@carbonbox/domain 0.52.0 → 0.53.0

package/build/carbonbox/stakeholders/shared/domain/constants/CARBON_AUDITOR_PERMISSION_CEILING.js

@@ -0,0 +1,86 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CARBON_AUDITOR_PERMISSION_CEILING = void 0;
+const Permission_1 = require("../../../../shared/domain/authorization/enums/Permission");
+/**
+ * Carbon Auditor permission ceiling (AUD-D03, decisions D2, D3 and D7).
+ *
+ * The auditor is an external verifier (ISO 14065 / ISO/IEC 17029 independence): it reads the
+ * audited footprints and only writes its own artifacts (accept or decline the engagement, findings
+ * and the verification statement). A validated `CarbonAuditorPermissions` rejects anything outside
+ * this list, whoever grants it (the host included), so a write permission over carbon client data
+ * can never reach an auditor.
+ *
+ * Closed list, NOT derived from the `_VIEW_` permissions: it leaves out cross-cutting views (other
+ * stakeholders, user profiles), contracts, orders, pricing, templates and text banks. Which carbon
+ * clients and footprints the auditor reads is a data scope rule of the backend (audit engagements in
+ * force); the methodology views (formulas, factors, variables, GWP) are narrowed there to what the
+ * audited calculations used (D7).
+ */
+exports.CARBON_AUDITOR_PERMISSION_CEILING = [
+    // === User Profile (own account) ===
+    Permission_1.Permission.USER_PROFILE_VIEW_OWN_PROFILE,
+    Permission_1.Permission.USER_PROFILE_UPDATE_OWN_PROFILE,
+    Permission_1.Permission.USER_PROFILE_CHANGE_OWN_PASSWORD,
+    // === Stakeholders (company profile of the audited carbon clients) ===
+    Permission_1.Permission.STAKEHOLDERS_VIEW_CARBON_CLIENT_PROFILE,
+    Permission_1.Permission.STAKEHOLDERS_VIEW_CARBON_CLIENT_LIST,
+    // === Carbon Footprint Configurations (read) ===
+    Permission_1.Permission.CARBON_FOOTPRINT_CONFIGURATIONS_VIEW_CORPORATE_CONFIGURATION,
+    Permission_1.Permission.CARBON_FOOTPRINT_CONFIGURATIONS_VIEW_CORPORATE_CONFIGURATION_LIST,
+    Permission_1.Permission.CARBON_FOOTPRINT_CONFIGURATIONS_VIEW_EVENT_CONFIGURATION,
+    Permission_1.Permission.CARBON_FOOTPRINT_CONFIGURATIONS_VIEW_EVENT_CONFIGURATION_LIST,
+    Permission_1.Permission.CARBON_FOOTPRINT_CONFIGURATIONS_VIEW_PRODUCT_CONFIGURATION,
+    Permission_1.Permission.CARBON_FOOTPRINT_CONFIGURATIONS_VIEW_PRODUCT_CONFIGURATION_LIST,
+    Permission_1.Permission.CARBON_FOOTPRINT_CONFIGURATIONS_VIEW_CORPORATE_SEGMENT_CATALOG,
+    Permission_1.Permission.CARBON_FOOTPRINT_CONFIGURATIONS_VIEW_CORPORATE_SEGMENT_CATALOG_LIST,
+    Permission_1.Permission.CARBON_FOOTPRINT_CONFIGURATIONS_VIEW_CORPORATE_SUBSEGMENT_CATALOG,
+    Permission_1.Permission.CARBON_FOOTPRINT_CONFIGURATIONS_VIEW_CORPORATE_SUBSEGMENT_CATALOG_LIST,
+    Permission_1.Permission.CARBON_FOOTPRINT_CONFIGURATIONS_VIEW_INTENSITY_INDICATOR,
+    Permission_1.Permission.CARBON_FOOTPRINT_CONFIGURATIONS_VIEW_INTENSITY_INDICATOR_LIST,
+    Permission_1.Permission.CARBON_FOOTPRINT_CONFIGURATIONS_VIEW_EVENT_LIFECYCLE_STAGE_LIST,
+    // === Company Resources (facilities; products and events referenced by an audited footprint) ===
+    Permission_1.Permission.COMPANY_RESOURCES_VIEW_FACILITY,
+    Permission_1.Permission.COMPANY_RESOURCES_VIEW_FACILITY_LIST,
+    Permission_1.Permission.COMPANY_RESOURCES_VIEW_EVENT,
+    Permission_1.Permission.COMPANY_RESOURCES_VIEW_EVENT_EDITION,
+    Permission_1.Permission.COMPANY_RESOURCES_VIEW_PRODUCT,
+    // === Activity Data Collection (records and the forms needed to read them) ===
+    Permission_1.Permission.ACTIVITY_DATA_COLLECTION_VIEW_ACTIVITY_DATA_SUBMISSION,
+    Permission_1.Permission.ACTIVITY_DATA_COLLECTION_VIEW_ACTIVITY_DATA_SUBMISSION_LIST,
+    Permission_1.Permission.ACTIVITY_DATA_COLLECTION_VIEW_COLLECTION_FIELD,
+    Permission_1.Permission.ACTIVITY_DATA_COLLECTION_VIEW_DYNAMIC_FORM,
+    // === Emission Calculation Process (read) ===
+    Permission_1.Permission.EMISSION_CALCULATION_PROCESS_VIEW_CALCULATION_PROCESS,
+    Permission_1.Permission.EMISSION_CALCULATION_PROCESS_VIEW_CALCULATION_PROCESS_LIST,
+    Permission_1.Permission.EMISSION_CALCULATION_PROCESS_VIEW_CALCULATION_WORKFLOW,
+    Permission_1.Permission.EMISSION_CALCULATION_PROCESS_VIEW_CALCULATION_WORKFLOW_LIST,
+    // === Emission Calculation Formulas (read, narrowed to what was used, D7) ===
+    Permission_1.Permission.EMISSION_FORMULAS_VIEW_FORMULA,
+    Permission_1.Permission.EMISSION_FORMULAS_VIEW_FORMULA_LIST,
+    Permission_1.Permission.EMISSION_FORMULAS_VIEW_EMISSION_FACTOR,
+    Permission_1.Permission.EMISSION_FORMULAS_VIEW_EMISSION_FACTOR_LIST,
+    Permission_1.Permission.EMISSION_FORMULAS_VIEW_CALCULATION_VARIABLE,
+    Permission_1.Permission.EMISSION_FORMULAS_VIEW_CALCULATION_VARIABLE_LIST,
+    Permission_1.Permission.EMISSION_FORMULAS_VIEW_GWP,
+    Permission_1.Permission.EMISSION_FORMULAS_VIEW_GWP_LIST,
+    // === Reporting (read) ===
+    Permission_1.Permission.REPORTING_VIEW_REPORT_INSTANCE,
+    Permission_1.Permission.REPORTING_VIEW_REPORT_INSTANCE_LIST,
+    Permission_1.Permission.REPORTING_VIEW_REPORT_PREPARATION_QUESTIONNAIRE,
+    Permission_1.Permission.REPORTING_VIEW_REPORT_PREPARATION_QUESTIONNAIRE_LIST,
+    // === Carbon Footprint Audits (its own artifacts) ===
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_VIEW_AUDIT_ENGAGEMENT,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_VIEW_AUDIT_ENGAGEMENT_LIST,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_ACCEPT_AUDIT_ENGAGEMENT,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_DECLINE_AUDIT_ENGAGEMENT,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_CREATE_AUDIT_FINDING,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_UPDATE_AUDIT_FINDING,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_CLOSE_AUDIT_FINDING,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_REOPEN_AUDIT_FINDING,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_VIEW_AUDIT_FINDING,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_VIEW_AUDIT_FINDING_LIST,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_ISSUE_VERIFICATION_STATEMENT,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_VIEW_VERIFICATION_STATEMENT,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_VIEW_VERIFICATION_STATEMENT_LIST,
+];

package/build/carbonbox/stakeholders/shared/domain/constants/CARBON_CLIENT_PERMISSION_CEILING.js

@@ -84,4 +84,17 @@ exports.CARBON_CLIENT_PERMISSION_CEILING = [
     Permission_1.Permission.REPORTING_VIEW_REPORT_INSTANCE_LIST,
     Permission_1.Permission.REPORTING_APPROVE_REPORT_BY_CLIENT,
     Permission_1.Permission.REPORTING_REJECT_REPORT,
+    // === Carbon Footprint Audits (AUD-D07, matrix §5.6: manages its own auditor, answers findings) ===
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_ASSIGN_AUDITOR,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_REPLACE_AUDITOR,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_REVOKE_AUDIT_ENGAGEMENT,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_RESEND_AUDITOR_INVITATION,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_UPDATE_AUDITED_CARBON_FOOTPRINTS,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_VIEW_AUDIT_ENGAGEMENT,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_VIEW_AUDIT_ENGAGEMENT_LIST,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_RESPOND_TO_AUDIT_FINDING,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_VIEW_AUDIT_FINDING,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_VIEW_AUDIT_FINDING_LIST,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_VIEW_VERIFICATION_STATEMENT,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_VIEW_VERIFICATION_STATEMENT_LIST,
 ];

package/build/carbonbox/stakeholders/shared/domain/constants/CARBON_COORDINATOR_PERMISSION_CEILING.js

@@ -85,4 +85,12 @@ exports.CARBON_COORDINATOR_PERMISSION_CEILING = [
     Permission_1.Permission.REPORTING_VIEW_REPORT_INSTANCE_LIST,
     Permission_1.Permission.REPORTING_APPROVE_REPORT_BY_CLIENT,
     Permission_1.Permission.REPORTING_REJECT_REPORT,
+    // === Carbon Footprint Audits (AUD-D07, matrix §5.6: sees the audit and answers findings, D11) ===
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_VIEW_AUDIT_ENGAGEMENT,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_VIEW_AUDIT_ENGAGEMENT_LIST,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_RESPOND_TO_AUDIT_FINDING,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_VIEW_AUDIT_FINDING,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_VIEW_AUDIT_FINDING_LIST,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_VIEW_VERIFICATION_STATEMENT,
+    Permission_1.Permission.CARBON_FOOTPRINT_AUDITS_VIEW_VERIFICATION_STATEMENT_LIST,
 ];

package/build/carbonbox/stakeholders/shared/domain/policies/RolePermissionCeilingPolicy.js

@@ -5,6 +5,7 @@ const StakeholderRole_1 = require("../../../../shared/domain/enums/StakeholderRo
 const CARBON_CLIENT_PERMISSION_CEILING_1 = require("../constants/CARBON_CLIENT_PERMISSION_CEILING");
 const CARBON_COORDINATOR_PERMISSION_CEILING_1 = require("../constants/CARBON_COORDINATOR_PERMISSION_CEILING");
 const CARBON_MANAGER_PERMISSION_CEILING_1 = require("../constants/CARBON_MANAGER_PERMISSION_CEILING");
+const CARBON_AUDITOR_PERMISSION_CEILING_1 = require("../constants/CARBON_AUDITOR_PERMISSION_CEILING");
 const PermissionAboveRoleCeilingError_1 = require("../exceptions/PermissionAboveRoleCeilingError");
 /**
  * Pure domain policy with the permission ceiling of each stakeholder role (AIS-D01, D9).
@@ -13,9 +14,12 @@ const PermissionAboveRoleCeilingError_1 = require("../exceptions/PermissionAbove
  * (a client with host permissions). The ceiling is the most a role can ever hold; the backend adds
  * the actor-relative rules on top (grantor ⊇ granted, target within the grantor's scope).
  *
- * The validated path of `CarbonClientPermissions`, `CarbonCoordinatorPermissions` and
- * `CarbonManagerPermissions` (`create`) calls `assertWithinCeiling`; `fromPrimitives` does not, so
- * existing records still load. `CARBON_HOST` has no ceiling.
+ * The validated path of `CarbonClientPermissions`, `CarbonCoordinatorPermissions`,
+ * `CarbonManagerPermissions` and `CarbonAuditorPermissions` (`create`) calls `assertWithinCeiling`;
+ * `fromPrimitives` does not, so existing records still load. `CARBON_HOST` has no ceiling.
+ *
+ * AUD-D03: the auditor ceiling is the read-only guarantee of the domain (§6.3.1 of the auditor
+ * plan): a write permission over carbon client data is outside it, whoever grants it.
  */
 class RolePermissionCeilingPolicy {
     constructor() {
@@ -52,4 +56,5 @@ RolePermissionCeilingPolicy.CEILINGS_BY_ROLE = new Map([
     [StakeholderRole_1.StakeholderRole.CARBON_CLIENT, CARBON_CLIENT_PERMISSION_CEILING_1.CARBON_CLIENT_PERMISSION_CEILING],
     [StakeholderRole_1.StakeholderRole.CARBON_COORDINATOR, CARBON_COORDINATOR_PERMISSION_CEILING_1.CARBON_COORDINATOR_PERMISSION_CEILING],
     [StakeholderRole_1.StakeholderRole.CARBON_MANAGER, CARBON_MANAGER_PERMISSION_CEILING_1.CARBON_MANAGER_PERMISSION_CEILING],
+    [StakeholderRole_1.StakeholderRole.CARBON_AUDITOR, CARBON_AUDITOR_PERMISSION_CEILING_1.CARBON_AUDITOR_PERMISSION_CEILING],
 ]);

package/build/carbonbox/stakeholders/shared/domain/value-objects/StakeholderRoleType.js

@@ -51,6 +51,12 @@ class StakeholderRoleType extends String_1.String {
     isCarbonClient() {
         return this.value === StakeholderRole_1.StakeholderRole.CARBON_CLIENT;
     }
+    /**
+     * AUD-D01: the carbon auditor is an external verifier, outside the supervision chain.
+     */
+    isCarbonAuditor() {
+        return this.value === StakeholderRole_1.StakeholderRole.CARBON_AUDITOR;
+    }
     hasManagementPrivileges() {
         return this.isCarbonManager() || this.isCarbonCoordinator();
     }
@@ -72,6 +78,7 @@ class StakeholderRoleType extends String_1.String {
             [StakeholderRole_1.StakeholderRole.CARBON_MANAGER]: 3, // Segundo nivel
             [StakeholderRole_1.StakeholderRole.CARBON_COORDINATOR]: 2, // Tercer nivel
             [StakeholderRole_1.StakeholderRole.CARBON_CLIENT]: 1, // Nivel base
+            [StakeholderRole_1.StakeholderRole.CARBON_AUDITOR]: 0, // Fuera de la jerarquía (AUD-D01)
         };
         const thisPrivilege = privilegeOrder[this.value] || 0;
         const otherPrivilege = privilegeOrder[other.value] || 0;
@@ -83,6 +90,7 @@ class StakeholderRoleType extends String_1.String {
             [StakeholderRole_1.StakeholderRole.CARBON_MANAGER]: 2, // Segundo nivel
             [StakeholderRole_1.StakeholderRole.CARBON_COORDINATOR]: 3, // Tercer nivel
             [StakeholderRole_1.StakeholderRole.CARBON_CLIENT]: 4, // Nivel base
+            [StakeholderRole_1.StakeholderRole.CARBON_AUDITOR]: 0, // Fuera de la jerarquía (AUD-D01)
         };
         return levels[this.value] || 0;
     }

package/build/carbonbox/stakeholders/user-invitations/domain/value-objects/UserInvitationInvitedByStakeholder.js

@@ -42,9 +42,12 @@ class UserInvitationInvitedByStakeholder extends StakeholderReference_1.Stakehol
 }
 exports.UserInvitationInvitedByStakeholder = UserInvitationInvitedByStakeholder;
 UserInvitationInvitedByStakeholder.PROPERTY_NAME = 'invitedByStakeholder';
-// Roles that create (and therefore invite) other stakeholder users
+// Roles that create (and therefore invite) other stakeholder users. A carbon client only invites
+// the auditor it assigns to its audit engagement (AUD-B10); which roles each inviter may create is
+// an application rule.
 UserInvitationInvitedByStakeholder.ALLOWED_INVITER_ROLES = [
     StakeholderRole_1.StakeholderRole.CARBON_HOST,
     StakeholderRole_1.StakeholderRole.CARBON_MANAGER,
     StakeholderRole_1.StakeholderRole.CARBON_COORDINATOR,
+    StakeholderRole_1.StakeholderRole.CARBON_CLIENT,
 ];

package/build/carbonbox/stakeholders/user-invitations/domain/value-objects/UserInvitationUserId.js

@@ -6,7 +6,8 @@ const SemanticUuidPrefix_1 = require("../../../../shared/domain/enums/SemanticUu
 const InvalidUserPrefixError_1 = require("../../../../shared/domain/exceptions/InvalidUserPrefixError");
 /**
  * Id of the stakeholder user a UserInvitation is for. Only users created by another stakeholder
- * are invited: clients, coordinators and managers (the host is created by the bootstrap).
+ * are invited: clients, coordinators, managers and auditors (the host is created by the bootstrap).
+ * A new auditor is invited when a carbon client assigns it to an audit engagement (AUD-B10).
  */
 class UserInvitationUserId extends UserId_1.UserId {
     constructor(value, skipDomainValidation) {
@@ -44,4 +45,5 @@ UserInvitationUserId.VALID_PREFIXES = [
     SemanticUuidPrefix_1.SemanticUuidPrefix.USR_STH_CLIENT,
     SemanticUuidPrefix_1.SemanticUuidPrefix.USR_STH_COORDINATOR,
     SemanticUuidPrefix_1.SemanticUuidPrefix.USR_STH_MANAGER,
+    SemanticUuidPrefix_1.SemanticUuidPrefix.USR_STH_AUDITOR,
 ];

package/build/carbonbox/stakeholders/user-preferences/domain/value-objects/UserPreferenceUserId.js

@@ -44,4 +44,5 @@ UserPreferenceUserId.VALID_PREFIXES = [
     SemanticUuidPrefix_1.SemanticUuidPrefix.USR_STH_COORDINATOR,
     SemanticUuidPrefix_1.SemanticUuidPrefix.USR_STH_HOST,
     SemanticUuidPrefix_1.SemanticUuidPrefix.USR_STH_MANAGER,
+    SemanticUuidPrefix_1.SemanticUuidPrefix.USR_STH_AUDITOR,
 ];