@jini-ai/cms 0.1.0

package/dist/identity/password-policy.js

@@ -0,0 +1,67 @@
+/**
+ * @file Password policy (NIST SP 800-63B aligned): a length floor only, no composition rules.
+ *
+ * NIST SP 800-63B — the current published memorized-secret guidance — recommends a minimum
+ * length requirement and explicitly recommends AGAINST composition rules (mandatory uppercase,
+ * digit, or symbol). Composition rules measurably push people toward predictable, guessable
+ * patterns ("Password1!") rather than genuinely stronger secrets, which is why this module
+ * enforces length only.
+ *
+ * `createUser` (`grant-service.ts`) and `resetUserPassword` (`admin-crud-service.ts`) are the
+ * identity system's only two write paths that ever set a password, confirmed by tracing the
+ * whole call graph — both call this module.
+ *
+ * Two things this deliberately does NOT do, both load-bearing:
+ * - Never reaches `seed.ts`'s first-boot owner password. `seedIdentity` hashes it directly
+ *   (`deps.hasher.hash(ownerPassword)`, `seed.ts:317`) and calls neither `createUser` nor
+ *   `resetUserPassword` — confirmed before writing this module. That separation is intentional
+ *   to preserve here: the host chooses the first-boot owner password (`SeedIdentityInput` requires
+ *   it and supplies no default), and an existing installation is already authenticating with
+ *   whatever it chose. Enforcing this policy on that path would lock out every such installation
+ *   whose chosen value predates the policy.
+ * - Never re-validates at login. This is a write-time policy — `login`/`verify` never call it.
+ *   An account whose password predates this policy (or was seeded) must keep authenticating; NIST
+ *   800-63B's own guidance is that length rules apply when a secret is *chosen*, not retroactively
+ *   to secrets already in use.
+ */
+/** NIST SP 800-63B's recommended floor. */
+export const MIN_PASSWORD_LENGTH = 12;
+/**
+ * Generous upper bound — not itself a security requirement (argon2id's cost is tuned by its
+ * `memoryCost`/`timeCost`/`parallelism` parameters, not by input size — see `hasher.ts`'s own
+ * `@complexity` note), but a defense-in-depth cap on how large a string this service will accept
+ * and pass to the hasher at all, independent of whatever limit (if any) sits in front of it at
+ * the HTTP layer. Comfortably above any realistic human-typed passphrase.
+ */
+export const MAX_PASSWORD_LENGTH = 512;
+/**
+ * Validates `password` against the length-only policy.
+ *
+ * Measures length in Unicode CODE POINTS (`[...password].length`), not UTF-16 code units
+ * (`password.length`): a passphrase built from astral-plane characters (many emoji, some
+ * CJK/historic scripts) is represented as a surrogate pair per character in a JS string, so plain
+ * `.length` overcounts those characters relative to what a human typing them perceives as "12
+ * characters" — silently misjudging the exact floor this function states. No trimming, no
+ * character allowlist: every printable character, including leading/trailing spaces and full
+ * Unicode, is accepted as typed. Silently altering the input (trimming, stripping) would make the
+ * stored credential differ from the secret the operator actually chose.
+ *
+ * @returns `null` if `password` satisfies the policy, otherwise an operator-facing message
+ * stating the requirement plainly — used verbatim as the thrown `IdentityValidationError`'s
+ * message by both call sites, and rendered as-is through the admin's `describeApiError` layer.
+ *
+ * @complexity O(n) in the password's length — spreading a string into code points is a single
+ * linear pass, which is the minimum work a correct (non-UTF-16-code-unit) count requires.
+ * @overallScore 100
+ */
+export function validatePasswordPolicy(password) {
+    const length = [...password].length;
+    if (length < MIN_PASSWORD_LENGTH) {
+        return `Password must be at least ${MIN_PASSWORD_LENGTH} characters.`;
+    }
+    if (length > MAX_PASSWORD_LENGTH) {
+        return `Password must be no more than ${MAX_PASSWORD_LENGTH} characters.`;
+    }
+    return null;
+}
+//# sourceMappingURL=password-policy.js.map

package/dist/identity/password-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-policy.js","sourceRoot":"","sources":["../../src/identity/password-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,2CAA2C;AAC3C,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAEtC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEvC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACrD,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,MAAM,CAAC;IACpC,IAAI,MAAM,GAAG,mBAAmB,EAAE,CAAC;QACjC,OAAO,6BAA6B,mBAAmB,cAAc,CAAC;IACxE,CAAC;IACD,IAAI,MAAM,GAAG,mBAAmB,EAAE,CAAC;QACjC,OAAO,iCAAiC,mBAAmB,cAAc,CAAC;IAC5E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/identity/permission-migrations.d.ts

@@ -0,0 +1,86 @@
+import type { IdGeneratorPort, UUID } from "../core/ports.js";
+import type { PolicyPermissionRepoPort, PolicyRepoPort } from "./ports.js";
+/**
+ * @file Shared deprecate-old/grant-new permission migration mechanism
+ * (generalized from the `settings.write` ->
+ * `settings.definitions.manage` precedent already shipped ad hoc in
+ * `identity/seed.ts`/`identity/permissions.ts`; see
+ * `docs/decisions/permission-catalog-migration.md`).
+ *
+ * Purpose:
+ * A permission-string rename/split after real grants exist is a breaking
+ * migration. This module is
+ * the one place that fan-out runs, so Menus/Members/Analytics/Integrations
+ * remediation efforts each register their own `{from, to}` pair here instead of
+ * hand-rolling a fourth divergent copy of the same fix.
+ *
+ * How it relates to the project:
+ * - `registerPermissionMigration`/`listPermissionMigrations` are a small,
+ *   in-process registry — pure metadata, no I/O, mirrors
+ *   `permissions.ts`'s `PermissionCatalog.register` overwrite semantics.
+ * - `migrateDeprecatedPermissionGrants` is the actual grant fan-out: for
+ *   every registered pair, every policy holding `from` gets every string in
+ *   `to` it doesn't already hold. It is deliberately, structurally
+ *   additive-only (INV-NEW-01) — there is no delete/update call against
+ *   `policy_permissions` anywhere in this file.
+ * - Feature-agnostic by design: this module has zero knowledge of
+ *   `navigation`/`settings`/any specific feature. Callers (e.g.
+ *   `identity/permissions.ts`) register their own pairs.
+ *
+ * Architectural role:
+ * Security-adjacent domain logic (a bug here could fail-open (grant more than
+ * intended) or fail-closed (a policy silently missing a needed grant) across every
+ * feature that reuses it). The additive-only design bounds the fail-closed
+ * direction to "a required new permission is missing," never "an existing
+ * permission is removed." See `__tests__/permission-migrations.test.ts` for
+ * the dedicated fixture-driven certification required before any
+ * caller wires this into a live boot path.
+ */
+/** One registered deprecate-old/grant-new rename or split pair. */
+export interface PermissionMigration {
+    /** The deprecated permission string. Never deleted from the catalog by this mechanism. */
+    readonly from: string;
+    /** The replacement permission string(s) every `from`-holding policy should also gain. */
+    readonly to: readonly string[];
+    /** Human-readable rationale, surfaced in docs/reviews — not interpreted by this module. */
+    readonly reason: string;
+}
+export interface MigrateDeprecatedPermissionGrantsDeps {
+    policyPermissions: PolicyPermissionRepoPort;
+    policies: PolicyRepoPort;
+    idGen: IdGeneratorPort;
+    workspaceId: UUID;
+}
+export interface MigrateDeprecatedPermissionGrantsResult {
+    /** Total new `policy_permissions` rows written across every policy and every registered pair. */
+    migratedGrantCount: number;
+}
+/**
+ * Register a `{from, to, reason}` rename/split pair for later fan-out.
+ * Idempotent: re-registering the same `from` overwrites the prior entry
+ * rather than duplicating it (matches `PermissionCatalog.register`'s
+ * existing overwrite semantics, `identity/permissions.ts`).
+ *
+ * @complexity O(1).
+ * @overallScore 100
+ */
+export declare function registerPermissionMigration(migration: PermissionMigration): void;
+/** Enumerate every registered migration pair. */
+export declare function listPermissionMigrations(): PermissionMigration[];
+/**
+ * For every registered `{from, to}` pair, for every policy in the workspace
+ * holding `from`, ensure every string in `to` is also granted — adding only
+ * the rows that are missing. Never removes or mutates `from` (or any other
+ * existing row) — additive-only by construction (INV-NEW-01), so a failed or
+ * partial run leaves the system in its previous, still-functioning state.
+ *
+ * Safe to call on every boot (idempotent): a rerun with nothing new to add
+ * returns `migratedGrantCount: 0` (mirrors `migrateLegacyPresentationSettings`'s
+ * boot-safety precedent).
+ *
+ * @complexity O(p * m) where p = policies in the workspace, m = registered
+ * migration pairs; both are small, bounded collections in this app's shape.
+ * @overallScore 100
+ */
+export declare function migrateDeprecatedPermissionGrants(deps: MigrateDeprecatedPermissionGrantsDeps): Promise<MigrateDeprecatedPermissionGrantsResult>;
+//# sourceMappingURL=permission-migrations.d.ts.map

package/dist/identity/permission-migrations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-migrations.d.ts","sourceRoot":"","sources":["../../src/identity/permission-migrations.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,KAAK,EAAE,wBAAwB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE3E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,mEAAmE;AACnE,MAAM,WAAW,mBAAmB;IAClC,0FAA0F;IAC1F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,yFAAyF;IACzF,QAAQ,CAAC,EAAE,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,2FAA2F;IAC3F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,qCAAqC;IACpD,iBAAiB,EAAE,wBAAwB,CAAC;IAC5C,QAAQ,EAAE,cAAc,CAAC;IACzB,KAAK,EAAE,eAAe,CAAC;IACvB,WAAW,EAAE,IAAI,CAAC;CACnB;AAED,MAAM,WAAW,uCAAuC;IACtD,iGAAiG;IACjG,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAKD;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,mBAAmB,GAAG,IAAI,CAEhF;AAED,iDAAiD;AACjD,wBAAgB,wBAAwB,IAAI,mBAAmB,EAAE,CAEhE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,iCAAiC,CACrD,IAAI,EAAE,qCAAqC,GAC1C,OAAO,CAAC,uCAAuC,CAAC,CAmClD"}

package/dist/identity/permission-migrations.js

@@ -0,0 +1,67 @@
+/** Module-singleton registry — keyed by `from` so re-registration overwrites (idempotent, matches `PermissionCatalog.register`). */
+const registry = new Map();
+/**
+ * Register a `{from, to, reason}` rename/split pair for later fan-out.
+ * Idempotent: re-registering the same `from` overwrites the prior entry
+ * rather than duplicating it (matches `PermissionCatalog.register`'s
+ * existing overwrite semantics, `identity/permissions.ts`).
+ *
+ * @complexity O(1).
+ * @overallScore 100
+ */
+export function registerPermissionMigration(migration) {
+    registry.set(migration.from, migration);
+}
+/** Enumerate every registered migration pair. */
+export function listPermissionMigrations() {
+    return [...registry.values()];
+}
+/**
+ * For every registered `{from, to}` pair, for every policy in the workspace
+ * holding `from`, ensure every string in `to` is also granted — adding only
+ * the rows that are missing. Never removes or mutates `from` (or any other
+ * existing row) — additive-only by construction (INV-NEW-01), so a failed or
+ * partial run leaves the system in its previous, still-functioning state.
+ *
+ * Safe to call on every boot (idempotent): a rerun with nothing new to add
+ * returns `migratedGrantCount: 0` (mirrors `migrateLegacyPresentationSettings`'s
+ * boot-safety precedent).
+ *
+ * @complexity O(p * m) where p = policies in the workspace, m = registered
+ * migration pairs; both are small, bounded collections in this app's shape.
+ * @overallScore 100
+ */
+export async function migrateDeprecatedPermissionGrants(deps) {
+    const migrations = listPermissionMigrations();
+    if (migrations.length === 0)
+        return { migratedGrantCount: 0 };
+    const policies = await deps.policies.list({ workspaceId: deps.workspaceId });
+    let migratedGrantCount = 0;
+    for (const policy of policies) {
+        const existing = await deps.policyPermissions.listByPolicyId({
+            workspaceId: deps.workspaceId,
+            policyId: policy.id,
+        });
+        const held = new Set(existing.map((row) => row.permission));
+        for (const migration of migrations) {
+            if (!held.has(migration.from))
+                continue;
+            for (const toPermission of migration.to) {
+                if (held.has(toPermission))
+                    continue;
+                await deps.policyPermissions.save({
+                    id: deps.idGen.newId(),
+                    workspaceId: deps.workspaceId,
+                    policyId: policy.id,
+                    permission: toPermission,
+                    resourceType: null,
+                    constraintJson: null,
+                });
+                held.add(toPermission);
+                migratedGrantCount += 1;
+            }
+        }
+    }
+    return { migratedGrantCount };
+}
+//# sourceMappingURL=permission-migrations.js.map

package/dist/identity/permission-migrations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-migrations.js","sourceRoot":"","sources":["../../src/identity/permission-migrations.ts"],"names":[],"mappings":"AA8DA,oIAAoI;AACpI,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA+B,CAAC;AAExD;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CAAC,SAA8B;IACxE,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AAC1C,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,wBAAwB;IACtC,OAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,IAA2C;IAE3C,MAAM,UAAU,GAAG,wBAAwB,EAAE,CAAC;IAC9C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,EAAE,CAAC;IAE9D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7E,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAE3B,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC;YAC3D,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,MAAM,CAAC,EAAE;SACpB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;QAE5D,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC;gBAAE,SAAS;YAExC,KAAK,MAAM,YAAY,IAAI,SAAS,CAAC,EAAE,EAAE,CAAC;gBACxC,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;oBAAE,SAAS;gBAErC,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC;oBAChC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE;oBACtB,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,QAAQ,EAAE,MAAM,CAAC,EAAE;oBACnB,UAAU,EAAE,YAAY;oBACxB,YAAY,EAAE,IAAI;oBAClB,cAAc,EAAE,IAAI;iBACrB,CAAC,CAAC;gBACH,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBACvB,kBAAkB,IAAI,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAChC,CAAC"}

package/dist/identity/permissions.d.ts

@@ -0,0 +1,35 @@
+/** One entry in the registered permission catalog. */
+export interface PermissionDescriptor {
+    /** Dotted permission string, e.g. `"content.write"`. */
+    id: string;
+    /** Registering module, e.g. `"core"` or a feature name. */
+    owner: string;
+    description: string;
+}
+/**
+ * Code-side registry backing REQ-03's catalog validation and REQ-12's
+ * enumeration. `"*"` (the owner wildcard, REQ-04) is deliberately not a
+ * catalog entry — it is a distinct, built-in-only grant shape checked by
+ * `authorize()`/seed, never a registrable permission string.
+ *
+ * @complexity O(1) amortized per lookup (Map-backed); O(n) to list all.
+ * @overallScore 100
+ */
+declare class PermissionCatalog {
+    private readonly byId;
+    constructor(initial: readonly PermissionDescriptor[]);
+    /** Idempotent: re-registering the same `id` (e.g. on a warm reload) is a no-op overwrite. */
+    register(descriptor: PermissionDescriptor): void;
+    has(id: string): boolean;
+    list(): PermissionDescriptor[];
+}
+/** Module-singleton catalog — core's base vocabulary, extended by feature registration. */
+export declare const permissionCatalog: PermissionCatalog;
+/** Register an additional permission at feature startup (REQ-03). */
+export declare function registerPermission(descriptor: PermissionDescriptor): void;
+/** Enumerate the full registered catalog (REQ-12 core capability; CLI wiring is N/A, see file header). */
+export declare function listPermissions(): PermissionDescriptor[];
+/** Whether `id` is a recognized catalog permission. `"*"` is intentionally excluded (see class doc). */
+export declare function isKnownPermission(id: string): boolean;
+export {};
+//# sourceMappingURL=permissions.d.ts.map

package/dist/identity/permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/identity/permissions.ts"],"names":[],"mappings":"AAsCA,sDAAsD;AACtD,MAAM,WAAW,oBAAoB;IACnC,wDAAwD;IACxD,EAAE,EAAE,MAAM,CAAC;IACX,2DAA2D;IAC3D,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB;AAmGD;;;;;;;;GAQG;AACH,cAAM,iBAAiB;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA2C;gBAEpD,OAAO,EAAE,SAAS,oBAAoB,EAAE;IAIpD,6FAA6F;IAC7F,QAAQ,CAAC,UAAU,EAAE,oBAAoB,GAAG,IAAI;IAIhD,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAIxB,IAAI,IAAI,oBAAoB,EAAE;CAG/B;AAED,2FAA2F;AAC3F,eAAO,MAAM,iBAAiB,mBAAsC,CAAC;AAErE,qEAAqE;AACrE,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,oBAAoB,GAAG,IAAI,CAEzE;AAocD,0GAA0G;AAC1G,wBAAgB,eAAe,IAAI,oBAAoB,EAAE,CAExD;AAED,wGAAwG;AACxG,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAErD"}