@fuzdev/fuz_app 0.53.0 → 0.54.0

package/dist/auth/CLAUDE.md

@@ -360,7 +360,10 @@ CRUD + listing:
 - `query_permit_find_active_for_actor`, `query_permit_list_for_actor`.
 - `query_permit_has_role(deps, actor_id, role, scope_id?)` — `IS NOT DISTINCT FROM`
   handles the NULL case. Omitted scope matches `scope_id IS NULL` (pre-scope
-  callers keep semantics).
+  callers keep semantics). Use only when checking an arbitrary `actor_id`
+  that isn't the request actor (e.g., post-mutation verification, scripts,
+  audit-time checks). For the request actor, prefer `has_scoped_role` /
+  `has_any_scoped_role` on the in-memory `auth.permits` snapshot.
 - `query_permit_find_account_id_for_role(deps, role)` — joins
   permit → actor → account, returns first match. Used by daemon token
   middleware to resolve the keeper account.
@@ -653,7 +656,17 @@ without being blocked.
   identity (the audit-log SSE uses this to close only the revoked session's
   stream on `session_revoke`).
 - `get_request_context(c)`, `require_request_context(c)` (throws on misuse
-  — misconfigured middleware surfaces immediately), `has_role(ctx, role, now?)`.
+  — misconfigured middleware surfaces immediately).
+- **In-memory permit predicates** — `has_role(ctx, role, now?)`,
+  `has_scoped_role(ctx, role, scope_id, now?)`,
+  `has_any_scoped_role(ctx, roles, scope_id, now?)`. All three take
+  `RequestContext | null` (null returns `false`) so they drop into
+  `auth: 'public'` handlers without a manual narrow. `scope_id === null`
+  matches global permits only; UUID matches that exact scope. Empty
+  `roles` short-circuits `has_any_scoped_role` to `false`. Decide-time
+  predicates only — the predicate / mutation race window is the same as
+  the SQL `query_permit_has_role` style and only a transactional re-check
+  inside the UPDATE/INSERT closes it.
 - `build_request_context(deps, account_id)` — shared helper used by
   session, bearer, and daemon token middleware; does
   `account → actor → permits` and returns `null` if either lookup misses.
@@ -1172,9 +1185,10 @@ codegen invariant and grow the surface linearly per role.
   `eligible_roles` is checked against `roles.role_options` at factory
   time so typos throw at startup instead of at first call.
 
-Grant branch uses `query_permit_has_role` for a benign-TOCTOU pre-check
-(distinguishes new grant from idempotent re-grant), then
-`query_grant_permit` for the actual insert. Revoke branch filters
+Grant branch uses `has_scoped_role(auth, role, null)` for a
+benign-TOCTOU pre-check (distinguishes new grant from idempotent
+re-grant) — reads from the in-memory `auth.permits` snapshot, no DB
+roundtrip — then `query_grant_permit` for the actual insert. Revoke branch filters
 `query_permit_find_active_for_actor` in JS for the matching
 `(actor, role, scope_id IS NULL)` row before calling
 `query_revoke_permit`. Bundle is **not** included in

package/dist/auth/permit_offer_actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permit_offer_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/permit_offer_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAa,KAAK,aAAa,EAAE,KAAK,SAAS,EAAC,MAAM,0BAA0B,CAAC;AAGxF,OAAO,EAAmC,KAAK,gBAAgB,EAAC,MAAM,kBAAkB,CAAC;AAsBzF,OAAO,EAAW,KAAK,cAAc,EAAC,MAAM,sBAAsB,CAAC;AACnE,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,WAAW,CAAC;AAChD,OAAO,EAON,KAAK,kBAAkB,EACvB,MAAM,iCAAiC,CAAC;AAmCzC;;;;;;;;GAQG;AACH,MAAM,MAAM,0BAA0B,GAAG,CACxC,IAAI,EAAE,cAAc,EACpB,KAAK,EAAE;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CAAC,EACrE,IAAI,EAAE,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC,EACnC,GAAG,EAAE,aAAa,KACd,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC,iDAAiD;AACjD,MAAM,WAAW,wBAAwB;IACxC;;;OAGG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,sFAAsF;IACtF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,0BAA0B,CAAC;CACvC;AAyBD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,yBAAyB,EAAE,0BAQvC,CAAC;AAcF;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAsB,SAAQ,IAAI,CAClD,gBAAgB,EAChB,KAAK,GAAG,gBAAgB,GAAG,kBAAkB,CAC7C;IACA,+EAA+E;IAC/E,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CAChD;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,GACvC,MAAM,qBAAqB,EAC3B,UAAS,wBAA6B,KACpC,KAAK,CAAC,SAAS,CAudjB,CAAC"}
+{"version":3,"file":"permit_offer_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/permit_offer_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAa,KAAK,aAAa,EAAE,KAAK,SAAS,EAAC,MAAM,0BAA0B,CAAC;AAGxF,OAAO,EAAmC,KAAK,gBAAgB,EAAC,MAAM,kBAAkB,CAAC;AAkBzF,OAAO,EAA4B,KAAK,cAAc,EAAC,MAAM,sBAAsB,CAAC;AACpF,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,WAAW,CAAC;AAChD,OAAO,EAON,KAAK,kBAAkB,EACvB,MAAM,iCAAiC,CAAC;AAmCzC;;;;;;;;GAQG;AACH,MAAM,MAAM,0BAA0B,GAAG,CACxC,IAAI,EAAE,cAAc,EACpB,KAAK,EAAE;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CAAC,EACrE,IAAI,EAAE,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC,EACnC,GAAG,EAAE,aAAa,KACd,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC,iDAAiD;AACjD,MAAM,WAAW,wBAAwB;IACxC;;;OAGG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,sFAAsF;IACtF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,0BAA0B,CAAC;CACvC;AA4BD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,yBAAyB,EAAE,0BASvC,CAAC;AAcF;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAsB,SAAQ,IAAI,CAClD,gBAAgB,EAChB,KAAK,GAAG,gBAAgB,GAAG,kBAAkB,CAC7C;IACA,+EAA+E;IAC/E,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CAChD;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,GACvC,MAAM,qBAAqB,EAC3B,UAAS,wBAA6B,KACpC,KAAK,CAAC,SAAS,CAudjB,CAAC"}

package/dist/auth/permit_offer_actions.js

@@ -42,10 +42,10 @@ import { emit_after_commit } from '../http/pending_effects.js';
 import { BUILTIN_ROLE_OPTIONS, ROLE_ADMIN } from './role_schema.js';
 import { PERMIT_OFFER_DEFAULT_TTL_MS, to_permit_offer_json } from './permit_offer_schema.js';
 import { query_permit_offer_create, query_permit_offer_decline, query_permit_offer_retract, query_permit_offer_list, query_permit_offer_history_for_account, query_accept_offer, PermitOfferAlreadyTerminalError, PermitOfferExpiredError, PermitOfferNotFoundError, PermitOfferSelfTargetError, } from './permit_offer_queries.js';
-import { query_permit_find_active_role_for_actor, query_permit_has_role, query_revoke_permit, } from './permit_queries.js';
+import { query_permit_find_active_role_for_actor, query_revoke_permit } from './permit_queries.js';
 import { query_actor_by_id } from './account_queries.js';
 import { audit_log_fire_and_forget } from './audit_log_queries.js';
-import { has_role } from './request_context.js';
+import { has_role, has_scoped_role } from './request_context.js';
 import { build_permit_offer_accepted_notification, build_permit_offer_declined_notification, build_permit_offer_received_notification, build_permit_offer_retracted_notification, build_permit_offer_supersede_notification, build_permit_revoke_notification, } from './permit_offer_notifications.js';
 import { ERROR_ACCOUNT_NOT_FOUND, ERROR_PERMIT_NOT_FOUND, ERROR_ROLE_NOT_WEB_GRANTABLE, } from '../http/error_schemas.js';
 import { ERROR_OFFER_EXPIRED, ERROR_OFFER_NOT_AUTHORIZED, ERROR_OFFER_NOT_FOUND, ERROR_OFFER_ROLE_NOT_GRANTABLE, ERROR_OFFER_SELF_TARGET, ERROR_OFFER_TERMINAL, permit_offer_create_action_spec, permit_offer_accept_action_spec, permit_offer_decline_action_spec, permit_offer_retract_action_spec, permit_offer_list_action_spec, permit_offer_history_action_spec, permit_revoke_action_spec, } from './permit_offer_action_specs.js';
@@ -61,10 +61,13 @@ const fan_out_audit_events = (events, on_audit_event, log) => {
         }
     }
 };
-const default_authorize = async (auth, input, _deps, ctx) => {
+// eslint-disable-next-line @typescript-eslint/require-await
+const default_authorize = async (auth, input, _deps, _ctx) => {
     // Caller must hold an active permit for the offered role. Global (no scope)
     // check — the scope-aware "only in this classroom" policy is consumer-level.
-    return query_permit_has_role(ctx, auth.actor.id, input.role);
+    // Reads from the in-memory `auth.permits` snapshot loaded once per request
+    // by `create_request_context_middleware`; no DB roundtrip needed.
+    return has_scoped_role(auth, input.role, null);
 };
 /**
  * Authorization callback that admits any admin and otherwise falls back to
@@ -79,10 +82,10 @@ const default_authorize = async (auth, input, _deps, ctx) => {
  * classroom_student in their own scope) wrap this and short-circuit `true`
  * before delegating.
  */
-export const authorize_admin_or_holder = async (auth, input, _deps, ctx) => {
+export const authorize_admin_or_holder = async (auth, input, _deps, _ctx) => {
     if (has_role(auth, ROLE_ADMIN))
         return true;
-    return query_permit_has_role(ctx, auth.actor.id, input.role);
+    return has_scoped_role(auth, input.role, null);
 };
 /**
  * Narrow `ctx.auth` to non-null. The RPC dispatcher has already enforced

package/dist/auth/request_context.d.ts

@@ -56,13 +56,58 @@ export declare const require_request_context: (c: Context) => RequestContext;
  * Check if a request context has an active permit for a given role.
  *
  * Checks the permits already loaded in the context (no DB query).
+ * Null-tolerant — `null` ctx (unauthenticated) returns `false`. Symmetric
+ * with `has_scoped_role` / `has_any_scoped_role` so the three helpers
+ * compose freely in the same predicate (e.g.
+ * `has_role(auth, ADMIN) || has_scoped_role(auth, role, scope)`).
  *
- * @param ctx - the request context
+ * @param ctx - the request context, or `null` for unauthenticated callers
  * @param role - the role to check
  * @param now - current time (defaults to `new Date()`, pass for testability and hot-path efficiency)
  * @returns `true` if the actor has an active permit for the role
  */
-export declare const has_role: (ctx: RequestContext, role: string, now?: Date) => boolean;
+export declare const has_role: (ctx: RequestContext | null, role: string, now?: Date) => boolean;
+/**
+ * Whether the request context holds an active permit for `role` at `scope_id`.
+ *
+ * Walks the in-memory `ctx.permits` snapshot loaded once per request by
+ * `create_request_context_middleware`; zero DB roundtrip per check. The
+ * "freshness" framing of a SQL re-query is illusory because the race window
+ * is between predicate and the actual mutation, not predicate and middleware
+ * load. Closing that race needs a transactional re-check inside the
+ * UPDATE/INSERT, which neither style provides.
+ *
+ * Null-tolerant — `null` ctx (unauthenticated) returns `false`. Same
+ * convention as `has_role`; lets the helper drop into `auth: 'public'`
+ * handlers without a manual narrow. See `cell_authorize` for the
+ * resource-side analog.
+ *
+ * `scope_id` semantics: in-memory `permit.scope_id` is `string | null`, so
+ * JS `===` matches the SQL `IS NOT DISTINCT FROM` semantics exactly:
+ *
+ * - `scope_id === null` matches global permits (`scope_id IS NULL`).
+ * - `scope_id === '<uuid>'` matches permits bound to that exact scope.
+ *
+ * @param ctx - the request context, or `null` for unauthenticated callers
+ * @param role - the role to check
+ * @param scope_id - the scope to check (`null` for global)
+ * @param now - current time (defaults to `new Date()`, pass for testability and hot-path efficiency)
+ * @returns `true` iff the actor holds an active permit for the role at the requested scope
+ */
+export declare const has_scoped_role: (ctx: RequestContext | null, role: string, scope_id: string | null, now?: Date) => boolean;
+/**
+ * Whether the request context holds an active permit for any role in `roles`
+ * at `scope_id`. Empty `roles` short-circuits to `false` — documents intent
+ * at the call site ("zero roles trivially admit no-one"). Same scope and
+ * null-tolerance semantics as `has_scoped_role`.
+ *
+ * @param ctx - the request context, or `null` for unauthenticated callers
+ * @param roles - the roles that would admit the caller (any-of)
+ * @param scope_id - the scope to check (`null` for global)
+ * @param now - current time (defaults to `new Date()`, pass for testability)
+ * @returns `true` iff the actor holds an active permit for any role in `roles` at the requested scope
+ */
+export declare const has_any_scoped_role: (ctx: RequestContext | null, roles: ReadonlyArray<string>, scope_id: string | null, now?: Date) => boolean;
 /**
  * Create middleware that builds the request context from a session cookie.
  *

package/dist/auth/request_context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request_context.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/request_context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAC,OAAO,EAAE,iBAAiB,EAAC,MAAM,MAAM,CAAC;AACrD,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,yBAAyB,CAAC;AAEpD,OAAO,EAAC,KAAK,OAAO,EAAE,KAAK,KAAK,EAAoB,KAAK,MAAM,EAAC,MAAM,qBAAqB,CAAC;AAQ5F,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,qBAAqB,CAAC;AAOnD,kEAAkE;AAClE,MAAM,WAAW,cAAc;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,KAAK,CAAC;IACb,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACvB;AAED,0DAA0D;AAC1D,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AAErD;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,4BAA4B,CAAC;AAErE;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAAI,GAAG,OAAO,KAAG,cAAc,GAAG,IAEjE,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uBAAuB,GAAI,GAAG,OAAO,KAAG,cAMpD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,QAAQ,GAAI,KAAK,cAAc,EAAE,MAAM,MAAM,EAAE,MAAK,IAAiB,KAAG,OAChB,CAAC;AAEtE;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,iCAAiC,GAC7C,MAAM,SAAS,EACf,KAAK,MAAM,EACX,4BAAuC,KACrC,iBA6CF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,YAAY,EAAE,iBAM1B,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,GAAI,MAAM,MAAM,KAAG,iBAW3C,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,eAAe,GAC3B,KAAK,cAAc,EACnB,MAAM,SAAS,KACb,OAAO,CAAC,cAAc,CAGxB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB,GACjC,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,cAAc,GAAG,IAAI,CAS/B,CAAC"}
+{"version":3,"file":"request_context.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/request_context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAC,OAAO,EAAE,iBAAiB,EAAC,MAAM,MAAM,CAAC;AACrD,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,yBAAyB,CAAC;AAEpD,OAAO,EAAC,KAAK,OAAO,EAAE,KAAK,KAAK,EAAoB,KAAK,MAAM,EAAC,MAAM,qBAAqB,CAAC;AAQ5F,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,qBAAqB,CAAC;AAOnD,kEAAkE;AAClE,MAAM,WAAW,cAAc;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,KAAK,CAAC;IACb,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACvB;AAED,0DAA0D;AAC1D,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AAErD;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,4BAA4B,CAAC;AAErE;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAAI,GAAG,OAAO,KAAG,cAAc,GAAG,IAEjE,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uBAAuB,GAAI,GAAG,OAAO,KAAG,cAMpD,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,QAAQ,GACpB,KAAK,cAAc,GAAG,IAAI,EAC1B,MAAM,MAAM,EACZ,MAAK,IAAiB,KACpB,OAAyF,CAAC;AAE7F;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,eAAe,GAC3B,KAAK,cAAc,GAAG,IAAI,EAC1B,MAAM,MAAM,EACZ,UAAU,MAAM,GAAG,IAAI,EACvB,MAAK,IAAiB,KACpB,OAKF,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB,GAC/B,KAAK,cAAc,GAAG,IAAI,EAC1B,OAAO,aAAa,CAAC,MAAM,CAAC,EAC5B,UAAU,MAAM,GAAG,IAAI,EACvB,MAAK,IAAiB,KACpB,OAMF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,iCAAiC,GAC7C,MAAM,SAAS,EACf,KAAK,MAAM,EACX,4BAAuC,KACrC,iBA6CF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,YAAY,EAAE,iBAM1B,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,GAAI,MAAM,MAAM,KAAG,iBAW3C,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,eAAe,GAC3B,KAAK,cAAc,EACnB,MAAM,SAAS,KACb,OAAO,CAAC,cAAc,CAGxB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB,GACjC,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,cAAc,GAAG,IAAI,CAS/B,CAAC"}

package/dist/auth/request_context.js

@@ -60,13 +60,68 @@ export const require_request_context = (c) => {
  * Check if a request context has an active permit for a given role.
  *
  * Checks the permits already loaded in the context (no DB query).
+ * Null-tolerant — `null` ctx (unauthenticated) returns `false`. Symmetric
+ * with `has_scoped_role` / `has_any_scoped_role` so the three helpers
+ * compose freely in the same predicate (e.g.
+ * `has_role(auth, ADMIN) || has_scoped_role(auth, role, scope)`).
  *
- * @param ctx - the request context
+ * @param ctx - the request context, or `null` for unauthenticated callers
  * @param role - the role to check
  * @param now - current time (defaults to `new Date()`, pass for testability and hot-path efficiency)
  * @returns `true` if the actor has an active permit for the role
  */
-export const has_role = (ctx, role, now = new Date()) => ctx.permits.some((p) => p.role === role && is_permit_active(p, now));
+export const has_role = (ctx, role, now = new Date()) => ctx?.permits.some((p) => p.role === role && is_permit_active(p, now)) ?? false;
+/**
+ * Whether the request context holds an active permit for `role` at `scope_id`.
+ *
+ * Walks the in-memory `ctx.permits` snapshot loaded once per request by
+ * `create_request_context_middleware`; zero DB roundtrip per check. The
+ * "freshness" framing of a SQL re-query is illusory because the race window
+ * is between predicate and the actual mutation, not predicate and middleware
+ * load. Closing that race needs a transactional re-check inside the
+ * UPDATE/INSERT, which neither style provides.
+ *
+ * Null-tolerant — `null` ctx (unauthenticated) returns `false`. Same
+ * convention as `has_role`; lets the helper drop into `auth: 'public'`
+ * handlers without a manual narrow. See `cell_authorize` for the
+ * resource-side analog.
+ *
+ * `scope_id` semantics: in-memory `permit.scope_id` is `string | null`, so
+ * JS `===` matches the SQL `IS NOT DISTINCT FROM` semantics exactly:
+ *
+ * - `scope_id === null` matches global permits (`scope_id IS NULL`).
+ * - `scope_id === '<uuid>'` matches permits bound to that exact scope.
+ *
+ * @param ctx - the request context, or `null` for unauthenticated callers
+ * @param role - the role to check
+ * @param scope_id - the scope to check (`null` for global)
+ * @param now - current time (defaults to `new Date()`, pass for testability and hot-path efficiency)
+ * @returns `true` iff the actor holds an active permit for the role at the requested scope
+ */
+export const has_scoped_role = (ctx, role, scope_id, now = new Date()) => {
+    if (!ctx)
+        return false;
+    return ctx.permits.some((p) => p.role === role && p.scope_id === scope_id && is_permit_active(p, now));
+};
+/**
+ * Whether the request context holds an active permit for any role in `roles`
+ * at `scope_id`. Empty `roles` short-circuits to `false` — documents intent
+ * at the call site ("zero roles trivially admit no-one"). Same scope and
+ * null-tolerance semantics as `has_scoped_role`.
+ *
+ * @param ctx - the request context, or `null` for unauthenticated callers
+ * @param roles - the roles that would admit the caller (any-of)
+ * @param scope_id - the scope to check (`null` for global)
+ * @param now - current time (defaults to `new Date()`, pass for testability)
+ * @returns `true` iff the actor holds an active permit for any role in `roles` at the requested scope
+ */
+export const has_any_scoped_role = (ctx, roles, scope_id, now = new Date()) => {
+    if (!ctx)
+        return false;
+    if (roles.length === 0)
+        return false;
+    return ctx.permits.some((p) => roles.includes(p.role) && p.scope_id === scope_id && is_permit_active(p, now));
+};
 /**
  * Create middleware that builds the request context from a session cookie.
  *

package/dist/auth/self_service_role_actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"self_service_role_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/self_service_role_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAiC,KAAK,SAAS,EAAC,MAAM,0BAA0B,CAAC;AAExF,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,kBAAkB,CAAC;AACvD,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,WAAW,CAAC;AAgBhD,sDAAsD;AACtD,MAAM,WAAW,6BAA6B;IAC7C;;;;OAIG;IACH,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC;;;;OAIG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;CACzB;AAED;;;;;GAKG;AACH,MAAM,MAAM,yBAAyB,GAAG,IAAI,CAC3C,gBAAgB,EAChB,KAAK,GAAG,gBAAgB,GAAG,kBAAkB,CAC7C,CAAC;AAOF;;;;;;;GAOG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,yBAAyB,EAC/B,SAAS,6BAA6B,KACpC,KAAK,CAAC,SAAS,CA4GjB,CAAC"}
+{"version":3,"file":"self_service_role_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/self_service_role_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAiC,KAAK,SAAS,EAAC,MAAM,0BAA0B,CAAC;AAExF,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,kBAAkB,CAAC;AACvD,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,WAAW,CAAC;AAYhD,sDAAsD;AACtD,MAAM,WAAW,6BAA6B;IAC7C;;;;OAIG;IACH,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC;;;;OAIG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;CACzB;AAED;;;;;GAKG;AACH,MAAM,MAAM,yBAAyB,GAAG,IAAI,CAC3C,gBAAgB,EAChB,KAAK,GAAG,gBAAgB,GAAG,kBAAkB,CAC7C,CAAC;AAOF;;;;;;;GAOG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,yBAAyB,EAC/B,SAAS,6BAA6B,KACpC,KAAK,CAAC,SAAS,CA+GjB,CAAC"}

package/dist/auth/self_service_role_actions.js

@@ -33,8 +33,10 @@
  */
 import { rpc_action } from '../actions/action_rpc.js';
 import { jsonrpc_errors } from '../http/jsonrpc_errors.js';
-import { query_grant_permit, query_permit_find_active_for_actor, query_permit_has_role, query_revoke_permit, } from './permit_queries.js';
+import { query_grant_permit, query_revoke_permit } from './permit_queries.js';
 import { audit_log_fire_and_forget } from './audit_log_queries.js';
+import { is_permit_active } from './account_schema.js';
+import { has_scoped_role } from './request_context.js';
 import { ERROR_ROLE_NOT_SELF_SERVICE_ELIGIBLE, self_service_role_set_action_spec, } from './self_service_role_action_specs.js';
 const require_request_auth = (auth) => {
     if (!auth)
@@ -73,13 +75,13 @@ export const create_self_service_role_actions = (deps, options) => {
             // Pre-check for idempotent re-grant. `query_grant_permit` is itself
             // idempotent (returns the existing permit instead of inserting), but
             // it doesn't signal "already existed" vs "newly inserted" — so we
-            // peek first. The TOCTOU window is benign for self-service: two
-            // concurrent grants both observe "no permit", both call
+            // peek first. Reads from the in-memory `auth.permits` snapshot
+            // (no DB roundtrip). The TOCTOU window is benign for self-service:
+            // two concurrent grants both observe "no permit", both call
             // `query_grant_permit`, and one collapses onto the other inside the
             // query's `ON CONFLICT DO NOTHING`. Worst case both responses report
             // `changed: true`; the DB still ends up with exactly one permit.
-            const already = await query_permit_has_role(ctx, auth.actor.id, input.role);
-            if (already) {
+            if (has_scoped_role(auth, input.role, null)) {
                 return { ok: true, enabled: true, changed: false };
             }
             const permit = await query_grant_permit(ctx, {
@@ -103,12 +105,13 @@ export const create_self_service_role_actions = (deps, options) => {
             }, deps);
             return { ok: true, enabled: true, changed: true };
         }
-        // Find an active global permit for this (actor, role). No dedicated
-        // query exists, but `query_permit_find_active_for_actor` returns the
-        // short list of every active permit and we filter in JS — fewer
-        // round-trips than a new helper for a one-call-per-revoke path.
-        const active = await query_permit_find_active_for_actor(ctx, auth.actor.id);
-        const target = active.find((p) => p.role === input.role && p.scope_id === null);
+        // Find an active global permit for this (actor, role) in the in-memory
+        // `auth.permits` snapshot. No DB roundtrip — same correctness-equivalent
+        // pattern as `has_scoped_role` above (race window is between predicate
+        // and `query_revoke_permit`'s actual UPDATE, not between predicate and
+        // middleware load).
+        const now = new Date();
+        const target = auth.permits.find((p) => p.role === input.role && p.scope_id === null && is_permit_active(p, now));
         if (!target) {
             return { ok: true, enabled: false, changed: false };
         }

package/dist/testing/schema_generators.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema_generators.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/schema_generators.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;GAQG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AACtB,OAAO,EAKN,KAAK,YAAY,EACjB,MAAM,yBAAyB,CAAC;AAIjC;;;GAGG;AACH,eAAO,MAAM,aAAa,GAAI,cAAc,CAAC,CAAC,OAAO,KAAG,MAAM,GAAG,IAShE,CAAC;AA+FF,qEAAqE;AACrE,eAAO,MAAM,oBAAoB,GAAI,OAAO,YAAY,EAAE,cAAc,CAAC,CAAC,OAAO,KAAG,OAmEnF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,EAAE,gBAAgB,CAAC,CAAC,SAAS,KAAG,MAa9E,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAC/B,cAAc,CAAC,CAAC,OAAO,KACrB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAkB5B,CAAC"}
+{"version":3,"file":"schema_generators.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/schema_generators.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;GAQG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AACtB,OAAO,EAKN,KAAK,YAAY,EACjB,MAAM,yBAAyB,CAAC;AAIjC;;;GAGG;AACH,eAAO,MAAM,aAAa,GAAI,cAAc,CAAC,CAAC,OAAO,KAAG,MAAM,GAAG,IAShE,CAAC;AA+FF,qEAAqE;AACrE,eAAO,MAAM,oBAAoB,GAAI,OAAO,YAAY,EAAE,cAAc,CAAC,CAAC,OAAO,KAAG,OA+EnF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,EAAE,gBAAgB,CAAC,CAAC,SAAS,KAAG,MAa9E,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAC/B,cAAc,CAAC,CAAC,OAAO,KACrB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAkB5B,CAAC"}

package/dist/testing/schema_generators.js

@@ -182,6 +182,18 @@ export const generate_valid_value = (field, field_schema) => {
             }
             return 'test_value';
         }
+        case 'literal': {
+            // Zod 4 stores literal values on `def.values` (always an array, even
+            // for single-valued literals). Returning the first literal satisfies
+            // `z.literal('foo')` as well as required discriminator fields in
+            // `z.discriminatedUnion` variants — without this branch the literal
+            // would fall through to the default and break parse.
+            const literal_def = zod_unwrap_def(field_schema);
+            if (literal_def.values && literal_def.values.length > 0) {
+                return literal_def.values[0];
+            }
+            return 'test_value';
+        }
         case 'enum': {
             const enum_def = zod_unwrap_def(field_schema);
             if ('entries' in enum_def) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fuzdev/fuz_app",
-  "version": "0.53.0",
+  "version": "0.54.0",
   "description": "fullstack app library",
   "glyph": "🗝",
   "logo": "logo.svg",