@headless-lms/core 0.3.0 → 0.5.0

package/dist/entitlements/service.js

@@ -1,31 +1,59 @@
-import { ConflictError, ForbiddenError, NotFoundError } from "../shared/errors.js";
 import { noopLogger } from "../shared/logger.js";
-import { canModerate, isStaffRole } from "../organizations/roles.js";
+import { ConflictError, ForbiddenError, NotFoundError } from "../shared/errors.js";
 import { entitlementEvents } from "./events.js";
-import { laterExpiry, opensSpace, seesSpace } from "./rules.js";
+import { opensSpace, seesSpace } from "./rules.js";
 //#region src/entitlements/service.ts
 const ENDING_SOON_MS = 10080 * 60 * 1e3;
 const NOTICE_BATCH_SIZE = 100;
 var EntitlementsServiceImpl = class {
 	repo;
 	content;
+	permissions;
 	uow;
 	logger;
 	constructor(params) {
 		this.repo = params.repo;
 		this.content = params.content;
+		this.permissions = params.permissions;
 		this.uow = params.uow;
 		this.logger = params.logger ?? noopLogger;
 	}
-	list(orgId, query) {
+	async list(query, actor) {
+		const orgId = actor.orgId;
+		if (!actor.permissions.has("access:read")) {
+			const contentId = query.contentId;
+			if (!(contentId !== void 0 && actor.permissions.has("progress:read", contentId) && await this.repo.contentTypeOf(orgId, contentId) === "course")) {
+				this.logger.warn("entitlements list refused", {
+					orgId,
+					actorId: actor.id,
+					contentId: contentId ?? null
+				});
+				throw new ForbiddenError(contentId === void 0 ? "You need access:read" : "You need access:read, or progress:read on this course, to see who holds it");
+			}
+		}
 		return this.repo.list(orgId, query);
 	}
-	async grant(orgId, input) {
+	async grant(input, actor) {
+		const orgId = actor.orgId;
+		const { contentType, ...grant } = input;
+		const contentId = grant.contentId ?? null;
+		const type = contentId === null ? null : await this.repo.contentTypeOf(orgId, contentId);
+		if (contentType !== void 0 && type !== contentType) throw new NotFoundError(contentType === "event" ? "Event" : "Content", contentId ?? "");
+		if (contentId !== null && type === "event") return this.grantEvent({
+			...grant,
+			contentId
+		}, actor);
+		actor.permissions.require("access:write");
+		if (contentId !== null && type === null) throw new NotFoundError("Content", contentId);
 		const entitlement = await this.uow.run(async ({ entitlements, outbox }) => {
-			const created = await entitlements.insert(orgId, input);
+			const created = await entitlements.insert(orgId, {
+				...grant,
+				source: this.sourceOf(actor, grant.orgUserId)
+			});
 			await outbox.append([entitlementEvents.entitlementCreated.make({
 				orgId,
-				data: created
+				data: created,
+				metadata: this.actorMetadata(actor)
 			})]);
 			return created;
 		});
@@ -34,73 +62,144 @@ var EntitlementsServiceImpl = class {
 			entitlementId: entitlement.id,
 			orgUserId: entitlement.orgUserId,
 			bundleId: entitlement.bundleId,
-			contentId: entitlement.contentId
+			contentId: entitlement.contentId,
+			source: entitlement.source,
+			actorId: actor.id
 		});
 		return entitlement;
 	}
-	async ensureGrant(orgId, input) {
-		const { entitlement, change } = await this.uow.run(async ({ entitlements, outbox }) => {
-			const created = await entitlements.insertIfAbsent(orgId, input);
-			if (created) {
-				await outbox.append([entitlementEvents.entitlementCreated.make({
+	async revoke(input, actor) {
+		const orgId = actor.orgId;
+		const { orgUserId } = input;
+		const contentId = input.contentId ?? null;
+		const bundleId = input.bundleId ?? null;
+		const type = contentId === null ? null : await this.repo.contentTypeOf(orgId, contentId);
+		if (input.contentType !== void 0 && type !== input.contentType) throw new NotFoundError(input.contentType === "event" ? "Event" : "Content", contentId ?? "");
+		if (type === "event" && contentId !== null) {
+			if (orgUserId !== actor.id) this.requireAttendeeManager(actor, contentId);
+		} else {
+			actor.permissions.require("access:write");
+			if (contentId !== null && type === null) throw new NotFoundError("Content", contentId);
+		}
+		const target = contentId ?? bundleId;
+		const revoked = await this.uow.run(async ({ entitlements, outbox }) => {
+			const existing = await entitlements.lockGrant(orgId, {
+				orgUserId,
+				contentId,
+				bundleId
+			});
+			if (!existing || !activeNow(existing, /* @__PURE__ */ new Date())) {
+				this.logger.warn("entitlement revoke rejected — no direct active grant", {
 					orgId,
-					data: created
-				})]);
+					orgUserId,
+					contentId,
+					bundleId,
+					actorId: actor.id
+				});
+				throw new NotFoundError("Entitlement", `${orgUserId}:${target}`);
+			}
+			const updated = await entitlements.setStatus(orgId, existing.id, "revoked");
+			if (!updated) throw new NotFoundError("Entitlement", existing.id);
+			await outbox.append([entitlementEvents.entitlementDeleted.make({
+				orgId,
+				data: updated,
+				metadata: this.actorMetadata(actor)
+			})]);
+			return updated;
+		});
+		this.logger.info("entitlement revoked", {
+			orgId,
+			entitlementId: revoked.id,
+			orgUserId,
+			contentId,
+			bundleId,
+			actorId: actor.id
+		});
+		return revoked;
+	}
+	async grantEvent(input, actor) {
+		const orgId = actor.orgId;
+		const eventId = input.contentId;
+		const orgUserId = input.orgUserId;
+		const self = orgUserId === actor.id;
+		if (!self) this.requireAttendeeManager(actor, eventId);
+		const event = await this.content.getEvent(eventId, this.system(orgId));
+		const now = /* @__PURE__ */ new Date();
+		if (self) await this.assertCanRegister(event, actor, now);
+		else assertOpenForAttendees(event, now);
+		const { entitlement, created } = await this.uow.run(async ({ entitlements, outbox }) => {
+			if (event.settings.capacity !== null) await entitlements.lockCapacity(orgId, eventId);
+			const existing = await entitlements.lockGrant(orgId, {
+				orgUserId,
+				contentId: eventId
+			});
+			if (existing && activeNow(existing, now)) {
+				if (self) throw alreadyRegistered();
 				return {
-					entitlement: created,
-					change: "created"
+					entitlement: existing,
+					created: false
 				};
 			}
-			const existing = await entitlements.lockGrant(orgId, input);
-			if (!existing) throw new ConflictError("The grant changed while it was being given");
-			if (existing.status === "revoked") return {
-				entitlement: existing,
-				change: null
-			};
-			const expiresAt = laterExpiry(existing.expiresAt, input.expiresAt ?? null);
-			if (expiresAt?.getTime() === existing.expiresAt?.getTime()) return {
-				entitlement: existing,
-				change: null
-			};
-			const updated = await entitlements.setExpiresAt(orgId, existing.id, expiresAt);
-			if (!updated) throw new NotFoundError("Entitlement", existing.id);
-			await outbox.append([entitlementEvents.entitlementUpdated.make({
+			await this.assertPlace(entitlements, orgId, event, orgUserId);
+			const inserted = await entitlements.insert(orgId, {
+				orgUserId,
+				contentId: eventId,
+				expiresAt: self ? null : input.expiresAt ?? null,
+				source: this.sourceOf(actor, orgUserId)
+			});
+			await outbox.append([entitlementEvents.entitlementCreated.make({
 				orgId,
-				data: updated
+				data: inserted,
+				metadata: this.actorMetadata(actor)
 			})]);
 			return {
-				entitlement: updated,
-				change: "updated"
+				entitlement: inserted,
+				created: true
 			};
 		});
-		if (change) this.logger.info(change === "created" ? "entitlement granted" : "entitlement extended", {
+		if (created) this.logger.info("entitlement granted", {
 			orgId,
 			entitlementId: entitlement.id,
-			orgUserId: entitlement.orgUserId,
-			bundleId: entitlement.bundleId,
-			contentId: entitlement.contentId
+			orgUserId,
+			contentId: eventId,
+			source: entitlement.source,
+			actorId: actor.id
 		});
 		return entitlement;
 	}
-	async setStatus(orgId, id, status) {
-		const entitlement = await this.uow.run(async ({ entitlements, outbox }) => {
-			const updated = await entitlements.setStatus(orgId, id, status);
-			if (!updated) return null;
-			await outbox.append([status === "revoked" ? entitlementEvents.entitlementDeleted.make({
-				orgId,
-				data: updated
-			}) : entitlementEvents.entitlementUpdated.make({
-				orgId,
-				data: updated
-			})]);
-			return updated;
-		});
-		if (entitlement) this.logger.info("entitlement status changed", {
-			orgId,
-			entitlementId: id,
-			status
+	async assertCanRegister(event, actor, now) {
+		if (event.status !== "published") throw new NotFoundError("Event", event.id);
+		if (await this.repo.hasAccess(actor.orgId, actor.id, event.id)) throw alreadyRegistered();
+		if (event.settings.type !== "public") {
+			this.logger.warn("event registration refused — private", {
+				orgId: actor.orgId,
+				eventId: event.id,
+				actorId: actor.id
+			});
+			throw new ForbiddenError("This event is private: only its organizers can add attendees");
+		}
+		if (event.startsAt.getTime() <= now.getTime()) throw new ConflictError("This event has already started", "started");
+	}
+	requireAttendeeManager(actor, eventId) {
+		if (actor.permissions.has("access:write") || actor.permissions.has("events:write", eventId)) return;
+		this.logger.warn("event attendees refused — cannot manage", {
+			orgId: actor.orgId,
+			eventId,
+			actorId: actor.id
 		});
-		return entitlement;
+		throw new ForbiddenError("You need access:write, or events:write on this event");
+	}
+	async assertPlace(entitlements, orgId, event, orgUserId) {
+		const capacity = event.settings.capacity;
+		if (capacity === null) return;
+		if ((await entitlements.grantedOrgUserIds(orgId, event.id)).filter((id) => id !== orgUserId).length >= capacity) throw new ConflictError("This event is full", "full");
+	}
+	sourceOf(actor, orgUserId) {
+		if (actor.id === this.system(actor.orgId).id) return "automation";
+		return orgUserId === actor.id ? "self" : "manual";
+	}
+	actorMetadata(actor) {
+		return actor.id === this.system(actor.orgId).id ? {} : { actorId: actor.id };
 	}
 	hasAccess(orgId, orgUserId, contentId) {
 		return this.repo.hasAccess(orgId, orgUserId, contentId);
@@ -108,66 +207,104 @@ var EntitlementsServiceImpl = class {
 	listAccessibleContent(orgId, orgUserId, type) {
 		return this.repo.listAccessibleContent(orgId, orgUserId, type);
 	}
-	async isCommunityMember(orgId, actor, communityId) {
-		return (await this.accessOf(orgId, actor.id, communityId, null))?.member === true;
+	holdsAnyGrant(orgId, orgUserId) {
+		return this.repo.holdsAnyGrant(orgId, orgUserId);
+	}
+	async opensEverySpace(actor, communityId) {
+		return (await this.standingOf(actor, communityId, null)).everySpace;
 	}
-	async canOpenSpace(orgId, actor, spaceId) {
-		const space = await this.content.getSpace(orgId, spaceId);
+	async isCommunityMember(communityId, actor) {
+		if (actor.permissions.has("communities:read", communityId)) return true;
+		return this.repo.hasCommunityAccess(actor.orgId, actor.id, communityId);
+	}
+	async canOpenSpace(spaceId, actor) {
+		const space = await this.content.getSpace(spaceId, this.system(actor.orgId));
 		if (!space) return false;
-		return this.canOpen(orgId, actor, space);
+		return this.canOpen(space, actor);
 	}
-	async canOpen(orgId, actor, space) {
-		const facts = await this.accessOf(orgId, actor.id, space.communityId, space.id);
-		if (!facts) return false;
-		return opensSpace(facts.role, facts.member, space.accessRule, facts.activeInSpace);
+	async canOpen(space, actor) {
+		const standing = await this.standingOf(actor, space.communityId, space.id);
+		return opensSpace(standing.member, standing.everySpace, space.accessRule, standing.activeInSpace);
 	}
-	async spaceStandings(orgId, actor, communityId) {
-		const rows = await this.repo.listSpaceMembersFor(orgId, actor.id, communityId);
+	async spaceStandings(communityId, actor) {
+		if ((await this.standingOf(actor, communityId, null)).everySpace) return {};
+		const rows = await this.repo.listSpaceMembersFor(actor.orgId, actor.id, communityId);
 		return Object.fromEntries(rows.map((row) => [row.spaceId, row.status]));
 	}
-	async openSpacesFor(orgId, actor, communityId) {
-		const facts = await this.accessOf(orgId, actor.id, communityId, null);
-		if (!facts?.member) return [];
-		const [spaces, activeIds] = await Promise.all([this.content.listSpaces(orgId, communityId), this.repo.activeSpaceIds(orgId, actor.id, communityId)]);
+	async openSpacesFor(communityId, actor) {
+		const orgId = actor.orgId;
+		const standing = await this.standingOf(actor, communityId, null);
+		if (!standing.member) return [];
+		const [spaces, activeIds] = await Promise.all([this.content.listSpaces(communityId, this.system(orgId)), standing.everySpace ? Promise.resolve([]) : this.repo.activeSpaceIds(orgId, actor.id, communityId)]);
 		const active = new Set(activeIds);
-		return spaces.filter((space) => opensSpace(facts.role, facts.member, space.accessRule, active.has(space.id)));
+		return spaces.filter((space) => opensSpace(true, standing.everySpace, space.accessRule, active.has(space.id)));
 	}
-	async openSpaceIds(orgId, actor, communityId) {
-		return (await this.openSpacesFor(orgId, actor, communityId)).map((space) => space.id);
+	async openSpaceIds(communityId, actor) {
+		return (await this.openSpacesFor(communityId, actor)).map((space) => space.id);
 	}
 	async communityMembersAmong(orgId, communityId, orgUserIds) {
 		if (orgUserIds.length === 0) return [];
-		return (await this.repo.accessAmong(orgId, communityId, null, orgUserIds)).filter((fact) => fact.member).map((fact) => fact.orgUserId);
+		const [facts, team] = await Promise.all([this.repo.accessAmong(orgId, communityId, null, orgUserIds), this.teamOf(orgId, communityId)]);
+		return facts.filter((fact) => standingFrom(fact, team).member).map((fact) => fact.orgUserId);
 	}
 	async spaceOpenersAmong(orgId, spaceId, orgUserIds) {
 		if (orgUserIds.length === 0) return [];
-		const space = await this.content.getSpace(orgId, spaceId);
+		const space = await this.content.getSpace(spaceId, this.system(orgId));
 		if (!space) return [];
-		return (await this.repo.accessAmong(orgId, space.communityId, space.id, orgUserIds)).filter((fact) => opensSpace(fact.role, fact.member, space.accessRule, fact.activeInSpace)).map((fact) => fact.orgUserId);
+		const [facts, team] = await Promise.all([this.repo.accessAmong(orgId, space.communityId, space.id, orgUserIds), this.teamOf(orgId, space.communityId)]);
+		return facts.filter((fact) => {
+			const standing = standingFrom(fact, team);
+			return opensSpace(standing.member, standing.everySpace, space.accessRule, standing.activeInSpace);
+		}).map((fact) => fact.orgUserId);
 	}
 	async spaceOpeners(orgId, spaceId) {
-		const space = await this.content.getSpace(orgId, spaceId);
+		const space = await this.content.getSpace(spaceId, this.system(orgId));
 		if (!space) return [];
-		const members = await this.repo.communityMemberIds(orgId, space.communityId);
+		const members = await this.communityMemberIds(orgId, space.communityId);
 		return this.spaceOpenersAmong(orgId, spaceId, members);
 	}
 	communitiesOpenedBy(orgId, grant) {
 		return this.repo.communitiesOpenedBy(orgId, grant);
 	}
-	communityModeratorIds(orgId, communityId) {
-		return this.repo.communityModeratorIds(orgId, communityId);
+	async communityModeratorIds(orgId, communityId) {
+		const moderators = await this.permissions.holders(orgId, "communities:moderate", communityId);
+		return this.communityMembersAmong(orgId, communityId, moderators);
 	}
 	communityIdsOpenedFor(orgId, orgUserId) {
 		return this.repo.communityIdsOpenedFor(orgId, orgUserId);
 	}
-	countActiveSpaceMembers(orgId, spaceId) {
-		return this.repo.countActiveSpaceMembers(orgId, spaceId);
+	openCommunityIds(actor) {
+		const readable = actor.permissions.where("communities:read");
+		return this.repo.openCommunityIds(actor.orgId, actor.id, {
+			all: readable.org,
+			ids: readable.content
+		});
+	}
+	async communityMemberIds(orgId, communityId) {
+		const readers = await this.permissions.holders(orgId, "communities:read", communityId);
+		return this.repo.communityMemberIds(orgId, communityId, readers);
+	}
+	grantedOrgUserIds(orgId, contentId) {
+		return this.repo.grantedOrgUserIds(orgId, contentId);
+	}
+	async countActiveSpaceMembers(orgId, spaceId) {
+		const space = await this.content.getSpace(spaceId, this.system(orgId));
+		if (!space) return 0;
+		const excluding = await this.everySpaceOpeners(orgId, space.communityId);
+		return this.repo.countActiveSpaceMembers(orgId, spaceId, excluding);
+	}
+	async everySpaceOpeners(orgId, communityId) {
+		const team = await this.teamOf(orgId, communityId);
+		const moderators = [...team.moderators].filter((id) => !team.readers.has(id));
+		const granted = moderators.length === 0 ? [] : (await this.repo.accessAmong(orgId, communityId, null, moderators)).filter((fact) => fact.granted).map((fact) => fact.orgUserId);
+		return [...team.readers, ...granted];
 	}
-	async requestJoin(orgId, actor, communityId, spaceId) {
-		const space = await this.requireVisibleSpaceIn(orgId, actor, communityId, spaceId);
+	async requestJoin(communityId, spaceId, actor) {
+		const orgId = actor.orgId;
+		const space = await this.requireVisibleSpaceIn(actor, communityId, spaceId);
 		this.assertRule(space.accessRule, "by_request");
-		if (canModerate(actor.role)) throw new ForbiddenError("Staff do not request a place in a space");
-		await this.assertGrant(orgId, actor, actor.id, space.communityId);
+		await this.assertHolder(actor, space.communityId);
+		await this.assertMember(actor, actor.id, space.communityId);
 		const created = await this.createMember(orgId, actor, space, actor.id, "requested", "request");
 		this.logger.info("space member created", {
 			orgId,
@@ -178,11 +315,12 @@ var EntitlementsServiceImpl = class {
 		});
 		return created;
 	}
-	async invite(orgId, actor, communityId, spaceId, orgUserId) {
-		const space = await this.requireVisibleSpaceIn(orgId, actor, communityId, spaceId);
+	async invite(communityId, spaceId, orgUserId, actor) {
+		const orgId = actor.orgId;
+		const space = await this.requireVisibleSpaceIn(actor, communityId, spaceId);
+		await this.assertCanManage(actor, space.communityId);
 		this.assertRule(space.accessRule, "by_invite");
-		await this.assertCanManage(orgId, actor, space.communityId);
-		await this.assertHolds(orgId, actor, orgUserId, space.communityId);
+		await this.assertHolds(actor, orgUserId, space.communityId);
 		const created = await this.createMember(orgId, actor, space, orgUserId, "invited", "invite");
 		this.logger.info("space member created", {
 			orgId,
@@ -193,11 +331,13 @@ var EntitlementsServiceImpl = class {
 		});
 		return created;
 	}
-	async addSpaceMember(orgId, actor, communityId, spaceId, orgUserId) {
-		const space = await this.requireVisibleSpaceIn(orgId, actor, communityId, spaceId);
+	async addSpaceMember(communityId, spaceId, orgUserId, actor) {
+		const orgId = actor.orgId;
+		const space = await this.requireVisibleSpaceIn(actor, communityId, spaceId);
+		await this.assertCanManage(actor, space.communityId);
 		this.assertHasMembers(space.accessRule);
-		await this.assertCanManage(orgId, actor, space.communityId);
-		await this.assertHolds(orgId, actor, orgUserId, space.communityId);
+		await this.assertHolds(actor, orgUserId, space.communityId);
+		const excluding = await this.everySpaceOpeners(orgId, space.communityId);
 		const created = await this.uow.run(async (scope) => {
 			const locked = await this.lockSpace(scope.spaces, orgId, spaceId);
 			this.assertHasMembers(locked.accessRule);
@@ -207,7 +347,10 @@ var EntitlementsServiceImpl = class {
 				orgUserId,
 				status: "active",
 				source: "manual"
-			}, locked);
+			}, {
+				space: locked,
+				excluding
+			});
 		});
 		this.logger.info("space member created", {
 			orgId,
@@ -218,41 +361,46 @@ var EntitlementsServiceImpl = class {
 		});
 		return created;
 	}
-	async accept(orgId, actor, communityId, spaceId) {
-		this.assertHolder(actor);
-		const space = await this.requireVisibleSpaceIn(orgId, actor, communityId, spaceId);
+	async accept(communityId, spaceId, actor) {
+		const orgId = actor.orgId;
+		const space = await this.requireVisibleSpaceIn(actor, communityId, spaceId);
 		this.assertRule(space.accessRule, "by_invite");
-		await this.assertGrant(orgId, actor, actor.id, space.communityId);
-		return this.activate(orgId, actor, spaceId, actor.id, "by_invite", "invited", () => ownRowMissing("invited"));
-	}
-	async approve(orgId, actor, communityId, spaceId, orgUserId) {
-		const space = await this.requireVisibleSpaceIn(orgId, actor, communityId, spaceId);
+		await this.assertHolder(actor, space.communityId);
+		await this.assertMember(actor, actor.id, space.communityId);
+		const excluding = await this.everySpaceOpeners(orgId, space.communityId);
+		return this.activate(orgId, actor, spaceId, actor.id, "by_invite", "invited", excluding, () => ownRowMissing("invited"));
+	}
+	async approve(communityId, spaceId, orgUserId, actor) {
+		const orgId = actor.orgId;
+		const space = await this.requireVisibleSpaceIn(actor, communityId, spaceId);
+		await this.assertCanManage(actor, space.communityId);
 		this.assertRule(space.accessRule, "by_request");
-		await this.assertCanManage(orgId, actor, space.communityId);
-		await this.assertGrant(orgId, actor, orgUserId, space.communityId);
-		return this.activate(orgId, actor, spaceId, orgUserId, "by_request", "requested", () => new NotFoundError("Space member", orgUserId));
-	}
-	async decline(orgId, actor, communityId, spaceId, orgUserId) {
-		const space = await this.requireVisibleSpaceIn(orgId, actor, communityId, spaceId);
-		await this.assertCanManage(orgId, actor, space.communityId);
-		return this.deleteMember(orgId, actor, spaceId, orgUserId, "requested", () => new NotFoundError("Space member", orgUserId));
-	}
-	async refuse(orgId, actor, communityId, spaceId) {
-		const space = await this.requireVisibleSpaceIn(orgId, actor, communityId, spaceId);
-		this.assertHolder(actor);
-		await this.assertGrant(orgId, actor, actor.id, space.communityId);
-		return this.deleteMember(orgId, actor, spaceId, actor.id, "invited", () => ownRowMissing("invited"));
-	}
-	async leave(orgId, actor, communityId, spaceId) {
-		const space = await this.requireVisibleSpaceIn(orgId, actor, communityId, spaceId);
-		this.assertHolder(actor);
-		await this.assertGrant(orgId, actor, actor.id, space.communityId);
-		return this.deleteMember(orgId, actor, spaceId, actor.id, "active", () => ownRowMissing("active"));
-	}
-	async remove(orgId, actor, communityId, spaceId, orgUserId) {
-		const space = await this.requireVisibleSpaceIn(orgId, actor, communityId, spaceId);
+		await this.assertHolds(actor, orgUserId, space.communityId);
+		const excluding = await this.everySpaceOpeners(orgId, space.communityId);
+		return this.activate(orgId, actor, spaceId, orgUserId, "by_request", "requested", excluding, () => new NotFoundError("Space member", orgUserId));
+	}
+	async decline(communityId, spaceId, orgUserId, actor) {
+		const space = await this.requireVisibleSpaceIn(actor, communityId, spaceId);
+		await this.assertCanManage(actor, space.communityId);
+		return this.deleteMember(actor.orgId, actor, spaceId, orgUserId, "requested", () => new NotFoundError("Space member", orgUserId));
+	}
+	async refuse(communityId, spaceId, actor) {
+		const space = await this.requireVisibleSpaceIn(actor, communityId, spaceId);
+		await this.assertHolder(actor, space.communityId);
+		await this.assertMember(actor, actor.id, space.communityId);
+		return this.deleteMember(actor.orgId, actor, spaceId, actor.id, "invited", () => ownRowMissing("invited"));
+	}
+	async leave(communityId, spaceId, actor) {
+		const space = await this.requireVisibleSpaceIn(actor, communityId, spaceId);
+		await this.assertHolder(actor, space.communityId);
+		await this.assertMember(actor, actor.id, space.communityId);
+		return this.deleteMember(actor.orgId, actor, spaceId, actor.id, "active", () => ownRowMissing("active"));
+	}
+	async remove(communityId, spaceId, orgUserId, actor) {
+		const orgId = actor.orgId;
+		const space = await this.requireVisibleSpaceIn(actor, communityId, spaceId);
+		await this.assertCanManage(actor, space.communityId);
 		this.assertHasMembers(space.accessRule);
-		await this.assertCanManage(orgId, actor, space.communityId);
 		const { updated, previousStatus } = await this.uow.run(async ({ entitlements, spaces, outbox }) => {
 			const locked = await this.lockSpace(spaces, orgId, spaceId);
 			this.assertHasMembers(locked.accessRule);
@@ -273,7 +421,7 @@ var EntitlementsServiceImpl = class {
 				orgId,
 				data: next,
 				metadata: {
-					actorOrgUserId: actor.id,
+					actorId: actor.id,
 					previousStatus: row.status
 				}
 			})]);
@@ -291,18 +439,32 @@ var EntitlementsServiceImpl = class {
 		});
 		return updated;
 	}
-	async listSpaceMembers(orgId, actor, communityId, spaceId, query) {
-		const space = await this.requireVisibleSpaceIn(orgId, actor, communityId, spaceId);
-		if (!await this.canOpen(orgId, actor, space)) throw new NotFoundError("Space", spaceId);
+	async listSpaceMembers(communityId, spaceId, query, actor) {
+		const orgId = actor.orgId;
+		const space = await this.requireVisibleSpaceIn(actor, communityId, spaceId);
+		if (!await this.canOpen(space, actor)) throw new NotFoundError("Space", spaceId);
+		const excluding = await this.everySpaceOpeners(orgId, space.communityId);
 		return this.repo.listSpaceMembers(orgId, spaceId, {
 			...query,
-			...canModerate(actor.role) ? {} : { statuses: ["active"] }
+			excluding,
+			...actor.permissions.has("communities:moderate", space.communityId) ? {} : { statuses: ["active"] }
 		});
 	}
-	hasDueNotices(orgId, now) {
-		return this.repo.hasDueNotices(orgId, now, new Date(now.getTime() + ENDING_SOON_MS));
+	async expireDueGrants(now) {
+		const orgIds = await this.repo.orgIdsWithDueNotices(now, new Date(now.getTime() + ENDING_SOON_MS));
+		let failed = 0;
+		for (const orgId of orgIds) try {
+			await this.expireDueIn(orgId, now);
+		} catch (err) {
+			failed += 1;
+			this.logger.error("due grants not expired", {
+				orgId,
+				err
+			});
+		}
+		if (failed > 0) throw new Error(`due grants of ${failed} orgs could not be expired`);
 	}
-	async expireDue(orgId, now) {
+	async expireDueIn(orgId, now) {
 		const until = new Date(now.getTime() + ENDING_SOON_MS);
 		let appended = 0;
 		let afterId;
@@ -372,8 +534,34 @@ var EntitlementsServiceImpl = class {
 			events: appended
 		});
 	}
+	system(orgId) {
+		return this.permissions.systemActor(orgId);
+	}
+	async teamOf(orgId, communityId) {
+		const [readers, moderators] = await Promise.all([this.permissions.holders(orgId, "communities:read", communityId), this.permissions.holders(orgId, "communities:moderate", communityId)]);
+		return {
+			readers: new Set(readers),
+			moderators: new Set(moderators)
+		};
+	}
+	async standingOf(actor, communityId, spaceId) {
+		const reads = actor.permissions.has("communities:read", communityId);
+		const moderates = actor.permissions.has("communities:moderate", communityId);
+		if (reads) return {
+			member: true,
+			everySpace: true,
+			activeInSpace: false
+		};
+		const facts = await this.accessOf(actor.orgId, actor.id, communityId, spaceId);
+		const member = facts?.granted === true;
+		return {
+			member,
+			everySpace: member && moderates,
+			activeInSpace: facts?.activeInSpace === true
+		};
+	}
 	async requireSpaceIn(orgId, communityId, spaceId) {
-		const space = await this.content.getSpace(orgId, spaceId);
+		const space = await this.content.getSpace(spaceId, this.system(orgId));
 		if (!space || space.communityId !== communityId) {
 			this.logger.warn("space members rejected — space not found", {
 				orgId,
@@ -384,11 +572,13 @@ var EntitlementsServiceImpl = class {
 		}
 		return space;
 	}
-	async requireVisibleSpaceIn(orgId, actor, communityId, spaceId) {
+	async requireVisibleSpaceIn(actor, communityId, spaceId) {
+		const orgId = actor.orgId;
 		const space = await this.requireSpaceIn(orgId, communityId, spaceId);
-		if (seesSpace(actor.role, space.accessRule, void 0)) return space;
+		if (seesSpace(false, space.accessRule, void 0)) return space;
+		if (await this.opensEverySpace(actor, communityId)) return space;
 		const row = await this.repo.findSpaceMember(orgId, spaceId, actor.id);
-		if (!seesSpace(actor.role, space.accessRule, row?.status)) throw new NotFoundError("Space", spaceId);
+		if (!seesSpace(false, space.accessRule, row?.status)) throw new NotFoundError("Space", spaceId);
 		return space;
 	}
 	assertHasMembers(accessRule) {
@@ -398,21 +588,39 @@ var EntitlementsServiceImpl = class {
 		this.assertHasMembers(accessRule);
 		if (accessRule !== expected) throw new ConflictError(accessRule === "by_invite" ? "This space is by invitation" : "This space is by request");
 	}
-	assertHolder(actor) {
-		if (isStaffRole(actor.role)) throw new ForbiddenError("Staff do not hold a place in a space");
+	async assertHolder(actor, communityId) {
+		if (await this.opensEverySpace(actor, communityId)) {
+			this.logger.warn("space place refused — opens every space", {
+				orgId: actor.orgId,
+				communityId,
+				actorId: actor.id
+			});
+			throw new ForbiddenError("You open every space in this community and hold no place in them");
+		}
 	}
-	async assertGrant(orgId, actor, orgUserId, communityId) {
-		if (!await this.repo.hasCommunityAccess(orgId, orgUserId, communityId)) throw new ForbiddenError(orgUserId === actor.id ? "You are not a member of this community" : "That person is not a member of this community");
+	async assertMember(actor, orgUserId, communityId) {
+		if (!(orgUserId === actor.id ? await this.isCommunityMember(communityId, actor) : (await this.communityMembersAmong(actor.orgId, communityId, [orgUserId])).length > 0)) throw new ForbiddenError(orgUserId === actor.id ? "You are not a member of this community" : "That person is not a member of this community");
 	}
-	async assertHolds(orgId, actor, orgUserId, communityId) {
-		const facts = await this.accessOf(orgId, orgUserId, communityId, null);
-		if (facts && isStaffRole(facts.role)) throw new ForbiddenError("Staff do not hold a place in a space");
-		await this.assertGrant(orgId, actor, orgUserId, communityId);
+	async assertHolds(actor, orgUserId, communityId) {
+		if ((await this.everySpaceOpeners(actor.orgId, communityId)).includes(orgUserId)) {
+			this.logger.warn("space place refused — person opens every space", {
+				orgId: actor.orgId,
+				communityId,
+				orgUserId,
+				actorId: actor.id
+			});
+			throw new ForbiddenError("That person opens every space in this community and holds no place in them");
+		}
+		await this.assertMember(actor, orgUserId, communityId);
 	}
-	async assertCanManage(orgId, actor, communityId) {
-		const facts = await this.accessOf(orgId, actor.id, communityId, null);
-		if (facts?.member && canModerate(facts.role)) return;
-		throw new ForbiddenError("You cannot manage members of this space");
+	async assertCanManage(actor, communityId) {
+		if (actor.permissions.has("communities:moderate", communityId) && await this.isCommunityMember(communityId, actor)) return;
+		this.logger.warn("space members refused — cannot manage", {
+			orgId: actor.orgId,
+			communityId,
+			actorId: actor.id
+		});
+		throw new ForbiddenError("You need communities:moderate on this community, as its member");
 	}
 	async accessOf(orgId, orgUserId, communityId, spaceId) {
 		const [facts] = await this.repo.accessAmong(orgId, communityId, spaceId, [orgUserId]);
@@ -430,17 +638,17 @@ var EntitlementsServiceImpl = class {
 	async insertMember(entitlements, outbox, orgId, actor, input, room) {
 		const existing = await entitlements.lockSpaceMember(orgId, input.spaceId, input.orgUserId);
 		if (existing && existing.status !== "revoked") throw new ConflictError(input.orgUserId === actor.id ? "You already have a place in this space" : "That person already has a place in this space");
-		if (room) await this.assertRoom(entitlements, orgId, room);
+		if (room) await this.assertRoom(entitlements, orgId, room.space, room.excluding);
 		if (existing) await entitlements.deleteSpaceMember(orgId, existing.id);
 		const created = await entitlements.insertSpaceMember(orgId, input);
 		await outbox.append([entitlementEvents.spaceMemberCreated.make({
 			orgId,
 			data: created,
-			metadata: { actorOrgUserId: actor.id }
+			metadata: { actorId: actor.id }
 		})]);
 		return created;
 	}
-	async activate(orgId, actor, spaceId, orgUserId, rule, from, missing) {
+	async activate(orgId, actor, spaceId, orgUserId, rule, from, excluding, missing) {
 		const updated = await this.uow.run(async ({ entitlements, spaces, outbox }) => {
 			const locked = await this.lockSpace(spaces, orgId, spaceId);
 			this.assertRule(locked.accessRule, rule);
@@ -455,14 +663,14 @@ var EntitlementsServiceImpl = class {
 				});
 				throw missing();
 			}
-			await this.assertRoom(entitlements, orgId, locked);
+			await this.assertRoom(entitlements, orgId, locked, excluding);
 			const next = await entitlements.updateSpaceMemberStatus(orgId, row.id, "active");
 			if (!next) throw missing();
 			await outbox.append([entitlementEvents.spaceMemberUpdated.make({
 				orgId,
 				data: next,
 				metadata: {
-					actorOrgUserId: actor.id,
+					actorId: actor.id,
 					previousStatus: from
 				}
 			})]);
@@ -494,7 +702,7 @@ var EntitlementsServiceImpl = class {
 				orgId,
 				data: current,
 				metadata: {
-					actorOrgUserId: actor.id,
+					actorId: actor.id,
 					previousStatus: from
 				}
 			})]);
@@ -514,17 +722,36 @@ var EntitlementsServiceImpl = class {
 		if (!locked) throw new NotFoundError("Space", spaceId);
 		return locked;
 	}
-	async assertRoom(entitlements, orgId, space) {
+	async assertRoom(entitlements, orgId, space, excluding) {
 		if (space.capacity === null) return;
-		if (await entitlements.countActiveSpaceMembers(orgId, space.id) >= space.capacity) throw new ConflictError("This space is full");
+		if (await entitlements.countActiveSpaceMembers(orgId, space.id, excluding) >= space.capacity) throw new ConflictError("This space is full");
 	}
 };
+function alreadyRegistered() {
+	return new ConflictError("You are already going to this event", "already_registered");
+}
+function activeNow(grant, now) {
+	return grant.status === "active" && (grant.expiresAt === null || grant.expiresAt.getTime() > now.getTime());
+}
+function assertOpenForAttendees(event, now) {
+	if (event.status !== "published") throw new ConflictError("This event is not published", "not_published");
+	if (event.endsAt.getTime() <= now.getTime()) throw new ConflictError("This event has ended", "ended");
+}
 function alreadyPlaced(actor, orgUserId) {
 	return new ConflictError(orgUserId === actor.id ? "You already have a place in this space" : "That person already has a place in this space");
 }
 function ownRowMissing(status) {
 	return new ConflictError(status === "invited" ? "You do not have an invitation to this space" : "You are not a member of this space");
 }
+function standingFrom(fact, team) {
+	const reads = team.readers.has(fact.orgUserId);
+	const member = reads || fact.granted;
+	return {
+		member,
+		everySpace: reads || member && team.moderators.has(fact.orgUserId),
+		activeInSpace: fact.activeInSpace
+	};
+}
 //#endregion
 export { EntitlementsServiceImpl };