@astram/identity 0.6.0 → 0.7.1

package/dist/features/service-account/lock-service-accounts.js

@@ -0,0 +1,35 @@
+"use strict";
+/**
+ * Lock the service accounts matching a predicate, without locking the table (Phase 9 #11).
+ *
+ * `service_account` has no index a role or scope predicate can use (`JSON_CONTAINS` on a JSON
+ * column, or an `OR` with one), so `SELECT … WHERE <predicate> FOR UPDATE` scans the whole table
+ * and InnoDB (REPEATABLE READ) keeps a next-key lock on every row it scanned: every other agent's
+ * edit, and every new agent, waits until the transaction ends. Instead:
+ *   1. a NON-locking read finds the candidate ids (a consistent read, no locks);
+ *   2. `FOR UPDATE` by primary key locks only those rows, sorted by id (a stable lock order), and
+ *      re-evaluates the predicate on the latest committed version of each, so a candidate that
+ *      stopped matching in between is dropped.
+ *
+ * A row that STARTS matching after step 1 (an agent that gains the role, or the company in its
+ * scope) is not locked or returned. Callers accept that (see their docs): the outcome equals the
+ * serial order "this transaction, then that edit", which the table-wide lock also allowed (the
+ * edit only waited, then applied).
+ *
+ * `columns` and `where.sql` are fixed SQL written by the caller (never client input); every value
+ * is `?`-bound.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.lockServiceAccountsWhere = lockServiceAccountsWhere;
+const APP = 'shield_app';
+async function lockServiceAccountsWhere(conn, columns, where) {
+    const candidates = (await conn.query(`SELECT sa_id FROM \`${APP}\`.\`service_account\` WHERE ${where.sql}`, [...where.params]));
+    const ids = [...new Set(candidates.map((r) => r.sa_id))].sort();
+    if (ids.length === 0)
+        return [];
+    return (await conn.query(`SELECT ${columns}
+       FROM \`${APP}\`.\`service_account\`
+      WHERE sa_id IN (${ids.map(() => '?').join(', ')}) AND (${where.sql})
+      ORDER BY sa_id
+      FOR UPDATE`, [...ids, ...where.params]));
+}

package/dist/features/service-account/no-expiry-key-report.d.ts

@@ -0,0 +1,39 @@
+/**
+ * The non-expiring service-account key report (security hardening Phase 8 #13, shipped as the
+ * `astram-sa-keys-report` bin in Phase 9 #8).
+ *
+ * Keys issued before an expiry became mandatory have `sak_expires_at_ms IS NULL` and never expire
+ * (a key issued later with an explicit `neverExpires: true` looks the same). This read-only report
+ * lists each agent's CURRENT, unrevoked key with no expiry so an operator can rotate it with an
+ * expiry. It prints labels and company names only: never a secret, a hash or a raw id.
+ */
+/** Read-only: the current unrevoked key of each agent that has no expiry, with display names. */
+export declare const NO_EXPIRY_KEY_REPORT_SQL = "SELECT sa.sa_label AS label, c.c_name AS company,\n       sa.sa_status AS status, k.sak_version AS version, k.sak_created_at_ms AS issuedAtMs\n  FROM shield_authz.service_account_key k\n  LEFT JOIN shield_app.service_account sa ON sa.sa_id = k.sak_account_id\n  LEFT JOIN shield_app.companies c ON c.c_uuid = k.sak_tenant_id\n WHERE k.sak_expires_at_ms IS NULL\n   AND k.sak_revoked_at_ms IS NULL\n   AND k.sak_version = (SELECT MAX(v.sak_version)\n                          FROM shield_authz.service_account_key v\n                         WHERE v.sak_account_id = k.sak_account_id)\n ORDER BY k.sak_created_at_ms";
+/** One non-expiring key, as printed (no ids, no secrets). */
+export interface NonExpiringKey {
+    /** The agent's label; `null` when the agent row no longer exists. */
+    readonly label: string | null;
+    /** The tenant company's name; `null` when the company no longer exists. */
+    readonly company: string | null;
+    readonly status: string | null;
+    readonly version: number;
+    readonly issuedAtMs: number | null;
+}
+/** The query surface the report needs (a `mariadb` pool or connection satisfies it). */
+export interface ReportQueryable {
+    query(sql: string, params?: unknown[]): Promise<unknown>;
+}
+/** Run the report query and map the rows. Read-only. */
+export declare function findNonExpiringKeys(db: ReportQueryable): Promise<NonExpiringKey[]>;
+/** Human-readable report text (one line per key, plus a summary line). */
+export declare function formatNonExpiringKeyReport(keys: readonly NonExpiringKey[]): string;
+/** The bin's behaviour, testable without a process: returns the exit code. */
+export declare function runNonExpiringKeyReport(opts: {
+    readonly argv: readonly string[];
+    readonly openDb: () => ReportQueryable & {
+        end(): Promise<void>;
+    };
+    readonly out: (text: string) => void;
+    readonly err: (text: string) => void;
+}): Promise<number>;
+//# sourceMappingURL=no-expiry-key-report.d.ts.map

package/dist/features/service-account/no-expiry-key-report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-expiry-key-report.d.ts","sourceRoot":"","sources":["../../../src/features/service-account/no-expiry-key-report.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,iGAAiG;AACjG,eAAO,MAAM,wBAAwB,2mBAUP,CAAC;AAE/B,6DAA6D;AAC7D,MAAM,WAAW,cAAc;IAC7B,qEAAqE;IACrE,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,wFAAwF;AACxF,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1D;AAMD,wDAAwD;AACxD,wBAAsB,mBAAmB,CAAC,EAAE,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CASxF;AAED,0EAA0E;AAC1E,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,SAAS,cAAc,EAAE,GAAG,MAAM,CAalF;AAcD,8EAA8E;AAC9E,wBAAsB,uBAAuB,CAAC,IAAI,EAAE;IAClD,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,eAAe,GAAG;QAAE,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC;IAClE,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACtC,GAAG,OAAO,CAAC,MAAM,CAAC,CAwBlB"}

package/dist/features/service-account/no-expiry-key-report.js

@@ -0,0 +1,91 @@
+"use strict";
+/**
+ * The non-expiring service-account key report (security hardening Phase 8 #13, shipped as the
+ * `astram-sa-keys-report` bin in Phase 9 #8).
+ *
+ * Keys issued before an expiry became mandatory have `sak_expires_at_ms IS NULL` and never expire
+ * (a key issued later with an explicit `neverExpires: true` looks the same). This read-only report
+ * lists each agent's CURRENT, unrevoked key with no expiry so an operator can rotate it with an
+ * expiry. It prints labels and company names only: never a secret, a hash or a raw id.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NO_EXPIRY_KEY_REPORT_SQL = void 0;
+exports.findNonExpiringKeys = findNonExpiringKeys;
+exports.formatNonExpiringKeyReport = formatNonExpiringKeyReport;
+exports.runNonExpiringKeyReport = runNonExpiringKeyReport;
+/** Read-only: the current unrevoked key of each agent that has no expiry, with display names. */
+exports.NO_EXPIRY_KEY_REPORT_SQL = `SELECT sa.sa_label AS label, c.c_name AS company,
+       sa.sa_status AS status, k.sak_version AS version, k.sak_created_at_ms AS issuedAtMs
+  FROM shield_authz.service_account_key k
+  LEFT JOIN shield_app.service_account sa ON sa.sa_id = k.sak_account_id
+  LEFT JOIN shield_app.companies c ON c.c_uuid = k.sak_tenant_id
+ WHERE k.sak_expires_at_ms IS NULL
+   AND k.sak_revoked_at_ms IS NULL
+   AND k.sak_version = (SELECT MAX(v.sak_version)
+                          FROM shield_authz.service_account_key v
+                         WHERE v.sak_account_id = k.sak_account_id)
+ ORDER BY k.sak_created_at_ms`;
+const str = (v) => (v === null || v === undefined ? null : String(v));
+const num = (v) => v === null || v === undefined || !Number.isFinite(Number(v)) ? null : Number(v);
+/** Run the report query and map the rows. Read-only. */
+async function findNonExpiringKeys(db) {
+    const rows = (await db.query(exports.NO_EXPIRY_KEY_REPORT_SQL));
+    return rows.map((r) => ({
+        label: str(r.label),
+        company: str(r.company),
+        status: str(r.status),
+        version: num(r.version) ?? 0,
+        issuedAtMs: num(r.issuedAtMs),
+    }));
+}
+/** Human-readable report text (one line per key, plus a summary line). */
+function formatNonExpiringKeyReport(keys) {
+    if (keys.length === 0)
+        return 'No service-account keys without an expiry.\n';
+    const lines = keys.map((k) => {
+        const issued = k.issuedAtMs === null ? 'unknown' : new Date(k.issuedAtMs).toISOString();
+        return (`- ${k.label ?? '(deleted agent)'} — company: ${k.company ?? '(deleted company)'}` +
+            ` — status: ${k.status ?? 'unknown'} — key version ${k.version}, issued ${issued}`);
+    });
+    return (`${keys.length} service-account key(s) with no expiry (rotate each with an expiry):\n` +
+        `${lines.join('\n')}\n`);
+}
+const USAGE = `Usage: astram-sa-keys-report [--fail-on-found]
+
+Lists service-account (agent) keys that never expire: each agent's current, unrevoked key with no
+expiry. Read-only. Connects with the APP_DB_HOST, APP_DB_PORT, APP_DB_USER, APP_DB_PASSWORD and
+APP_DB_NAME environment variables (the same as the identity module's authz pool).
+
+  --fail-on-found  exit 1 if any key is listed (for CI)
+  --help           show this text
+
+Exit codes: 0 done (or nothing found), 1 found with --fail-on-found, 2 error.
+`;
+/** The bin's behaviour, testable without a process: returns the exit code. */
+async function runNonExpiringKeyReport(opts) {
+    const known = new Set(['--fail-on-found', '--help', '-h']);
+    const unknown = opts.argv.filter((a) => !known.has(a));
+    if (unknown.length > 0) {
+        opts.err(`Unknown option: ${unknown.join(' ')}\n\n${USAGE}`);
+        return 2;
+    }
+    if (opts.argv.includes('--help') || opts.argv.includes('-h')) {
+        opts.out(USAGE);
+        return 0;
+    }
+    let db;
+    try {
+        db = opts.openDb();
+        const keys = await findNonExpiringKeys(db);
+        opts.out(formatNonExpiringKeyReport(keys));
+        return keys.length > 0 && opts.argv.includes('--fail-on-found') ? 1 : 0;
+    }
+    catch (e) {
+        // The driver's message names the failing step (host/user at most), never the password.
+        opts.err(`astram-sa-keys-report failed: ${e instanceof Error ? e.message : String(e)}\n`);
+        return 2;
+    }
+    finally {
+        await db?.end().catch(() => undefined);
+    }
+}

package/dist/features/shared/http.d.ts

@@ -3,6 +3,12 @@ import type { Principal } from '@astram/engine';
 export interface AuthedRequest {
     principal: Principal;
 }
+/**
+ * Same uuid, compared the way MariaDB does: the uuid columns are `utf8mb4_unicode_ci`, so a route
+ * param that differs only in case reaches the same row. Every JS-side id guard (own root, platform
+ * administrators) must use this, never `===` (Phase 10 #1).
+ */
+export declare function sameUuid(a: string | null | undefined, b: string | null | undefined): boolean;
 /** Coerce an unknown field value to a string uuid or null. */
 export declare function asUuid(v: unknown): string | null;
 /**

package/dist/features/shared/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../../src/features/shared/http.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,iFAAiF;AACjF,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,SAAS,CAAC;CACtB;AAED,8DAA8D;AAC9D,wBAAgB,MAAM,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAEhD;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAQnD"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../../src/features/shared/http.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,iFAAiF;AACjF,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,SAAS,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAE5F;AAED,8DAA8D;AAC9D,wBAAgB,MAAM,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAEhD;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAQnD"}

package/dist/features/shared/http.js

@@ -1,7 +1,16 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.sameUuid = sameUuid;
 exports.asUuid = asUuid;
 exports.asEpochMs = asEpochMs;
+/**
+ * Same uuid, compared the way MariaDB does: the uuid columns are `utf8mb4_unicode_ci`, so a route
+ * param that differs only in case reaches the same row. Every JS-side id guard (own root, platform
+ * administrators) must use this, never `===` (Phase 10 #1).
+ */
+function sameUuid(a, b) {
+    return typeof a === 'string' && typeof b === 'string' && a.toLowerCase() === b.toLowerCase();
+}
 /** Coerce an unknown field value to a string uuid or null. */
 function asUuid(v) {
     return typeof v === 'string' && v.length > 0 ? v : null;

package/dist/features/user/user.service.d.ts

@@ -17,9 +17,9 @@ export interface UserPatch {
  * Users are GLOBAL (one user can belong to many tenants) and the email is a credential attribute:
  * forgot-password mails the reset link to it. So (security hardening #3, D2):
  *   - the patch is whitelisted to `{username, email, status}`;
- *   - changing `email` or `status`, and deleting a user, require the actor to DOMINATE the target
- *     (`GrantCeiling.assertDominates`: every membership of the target inside the actor's subtree,
- *     and every key the target could hold is held by the actor);
+ *   - changing `username` (Phase 9 #13a), `email` or `status`, and deleting a user, require the
+ *     actor to DOMINATE the target (`GrantCeiling.assertDominates`: every membership of the target
+ *     inside the actor's subtree, and every key the target could hold is held by the actor);
  *   - an email change burns the target's outstanding password-reset tokens BEFORE the change and
  *     notifies the OLD address after it (best-effort), when guard's reset-token store and email
  *     sender are wired (`ShieldModule.forRoot({ auth: true })`).
@@ -46,7 +46,7 @@ export declare class UserService {
     listUsers(params?: ListParams): Promise<import("@astram/engine").RecordPage>;
     /** Read a single user. */
     getUser(uuid: string): Promise<import("@astram/engine").RecordView | null>;
-    /** Update a user (whitelisted patch; email/status changes need dominance — see the class doc). */
+    /** Update a user (whitelisted patch; username/email/status changes need dominance — class doc). */
     updateUser(actor: Principal, uuid: string, patch: UserPatch): Promise<void>;
     /**
      * After a status change (security hardening Phase 3): bump every tenant the user is a member of

package/dist/features/user/user.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.service.d.ts","sourceRoot":"","sources":["../../../src/features/user/user.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAIL,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAMzD,4EAA4E;AAC5E,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;;;;;;GAaG;AACH,qBACa,WAAW;IAIpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAGxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IACY,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAMtE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAK1B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAnB/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;gBAGpC,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,YAAY,EAGrB,WAAW,CAAC,GAAE,eAAe,GAAG,IAAI,aAAA,EACK,WAAW,CAAC,GAAE,WAAW,GAAG,IAAI,aAAA,EAMzE,QAAQ,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKhC,WAAW,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA;IAG1D;;;;OAIG;IACG,UAAU,CACd,KAAK,EAAE,SAAS,EAChB,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,GAC5D,OAAO,CAAC,QAAQ,CAAC;IAcpB,uEAAuE;IACvE,SAAS,CAAC,MAAM,CAAC,EAAE,UAAU;IAI7B,0BAA0B;IAC1B,OAAO,CAAC,IAAI,EAAE,MAAM;IAIpB,kGAAkG;IAC5F,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IA8BjF;;;;;;;;;OASG;YACW,iBAAiB;IAY/B,uDAAuD;IACjD,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO/D,6FAA6F;YAC/E,kBAAkB;CAkBjC"}
+{"version":3,"file":"user.service.d.ts","sourceRoot":"","sources":["../../../src/features/user/user.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAIL,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAMzD,4EAA4E;AAC5E,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;;;;;;GAaG;AACH,qBACa,WAAW;IAIpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAGxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IACY,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAMtE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAK1B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAnB/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;gBAGpC,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,YAAY,EAGrB,WAAW,CAAC,GAAE,eAAe,GAAG,IAAI,aAAA,EACK,WAAW,CAAC,GAAE,WAAW,GAAG,IAAI,aAAA,EAMzE,QAAQ,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKhC,WAAW,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA;IAG1D;;;;OAIG;IACG,UAAU,CACd,KAAK,EAAE,SAAS,EAChB,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,GAC5D,OAAO,CAAC,QAAQ,CAAC;IAcpB,uEAAuE;IACvE,SAAS,CAAC,MAAM,CAAC,EAAE,UAAU;IAI7B,0BAA0B;IAC1B,OAAO,CAAC,IAAI,EAAE,MAAM;IAIpB,mGAAmG;IAC7F,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAkCjF;;;;;;;;;OASG;YACW,iBAAiB;IAY/B,uDAAuD;IACjD,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO/D,6FAA6F;YAC/E,kBAAkB;CAkBjC"}

package/dist/features/user/user.service.js

@@ -30,9 +30,9 @@ const USER_SORT_FIELDS = ['username', 'email', 'status', 'createdAt'];
  * Users are GLOBAL (one user can belong to many tenants) and the email is a credential attribute:
  * forgot-password mails the reset link to it. So (security hardening #3, D2):
  *   - the patch is whitelisted to `{username, email, status}`;
- *   - changing `email` or `status`, and deleting a user, require the actor to DOMINATE the target
- *     (`GrantCeiling.assertDominates`: every membership of the target inside the actor's subtree,
- *     and every key the target could hold is held by the actor);
+ *   - changing `username` (Phase 9 #13a), `email` or `status`, and deleting a user, require the
+ *     actor to DOMINATE the target (`GrantCeiling.assertDominates`: every membership of the target
+ *     inside the actor's subtree, and every key the target could hold is held by the actor);
  *   - an email change burns the target's outstanding password-reset tokens BEFORE the change and
  *     notifies the OLD address after it (best-effort), when guard's reset-token store and email
  *     sender are wired (`ShieldModule.forRoot({ auth: true })`).
@@ -79,13 +79,16 @@ let UserService = UserService_1 = class UserService {
     getUser(uuid) {
         return this.records.get('user', uuid);
     }
-    /** Update a user (whitelisted patch; email/status changes need dominance — see the class doc). */
+    /** Update a user (whitelisted patch; username/email/status changes need dominance — class doc). */
     async updateUser(actor, uuid, patch) {
         const current = await this.records.get('user', uuid);
         if (current === null)
             throw new identity_errors_js_1.IdentityNotFoundError('User not found.');
         const fields = {};
-        if (typeof patch?.username === 'string')
+        // Phase 9 #13a: the username is a sign-in identifier like the email, so changing it needs the
+        // same dominance (re-sending the current username changes nothing and needs none).
+        const usernameChanged = typeof patch?.username === 'string' && patch.username !== current.fields.username;
+        if (usernameChanged)
             fields.username = patch.username;
         const oldEmail = typeof current.fields.email === 'string' ? current.fields.email : '';
         const emailChanged = typeof patch?.email === 'string' && patch.email !== oldEmail;
@@ -98,7 +101,7 @@ let UserService = UserService_1 = class UserService {
             fields.email = patch.email;
         if (statusChanged)
             fields.status = patch.status;
-        if (emailChanged || statusChanged || wantsInactive) {
+        if (usernameChanged || emailChanged || statusChanged || wantsInactive) {
             await this.ceiling.assertDominates(actor, uuid);
         }
         if (Object.keys(fields).length > 0) {

package/dist/index.d.ts

@@ -36,19 +36,9 @@ export { identityAuthActionKeys, identityControlPlaneKeys } from './auth-facts-k
  * `identityObjects`, and mounts the CRUD controllers — no separate engine setup needed.
  */
 export { IdentityFeatureModule } from './features/identity-feature.module.js';
-/**
- * The record-tier authorization wiring: the helper that assembles `RecordAuthorizationInputs`
- * for `ShieldModule.forRoot({ recordAuthorization })`. Once wired, `decide()` is real (the
- * framework's record-tier adapters run over the identity app schema) instead of the
- * deny-everything stub. Its pool factory, `createIdentityAuthzPool` (it opens a raw pool), is NOT
- * exported here (Phase 8 #5): import it from `@astram/identity/internal` in the composition root
- * (`src/app.module.ts`).
- */
-export { buildIdentityRecordAuthorization } from './features/authz/record-authorization.js';
 /**
  * The ADR-0011 per-request session-facts reader (ALS hot path), re-exported so a consumer
- * that wants to construct it directly (rather than via `buildIdentityRecordAuthorization`)
- * can do so.
+ * that wants to construct it directly can do so.
  */
 export { AlsSessionFactsReader } from './features/authz/session-facts.reader.js';
 /**

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D;;;;GAIG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C;;;;;;GAMG;AACH,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAExF;;;;;GAKG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAE9E;;;;;;;GAOG;AACH,OAAO,EAAE,gCAAgC,EAAE,MAAM,0CAA0C,CAAC;AAE5F;;;;GAIG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AAEjF;;;;;;GAMG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AAEpF;;;;;;;GAOG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D;;;;GAIG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C;;;;;;GAMG;AACH,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAExF;;;;;GAKG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAU9E;;;GAGG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AAEjF;;;;;;GAMG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AAEpF;;;;;;;GAOG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC"}

package/dist/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DbMembershipChecker = exports.DbScopeSubtreeResolver = exports.AlsSessionFactsReader = exports.buildIdentityRecordAuthorization = exports.IdentityFeatureModule = exports.identityControlPlaneKeys = exports.identityAuthActionKeys = exports.identityObjects = exports.identityMigrationsDir = exports.ServiceAccount = exports.CompanyBranch = exports.CompanyDepartment = exports.MembershipPosting = exports.CompanyMembership = exports.Branch = exports.Department = exports.Role = exports.User = exports.Company = void 0;
+exports.DbMembershipChecker = exports.DbScopeSubtreeResolver = exports.AlsSessionFactsReader = exports.IdentityFeatureModule = exports.identityControlPlaneKeys = exports.identityAuthActionKeys = exports.identityObjects = exports.identityMigrationsDir = exports.ServiceAccount = exports.CompanyBranch = exports.CompanyDepartment = exports.MembershipPosting = exports.CompanyMembership = exports.Branch = exports.Department = exports.Role = exports.User = exports.Company = void 0;
 /**
  * @astram/identity — the framework-owned identity + tenancy model.
  * The 9 identity object classes (relocated from the consumer app in Sub-plan B) +
@@ -54,20 +54,16 @@ Object.defineProperty(exports, "identityControlPlaneKeys", { enumerable: true, g
  */
 var identity_feature_module_js_1 = require("./features/identity-feature.module.js");
 Object.defineProperty(exports, "IdentityFeatureModule", { enumerable: true, get: function () { return identity_feature_module_js_1.IdentityFeatureModule; } });
-/**
- * The record-tier authorization wiring: the helper that assembles `RecordAuthorizationInputs`
- * for `ShieldModule.forRoot({ recordAuthorization })`. Once wired, `decide()` is real (the
- * framework's record-tier adapters run over the identity app schema) instead of the
- * deny-everything stub. Its pool factory, `createIdentityAuthzPool` (it opens a raw pool), is NOT
- * exported here (Phase 8 #5): import it from `@astram/identity/internal` in the composition root
- * (`src/app.module.ts`).
+/*
+ * The record-tier authorization: since 0.7 (security hardening Phase 9 #7)
+ * `IdentityFeatureModule.forRoot({ extraObjects })` builds it and provides it to `ShieldModule`
+ * (guard's `SHIELD_RECORD_AUTHORIZATION`); `buildIdentityRecordAuthorization` is removed, and the
+ * app passes no `recordAuthorization`. `createIdentityAuthzPool` (a raw pool, e.g. for
+ * `DbScopeSubtreeResolver`) stays on `@astram/identity/internal`, composition root only.
  */
-var record_authorization_js_1 = require("./features/authz/record-authorization.js");
-Object.defineProperty(exports, "buildIdentityRecordAuthorization", { enumerable: true, get: function () { return record_authorization_js_1.buildIdentityRecordAuthorization; } });
 /**
  * The ADR-0011 per-request session-facts reader (ALS hot path), re-exported so a consumer
- * that wants to construct it directly (rather than via `buildIdentityRecordAuthorization`)
- * can do so.
+ * that wants to construct it directly can do so.
  */
 var session_facts_reader_js_1 = require("./features/authz/session-facts.reader.js");
 Object.defineProperty(exports, "AlsSessionFactsReader", { enumerable: true, get: function () { return session_facts_reader_js_1.AlsSessionFactsReader; } });

package/dist/internal.d.ts

@@ -2,8 +2,9 @@
  * @astram/identity/internal — composition-root surface (Phase 8 #5).
  *
  * `createIdentityAuthzPool` opens a raw `mariadb` pool, so it is NOT on the package entry point
- * (`@astram/identity`). An app's `src/app.module.ts` imports it from here to wire
- * `buildIdentityRecordAuthorization(authzPool)`; the scaffolded app's lint wall rejects this
+ * (`@astram/identity`). An app's `src/app.module.ts` imports it from here to wire pool-backed ports
+ * such as `new DbScopeSubtreeResolver(authzPool)` (the record authorization itself is built by
+ * `IdentityFeatureModule` since 0.7); the scaffolded app's lint wall rejects this
  * subpath everywhere else. Feature code never holds a pool: it uses the RecordEngine.
  */
 export { createIdentityAuthzPool } from './features/authz/record-authorization.js';

package/dist/internal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"internal.d.ts","sourceRoot":"","sources":["../src/internal.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC"}
+{"version":3,"file":"internal.d.ts","sourceRoot":"","sources":["../src/internal.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC"}

package/dist/internal.js

@@ -5,8 +5,9 @@ exports.createIdentityAuthzPool = void 0;
  * @astram/identity/internal — composition-root surface (Phase 8 #5).
  *
  * `createIdentityAuthzPool` opens a raw `mariadb` pool, so it is NOT on the package entry point
- * (`@astram/identity`). An app's `src/app.module.ts` imports it from here to wire
- * `buildIdentityRecordAuthorization(authzPool)`; the scaffolded app's lint wall rejects this
+ * (`@astram/identity`). An app's `src/app.module.ts` imports it from here to wire pool-backed ports
+ * such as `new DbScopeSubtreeResolver(authzPool)` (the record authorization itself is built by
+ * `IdentityFeatureModule` since 0.7); the scaffolded app's lint wall rejects this
  * subpath everywhere else. Feature code never holds a pool: it uses the RecordEngine.
  */
 var record_authorization_js_1 = require("./features/authz/record-authorization.js");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astram/identity",
-  "version": "0.6.0",
+  "version": "0.7.1",
   "license": "MIT",
   "description": "Astram framework — the framework-owned identity + tenancy model. Hosts the identity @ObjectType classes (user, company, membership, posting), framework-authored identity migrations, and the identity resolver. Top of the dependency graph: depends on @astram/engine (for @ObjectType/@Field decorators) + @astram/guard / @astram/core (for the auth ports).",
   "type": "commonjs",
@@ -23,6 +23,9 @@
       ]
     }
   },
+  "bin": {
+    "astram-sa-keys-report": "dist/bin/sa-keys-report.js"
+  },
   "files": [
     "dist",
     "migrations"
@@ -32,10 +35,10 @@
     "access": "public"
   },
   "dependencies": {
-    "mariadb": "^3.4.0",
+    "mariadb": "^3.5.4",
     "@astram/core": "1.4.0",
-    "@astram/guard": "0.9.0",
-    "@astram/engine": "0.5.0"
+    "@astram/guard": "0.10.1",
+    "@astram/engine": "0.5.1"
   },
   "peerDependencies": {
     "@nestjs/common": "^11",