@jini-ai/user-management 0.3.3 → 0.6.10

package/dist/server/agent-tool-input.js

@@ -33,6 +33,9 @@ const STRING_KEYWORDS = new Set(["type", "minLength", "description"]);
  * that ordering a schema could publish, say, a `pattern` the parser silently ignores, and every
  * test using a conforming fixture would still pass.
  *
+ * Check order (pinned in `__tests__/agent-tool-input.pins.test.ts`): object shape, top-level
+ * keywords, `type`, `additionalProperties`, `properties`, `required`, then each property sub-schema.
+ *
  * @param schema - A tool's published `inputSchema`.
  * @throws {Error} If the schema, or any property sub-schema, uses an unimplemented keyword.
  * @complexity O(k) in the total keyword count across the schema and its property sub-schemas.
@@ -51,27 +54,42 @@ function assertSchemaIsInterpretable(schema) {
     const properties = Object.hasOwn(schema, "properties") ? schema.properties : {};
     if (!isSchemaObject(properties))
         throw new Error("identity agent-tool schema properties must be an object");
-    const required = Object.hasOwn(schema, "required") ? schema.required : [];
-    if (!Array.isArray(required) || required.some(key => typeof key !== "string") || new Set(required).size !== required.length) {
+    assertRequiredIsDeclared(Object.hasOwn(schema, "required") ? schema.required : [], properties);
+    for (const [key, sub] of Object.entries(properties))
+        assertStringPropertySchema(key, sub);
+}
+/** `required` must be unique strings, each naming an OWN declared property. */
+function assertRequiredIsDeclared(required, properties) {
+    if (!isUniqueStringArray(required)) {
         throw new Error("identity agent-tool schema required must be an array of unique strings");
     }
     for (const key of required) {
         if (!Object.hasOwn(properties, key))
             throw new Error(`identity agent-tool schema requires undeclared property '${key}'`);
     }
-    for (const [key, sub] of Object.entries(properties)) {
-        if (!isSchemaObject(sub))
-            throw new Error(`identity agent-tool schema property '${key}' must be an object`);
-        assertKeywords(sub, STRING_KEYWORDS);
-        if (sub.type !== "string") {
-            throw new Error(`identity agent-tool schema declares non-string property '${key}' — this parser only implements string properties`);
-        }
-        if (Object.hasOwn(sub, "minLength") && (typeof sub.minLength !== "number" || !Number.isInteger(sub.minLength) || sub.minLength < 0)) {
-            throw new Error(`identity agent-tool schema minLength for '${key}' must be a nonnegative integer`);
-        }
+}
+function isUniqueStringArray(value) {
+    return Array.isArray(value) && value.every(key => typeof key === "string") && new Set(value).size === value.length;
+}
+/** A property sub-schema must be a string schema whose optional `minLength` is a nonnegative integer. */
+function assertStringPropertySchema(key, sub) {
+    if (!isSchemaObject(sub))
+        throw new Error(`identity agent-tool schema property '${key}' must be an object`);
+    assertKeywords(sub, STRING_KEYWORDS);
+    if (sub.type !== "string") {
+        throw new Error(`identity agent-tool schema declares non-string property '${key}' — this parser only implements string properties`);
+    }
+    if (Object.hasOwn(sub, "minLength") && !isNonNegativeInteger(sub.minLength)) {
+        throw new Error(`identity agent-tool schema minLength for '${key}' must be a nonnegative integer`);
     }
 }
-/** JSON Schema objects and keyword placement are checked before inspecting any input value. */
+function isNonNegativeInteger(value) {
+    return typeof value === "number" && Number.isInteger(value) && value >= 0;
+}
+/**
+ * JSON Schema objects and keyword placement are checked before inspecting any input value. The
+ * same "non-null, non-array object" test also decides whether an input is an object at all.
+ */
 function isSchemaObject(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -110,39 +128,47 @@ function assertKeywords(schema, supported) {
  */
 export function parseIdentityToolInput(required) {
     const schema = required.schema;
+    // Also guarantees `type === "object"` and `additionalProperties === false`, read through the
+    // same property access used below, so neither needs re-checking here.
     assertSchemaIsInterpretable(schema);
-    if (schema.type !== "object") {
-        throw new Error(`identity agent-tool schema must be an object schema, got type '${String(schema.type)}'`);
-    }
     const { input } = required;
-    if (typeof input !== "object" || input === null || Array.isArray(input)) {
-        return { ok: false, error: new Error("input must be an object") };
-    }
-    const record = input;
+    if (!isSchemaObject(input))
+        return rejected("input must be an object");
+    // Read through ordinary property access, exactly as before validation was split out — see the
+    // "inherited schema members (reported, not fixed)" pins for what that means for a prototype.
     const properties = (schema.properties ?? {});
-    if (schema.additionalProperties === false) {
-        for (const key of Object.keys(record)) {
-            if (!Object.hasOwn(properties, key)) {
-                return { ok: false, error: new Error(`'${key}' is not a recognized input key`) };
-            }
-        }
-    }
-    for (const key of schema.required ?? []) {
-        if (!Object.hasOwn(record, key) || record[key] === undefined) {
-            return { ok: false, error: new Error(`'${key}' is required`) };
-        }
-    }
+    const violation = findUnrecognizedKey(input, properties)
+        ?? findMissingRequiredKey(input, schema.required ?? []);
+    if (violation !== undefined)
+        return rejected(violation);
+    return extractStrings(input, properties);
+}
+function rejected(message) {
+    return { ok: false, error: new Error(message) };
+}
+/** Own input keys only; a key inherited through the input's prototype is neither rejected nor read. */
+function findUnrecognizedKey(record, properties) {
+    const key = Object.keys(record).find(candidate => !Object.hasOwn(properties, candidate));
+    return key === undefined ? undefined : `'${key}' is not a recognized input key`;
+}
+/** A required key present with the value `undefined` counts as missing. */
+function findMissingRequiredKey(record, requiredKeys) {
+    const key = requiredKeys.find(candidate => !Object.hasOwn(record, candidate) || record[candidate] === undefined);
+    return key === undefined ? undefined : `'${key}' is required`;
+}
+/** Extracts every present declared key, in declaration order, rejecting the first non-conforming value. */
+function extractStrings(record, properties) {
     const value = {};
     for (const [key, sub] of Object.entries(properties)) {
         if (!Object.hasOwn(record, key))
             continue;
         const candidate = record[key];
-        if (typeof candidate !== "string") {
-            return { ok: false, error: new Error(`'${key}' must be a string, received ${describeType(candidate)}`) };
-        }
+        if (typeof candidate !== "string")
+            return rejected(`'${key}' must be a string, received ${describeType(candidate)}`);
         if (typeof sub.minLength === "number" && Array.from(candidate).length < sub.minLength) {
-            return { ok: false, error: new Error(`'${key}' must contain at least ${sub.minLength} Unicode code point(s)`) };
+            return rejected(`'${key}' must contain at least ${sub.minLength} Unicode code point(s)`);
         }
+        // defineProperty keeps a `__proto__` key as plain own data rather than invoking the setter.
         Object.defineProperty(value, key, { value: candidate, enumerable: true, writable: true, configurable: true });
     }
     return { ok: true, value };

package/dist/server/agent-tool-registrations.d.ts

@@ -13,6 +13,7 @@ import type { Clock, IdGenerator } from "@jini-ai/core/primitives";
  * `assistant/__tests__/tool-registrations.identity-authorization.test.ts`.
  */
 import { type DerivedRiskByToolId, type ToolRegistration } from "@jini-ai/core";
+import { type IdentityAgentToolDefinition } from "./agent-tools.js";
 import type { AuthServiceDeps } from "./auth-service.js";
 import type { IdentityRepos, PasswordHasherPort, PolicyPermissionRepoPort, PolicyRepoPort, PrincipalPolicyRepoPort, PrincipalRepoPort, PrincipalRoleRepoPort, RolePolicyRepoPort, RoleRepoPort, SessionRepoPort, UserRepoPort } from "../core/index.js";
 /**
@@ -48,5 +49,50 @@ export interface IdentityToolDeps {
  * `sideEffects` declaration.
  */
 export declare const identityDerivedRisk: DerivedRiskByToolId;
+/**
+ * Catalog lookup that fails loudly on drift between a handler's tool id and the published catalog.
+ * Exported for this module's tests only — the package entry does not re-export it.
+ */
+export declare function requireIdentityCatalogEntry({ toolId }: {
+    toolId: string;
+}): IdentityAgentToolDefinition;
+/**
+ * Validates `input` through the tool's OWN published `inputSchema` (interpreted by
+ * `agent-tool-input.ts`), then re-throws any rejection with that schema appended.
+ *
+ * Identity is the one domain whose published schema is ALSO the enforcing parser, so this does not
+ * use the kit's `withSchemaOnRejection`: there is no domain call to wrap, the rejection is produced
+ * here. Same error-recovery contract either way — a model that gets back only "'roleId' is
+ * required" must guess the rest of the shape, whereas one that gets the schema with it can correct
+ * the call in a single turn.
+ *
+ * @complexity O(p) in the tool's declared property count.
+ * @overallScore 100
+ */
+/**
+ * A validated tool input, with required and optional reads spelled differently.
+ *
+ * The distinction is not decoration. `parseIdentityToolInput` returns a `Record<string, string>`
+ * whose keys are whatever the caller supplied and the schema accepted, so nothing in the type says
+ * which fields are guaranteed. Reading them all the same way makes a schema that forgot to mark a
+ * field `required` indistinguishable from one that did — and the failure mode is silent: the
+ * handler passes `undefined` into a service call, which stores it. Splitting the read means the
+ * handler states which fields it is relying on, and a schema/handler disagreement throws at the
+ * boundary naming the field.
+ */
+export interface ValidatedIdentityInput {
+    /** A field the tool's published `inputSchema` marks `required`. @throws {Error} If absent. */
+    req(field: string): string;
+    /** A field the schema leaves optional. `undefined` means the caller omitted it. */
+    opt(field: string): string | undefined;
+}
+/**
+ * Parses `input` against `toolId`'s published schema and returns the split required/optional reader.
+ * Exported for this module's tests only — the package entry does not re-export it.
+ */
+export declare function identityInput({ toolId, input }: {
+    toolId: string;
+    input: unknown;
+}): ValidatedIdentityInput;
 export declare function buildIdentityRegistrations(routeDeps: IdentityToolDeps): ToolRegistration[];
 //# sourceMappingURL=agent-tool-registrations.d.ts.map

package/dist/server/agent-tool-registrations.js

@@ -102,14 +102,22 @@ export const identityDerivedRisk = new Map([
  * work with what it got and knows not to treat the list as complete.
  */
 const IDENTITY_USER_LIST_MAX = 200;
-function requireIdentityCatalogEntry(toolId) {
+/**
+ * Catalog lookup that fails loudly on drift between a handler's tool id and the published catalog.
+ * Exported for this module's tests only — the package entry does not re-export it.
+ */
+export function requireIdentityCatalogEntry({ toolId }) {
     const entry = CATALOG_BY_ID.get(toolId);
     if (!entry)
         throw new Error(`agent-tool-registrations: catalog has no entry named '${toolId}' — @jini-ai/user-management/server catalog drifted`);
     return entry;
 }
-function identityInput(toolId, input) {
-    const entry = requireIdentityCatalogEntry(toolId);
+/**
+ * Parses `input` against `toolId`'s published schema and returns the split required/optional reader.
+ * Exported for this module's tests only — the package entry does not re-export it.
+ */
+export function identityInput({ toolId, input }) {
+    const entry = requireIdentityCatalogEntry({ toolId });
     const parsed = parseIdentityToolInput({ schema: entry.inputSchema, input });
     if (!parsed.ok) {
         const recovery = "Fix the input and retry — this will not resolve on retry without an input change.";
@@ -131,7 +139,7 @@ function identityInput(toolId, input) {
 }
 /** The permission set a tool's catalog entry declares — both halves when the gate is an OR. */
 function identityPermissionsFor(toolId) {
-    const { authorization } = requireIdentityCatalogEntry(toolId);
+    const { authorization } = requireIdentityCatalogEntry({ toolId });
     return authorization.orPermission ? [authorization.permission, authorization.orPermission] : [authorization.permission];
 }
 /**
@@ -225,7 +233,7 @@ export function buildIdentityRegistrations(routeDeps) {
     const serviceDeps = () => identityServiceDepsFrom(routeDeps);
     const handlers = {
         identity_user_list: async (ctx) => {
-            identityInput("identity_user_list", ctx.input);
+            identityInput({ toolId: "identity_user_list", input: ctx.input });
             await assertIdentityReadAllowed(routeDeps, "identity_user_list", ctx.principal.id);
             const principals = await routeDeps.principalRepo.list({ workspaceId: routeDeps.workspaceId });
             // Humans only — `system`/`agent`/`api_key` principals (including the disabled `user-local`
@@ -244,19 +252,19 @@ export function buildIdentityRegistrations(routeDeps) {
                 : { users: listed };
         },
         identity_role_list: async (ctx) => {
-            identityInput("identity_role_list", ctx.input);
+            identityInput({ toolId: "identity_role_list", input: ctx.input });
             await assertIdentityReadAllowed(routeDeps, "identity_role_list", ctx.principal.id);
             const roles = await routeDeps.roleRepo.list({ workspaceId: routeDeps.workspaceId });
             return { roles: roles.map(toIdentityRoleView) };
         },
         identity_policy_list: async (ctx) => {
-            identityInput("identity_policy_list", ctx.input);
+            identityInput({ toolId: "identity_policy_list", input: ctx.input });
             await assertIdentityReadAllowed(routeDeps, "identity_policy_list", ctx.principal.id);
             const policies = await routeDeps.policyRepo.list({ workspaceId: routeDeps.workspaceId });
             return { policies: policies.map(toIdentityPolicyView) };
         },
         identity_user_create: async (ctx) => {
-            const input = identityInput("identity_user_create", ctx.input);
+            const input = identityInput({ toolId: "identity_user_create", input: ctx.input });
             const { principal, user } = await createUser({
                 deps: serviceDeps(),
                 input: {
@@ -270,7 +278,7 @@ export function buildIdentityRegistrations(routeDeps) {
             return { user: toIdentityUserView({ principal, user, roleIds: [] }) };
         },
         identity_user_update_email: async (ctx) => {
-            const input = identityInput("identity_user_update_email", ctx.input);
+            const input = identityInput({ toolId: "identity_user_update_email", input: ctx.input });
             const { user } = await updateUser({
                 deps: serviceDeps(),
                 input: {
@@ -287,7 +295,7 @@ export function buildIdentityRegistrations(routeDeps) {
             return { user: toIdentityUserView({ principal, user, roleIds: await roleIdsFor(routeDeps, principal.id) }) };
         },
         identity_user_change_username: async (ctx) => {
-            const input = identityInput("identity_user_change_username", ctx.input);
+            const input = identityInput({ toolId: "identity_user_change_username", input: ctx.input });
             const principalId = input.req("principalId");
             const { user } = await updateUser({ deps: serviceDeps(), input: {
                     workspaceId: routeDeps.workspaceId, callerPrincipalId: ctx.principal.id, principalId,
@@ -298,7 +306,7 @@ export function buildIdentityRegistrations(routeDeps) {
             return { user: toIdentityUserView({ principal, user, roleIds: await roleIdsFor(routeDeps, principalId) }) };
         },
         identity_user_disable: async (ctx) => {
-            const input = identityInput("identity_user_disable", ctx.input);
+            const input = identityInput({ toolId: "identity_user_disable", input: ctx.input });
             const { principal } = await disablePrincipal({
                 deps: serviceDeps(),
                 input: {
@@ -314,7 +322,7 @@ export function buildIdentityRegistrations(routeDeps) {
             return { user: toIdentityUserView({ principal, user, roleIds: await roleIdsFor(routeDeps, principal.id) }) };
         },
         identity_user_enable: async (ctx) => {
-            const input = identityInput("identity_user_enable", ctx.input);
+            const input = identityInput({ toolId: "identity_user_enable", input: ctx.input });
             const { principal } = await enablePrincipal({
                 deps: serviceDeps(),
                 input: { workspaceId: routeDeps.workspaceId, callerPrincipalId: ctx.principal.id, principalId: input.req("principalId") },
@@ -323,7 +331,7 @@ export function buildIdentityRegistrations(routeDeps) {
             return { user: toIdentityUserView({ principal, user, roleIds: await roleIdsFor(routeDeps, principal.id) }) };
         },
         identity_role_create: async (ctx) => {
-            const input = identityInput("identity_role_create", ctx.input);
+            const input = identityInput({ toolId: "identity_role_create", input: ctx.input });
             const { role } = await createRole({
                 deps: serviceDeps(),
                 input: { workspaceId: routeDeps.workspaceId, callerPrincipalId: ctx.principal.id, name: input.req("name") },
@@ -331,7 +339,7 @@ export function buildIdentityRegistrations(routeDeps) {
             return { role: toIdentityRoleView(role) };
         },
         identity_role_assign: async (ctx) => {
-            const input = identityInput("identity_role_assign", ctx.input);
+            const input = identityInput({ toolId: "identity_role_assign", input: ctx.input });
             const { assignment } = await assignRole({
                 deps: serviceDeps(),
                 input: {
@@ -346,7 +354,7 @@ export function buildIdentityRegistrations(routeDeps) {
             return { assigned: { principalId: assignment.principalId, roleId: assignment.roleId } };
         },
         identity_role_rename: async (ctx) => {
-            const input = identityInput("identity_role_rename", ctx.input);
+            const input = identityInput({ toolId: "identity_role_rename", input: ctx.input });
             const { role } = await updateRole({
                 deps: serviceDeps(),
                 input: { workspaceId: routeDeps.workspaceId, callerPrincipalId: ctx.principal.id, roleId: input.req("roleId"), name: input.req("name") },
@@ -354,7 +362,7 @@ export function buildIdentityRegistrations(routeDeps) {
             return { role: toIdentityRoleView(role) };
         },
         identity_role_delete: async (ctx) => {
-            const input = identityInput("identity_role_delete", ctx.input);
+            const input = identityInput({ toolId: "identity_role_delete", input: ctx.input });
             await deleteRole({
                 deps: serviceDeps(),
                 input: { workspaceId: routeDeps.workspaceId, callerPrincipalId: ctx.principal.id, roleId: input.req("roleId") },
@@ -364,7 +372,7 @@ export function buildIdentityRegistrations(routeDeps) {
             return { deleted: { roleId: input.req("roleId") } };
         },
         identity_policy_create: async (ctx) => {
-            const input = identityInput("identity_policy_create", ctx.input);
+            const input = identityInput({ toolId: "identity_policy_create", input: ctx.input });
             const { policy } = await createPolicy({
                 deps: serviceDeps(),
                 input: {
@@ -379,7 +387,7 @@ export function buildIdentityRegistrations(routeDeps) {
             return { policy: toIdentityPolicyView(policy) };
         },
         identity_policy_update: async (ctx) => {
-            const input = identityInput("identity_policy_update", ctx.input);
+            const input = identityInput({ toolId: "identity_policy_update", input: ctx.input });
             const { policy } = await updatePolicy({
                 deps: serviceDeps(),
                 input: {
@@ -393,7 +401,7 @@ export function buildIdentityRegistrations(routeDeps) {
             return { policy: toIdentityPolicyView(policy) };
         },
         identity_policy_delete: async (ctx) => {
-            const input = identityInput("identity_policy_delete", ctx.input);
+            const input = identityInput({ toolId: "identity_policy_delete", input: ctx.input });
             await deletePolicy({
                 deps: serviceDeps(),
                 input: { workspaceId: routeDeps.workspaceId, callerPrincipalId: ctx.principal.id, policyId: input.req("policyId") },
@@ -403,7 +411,7 @@ export function buildIdentityRegistrations(routeDeps) {
             return { deleted: { policyId: input.req("policyId") } };
         },
         identity_policy_attach: async (ctx) => {
-            const input = identityInput("identity_policy_attach", ctx.input);
+            const input = identityInput({ toolId: "identity_policy_attach", input: ctx.input });
             const { attachment } = await attachPolicy({
                 deps: serviceDeps(),
                 input: {

package/dist/server/auth-service.js

@@ -63,6 +63,38 @@ export async function createSessionForPrincipal(required, optional = {}) {
     await deps.repos.sessions.save(session);
     return { session, rawToken };
 }
+/**
+ * The one status that may log in or keep a live session: the principal exists AND is `active`.
+ * Shared by `login` and `validateSession` so the two fail-closed checks cannot drift apart.
+ */
+function isActivePrincipal(principal) {
+    return principal?.status === "active";
+}
+/**
+ * The credential checks of `login`, in their fixed order: blank input is refused before any lookup,
+ * and the (slow) hash verify runs only once a live principal is found. Every refusal throws the same
+ * `AuthInvalidCredentialsError` message — no user-enumeration signal.
+ */
+async function verifyCredentials(required) {
+    const { deps, input, invalidCredentialsMessage } = required;
+    const refuse = () => new AuthInvalidCredentialsError({ message: invalidCredentialsMessage });
+    const username = normalizeUsername({ raw: input.username });
+    if (!username || !input.password)
+        throw refuse();
+    const userRow = await deps.repos.users.findByUsername({ workspaceId: input.workspaceId, username });
+    if (!userRow)
+        throw refuse();
+    const principal = await deps.repos.principals.findById({
+        workspaceId: input.workspaceId,
+        id: userRow.principalId,
+    });
+    if (!isActivePrincipal(principal))
+        throw refuse();
+    const passwordOk = await deps.hasher.verify({ hash: userRow.passwordHash, password: input.password });
+    if (!passwordOk)
+        throw refuse();
+    return { userRow, principal };
+}
 /**
  * Verify `username`+`password` for an `active` principal and mint a session
  * Constant-shaped failure: a nonexistent username, a
@@ -77,25 +109,8 @@ export async function createSessionForPrincipal(required, optional = {}) {
 export async function login(required, optional = {}) {
     const { deps } = required;
     const input = { ...required.input, ...optional };
-    const username = normalizeUsername({ raw: input.username });
-    if (!username || !input.password) {
-        throw new AuthInvalidCredentialsError({ message: (optional.messages ?? defaultUserManagementMessages).invalidCredentials });
-    }
-    const userRow = await deps.repos.users.findByUsername({ workspaceId: input.workspaceId, username });
-    if (!userRow) {
-        throw new AuthInvalidCredentialsError({ message: (optional.messages ?? defaultUserManagementMessages).invalidCredentials });
-    }
-    const principal = await deps.repos.principals.findById({
-        workspaceId: input.workspaceId,
-        id: userRow.principalId,
-    });
-    if (!principal || principal.status !== "active") {
-        throw new AuthInvalidCredentialsError({ message: (optional.messages ?? defaultUserManagementMessages).invalidCredentials });
-    }
-    const passwordOk = await deps.hasher.verify({ hash: userRow.passwordHash, password: input.password });
-    if (!passwordOk) {
-        throw new AuthInvalidCredentialsError({ message: (optional.messages ?? defaultUserManagementMessages).invalidCredentials });
-    }
+    const invalidCredentialsMessage = (optional.messages ?? defaultUserManagementMessages).invalidCredentials;
+    const { userRow, principal } = await verifyCredentials({ deps, input, invalidCredentialsMessage });
     const { session, rawToken } = await createSessionForPrincipal({ deps, input: { workspaceId: input.workspaceId, principalId: principal.id } }, { ip: input.ip, userAgent: input.userAgent, sessionTtlMs: optional.sessionTtlMs, messages: optional.messages });
     // Reuses the session's own `createdAt` rather than a second `kernelNowIso({ clock: clock })` call — both are
     // meant to be the same instant, and reading one avoids two clock reads ever disagreeing.
@@ -133,7 +148,7 @@ export async function validateSession(required, optional = {}) {
         id: session.principalId,
     });
     // a disabled principal's live session stops validating immediately. See docs/decisions/DR-001-identity-and-session-boundary.md.
-    if (!principal || principal.status !== "active")
+    if (!isActivePrincipal(principal))
         return null;
     return { principal, session };
 }

package/dist/server/authorize.js

@@ -29,11 +29,10 @@ export async function resolveEffectivePermissions(required) {
  * True iff `row` is an exact, unconstrained-or-scope-matching grant of
  * `permission` in `context` (state.spec §4 `matchesRow`). Assumes `row` has
  * already passed the owner-wildcard check upstream — this never special-cases
- * `"*"`.
+ * `"*"`. Callers pass only rows already filtered to `permission` (see
+ * `authorize`'s `candidates`), so the permission equality is not re-checked here.
  */
-function matchesRow(row, permission, context) {
-    if (row.permission !== permission)
-        return false;
+function matchesRow(row, context) {
     if (row.constraintJson != null)
         return false;
     if (row.resourceType != null && row.resourceType !== context.entityType)
@@ -89,16 +88,15 @@ export async function authorize(required, optional = {}) {
     if (candidates.length === 0) {
         return { allowed: false, reason: "no_grant" };
     }
-    const matched = candidates.some((row) => matchesRow(row, permission, context));
+    const matched = candidates.some((row) => matchesRow(row, context));
     if (matched) {
         return { allowed: true, reason: "matched" };
     }
     if (candidates.some((row) => row.constraintJson != null)) {
         return { allowed: false, reason: "unconstrained_deny" };
     }
-    if (candidates.some((row) => row.resourceType != null)) {
-        return { allowed: false, reason: "resource_scope_mismatch" };
-    }
-    return { allowed: false, reason: "no_grant" };
+    // A candidate fails matchesRow only through a constraint or a mismatched resource scope; with
+    // no constraint left, every candidate carries a resource scope that differs from the context.
+    return { allowed: false, reason: "resource_scope_mismatch" };
 }
 //# sourceMappingURL=authorize.js.map

package/dist/server/permission-migrations.js

@@ -18,6 +18,39 @@ export function createPermissionMigrationRegistry(_required = {}, optional = {})
         register(migration);
     return { register, list: () => [...byFrom.values()] };
 }
+/**
+ * One policy's share of the fan-out: for each pair whose `from` the policy holds, write every `to`
+ * it does not hold yet. `held` is updated as rows are written, so a target named by two pairs is
+ * written once; pairs run in list order in a single pass, so a target written here is never then
+ * re-read as a later pair's `from` within this same policy. Additive-only — only `save` is called.
+ *
+ * @returns how many rows were written for this policy.
+ */
+async function grantMissingTargets(required) {
+    const { deps, policyId } = required;
+    const existing = await deps.policyPermissions.listByPolicyId({ workspaceId: deps.workspaceId, policyId });
+    const held = new Set(existing.map((row) => row.permission));
+    let written = 0;
+    for (const migration of deps.migrations) {
+        if (!held.has(migration.from))
+            continue;
+        for (const toPermission of migration.to) {
+            if (held.has(toPermission))
+                continue;
+            await deps.policyPermissions.save({
+                id: deps.idGen.newId(),
+                workspaceId: deps.workspaceId,
+                policyId,
+                permission: toPermission,
+                resourceType: null,
+                constraintJson: null,
+            });
+            held.add(toPermission);
+            written += 1;
+        }
+    }
+    return written;
+}
 /**
  * For every `{from, to}` pair in `deps.migrations`, for every policy in the workspace
  * holding `from`, ensure every string in `to` is also granted — adding only
@@ -36,8 +69,7 @@ export function createPermissionMigrationRegistry(_required = {}, optional = {})
  * See docs/decisions/DR-003-additive-permission-migration.md.
  */
 export async function migrateDeprecatedPermissionGrants(deps) {
-    const { migrations } = deps;
-    if (migrations.length === 0)
+    if (deps.migrations.length === 0)
         return { migratedGrantCount: 0 };
     return inIdentityTransaction({
         transactions: deps.transactions,
@@ -46,29 +78,7 @@ export async function migrateDeprecatedPermissionGrants(deps) {
             const policies = await deps.policies.list({ workspaceId: deps.workspaceId });
             let migratedGrantCount = 0;
             for (const policy of policies) {
-                const existing = await deps.policyPermissions.listByPolicyId({
-                    workspaceId: deps.workspaceId,
-                    policyId: policy.id,
-                });
-                const held = new Set(existing.map((row) => row.permission));
-                for (const migration of migrations) {
-                    if (!held.has(migration.from))
-                        continue;
-                    for (const toPermission of migration.to) {
-                        if (held.has(toPermission))
-                            continue;
-                        await deps.policyPermissions.save({
-                            id: deps.idGen.newId(),
-                            workspaceId: deps.workspaceId,
-                            policyId: policy.id,
-                            permission: toPermission,
-                            resourceType: null,
-                            constraintJson: null,
-                        });
-                        held.add(toPermission);
-                        migratedGrantCount += 1;
-                    }
-                }
+                migratedGrantCount += await grantMissingTargets({ deps, policyId: policy.id });
             }
             return { migratedGrantCount };
         },

package/dist/server/repo.memory-transactions.js

@@ -12,12 +12,12 @@ export function createTransactionalInMemoryIdentityRepos(required) {
         throw new Error('identity repositories are already bound to a transaction port');
     const context = new AsyncLocalStorage();
     let tail = Promise.resolve();
-    const stores = Object.entries(required.repos).filter(([key]) => key !== 'transactions');
-    for (const [, repo] of stores) {
+    const stores = Object.entries(required.repos).filter(([key]) => key !== 'transactions').map(([, repo]) => {
         if (!(repo instanceof InMemoryIdentityRows)) {
             throw new Error('memory transactions require in-memory identity repositories');
         }
-    }
+        return repo;
+    });
     /** Preserve queue progress after rejection; descendants of a completed body cannot bypass it. */
     async function exclusive(execute) {
         if (context.getStore()?.active)
@@ -37,9 +37,8 @@ export function createTransactionalInMemoryIdentityRepos(required) {
     }
     const transactions = {
         run: ({ execute }) => exclusive(async () => {
-            const snapshots = stores.map(([, repo]) => {
-                if (!(repo instanceof InMemoryIdentityRows))
-                    throw new Error('memory transactions require in-memory identity repositories');
+            // Every store was checked to be InMemoryIdentityRows when the bag was bound above.
+            const snapshots = stores.map((repo) => {
                 const rows = repo.snapshotRows({});
                 return { restore: () => repo.restoreRows({ rows }) };
             });