller's own-tenant accounts (newest first). Root sees all. */
|
|
55
70
|
list(scope: SubtreeScope): Promise<ServiceAccountRow[]>;
|
|
56
71
|
/** Fetch one account BY id, scoped to the caller's subtree. Cross-tenant/unknown → null (404). */
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"service-account.store.d.ts","sourceRoot":"","sources":["../../../src/features/service-account/service-account.store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;
|
|
1
|
+
{"version":3,"file":"service-account.store.d.ts","sourceRoot":"","sources":["../../../src/features/service-account/service-account.store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAMpC,+FAA+F;AAC/F,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAUD,kGAAkG;AAClG,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,qGAAqG;AACrG,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AA2DD,kGAAkG;AAClG,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,iGAAiG;AACjG,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAOD,qBAAa,mBAAmB;IAClB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,IAAI;IAMvC,0FAA0F;IACpF,UAAU,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAU/D,yDAAyD;IACnD,QAAQ,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;IAQvC,uFAAuF;IACjF,UAAU,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAUpE,kEAAkE;IAC5D,QAAQ,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;IAQ5C;;;;;OAKG;IACG,WAAW,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAwBjF,2EAA2E;IACrE,IAAI,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAS7D,kGAAkG;IAC5F,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IASjF;;;;OAIG;IACG,MAAM,CAAC,KAAK,EAAE;QAClB,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;QACvC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBjB;;;;OAIG;IACG,MAAM,CACV,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,EACnB,KAAK,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACxC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EACD,WAAW,EAAE,MAAM;IACnB;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,GAClC,OAAO,CAAC,MAAM,CAAC;CAgCnB"}
|
|
@@ -2,6 +2,8 @@
|
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
3
|
exports.ServiceAccountStore = void 0;
|
|
4
4
|
const APP = 'shield_app';
|
|
5
|
+
/** Guard's key table lives here (`1710000000017-CreateServiceAccountKey.cjs`); read-only here. */
|
|
6
|
+
const AUTHZ = 'shield_authz';
|
|
5
7
|
/** Normalize a JSON-array column (driver returns array OR string) → string[]. Fail-safe to []. */
|
|
6
8
|
function jsonArray(v) {
|
|
7
9
|
const arr = Array.isArray(v)
|
|
@@ -83,6 +85,33 @@ class ServiceAccountStore {
|
|
|
83
85
|
const rows = (await this.pool.query(`SELECT c_uuid AS id, c_name AS name, c_parent_uuid AS parentId FROM \`${APP}\`.\`companies\` ORDER BY c_name`, []));
|
|
84
86
|
return rows.map((r) => ({ id: r.id, name: r.name, parentId: r.parentId ?? null }));
|
|
85
87
|
}
|
|
88
|
+
/**
|
|
89
|
+
* Phase 8 #13 — the CURRENT key (highest version: the only one the authenticator honours) of
|
|
90
|
+
* each account, from guard's `shield_authz.service_account_key`, in ONE batched read. Status
|
|
91
|
+
* columns only — never the hash. Read-only. Callers pass ids they already read through the
|
|
92
|
+
* own-tenant wall (`list`/`getById`); accounts with no key are simply absent.
|
|
93
|
+
*/
|
|
94
|
+
async currentKeys(accountIds) {
|
|
95
|
+
const u = uniqueIds(accountIds);
|
|
96
|
+
if (u.length === 0)
|
|
97
|
+
return [];
|
|
98
|
+
const rows = (await this.pool.query(`SELECT k.sak_account_id, k.sak_version, k.sak_expires_at_ms, k.sak_revoked_at_ms,
|
|
99
|
+
k.sak_created_at_ms
|
|
100
|
+
FROM \`${AUTHZ}\`.\`service_account_key\` k
|
|
101
|
+
JOIN (SELECT sak_account_id, MAX(sak_version) AS v
|
|
102
|
+
FROM \`${AUTHZ}\`.\`service_account_key\`
|
|
103
|
+
WHERE sak_account_id IN (${u.map(() => '?').join(', ')})
|
|
104
|
+
GROUP BY sak_account_id) m
|
|
105
|
+
ON m.sak_account_id = k.sak_account_id AND m.v = k.sak_version`, u));
|
|
106
|
+
const ms = (v) => (v === null || v === undefined ? null : Number(v));
|
|
107
|
+
return rows.map((r) => ({
|
|
108
|
+
accountId: r.sak_account_id,
|
|
109
|
+
version: Number(r.sak_version),
|
|
110
|
+
expiresAtMs: ms(r.sak_expires_at_ms),
|
|
111
|
+
revokedAtMs: ms(r.sak_revoked_at_ms),
|
|
112
|
+
createdAtMs: Number(r.sak_created_at_ms),
|
|
113
|
+
}));
|
|
114
|
+
}
|
|
86
115
|
/** List the caller's own-tenant accounts (newest first). Root sees all. */
|
|
87
116
|
async list(scope) {
|
|
88
117
|
const t = tenantScope(scope);
|
package/dist/index.d.ts
CHANGED
|
@@ -37,12 +37,14 @@ export { identityAuthActionKeys, identityControlPlaneKeys } from './auth-facts-k
|
|
|
37
37
|
*/
|
|
38
38
|
export { IdentityFeatureModule } from './features/identity-feature.module.js';
|
|
39
39
|
/**
|
|
40
|
-
* The record-tier authorization wiring: the
|
|
41
|
-
*
|
|
42
|
-
*
|
|
43
|
-
*
|
|
40
|
+
* The record-tier authorization wiring: the helper that assembles `RecordAuthorizationInputs`
|
|
41
|
+
* for `ShieldModule.forRoot({ recordAuthorization })`. Once wired, `decide()` is real (the
|
|
42
|
+
* framework's record-tier adapters run over the identity app schema) instead of the
|
|
43
|
+
* deny-everything stub. Its pool factory, `createIdentityAuthzPool` (it opens a raw pool), is NOT
|
|
44
|
+
* exported here (Phase 8 #5): import it from `@astram/identity/internal` in the composition root
|
|
45
|
+
* (`src/app.module.ts`).
|
|
44
46
|
*/
|
|
45
|
-
export {
|
|
47
|
+
export { buildIdentityRecordAuthorization } from './features/authz/record-authorization.js';
|
|
46
48
|
/**
|
|
47
49
|
* The ADR-0011 per-request session-facts reader (ALS hot path), re-exported so a consumer
|
|
48
50
|
* that wants to construct it directly (rather than via `buildIdentityRecordAuthorization`)
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D;;;;GAIG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C;;;;;;GAMG;AACH,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAExF;;;;;GAKG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAE9E
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D;;;;GAIG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C;;;;;;GAMG;AACH,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAExF;;;;;GAKG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAE9E;;;;;;;GAOG;AACH,OAAO,EAAE,gCAAgC,EAAE,MAAM,0CAA0C,CAAC;AAE5F;;;;GAIG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AAEjF;;;;;;GAMG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AAEpF;;;;;;;GAOG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.DbMembershipChecker = exports.DbScopeSubtreeResolver = exports.AlsSessionFactsReader = exports.buildIdentityRecordAuthorization = exports.
|
|
3
|
+
exports.DbMembershipChecker = exports.DbScopeSubtreeResolver = exports.AlsSessionFactsReader = exports.buildIdentityRecordAuthorization = exports.IdentityFeatureModule = exports.identityControlPlaneKeys = exports.identityAuthActionKeys = exports.identityObjects = exports.identityMigrationsDir = exports.ServiceAccount = exports.CompanyBranch = exports.CompanyDepartment = exports.MembershipPosting = exports.CompanyMembership = exports.Branch = exports.Department = exports.Role = exports.User = exports.Company = void 0;
|
|
4
4
|
/**
|
|
5
5
|
* @astram/identity — the framework-owned identity + tenancy model.
|
|
6
6
|
* The 9 identity object classes (relocated from the consumer app in Sub-plan B) +
|
|
@@ -55,13 +55,14 @@ Object.defineProperty(exports, "identityControlPlaneKeys", { enumerable: true, g
|
|
|
55
55
|
var identity_feature_module_js_1 = require("./features/identity-feature.module.js");
|
|
56
56
|
Object.defineProperty(exports, "IdentityFeatureModule", { enumerable: true, get: function () { return identity_feature_module_js_1.IdentityFeatureModule; } });
|
|
57
57
|
/**
|
|
58
|
-
* The record-tier authorization wiring: the
|
|
59
|
-
*
|
|
60
|
-
*
|
|
61
|
-
*
|
|
58
|
+
* The record-tier authorization wiring: the helper that assembles `RecordAuthorizationInputs`
|
|
59
|
+
* for `ShieldModule.forRoot({ recordAuthorization })`. Once wired, `decide()` is real (the
|
|
60
|
+
* framework's record-tier adapters run over the identity app schema) instead of the
|
|
61
|
+
* deny-everything stub. Its pool factory, `createIdentityAuthzPool` (it opens a raw pool), is NOT
|
|
62
|
+
* exported here (Phase 8 #5): import it from `@astram/identity/internal` in the composition root
|
|
63
|
+
* (`src/app.module.ts`).
|
|
62
64
|
*/
|
|
63
65
|
var record_authorization_js_1 = require("./features/authz/record-authorization.js");
|
|
64
|
-
Object.defineProperty(exports, "createIdentityAuthzPool", { enumerable: true, get: function () { return record_authorization_js_1.createIdentityAuthzPool; } });
|
|
65
66
|
Object.defineProperty(exports, "buildIdentityRecordAuthorization", { enumerable: true, get: function () { return record_authorization_js_1.buildIdentityRecordAuthorization; } });
|
|
66
67
|
/**
|
|
67
68
|
* The ADR-0011 per-request session-facts reader (ALS hot path), re-exported so a consumer
|
|
@@ -0,0 +1,10 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* @astram/identity/internal — composition-root surface (Phase 8 #5).
|
|
3
|
+
*
|
|
4
|
+
* `createIdentityAuthzPool` opens a raw `mariadb` pool, so it is NOT on the package entry point
|
|
5
|
+
* (`@astram/identity`). An app's `src/app.module.ts` imports it from here to wire
|
|
6
|
+
* `buildIdentityRecordAuthorization(authzPool)`; the scaffolded app's lint wall rejects this
|
|
7
|
+
* subpath everywhere else. Feature code never holds a pool: it uses the RecordEngine.
|
|
8
|
+
*/
|
|
9
|
+
export { createIdentityAuthzPool } from './features/authz/record-authorization.js';
|
|
10
|
+
//# sourceMappingURL=internal.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"internal.d.ts","sourceRoot":"","sources":["../src/internal.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC"}
|
package/dist/internal.js
ADDED
|
@@ -0,0 +1,13 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.createIdentityAuthzPool = void 0;
|
|
4
|
+
/**
|
|
5
|
+
* @astram/identity/internal — composition-root surface (Phase 8 #5).
|
|
6
|
+
*
|
|
7
|
+
* `createIdentityAuthzPool` opens a raw `mariadb` pool, so it is NOT on the package entry point
|
|
8
|
+
* (`@astram/identity`). An app's `src/app.module.ts` imports it from here to wire
|
|
9
|
+
* `buildIdentityRecordAuthorization(authzPool)`; the scaffolded app's lint wall rejects this
|
|
10
|
+
* subpath everywhere else. Feature code never holds a pool: it uses the RecordEngine.
|
|
11
|
+
*/
|
|
12
|
+
var record_authorization_js_1 = require("./features/authz/record-authorization.js");
|
|
13
|
+
Object.defineProperty(exports, "createIdentityAuthzPool", { enumerable: true, get: function () { return record_authorization_js_1.createIdentityAuthzPool; } });
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@astram/identity",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.6.0",
|
|
4
4
|
"license": "MIT",
|
|
5
5
|
"description": "Astram framework — the framework-owned identity + tenancy model. Hosts the identity @ObjectType classes (user, company, membership, posting), framework-authored identity migrations, and the identity resolver. Top of the dependency graph: depends on @astram/engine (for @ObjectType/@Field decorators) + @astram/guard / @astram/core (for the auth ports).",
|
|
6
6
|
"type": "commonjs",
|
|
@@ -10,6 +10,17 @@
|
|
|
10
10
|
".": {
|
|
11
11
|
"types": "./dist/index.d.ts",
|
|
12
12
|
"default": "./dist/index.js"
|
|
13
|
+
},
|
|
14
|
+
"./internal": {
|
|
15
|
+
"types": "./dist/internal.d.ts",
|
|
16
|
+
"default": "./dist/internal.js"
|
|
17
|
+
}
|
|
18
|
+
},
|
|
19
|
+
"typesVersions": {
|
|
20
|
+
"*": {
|
|
21
|
+
"internal": [
|
|
22
|
+
"dist/internal.d.ts"
|
|
23
|
+
]
|
|
13
24
|
}
|
|
14
25
|
},
|
|
15
26
|
"files": [
|
|
@@ -23,8 +34,8 @@
|
|
|
23
34
|
"dependencies": {
|
|
24
35
|
"mariadb": "^3.4.0",
|
|
25
36
|
"@astram/core": "1.4.0",
|
|
26
|
-
"@astram/guard": "0.
|
|
27
|
-
"@astram/engine": "0.
|
|
37
|
+
"@astram/guard": "0.9.0",
|
|
38
|
+
"@astram/engine": "0.5.0"
|
|
28
39
|
},
|
|
29
40
|
"peerDependencies": {
|
|
30
41
|
"@nestjs/common": "^11",
|