@axiom-lattice/gateway 8.2.0 → 8.3.0

package/dist/index.mjs

@@ -12018,15 +12018,25 @@ var ProjectAccessService = class {
       input.projectId,
       input.userId
     );
-    if (membership?.status === "active") {
+    if (project.kind === "personal") {
+      if (!this.isActiveMembership(membership, input)) this.accessDenied();
       this.requireCapability(membership, input.capability);
       return { project, membership };
     }
+    if (this.isActiveMembership(membership, input) && this.hasCapability(membership, input.capability)) {
+      return { project, membership };
+    }
+    const tenantAdmin = await this.tenantAdminMembership(project, input);
+    if (this.isActiveMembership(membership, input)) {
+      if (tenantAdmin) return { project, membership: tenantAdmin };
+      this.requireCapability(membership, input.capability);
+    }
     const memberships = await this.deps.membershipStore.list(input.tenantId, input.projectId);
-    if (memberships.length !== 0) this.accessDenied();
-    if (project.kind === "personal") this.accessDenied();
-    const tenantLink = await this.deps.userTenantLinkStore.getLink(input.userId, input.tenantId);
-    if (tenantLink?.role !== "owner" && tenantLink?.role !== "admin") this.accessDenied();
+    if (memberships.length !== 0) {
+      if (tenantAdmin) return { project, membership: tenantAdmin };
+      this.accessDenied();
+    }
+    if (!tenantAdmin) this.accessDenied();
     let claim;
     try {
       claim = await this.deps.membershipStore.createInitialOwner({
@@ -12069,9 +12079,19 @@ var ProjectAccessService = class {
       input.projectId,
       input.userId
     );
-    if (!membership || membership.tenantId !== input.tenantId || membership.projectId !== input.projectId || membership.userId !== input.userId || membership.status !== "active") this.accessDenied();
-    this.requireCapability(membership, input.capability);
-    return { project, membership };
+    const activeMembership = this.isActiveMembership(membership, input) ? membership : void 0;
+    if (project.kind === "personal") {
+      if (!activeMembership) this.accessDenied();
+      this.requireCapability(activeMembership, input.capability);
+      return { project, membership: activeMembership };
+    }
+    if (activeMembership && this.hasCapability(activeMembership, input.capability)) {
+      return { project, membership: activeMembership };
+    }
+    const tenantAdmin = await this.tenantAdminMembership(project, input);
+    if (tenantAdmin) return { project, membership: tenantAdmin };
+    if (activeMembership) this.requireCapability(activeMembership, input.capability);
+    this.accessDenied();
   }
   /**
    * Authorizes roster visibility for any active participant (owner/admin/member/viewer).
@@ -12093,6 +12113,9 @@ var ProjectAccessService = class {
       input.userId
     );
     if (membership?.status === "active") {
+      if (this.hasCapability(membership, input.capability)) return { project, membership };
+      const tenantAdmin = await this.tenantAdminMembership(project, input);
+      if (tenantAdmin) return { project, membership: tenantAdmin };
       this.requireCapability(membership, input.capability);
       return { project, membership };
     }
@@ -12107,6 +12130,9 @@ var ProjectAccessService = class {
       input.userId
     );
     if (membership?.status === "active") {
+      if (this.hasCapability(membership, input.capability)) return { project, membership };
+      const tenantAdmin = await this.tenantAdminMembership(project, input);
+      if (tenantAdmin) return { project, membership: tenantAdmin };
       this.requireCapability(membership, input.capability);
       return { project, membership };
     }
@@ -12158,8 +12184,29 @@ var ProjectAccessService = class {
       throw error;
     }
   }
+  hasCapability(membership, capability2) {
+    return allowedRoles[capability2].has(membership.role);
+  }
   requireCapability(membership, capability2) {
-    if (!allowedRoles[capability2].has(membership.role)) this.accessDenied();
+    if (!this.hasCapability(membership, capability2)) this.accessDenied();
+  }
+  async tenantAdminMembership(project, input) {
+    if (project.kind === "personal") return void 0;
+    const tenantLink = await this.deps.userTenantLinkStore.getLink(input.userId, input.tenantId);
+    if (tenantLink?.role !== "owner" && tenantLink?.role !== "admin") return void 0;
+    return {
+      id: `tenant-admin:${input.userId}`,
+      tenantId: input.tenantId,
+      projectId: project.id,
+      userId: input.userId,
+      role: "admin",
+      status: "active",
+      joinedAt: project.createdAt,
+      updatedAt: project.updatedAt
+    };
+  }
+  isActiveMembership(membership, input) {
+    return membership != null && membership.tenantId === input.tenantId && membership.projectId === input.projectId && membership.userId === input.userId && membership.status === "active";
   }
   accessDenied() {
     throw new ProjectCollaborationError("PROJECT_ACCESS_DENIED", 403, "Project access denied");
@@ -23449,8 +23496,6 @@ var ProjectMembershipService = class {
   }
   async list(actor3) {
     await this.deps.accessService.requireRosterAccess(actor3);
-    const membership = await this.deps.membershipStore.findByUser(actor3.tenantId, actor3.projectId, actor3.userId);
-    if (!membership || membership.status !== "active") this.accessDenied();
     return this.deps.membershipStore.list(actor3.tenantId, actor3.projectId);
   }
   async add(actor3, input) {
@@ -23508,10 +23553,8 @@ var ProjectMembershipService = class {
     });
   }
   async authorize(actor3) {
-    await this.deps.accessService.requireProjectAccess({ ...actor3, capability: "manage" });
-    const membership = await this.deps.membershipStore.findByUser(actor3.tenantId, actor3.projectId, actor3.userId);
-    if (!membership || membership.status !== "active") this.accessDenied();
-    return membership;
+    const access = await this.deps.accessService.requireProjectAccess({ ...actor3, capability: "manage" });
+    return access.membership;
   }
   async target(actor3, id3) {
     const target = (await this.deps.membershipStore.list(actor3.tenantId, actor3.projectId)).find((item) => item.id === id3);