@futdevpro/nts-dynamo 1.15.250 → 1.15.253

package/build/_modules/privacy-lifecycle/privacy-rights-notification.mongo-store.js

@@ -0,0 +1,681 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DyNTS_PrivacyRightsNotification_MongoStore = void 0;
+const node_crypto_1 = require("node:crypto");
+const node_util_1 = require("node:util");
+const mongoose_1 = require("mongoose");
+const email_submission_outcome_enum_1 = require("../../_enums/email-submission-outcome.enum");
+const privacy_rights_decision_type_enum_1 = require("./_enums/privacy-rights-decision.type-enum");
+const privacy_rights_notification_state_type_enum_1 = require("./_enums/privacy-rights-notification-state.type-enum");
+const privacy_request_type_enum_1 = require("./_enums/privacy-request.type-enum");
+/**
+ * Persists a content-free notification intent in the rights transaction and fences later SMTP submission.
+ * External delivery never runs inside the Mongo transaction. An expired claim becomes manual review, never resend.
+ */
+class DyNTS_PrivacyRightsNotification_MongoStore {
+    settings;
+    ownedErrors = new WeakSet();
+    isReady = false;
+    /** Requires explicit timing and a closed server-owned template allowlist. */
+    constructor(settings) {
+        try {
+            if (!settings?.connection || typeof settings.connection.startSession !== 'function'
+                || !this.positive(settings.maxOperationTimeMs, 2_147_483_647)
+                || !this.positive(settings.claimTimeMs, 86_400_000)
+                || !Array.isArray(settings.templateCodes) || settings.templateCodes.length < 1
+                || settings.templateCodes.length > 64 || new Set(settings.templateCodes).size !== settings.templateCodes.length
+                || settings.templateCodes.some((code) => !this.code(code))) {
+                throw new Error();
+            }
+            this.settings = Object.freeze({ ...settings, templateCodes: Object.freeze([...settings.templateCodes]) });
+        }
+        catch {
+            throw this.error('SETTINGS_INVALID');
+        }
+    }
+    /** Creates and validates the strict outbox schema before any request is admitted. */
+    async ensureReady() {
+        if (this.isReady) {
+            return;
+        }
+        try {
+            try {
+                await this.settings.connection.db.createCollection('dynts_privacy_rights_notifications', {
+                    validator: this.validator(), validationLevel: 'strict', validationAction: 'error',
+                    maxTimeMS: this.settings.maxOperationTimeMs,
+                });
+            }
+            catch (error) {
+                if (!(error instanceof mongoose_1.mongo.MongoServerError) || error.code !== 48) {
+                    throw error;
+                }
+            }
+            const information = await this.settings.connection.db.listCollections({ name: 'dynts_privacy_rights_notifications' }, { nameOnly: false, maxTimeMS: this.settings.maxOperationTimeMs }).next();
+            if (!(0, node_util_1.isDeepStrictEqual)(information?.options?.validator, this.validator())
+                || information?.options?.validationLevel !== 'strict'
+                || information?.options?.validationAction !== 'error') {
+                throw this.error('SCHEMA_MIGRATION_REQUIRED');
+            }
+            await this.collection().createIndex({ requestId: 1, subjectId: 1, organizationId: 1 }, { unique: true, name: 'uq_dynts_rights_notification_authority', maxTimeMS: this.settings.maxOperationTimeMs });
+            this.isReady = true;
+        }
+        catch (error) {
+            if (error instanceof Error && this.ownedErrors.has(error)) {
+                throw error;
+            }
+            throw this.error('NOT_READY');
+        }
+    }
+    /** Schedules exactly once in the same strong transaction as the product mutation and execution journal. */
+    async schedule(set) {
+        if (!this.exactRecord(set, ['execution', 'templateCode', 'session'])) {
+            throw this.error('SCHEDULE_INVALID');
+        }
+        return this.inTransaction(set?.session, async () => {
+            const execution = this.execution(set?.execution);
+            const templateCode = this.template(set?.templateCode);
+            const authority = this.authority(execution);
+            const key = this.key(authority);
+            const existing = await this.collection().findOne({ _id: key }, this.transactionOptions(set.session));
+            if (existing) {
+                this.assertRecord(existing, authority);
+                if (existing.executionReference !== this.executionReference(execution)
+                    || existing.executionCompletedAt !== execution.completedAt || existing.templateCode !== templateCode) {
+                    throw this.error('SCHEDULE_CONFLICT');
+                }
+                return this.view(existing, false);
+            }
+            const record = {
+                _id: key, contractVersion: 'dynts-privacy-rights-notification/1', ...authority,
+                executionReference: this.executionReference(execution), executionCompletedAt: execution.completedAt,
+                templateCode: templateCode, state: privacy_rights_notification_state_type_enum_1.DyNTS_PrivacyRightsNotificationState_Type.pending,
+                attemptCount: 0, revision: 0, claimTokenHash: '', claimedAt: '', claimExpiresAt: '',
+                channel: privacy_rights_notification_state_type_enum_1.DyNTS_PrivacyRightsNotificationChannel_Type.none, outcome: '', submissionReference: '',
+                acceptedCount: 0, rejectedCount: 0, pendingCount: 0,
+                completedAt: '',
+            };
+            await this.collection().insertOne(record, this.transactionOptions(set.session));
+            return this.view(record, true);
+        });
+    }
+    /** Claims one pending notification or converts an abandoned external-send claim to manual review. */
+    async claim(authorityValue) {
+        return this.protect('CLAIM_FAILED', () => this.claimInternal(authorityValue));
+    }
+    async claimInternal(authorityValue) {
+        this.assertReady();
+        if (!this.exactRecord(authorityValue, ['requestId', 'subjectId', 'organizationId'])) {
+            throw this.error('AUTHORITY_INVALID');
+        }
+        const authority = this.authority(authorityValue);
+        const now = await this.databaseTime();
+        let record = await this.collection().findOne({ _id: this.key(authority) }, this.options());
+        if (!record) {
+            throw this.error('NOT_SCHEDULED');
+        }
+        this.assertRecord(record, authority);
+        if (record.state === privacy_rights_notification_state_type_enum_1.DyNTS_PrivacyRightsNotificationState_Type.dispatching) {
+            if (Date.parse(record.claimExpiresAt) <= now.getTime()) {
+                record = await this.expireClaim(record, now);
+                this.assertRecord(record, authority);
+            }
+            return this.claimResult(record, false, '');
+        }
+        if (record.state !== privacy_rights_notification_state_type_enum_1.DyNTS_PrivacyRightsNotificationState_Type.pending) {
+            return this.claimResult(record, false, '');
+        }
+        const claimToken = (0, node_crypto_1.randomBytes)(32).toString('hex');
+        const claimed = await this.collection().findOneAndUpdate({ _id: record._id, state: privacy_rights_notification_state_type_enum_1.DyNTS_PrivacyRightsNotificationState_Type.pending, revision: record.revision }, { $set: {
+                state: privacy_rights_notification_state_type_enum_1.DyNTS_PrivacyRightsNotificationState_Type.dispatching,
+                claimTokenHash: this.tokenHash(claimToken), claimedAt: now.toISOString(),
+                claimExpiresAt: new Date(now.getTime() + this.settings.claimTimeMs).toISOString(),
+            }, $inc: { attemptCount: 1, revision: 1 } }, { ...this.options(), returnDocument: 'after' });
+        if (!claimed) {
+            record = await this.collection().findOne({ _id: record._id }, this.options());
+            if (!record) {
+                throw this.error('CLAIM_RACE_UNRESOLVED');
+            }
+            this.assertRecord(record, authority);
+            return this.claimResult(record, false, '');
+        }
+        this.assertRecord(claimed, authority);
+        return this.claimResult(claimed, true, claimToken);
+    }
+    /** Persists only the content-free email receipt and supports exact lost-response replay. */
+    async complete(value) {
+        return this.protect('COMPLETION_FAILED', () => this.completeInternal(value));
+    }
+    async completeInternal(value) {
+        this.assertReady();
+        const input = this.completion(value);
+        const authority = this.authority(input);
+        const now = await this.databaseTime();
+        const record = await this.requireRecord(authority);
+        this.assertClaimToken(record, input.claimToken);
+        if (this.terminal(record.state)) {
+            if (!this.sameSubmission(record, input.submission)) {
+                throw this.error('COMPLETION_CONFLICT');
+            }
+            return this.view(record, false);
+        }
+        if (record.state !== privacy_rights_notification_state_type_enum_1.DyNTS_PrivacyRightsNotificationState_Type.dispatching) {
+            throw this.error('CLAIM_REQUIRED');
+        }
+        const state = input.submission.outcome === email_submission_outcome_enum_1.DyNTS_EmailSubmissionOutcome_Enum.accepted
+            ? privacy_rights_notification_state_type_enum_1.DyNTS_PrivacyRightsNotificationState_Type.submitted
+            : input.submission.outcome === email_submission_outcome_enum_1.DyNTS_EmailSubmissionOutcome_Enum.rejected
+                ? privacy_rights_notification_state_type_enum_1.DyNTS_PrivacyRightsNotificationState_Type.rejected
+                : privacy_rights_notification_state_type_enum_1.DyNTS_PrivacyRightsNotificationState_Type.manualReview;
+        const updated = await this.collection().findOneAndUpdate({ _id: record._id, state: privacy_rights_notification_state_type_enum_1.DyNTS_PrivacyRightsNotificationState_Type.dispatching,
+            revision: record.revision, claimTokenHash: record.claimTokenHash }, { $set: {
+                state: state, channel: this.notificationChannel(input.submission.channel),
+                outcome: input.submission.outcome,
+                submissionReference: input.submission.submissionReference,
+                acceptedCount: input.submission.acceptedCount, rejectedCount: input.submission.rejectedCount,
+                pendingCount: input.submission.pendingCount, completedAt: now.toISOString(),
+            }, $inc: { revision: 1 } }, { ...this.options(), returnDocument: 'after' });
+        if (!updated) {
+            throw this.error('COMPLETION_RACE');
+        }
+        this.assertRecord(updated, authority);
+        return this.view(updated, true);
+    }
+    /** Records an attempted-but-unconfirmed send without persisting any raw transport failure. */
+    async markIndeterminate(value) {
+        return this.protect('INDETERMINATE_FAILED', () => this.markIndeterminateInternal(value));
+    }
+    async markIndeterminateInternal(value) {
+        this.assertReady();
+        const input = this.indeterminate(value);
+        const authority = this.authority(input);
+        const record = await this.requireRecord(authority);
+        this.assertClaimToken(record, input.claimToken);
+        if (this.terminal(record.state)) {
+            if (record.state !== privacy_rights_notification_state_type_enum_1.DyNTS_PrivacyRightsNotificationState_Type.manualReview
+                || record.outcome !== email_submission_outcome_enum_1.DyNTS_EmailSubmissionOutcome_Enum.indeterminate) {
+                throw this.error('INDETERMINATE_CONFLICT');
+            }
+            return this.view(record, false);
+        }
+        if (record.state !== privacy_rights_notification_state_type_enum_1.DyNTS_PrivacyRightsNotificationState_Type.dispatching) {
+            throw this.error('CLAIM_REQUIRED');
+        }
+        const now = await this.databaseTime();
+        const updated = await this.collection().findOneAndUpdate({ _id: record._id, state: privacy_rights_notification_state_type_enum_1.DyNTS_PrivacyRightsNotificationState_Type.dispatching,
+            revision: record.revision, claimTokenHash: record.claimTokenHash }, { $set: {
+                state: privacy_rights_notification_state_type_enum_1.DyNTS_PrivacyRightsNotificationState_Type.manualReview,
+                channel: privacy_rights_notification_state_type_enum_1.DyNTS_PrivacyRightsNotificationChannel_Type.none,
+                outcome: email_submission_outcome_enum_1.DyNTS_EmailSubmissionOutcome_Enum.indeterminate, submissionReference: '',
+                acceptedCount: 0, rejectedCount: 0, pendingCount: 0, completedAt: now.toISOString(),
+            }, $inc: { revision: 1 } }, { ...this.options(), returnDocument: 'after' });
+        if (!updated) {
+            throw this.error('INDETERMINATE_RACE');
+        }
+        this.assertRecord(updated, authority);
+        return this.view(updated, true);
+    }
+    /** Returns content-free current state; claim capability and message data never leave the worker boundary. */
+    async read(authorityValue) {
+        return this.protect('READ_FAILED', () => this.readInternal(authorityValue));
+    }
+    async readInternal(authorityValue) {
+        this.assertReady();
+        if (!this.exactRecord(authorityValue, ['requestId', 'subjectId', 'organizationId'])) {
+            throw this.error('AUTHORITY_INVALID');
+        }
+        const authority = this.authority(authorityValue);
+        const record = await this.collection().findOne({ _id: this.key(authority) }, this.options());
+        if (!record) {
+            return null;
+        }
+        this.assertRecord(record, authority);
+        return this.view(record, false);
+    }
+    async expireClaim(record, now) {
+        const updated = await this.collection().findOneAndUpdate({ _id: record._id, state: privacy_rights_notification_state_type_enum_1.DyNTS_PrivacyRightsNotificationState_Type.dispatching,
+            revision: record.revision, claimExpiresAt: record.claimExpiresAt }, { $set: {
+                state: privacy_rights_notification_state_type_enum_1.DyNTS_PrivacyRightsNotificationState_Type.manualReview,
+                channel: privacy_rights_notification_state_type_enum_1.DyNTS_PrivacyRightsNotificationChannel_Type.none,
+                outcome: email_submission_outcome_enum_1.DyNTS_EmailSubmissionOutcome_Enum.indeterminate, submissionReference: '',
+                acceptedCount: 0, rejectedCount: 0, pendingCount: 0, completedAt: now.toISOString(),
+            }, $inc: { revision: 1 } }, { ...this.options(), returnDocument: 'after' });
+        if (!updated) {
+            const current = await this.collection().findOne({ _id: record._id }, this.options());
+            if (!current) {
+                throw this.error('EXPIRED_CLAIM_RACE');
+            }
+            return current;
+        }
+        return updated;
+    }
+    execution(value) {
+        if (!this.exactRecord(value, [
+            'contractVersion', 'requestId', 'subjectId', 'organizationId', 'requestType', 'policyVersion',
+            'expectedRequestRevision', 'rectifications', 'purposes', 'completedAt', 'created',
+        ])) {
+            throw this.error('EXECUTION_INVALID');
+        }
+        const rectifications = this.rectifications(value.rectifications);
+        const purposes = this.purposes(value.purposes);
+        const completedAtValue = typeof value.completedAt === 'string' ? value.completedAt : '';
+        const completedAt = Date.parse(completedAtValue);
+        const requestType = this.rightsRequestType(value.requestType);
+        const rectificationRequest = requestType === privacy_request_type_enum_1.DyNTS_PrivacyRequest_Type.rectification;
+        const purposeRequest = requestType === privacy_request_type_enum_1.DyNTS_PrivacyRequest_Type.restriction
+            || requestType === privacy_request_type_enum_1.DyNTS_PrivacyRequest_Type.objection;
+        if (value.contractVersion !== 'dynts-privacy-rights-execution-receipt/1'
+            || !this.code(value.requestId) || !this.code(value.subjectId) || !this.code(value.organizationId)
+            || !this.code(value.policyVersion) || !Number.isSafeInteger(value.expectedRequestRevision)
+            || Number(value.expectedRequestRevision) < 0 || typeof value.created !== 'boolean'
+            || !rectifications || !purposes || !Number.isFinite(completedAt) || !requestType
+            || (rectificationRequest && (rectifications.length < 1 || purposes.length !== 0))
+            || (purposeRequest && (purposes.length < 1 || rectifications.length !== 0))
+            || rectifications.some((decision) => (!this.rectificationSemantics(decision)))
+            || purposes.some((decision) => (!this.purposeSemantics(decision, completedAt)))) {
+            throw this.error('EXECUTION_INVALID');
+        }
+        return Object.freeze({
+            contractVersion: 'dynts-privacy-rights-execution-receipt/1',
+            requestId: value.requestId, subjectId: value.subjectId, organizationId: value.organizationId,
+            requestType: requestType, policyVersion: value.policyVersion,
+            expectedRequestRevision: Number(value.expectedRequestRevision), rectifications: rectifications,
+            purposes: purposes, completedAt: completedAtValue, created: value.created,
+        });
+    }
+    completion(value) {
+        if (!this.exactRecord(value, [
+            'contractVersion', 'requestId', 'subjectId', 'organizationId', 'claimToken', 'submission',
+        ])) {
+            throw this.error('COMPLETION_INVALID');
+        }
+        const submission = this.submission(value.submission);
+        if (value.contractVersion !== 'dynts-privacy-rights-notification-completion/1'
+            || !this.code(value.requestId) || !this.code(value.subjectId) || !this.code(value.organizationId)
+            || !this.token(value.claimToken) || !submission) {
+            throw this.error('COMPLETION_INVALID');
+        }
+        return Object.freeze({
+            contractVersion: 'dynts-privacy-rights-notification-completion/1',
+            requestId: value.requestId, subjectId: value.subjectId, organizationId: value.organizationId,
+            claimToken: value.claimToken, submission: submission,
+        });
+    }
+    indeterminate(value) {
+        if (!this.exactRecord(value, [
+            'contractVersion', 'requestId', 'subjectId', 'organizationId', 'claimToken',
+        ])) {
+            throw this.error('INDETERMINATE_INVALID');
+        }
+        if (value.contractVersion !== 'dynts-privacy-rights-notification-indeterminate/1'
+            || !this.code(value.requestId) || !this.code(value.subjectId) || !this.code(value.organizationId)
+            || !this.token(value.claimToken)) {
+            throw this.error('INDETERMINATE_INVALID');
+        }
+        return Object.freeze({
+            contractVersion: 'dynts-privacy-rights-notification-indeterminate/1',
+            requestId: value.requestId, subjectId: value.subjectId, organizationId: value.organizationId,
+            claimToken: value.claimToken,
+        });
+    }
+    submission(value) {
+        if (!this.exactRecord(value, [
+            'contractVersion', 'channel', 'outcome', 'submissionReference',
+            'acceptedCount', 'rejectedCount', 'pendingCount',
+        ])) {
+            return null;
+        }
+        const channel = this.emailChannel(value.channel);
+        const outcome = this.emailOutcome(value.outcome)
+            ? value.outcome : null;
+        const submissionReference = typeof value.submissionReference === 'string'
+            ? value.submissionReference : '';
+        const acceptedCount = this.count(value.acceptedCount) ? value.acceptedCount : -1;
+        const rejectedCount = this.count(value.rejectedCount) ? value.rejectedCount : -1;
+        const pendingCount = this.count(value.pendingCount) ? value.pendingCount : -1;
+        const valid = value.contractVersion === 'dynts-email-submission-receipt/1'
+            && !!channel && !!outcome
+            && (submissionReference === '' || /^sha256:[a-f0-9]{64}$/u.test(submissionReference))
+            && acceptedCount >= 0 && rejectedCount >= 0 && pendingCount >= 0
+            && !(outcome === email_submission_outcome_enum_1.DyNTS_EmailSubmissionOutcome_Enum.accepted
+                && channel === privacy_rights_notification_state_type_enum_1.DyNTS_PrivacyRightsNotificationChannel_Type.smtp
+                && (acceptedCount < 1 || rejectedCount !== 0 || pendingCount !== 0 || submissionReference === ''));
+        return valid ? Object.freeze({
+            contractVersion: 'dynts-email-submission-receipt/1', channel: channel,
+            outcome: outcome,
+            submissionReference: submissionReference, acceptedCount: acceptedCount,
+            rejectedCount: rejectedCount, pendingCount: pendingCount,
+        }) : null;
+    }
+    rectifications(value) {
+        if (!Array.isArray(value) || value.length > 64) {
+            return null;
+        }
+        const decisions = [];
+        for (const entry of value) {
+            if (!this.exactRecord(entry, [
+                'fieldCode', 'decision', 'expectedRevision', 'resultingRevision', 'reasonCode',
+            ]) || !this.code(entry.fieldCode) || !this.rectificationDecision(entry.decision)
+                || !this.count(entry.expectedRevision) || !this.count(entry.resultingRevision)
+                || typeof entry.reasonCode !== 'string' || entry.reasonCode.length > 128) {
+                return null;
+            }
+            decisions.push(Object.freeze({
+                fieldCode: entry.fieldCode,
+                decision: entry.decision,
+                expectedRevision: entry.expectedRevision, resultingRevision: entry.resultingRevision,
+                reasonCode: entry.reasonCode,
+            }));
+        }
+        return Object.freeze(decisions);
+    }
+    purposes(value) {
+        if (!Array.isArray(value) || value.length > 64) {
+            return null;
+        }
+        const decisions = [];
+        for (const entry of value) {
+            if (!this.exactRecord(entry, ['purposeCode', 'decision', 'reasonCode', 'exceptionExpiresAt'])
+                || !this.code(entry.purposeCode) || !this.purposeDecision(entry.decision)
+                || typeof entry.reasonCode !== 'string' || entry.reasonCode.length > 128
+                || typeof entry.exceptionExpiresAt !== 'string' || entry.exceptionExpiresAt.length > 24) {
+                return null;
+            }
+            decisions.push(Object.freeze({
+                purposeCode: entry.purposeCode, decision: entry.decision,
+                reasonCode: entry.reasonCode, exceptionExpiresAt: entry.exceptionExpiresAt,
+            }));
+        }
+        return Object.freeze(decisions);
+    }
+    async requireRecord(authority) {
+        const record = await this.collection().findOne({ _id: this.key(authority) }, this.options());
+        if (!record) {
+            throw this.error('NOT_SCHEDULED');
+        }
+        this.assertRecord(record, authority);
+        return record;
+    }
+    assertRecord(record, authority) {
+        if (!this.exactRecord(record, [
+            '_id', 'contractVersion', 'requestId', 'subjectId', 'organizationId', 'executionReference',
+            'executionCompletedAt', 'templateCode', 'state', 'attemptCount', 'revision', 'claimTokenHash',
+            'claimedAt', 'claimExpiresAt', 'channel', 'outcome', 'submissionReference', 'acceptedCount',
+            'rejectedCount', 'pendingCount', 'completedAt',
+        ]) || record._id !== this.key(authority) || record.contractVersion !== 'dynts-privacy-rights-notification/1'
+            || record.requestId !== authority.requestId || record.subjectId !== authority.subjectId
+            || record.organizationId !== authority.organizationId || !/^sha256:[a-f0-9]{64}$/u.test(record.executionReference)
+            || !Number.isFinite(Date.parse(record.executionCompletedAt)) || !this.code(record.templateCode)
+            || !this.settings.templateCodes.includes(record.templateCode)
+            || !Object.values(privacy_rights_notification_state_type_enum_1.DyNTS_PrivacyRightsNotificationState_Type).includes(record.state)
+            || !this.count(record.attemptCount) || !this.count(record.revision)
+            || !this.count(record.acceptedCount) || !this.count(record.rejectedCount) || !this.count(record.pendingCount)
+            || !this.recordStateValid(record)) {
+            throw this.error('RECORD_CORRUPT');
+        }
+    }
+    recordStateValid(record) {
+        if (record.state === privacy_rights_notification_state_type_enum_1.DyNTS_PrivacyRightsNotificationState_Type.pending) {
+            return record.attemptCount === 0 && record.revision === 0 && record.claimTokenHash === ''
+                && record.claimedAt === '' && record.claimExpiresAt === ''
+                && record.channel === privacy_rights_notification_state_type_enum_1.DyNTS_PrivacyRightsNotificationChannel_Type.none && record.outcome === ''
+                && record.submissionReference === '' && record.acceptedCount === 0 && record.rejectedCount === 0
+                && record.pendingCount === 0 && record.completedAt === '';
+        }
+        const claimValid = /^sha256:[a-f0-9]{64}$/u.test(record.claimTokenHash)
+            && Number.isFinite(Date.parse(record.claimedAt)) && Number.isFinite(Date.parse(record.claimExpiresAt))
+            && Date.parse(record.claimExpiresAt) > Date.parse(record.claimedAt) && record.attemptCount === 1
+            && record.revision >= 1;
+        if (record.state === privacy_rights_notification_state_type_enum_1.DyNTS_PrivacyRightsNotificationState_Type.dispatching) {
+            return claimValid && record.revision === 1
+                && record.channel === privacy_rights_notification_state_type_enum_1.DyNTS_PrivacyRightsNotificationChannel_Type.none && record.outcome === ''
+                && record.submissionReference === '' && record.completedAt === '';
+        }
+        if (!claimValid || record.revision !== 2 || !Number.isFinite(Date.parse(record.completedAt))) {
+            return false;
+        }
+        if (record.state === privacy_rights_notification_state_type_enum_1.DyNTS_PrivacyRightsNotificationState_Type.manualReview
+            && record.outcome === email_submission_outcome_enum_1.DyNTS_EmailSubmissionOutcome_Enum.indeterminate
+            && record.channel === privacy_rights_notification_state_type_enum_1.DyNTS_PrivacyRightsNotificationChannel_Type.none) {
+            return record.submissionReference === '' && record.acceptedCount === 0
+                && record.rejectedCount === 0 && record.pendingCount === 0;
+        }
+        const submission = this.submission({
+            contractVersion: 'dynts-email-submission-receipt/1', channel: record.channel, outcome: record.outcome,
+            submissionReference: record.submissionReference, acceptedCount: record.acceptedCount,
+            rejectedCount: record.rejectedCount, pendingCount: record.pendingCount,
+        });
+        return !!submission && ((record.state === privacy_rights_notification_state_type_enum_1.DyNTS_PrivacyRightsNotificationState_Type.submitted
+            && record.outcome === email_submission_outcome_enum_1.DyNTS_EmailSubmissionOutcome_Enum.accepted)
+            || (record.state === privacy_rights_notification_state_type_enum_1.DyNTS_PrivacyRightsNotificationState_Type.rejected
+                && record.outcome === email_submission_outcome_enum_1.DyNTS_EmailSubmissionOutcome_Enum.rejected)
+            || (record.state === privacy_rights_notification_state_type_enum_1.DyNTS_PrivacyRightsNotificationState_Type.manualReview
+                && (record.outcome === email_submission_outcome_enum_1.DyNTS_EmailSubmissionOutcome_Enum.partial
+                    || record.outcome === email_submission_outcome_enum_1.DyNTS_EmailSubmissionOutcome_Enum.indeterminate)));
+    }
+    sameSubmission(record, submission) {
+        return record.channel === submission.channel && record.outcome === submission.outcome
+            && record.submissionReference === submission.submissionReference
+            && record.acceptedCount === submission.acceptedCount && record.rejectedCount === submission.rejectedCount
+            && record.pendingCount === submission.pendingCount;
+    }
+    view(record, created) {
+        return Object.freeze({
+            contractVersion: record.contractVersion, requestId: record.requestId, subjectId: record.subjectId,
+            organizationId: record.organizationId, executionReference: record.executionReference,
+            executionCompletedAt: record.executionCompletedAt, templateCode: record.templateCode, state: record.state,
+            attemptCount: record.attemptCount, channel: record.channel, outcome: record.outcome,
+            submissionReference: record.submissionReference, acceptedCount: record.acceptedCount,
+            rejectedCount: record.rejectedCount, pendingCount: record.pendingCount,
+            completedAt: record.completedAt, created: created,
+        });
+    }
+    claimResult(record, claimed, claimToken) {
+        return Object.freeze({
+            contractVersion: 'dynts-privacy-rights-notification-claim/1', claimed: claimed,
+            claimToken: claimToken, notification: this.view(record, false),
+        });
+    }
+    authority(value) {
+        if (!value || typeof value !== 'object') {
+            throw this.error('AUTHORITY_INVALID');
+        }
+        const descriptors = Object.getOwnPropertyDescriptors(value);
+        const requestId = descriptors.requestId?.value;
+        const subjectId = descriptors.subjectId?.value;
+        const organizationId = descriptors.organizationId?.value;
+        if (!this.code(requestId) || !this.code(subjectId) || !this.code(organizationId)) {
+            throw this.error('AUTHORITY_INVALID');
+        }
+        return Object.freeze({ requestId: requestId, subjectId: subjectId, organizationId: organizationId });
+    }
+    template(value) {
+        if (typeof value !== 'string' || !this.settings.templateCodes.includes(value)) {
+            throw this.error('TEMPLATE_INVALID');
+        }
+        return value;
+    }
+    async inTransaction(session, task) {
+        const concern = session?.transaction?.options?.readConcern;
+        if (!this.isReady || !session?.inTransaction() || session.transaction.options.writeConcern?.w !== 'majority'
+            || (typeof concern === 'string' ? concern : concern?.level) !== 'snapshot') {
+            throw this.error('OWNING_TRANSACTION_REQUIRED');
+        }
+        try {
+            await this.collection().findOne({ _id: '' }, this.transactionOptions(session));
+            return await task();
+        }
+        catch (error) {
+            if (error instanceof mongoose_1.mongo.MongoError && error.hasErrorLabel('TransientTransactionError')) {
+                const retryable = new mongoose_1.mongo.MongoError('DyNTS|PRIVACY_RIGHTS_NOTIFICATION|TRANSACTION_FAILED');
+                retryable.addErrorLabel('TransientTransactionError');
+                throw retryable;
+            }
+            if (error instanceof Error && this.ownedErrors.has(error)) {
+                throw error;
+            }
+            throw this.error('SCHEDULE_FAILED');
+        }
+    }
+    async protect(code, task) {
+        try {
+            return await task();
+        }
+        catch (error) {
+            if (error instanceof Error && this.ownedErrors.has(error)) {
+                throw error;
+            }
+            throw this.error(code);
+        }
+    }
+    assertClaimToken(record, token) {
+        if (!this.token(token) || record.claimTokenHash !== this.tokenHash(token)) {
+            throw this.error('CLAIM_TOKEN_INVALID');
+        }
+    }
+    executionReference(execution) {
+        return `sha256:${(0, node_crypto_1.createHash)('sha256').update(JSON.stringify({
+            contractVersion: execution.contractVersion, requestId: execution.requestId, subjectId: execution.subjectId,
+            organizationId: execution.organizationId, requestType: execution.requestType,
+            policyVersion: execution.policyVersion, expectedRequestRevision: execution.expectedRequestRevision,
+            rectifications: execution.rectifications, purposes: execution.purposes, completedAt: execution.completedAt,
+        })).digest('hex')}`;
+    }
+    tokenHash(token) {
+        return `sha256:${(0, node_crypto_1.createHash)('sha256').update(token).digest('hex')}`;
+    }
+    key(authority) {
+        return (0, node_crypto_1.createHash)('sha256').update(JSON.stringify([
+            'dynts-privacy-rights-notification/1', authority.requestId, authority.subjectId, authority.organizationId,
+        ])).digest('hex');
+    }
+    async databaseTime() {
+        const result = await this.settings.connection.db.command({ hello: 1, maxTimeMS: this.settings.maxOperationTimeMs }, { timeoutMS: this.settings.maxOperationTimeMs });
+        const now = result.localTime;
+        if (!(now instanceof Date) || !Number.isFinite(now.getTime())) {
+            throw this.error('CLOCK_UNAVAILABLE');
+        }
+        return now;
+    }
+    terminal(state) {
+        return state === privacy_rights_notification_state_type_enum_1.DyNTS_PrivacyRightsNotificationState_Type.submitted
+            || state === privacy_rights_notification_state_type_enum_1.DyNTS_PrivacyRightsNotificationState_Type.rejected
+            || state === privacy_rights_notification_state_type_enum_1.DyNTS_PrivacyRightsNotificationState_Type.manualReview;
+    }
+    emailOutcome(value) {
+        return value === email_submission_outcome_enum_1.DyNTS_EmailSubmissionOutcome_Enum.accepted
+            || value === email_submission_outcome_enum_1.DyNTS_EmailSubmissionOutcome_Enum.partial
+            || value === email_submission_outcome_enum_1.DyNTS_EmailSubmissionOutcome_Enum.rejected
+            || value === email_submission_outcome_enum_1.DyNTS_EmailSubmissionOutcome_Enum.indeterminate;
+    }
+    emailChannel(value) {
+        if (value === privacy_rights_notification_state_type_enum_1.DyNTS_PrivacyRightsNotificationChannel_Type.smtp
+            || value === privacy_rights_notification_state_type_enum_1.DyNTS_PrivacyRightsNotificationChannel_Type.testSink) {
+            return value;
+        }
+        return null;
+    }
+    notificationChannel(value) {
+        return value === 'smtp' ? privacy_rights_notification_state_type_enum_1.DyNTS_PrivacyRightsNotificationChannel_Type.smtp
+            : privacy_rights_notification_state_type_enum_1.DyNTS_PrivacyRightsNotificationChannel_Type.testSink;
+    }
+    rightsRequestType(value) {
+        if (value === privacy_request_type_enum_1.DyNTS_PrivacyRequest_Type.rectification || value === privacy_request_type_enum_1.DyNTS_PrivacyRequest_Type.restriction
+            || value === privacy_request_type_enum_1.DyNTS_PrivacyRequest_Type.objection) {
+            return value;
+        }
+        return null;
+    }
+    rectificationDecision(value) {
+        return value === privacy_rights_decision_type_enum_1.DyNTS_PrivacyRightsRectificationDecision_Type.updated
+            || value === privacy_rights_decision_type_enum_1.DyNTS_PrivacyRightsRectificationDecision_Type.correctionRequired
+            || value === privacy_rights_decision_type_enum_1.DyNTS_PrivacyRightsRectificationDecision_Type.refused;
+    }
+    purposeDecision(value) {
+        return value === privacy_rights_decision_type_enum_1.DyNTS_PrivacyRightsPurposeDecision_Type.stopped
+            || value === privacy_rights_decision_type_enum_1.DyNTS_PrivacyRightsPurposeDecision_Type.retainedWithException
+            || value === privacy_rights_decision_type_enum_1.DyNTS_PrivacyRightsPurposeDecision_Type.rejected;
+    }
+    rectificationSemantics(decision) {
+        if (decision.decision === privacy_rights_decision_type_enum_1.DyNTS_PrivacyRightsRectificationDecision_Type.updated) {
+            return decision.resultingRevision > decision.expectedRevision && decision.reasonCode === '';
+        }
+        return this.code(decision.reasonCode);
+    }
+    purposeSemantics(decision, completedAt) {
+        if (decision.decision === privacy_rights_decision_type_enum_1.DyNTS_PrivacyRightsPurposeDecision_Type.stopped) {
+            return decision.reasonCode === '' && decision.exceptionExpiresAt === '';
+        }
+        if (decision.decision === privacy_rights_decision_type_enum_1.DyNTS_PrivacyRightsPurposeDecision_Type.rejected) {
+            return this.code(decision.reasonCode) && decision.exceptionExpiresAt === '';
+        }
+        const exceptionExpiresAt = Date.parse(decision.exceptionExpiresAt);
+        return this.code(decision.reasonCode) && Number.isFinite(exceptionExpiresAt)
+            && exceptionExpiresAt > completedAt;
+    }
+    exactRecord(value, expectedKeys) {
+        if (typeof value !== 'object' || value === null) {
+            return false;
+        }
+        const keys = Reflect.ownKeys(value);
+        return keys.length === expectedKeys.length && expectedKeys.every((key) => {
+            const descriptor = Object.getOwnPropertyDescriptor(value, key);
+            return !!descriptor && 'value' in descriptor;
+        });
+    }
+    assertReady() {
+        if (!this.isReady) {
+            throw this.error('NOT_READY');
+        }
+    }
+    positive(value, maximum) {
+        return Number.isSafeInteger(value) && Number(value) > 0 && Number(value) <= maximum;
+    }
+    count(value) {
+        return Number.isSafeInteger(value) && Number(value) >= 0 && Number(value) <= 1_000_000;
+    }
+    code(value) {
+        return typeof value === 'string' && /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/u.test(value);
+    }
+    token(value) {
+        return typeof value === 'string' && /^[a-f0-9]{64}$/u.test(value);
+    }
+    options() {
+        return { maxTimeMS: this.settings.maxOperationTimeMs };
+    }
+    transactionOptions(session) {
+        return { session: session, maxTimeMS: this.settings.maxOperationTimeMs };
+    }
+    collection() {
+        return this.settings.connection.db.collection('dynts_privacy_rights_notifications');
+    }
+    error(code) {
+        const error = new Error(`DyNTS|PRIVACY_RIGHTS_NOTIFICATION|${code}`);
+        this.ownedErrors.add(error);
+        return error;
+    }
+    validator() {
+        const code = { bsonType: 'string', pattern: '^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$' };
+        const count = {
+            bsonType: ['int', 'long', 'double'], minimum: 0, maximum: Number.MAX_SAFE_INTEGER,
+        };
+        const properties = {
+            _id: { bsonType: 'string', pattern: '^[a-f0-9]{64}$' },
+            contractVersion: { enum: ['dynts-privacy-rights-notification/1'] },
+            requestId: code, subjectId: code, organizationId: code,
+            executionReference: { bsonType: 'string', pattern: '^sha256:[a-f0-9]{64}$' },
+            executionCompletedAt: { bsonType: 'string', maxLength: 24 }, templateCode: code,
+            state: { enum: Object.values(privacy_rights_notification_state_type_enum_1.DyNTS_PrivacyRightsNotificationState_Type) },
+            attemptCount: count, revision: count,
+            claimTokenHash: { bsonType: 'string', maxLength: 71 }, claimedAt: { bsonType: 'string', maxLength: 24 },
+            claimExpiresAt: { bsonType: 'string', maxLength: 24 },
+            channel: { enum: Object.values(privacy_rights_notification_state_type_enum_1.DyNTS_PrivacyRightsNotificationChannel_Type) },
+            outcome: { enum: ['', ...Object.values(email_submission_outcome_enum_1.DyNTS_EmailSubmissionOutcome_Enum)] },
+            submissionReference: { bsonType: 'string', maxLength: 71 }, acceptedCount: count,
+            rejectedCount: count, pendingCount: count, completedAt: { bsonType: 'string', maxLength: 24 },
+        };
+        return { $jsonSchema: { bsonType: 'object', additionalProperties: false,
+                required: Object.keys(properties), properties: properties } };
+    }
+}
+exports.DyNTS_PrivacyRightsNotification_MongoStore = DyNTS_PrivacyRightsNotification_MongoStore;
+//# sourceMappingURL=privacy-rights-notification.mongo-store.js.map