@ketvietlab/ketsuite 0.1.25 → 0.1.30

package/dist/modules/user/authorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../../../../../../packages/ketsuite/src/modules/user/authorization.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAEnE,KAAK,KAAK,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAA;AAM9E,QAAA,MAAM,OAAO,WAAY,KAAK,EAAE;;;CAAqC,CAAA;AAYrE,eAAO,MAAM,kBAAkB,WAAY,UAAU,CAAC,OAAO,OAAO,CAAC,KAAG,KAEvE,CAAA;AAED,eAAO,MAAM,wBAAwB,GAAU,CAAC,OAAO,GAAG,QAAQ,CAAC,EAAE,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC;;;EAOxF,CAAA;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,EAAE,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAA;IAC1C,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,QAAQ,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,SAAS,GAAG,QAAQ,CAAA;IAC9B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,KAAK,EAAE,uBAAuB,EAAE,CAAA;CACjC,CAAA;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAA;IAC9D,SAAS,EAAE,OAAO,CAAA;IAClB,SAAS,EAAE,mBAAmB,EAAE,CAAA;IAChC,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACjE,CAAA;AA4CD,eAAO,MAAM,wBAAwB,QAC9B,GAAG,UACA,MAAM,UACN;IAAE,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,KACvE,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,eAAe,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,KAAK,EAAE,CAAA;CAAE,CA0C/E,CAAA;AAED,eAAO,MAAM,uBAAuB,QAAe,GAAG,KAAG,OAAO,CAAC,MAAM,CAItE,CAAA;AAED,eAAO,MAAM,4BAA4B,QAAe,GAAG,KAAG,OAAO,CAAC,MAAM,CAW3E,CAAA;AAwBD,eAAO,MAAM,wBAAwB,QAC9B,GAAG,UACA;IACN,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAClC,MAAM,EAAE,OAAO,CAAA;IACf,KAAK,EAAE,OAAO,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,kBAqBF,CAAA;AAsCD;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,aACxB,QAAQ,QACZ,GAAG,UACD,SAAS,GAAG,EAAE,WACb,SAAS,GAAG,EAAE,KACtB,MAAM,EAoCR,CAAA;AAED,uEAAuE;AACvE,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,WAAW,CAAC,EAAE,GAAG,EAAE,CAAA;IACnB,SAAS,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IACvB,QAAQ,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC/B,CAAA;AACD,wBAAsB,2BAA2B,CAC/C,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,MAAM,EACd,UAAU,GAAE,gBAAqB,GAChC,OAAO,CAAC,eAAe,CAAC,CAwI1B;AAED,eAAO,MAAM,qBAAqB,QAAe,GAAG,UAAU,MAAM,KAAG,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAG7F,CAAA;AAsDD,eAAO,MAAM,qBAAqB,UAoBjC,CAAA;AAED,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CA+rBzD,CAAA;AAED,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,UAM/B,CAAA;AACD,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,aAAa,CAAC,EAAE,OAAO,CAAA;CACxB,CAAA;AAGD,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAuBnF;AA2DD,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa;;;GA6BnE;AA4BD,wBAAsB,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;;;;;;;;GAQ5E;AAED,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,iBAYpF;AAED,eAAO,MAAM,uBAAuB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAmR1D,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;CACf,CAAA;AACD,sGAAsG;AACtG,wBAAsB,4BAA4B,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClF,GAAG,EAAE,GAAG,EACR,KAAK,EAAE,iBAAiB,EACxB,WAAW,EAAE,CAAC,EAAE,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC;;;;;;QAqDrC"}
+{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../../../../../../packages/ketsuite/src/modules/user/authorization.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAEnE,KAAK,KAAK,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAA;AAM9E,QAAA,MAAM,OAAO,WAAY,KAAK,EAAE;;;CAAqC,CAAA;AAYrE,eAAO,MAAM,kBAAkB,WAAY,UAAU,CAAC,OAAO,OAAO,CAAC,KAAG,KAEvE,CAAA;AAED,eAAO,MAAM,wBAAwB,GAAU,CAAC,OAAO,GAAG,QAAQ,CAAC,EAAE,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC;;;EAOxF,CAAA;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,EAAE,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAA;IAC1C,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,QAAQ,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,SAAS,GAAG,QAAQ,CAAA;IAC9B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,KAAK,EAAE,uBAAuB,EAAE,CAAA;CACjC,CAAA;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAA;IAC9D,SAAS,EAAE,OAAO,CAAA;IAClB,SAAS,EAAE,mBAAmB,EAAE,CAAA;IAChC,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACjE,CAAA;AA4CD,eAAO,MAAM,wBAAwB,QAC9B,GAAG,UACA,MAAM,UACN;IAAE,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,KACvE,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,eAAe,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,KAAK,EAAE,CAAA;CAAE,CA0C/E,CAAA;AAED,eAAO,MAAM,uBAAuB,QAAe,GAAG,KAAG,OAAO,CAAC,MAAM,CAItE,CAAA;AAED,eAAO,MAAM,4BAA4B,QAAe,GAAG,KAAG,OAAO,CAAC,MAAM,CAW3E,CAAA;AAED,eAAO,MAAM,YAAY,QAAe,GAAG,YAAY,MAAM,KAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAoBpF,CAAA;AAED,eAAO,MAAM,wBAAwB,QAC9B,GAAG,UACA;IACN,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAClC,MAAM,EAAE,OAAO,CAAA;IACf,KAAK,EAAE,OAAO,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,kBAqBF,CAAA;AAED,eAAO,MAAM,eAAe,QACrB,GAAG,MACJ,MAAM,SACH,OAAO,KACb,OAAO,CAAC;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,QAAQ,EAAE,IAAI,CAAA;CAAE,CAepG,CAAA;AAED,eAAO,MAAM,iBAAiB,QAAe,GAAG,MAAM,MAAM,UAAU,OAAO,kBAE5E,CAAA;AAaD;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,aACxB,QAAQ,QACZ,GAAG,UACD,SAAS,GAAG,EAAE,WACb,SAAS,GAAG,EAAE,KACtB,MAAM,EAoCR,CAAA;AAED,uEAAuE;AACvE,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,WAAW,CAAC,EAAE,GAAG,EAAE,CAAA;IACnB,SAAS,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IACvB,QAAQ,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC/B,CAAA;AACD,wBAAsB,2BAA2B,CAC/C,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,MAAM,EACd,UAAU,GAAE,gBAAqB,GAChC,OAAO,CAAC,eAAe,CAAC,CA2I1B;AAED,eAAO,MAAM,qBAAqB,QAAe,GAAG,UAAU,MAAM,KAAG,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAG7F,CAAA;AAsDD,eAAO,MAAM,qBAAqB,UAqBjC,CAAA;AAED,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CA6wBzD,CAAA;AAED,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,UAM/B,CAAA;AACD,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,aAAa,CAAC,EAAE,OAAO,CAAA;CACxB,CAAA;AAGD,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAuBnF;AA2DD,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa;;;GA6BnE;AA4BD,wBAAsB,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;;;;;;;;GAQ5E;AAED,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,iBAYpF;AAED,eAAO,MAAM,uBAAuB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAqf1D,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAA;AACD,sGAAsG;AACtG,wBAAsB,4BAA4B,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClF,GAAG,EAAE,GAAG,EACR,KAAK,EAAE,iBAAiB,EACxB,WAAW,EAAE,CAAC,EAAE,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC;;;;;;QAqDrC"}

package/dist/modules/user/authorization.js

@@ -109,7 +109,7 @@ export const advanceAuthorizationRevision = async (ctx) => {
         message: 'authorization revision changed concurrently',
     });
 };
-const bumpRevision = async (ctx, expected) => {
+export const bumpRevision = async (ctx, expected) => {
     const R = ctx.table('user.AuthorizationRevision');
     const row = await ctx.db.one(from(R).where(eq(R.id, 'tenant')));
     if (!row) {
@@ -147,7 +147,7 @@ export const recordAuthorizationAudit = async (ctx, values) => {
         outcome: values.outcome ?? 'success',
     });
 };
-const operationReplay = async (ctx, id, input) => {
+export const operationReplay = async (ctx, id, input) => {
     const digest = permissionDigest(input);
     const O = ctx.table('user.AuthorizationOperation');
     const existing = await ctx.db.one(from(O).where(eq(O.id, id)));
@@ -163,7 +163,7 @@ const operationReplay = async (ctx, id, input) => {
     });
     return 'dryRun' in inserted || inserted.inserted ? { replay: false, digest } : { conflict: true };
 };
-const completeOperation = async (ctx, id, result) => {
+export const completeOperation = async (ctx, id, result) => {
     await ctx.db.update('user.AuthorizationOperation', { id }, { result, completedAt: nowIso() });
 };
 const roleApplies = (assignment, companyId, branchId) => {
@@ -246,7 +246,12 @@ export async function resolveEffectivePermissions(ctx, userId, projection = {})
     if (branchId && branches.get(branchId) !== companyId)
         return empty([{ code: 'invalid-branch-context' }]);
     const A = ctx.table('user.Assignment');
-    const assignments = (projection.assignments ?? (await ctx.db.all(from(A).where(eq(A.userId, userId))))).filter((assignment) => roleApplies(assignment, companyId, branchId));
+    const P = ctx.table('user.PolicyAssignment');
+    const policyAssignments = await ctx.db.all(from(P).where(eq(P.userId, userId)));
+    const assignments = [
+        ...(projection.assignments ?? (await ctx.db.all(from(A).where(eq(A.userId, userId))))),
+        ...policyAssignments,
+    ].filter((assignment) => roleApplies(assignment, companyId, branchId));
     if (!assignments.length)
         return empty();
     const roleIds = [...new Set(assignments.map((assignment) => String(assignment.roleId)))];
@@ -408,6 +413,7 @@ export const AUTHORIZATION_EFFECTS = [
     'read:user.GrantSource',
     'write:user.GrantSource',
     'read:user.Assignment',
+    'read:user.PolicyAssignment',
     'write:user.Assignment',
     'read:user.Membership',
     'read:user.BranchMembership',
@@ -485,7 +491,7 @@ export const authorizationFunctions = {
             expectedRoleRevision: 'int',
             expectedAuthorizationRevision: 'int',
             idempotencyKey: 'text',
-            reason: 'text',
+            reason: 'text?',
         },
         output: {
             ok: 'bool',
@@ -502,10 +508,10 @@ export const authorizationFunctions = {
             const template = ctx.manifest.permissions.roleTemplates[templateKey];
             if (!template)
                 return invalid([issue('templateKey', 'E_PERMISSION_BUNDLE_UNKNOWN')]);
-            const reason = String(args.reason).trim();
+            const reason = String(args.reason ?? '').trim();
             const operationId = `role-template:${String(args.idempotencyKey).trim()}`;
-            if (!reason || operationId.endsWith(':'))
-                return invalid([issue('reason', 'user.error.required')]);
+            if (operationId.endsWith(':'))
+                return invalid([issue('idempotencyKey', 'user.error.required')]);
             return authorizationTransaction(ctx, async (tx) => {
                 const replay = await operationReplay(tx, operationId, args);
                 if ('conflict' in replay)
@@ -637,6 +643,80 @@ export const authorizationFunctions = {
             });
         },
     }),
+    /**
+     * Bring every role template this deployment declares into the tenant as a
+     * managed role, and bring stale ones up to date.
+     *
+     * Without this a template is a declaration nobody can use: assignment accepts
+     * only managed roles, a managed role exists only once a template is applied, and
+     * nothing applied one. A fresh install therefore had no role to give, and every
+     * template change silently stripped its holders (`stale-managed-role`) until an
+     * operator re-applied it by hand. `ketsuite serve` runs this before it listens,
+     * so both a new and an upgraded install are complete.
+     *
+     * A role a template already backs is kept at its id; a new one takes the
+     * template key as its id. A role at a newer version than the code is left
+     * alone, and so is a custom role, whatever its id.
+     */
+    syncRoleTemplates: defineFn({
+        exposure: 'internal',
+        input: {},
+        output: { ok: 'bool', applied: 'json?', errors: 'json?' },
+        effects: AUTHORIZATION_EFFECTS,
+        handler: async (ctx) => {
+            if (!String(ctx.actor ?? '').startsWith('system:'))
+                return invalid([issue('actor', 'user.error.provisionActor')]);
+            const applied = [];
+            const skipped = [];
+            const R = ctx.table('user.Role');
+            const templates = Object.values(ctx.manifest.permissions.roleTemplates).sort((a, b) => a.key.localeCompare(b.key));
+            for (const template of templates) {
+                const backing = (await ctx.db.all(from(R).where(eq(R.templateKey, template.key)))).filter((role) => String(role.mode ?? 'custom') === 'managed');
+                const targets = backing.length ? backing : [null];
+                for (const role of targets) {
+                    const roleId = role ? String(role.id) : template.key;
+                    if (!role) {
+                        const taken = await ctx.db.one(from(R).where(eq(R.id, roleId)));
+                        // A custom role already holds the key as its id: never overwrite a local decision.
+                        if (taken)
+                            continue;
+                    }
+                    else {
+                        if (Number(role.templateVersion ?? 0) > template.version)
+                            continue;
+                        const G = ctx.table('user.Grant');
+                        const S = ctx.table('user.GrantSource');
+                        const current = Number(role.templateVersion) === template.version &&
+                            role.templateDigest === template.digest &&
+                            managedRoleHealthIssues(ctx.manifest, role, await ctx.db.all(from(G).where(eq(G.roleId, roleId))), await ctx.db.all(from(S).where(eq(S.roleId, roleId)))).length === 0;
+                        if (current)
+                            continue;
+                    }
+                    const expectedRoleRevision = Number(role?.revision ?? 0);
+                    const expectedAuthorizationRevision = await authorizationRevisionOf(ctx);
+                    const result = (await authorizationFunctions.applyRoleTemplate.handler(ctx, {
+                        roleId,
+                        templateKey: template.key,
+                        expectedRoleRevision,
+                        expectedAuthorizationRevision,
+                        // Keyed on the state being repaired, not only the template: a role that
+                        // drifts again after a sync must be applied again, not answered with the
+                        // earlier replay. The authorization revision moves with every write.
+                        idempotencyKey: `sync:${roleId}:${template.version}:${template.digest}:${expectedRoleRevision}:${expectedAuthorizationRevision}`,
+                        reason: 'Áp dụng mẫu vai trò của hệ thống',
+                    }));
+                    // One template that cannot land — a local role already carries its name, say —
+                    // must not keep every other job out of the tenant, nor keep the server down.
+                    // It is reported, and the rest are applied.
+                    if (result?.ok !== true)
+                        skipped.push({ roleId, errors: result?.errors ?? result });
+                    else
+                        applied.push(roleId);
+                }
+            }
+            return skipped.length ? { ok: true, applied, errors: skipped } : { ok: true, applied };
+        },
+    }),
     assignScopedRole: defineFn({
         input: {
             id: 'id',
@@ -647,7 +727,7 @@ export const authorizationFunctions = {
             branchId: 'id?',
             expectedAuthorizationRevision: 'int',
             idempotencyKey: 'text',
-            reason: 'text',
+            reason: 'text?',
         },
         output: {
             ok: 'bool',
@@ -663,10 +743,10 @@ export const authorizationFunctions = {
             const normalized = await normalizeAssignmentScope(ctx, String(args.userId), args);
             if (!normalized.ok)
                 return normalized;
-            const reason = String(args.reason).trim();
+            const reason = String(args.reason ?? '').trim();
             const operationId = `assignment:${String(args.idempotencyKey).trim()}`;
-            if (!reason || operationId.endsWith(':'))
-                return invalid([issue('reason', 'user.error.required')]);
+            if (operationId.endsWith(':'))
+                return invalid([issue('idempotencyKey', 'user.error.required')]);
             return authorizationTransaction(ctx, async (tx) => {
                 const liveScope = await normalizeAssignmentScope(tx, String(args.userId), args);
                 const scope = liveScope.ok ? liveScope.scope : abortAuthorization(liveScope);
@@ -741,7 +821,7 @@ export const authorizationFunctions = {
             scopeKey: 'text',
             expectedAuthorizationRevision: 'int',
             idempotencyKey: 'text',
-            reason: 'text',
+            reason: 'text?',
         },
         output: {
             ok: 'bool',
@@ -753,10 +833,10 @@ export const authorizationFunctions = {
         effects: AUTHORIZATION_EFFECTS,
         idempotent: true,
         handler: async (ctx, args) => {
-            const reason = String(args.reason).trim();
+            const reason = String(args.reason ?? '').trim();
             const operationId = `unassignment:${String(args.idempotencyKey).trim()}`;
-            if (!reason || operationId.endsWith(':'))
-                return invalid([issue('reason', 'user.error.required')]);
+            if (operationId.endsWith(':'))
+                return invalid([issue('idempotencyKey', 'user.error.required')]);
             return authorizationTransaction(ctx, async (tx) => {
                 const replay = await operationReplay(tx, operationId, args);
                 if ('conflict' in replay)
@@ -814,7 +894,7 @@ export const authorizationFunctions = {
             name: 'text',
             expectedAuthorizationRevision: 'int',
             idempotencyKey: 'text',
-            reason: 'text',
+            reason: 'text?',
         },
         output: {
             ok: 'bool',
@@ -826,10 +906,10 @@ export const authorizationFunctions = {
         effects: AUTHORIZATION_EFFECTS,
         idempotent: true,
         handler: async (ctx, args) => {
-            const reason = String(args.reason).trim();
+            const reason = String(args.reason ?? '').trim();
             const name = String(args.name).trim();
             const operationId = `role-clone:${String(args.idempotencyKey).trim()}`;
-            if (!reason || !name || operationId.endsWith(':'))
+            if (!name || operationId.endsWith(':'))
                 return invalid([issue('name', 'user.error.required')]);
             return authorizationTransaction(ctx, async (tx) => {
                 const replay = await operationReplay(tx, operationId, args);
@@ -901,7 +981,7 @@ export const authorizationFunctions = {
             expiresAt: 'datetime?',
             expectedAuthorizationRevision: 'int',
             idempotencyKey: 'text',
-            reason: 'text',
+            reason: 'text?',
         },
         output: {
             ok: 'bool',
@@ -915,13 +995,13 @@ export const authorizationFunctions = {
         effects: AUTHORIZATION_EFFECTS,
         idempotent: true,
         handler: async (ctx, args) => {
-            const reason = String(args.reason).trim();
+            const reason = String(args.reason ?? '').trim();
             const operationId = `break-glass:${String(args.idempotencyKey).trim()}`;
             const enabled = args.enabled === true;
             const expiresAt = args.expiresAt ? new Date(String(args.expiresAt)) : null;
             const expiryMs = expiresAt?.getTime() ?? Number.NaN;
-            if (!reason || operationId.endsWith(':'))
-                return invalid([issue('reason', 'user.error.required')]);
+            if (operationId.endsWith(':'))
+                return invalid([issue('idempotencyKey', 'user.error.required')]);
             if (enabled && (!expiresAt || !Number.isFinite(expiryMs) || expiryMs <= Date.now()))
                 return invalid([issue('expiresAt', 'E_BREAK_GLASS_EXPIRY_REQUIRED')]);
             if (!(await liveSuperuser(ctx, ctx.actor)))
@@ -1235,7 +1315,7 @@ export const accessWorkflowFunctions = {
     assignRoles: defineFn({
         input: {
             ...selectionInput,
-            reason: 'text',
+            reason: 'text?',
             expectedAuthorizationRevision: 'int',
             idempotencyKey: 'text',
         },
@@ -1244,8 +1324,8 @@ export const accessWorkflowFunctions = {
         idempotent: true,
         handler: (ctx, args) => authorizationTransaction(ctx, async (tx) => {
             const op = `role-batch:${String(args.idempotencyKey).trim()}`;
-            if (!String(args.reason).trim() || op.endsWith(':'))
-                required('reason', 'user.error.required');
+            if (op.endsWith(':'))
+                required('idempotencyKey', 'user.error.required');
             const replay = await operationReplay(tx, op, args);
             if ('conflict' in replay)
                 required('idempotencyKey', 'E_AUTHORIZATION_REVISION_CONFLICT');
@@ -1266,7 +1346,7 @@ export const accessWorkflowFunctions = {
                 userId: selection.userId,
                 scopeKey: added.scope.scopeKey,
                 source: 'system-roles',
-                reason: String(args.reason).trim(),
+                reason: String(args.reason ?? '').trim(),
                 before: null,
                 after: added.assignments,
                 revision,
@@ -1298,7 +1378,7 @@ export const accessWorkflowFunctions = {
             scopeKind: 'text',
             companyId: 'id?',
             branchId: 'id?',
-            reason: 'text',
+            reason: 'text?',
             expectedAuthorizationRevision: 'int',
             idempotencyKey: 'text',
         },
@@ -1313,8 +1393,8 @@ export const accessWorkflowFunctions = {
         idempotent: true,
         handler: (ctx, args) => authorizationTransaction(ctx, async (tx) => {
             const op = `provision-user:${String(args.idempotencyKey).trim()}`;
-            if (!String(args.reason).trim() || op.endsWith(':'))
-                required('reason', 'user.error.required');
+            if (op.endsWith(':'))
+                required('idempotencyKey', 'user.error.required');
             const replay = await operationReplay(tx, op, args);
             if ('conflict' in replay)
                 required('idempotencyKey', 'E_AUTHORIZATION_REVISION_CONFLICT');
@@ -1358,20 +1438,22 @@ export const accessWorkflowFunctions = {
             });
             if (!('dryRun' in inserted) && !inserted.inserted)
                 required('login', 'user.error.loginUnique');
+            // A person may be created before any role exists for them. They hold their
+            // workplace and nothing else — no role means no function — until one is
+            // assigned on the access tab. Requiring a role here made hiring impossible
+            // wherever no role template had been applied yet.
             const selection = parseSelection({ ...args, userId, addMembership: true });
-            if (!selection.roleIds.length)
-                required('roleIds', 'E_ROLE_SELECTION_INVALID');
             const added = await addSelectedRoles(tx, selection);
             const revision = (await bumpRevision(tx, Number(args.expectedAuthorizationRevision))) ??
                 required('expectedAuthorizationRevision', 'E_AUTHORIZATION_REVISION_CONFLICT');
             await recordAuthorizationAudit(tx, {
-                event: 'authorization.assignment.created',
+                event: selection.roleIds.length ? 'authorization.assignment.created' : 'authorization.user.created',
                 targetKind: 'user',
                 targetId: userId,
                 userId,
                 scopeKey: added.scope.scopeKey,
                 source: 'system-roles',
-                reason: String(args.reason).trim(),
+                reason: String(args.reason ?? '').trim(),
                 before: null,
                 after: added.assignments,
                 revision,
@@ -1386,6 +1468,230 @@ export const accessWorkflowFunctions = {
             return result;
         }),
     }),
+    /**
+     * Where a person works, decided in one go.
+     *
+     * The screen asks for the whole answer — which companies, which branches, and
+     * which of them is the one they land in — so this settles it in one commit. The
+     * older path granted and revoked one workplace per call from a route loop, which
+     * could fail halfway and leave a person holding half a decision.
+     *
+     * Holding a company implies holding its root branch: that is what makes a company
+     * membership usable, and every grant has always written it.
+     */
+    setWorkplaces: defineFn({
+        input: {
+            userId: 'id',
+            companyIds: 'json',
+            branchIds: 'json',
+            defaultCompanyId: 'id',
+            defaultBranchId: 'id',
+            reason: 'text?',
+            expectedAuthorizationRevision: 'int',
+            idempotencyKey: 'text',
+        },
+        output: { ok: 'bool', revision: 'int?', errors: 'json?', replayed: 'bool?' },
+        effects: [
+            ...USER_ACCESS_EFFECTS,
+            'read:user.User',
+            'write:user.User',
+            'read:company.Company',
+            'read:company.Branch',
+        ],
+        idempotent: true,
+        handler: (ctx, args) => authorizationTransaction(ctx, async (tx) => {
+            const op = `set-workplaces:${String(args.idempotencyKey).trim()}`;
+            const reason = String(args.reason ?? '').trim();
+            if (op.endsWith(':'))
+                required('idempotencyKey', 'user.error.required');
+            const replay = await operationReplay(tx, op, args);
+            if ('conflict' in replay)
+                required('idempotencyKey', 'E_AUTHORIZATION_REVISION_CONFLICT');
+            if ('replay' in replay && replay.replay)
+                return { ...replay.result, replayed: true };
+            if ((await authorizationRevisionOf(tx)) !== args.expectedAuthorizationRevision)
+                required('expectedAuthorizationRevision', 'E_AUTHORIZATION_REVISION_CONFLICT');
+            const userId = String(args.userId);
+            const U = tx.table('user.User');
+            const person = await tx.db.one(from(U).where(eq(U.id, userId)));
+            if (!person)
+                required('userId', 'user.error.userMissing');
+            const companyIds = [...new Set(args.companyIds.map(String))];
+            if (!companyIds.length)
+                required('companyIds', 'user.error.companyRequired');
+            const C = tx.table('company.Company');
+            const B = tx.table('company.Branch');
+            const roots = new Map();
+            for (const companyId of companyIds) {
+                if (!(await tx.db.one(from(C).where(eq(C.id, companyId), eq(C.active, true)))))
+                    required('companyIds', 'user.error.companyMissing');
+                const root = await tx.db.one(from(B).where(eq(B.rootKey, companyId), eq(B.active, true)));
+                if (!root)
+                    required('companyIds', 'user.error.rootBranchMissing');
+                roots.set(companyId, String(root.id));
+            }
+            // A branch is only a workplace if its company is one too.
+            const held = new Set(companyIds);
+            const branchIds = new Set(roots.values());
+            for (const branchId of new Set(args.branchIds.map(String))) {
+                const branch = await tx.db.one(from(B).where(eq(B.id, branchId), eq(B.active, true)));
+                if (!branch)
+                    required('branchIds', 'user.error.branchMissing');
+                if (!held.has(String(branch.companyId)))
+                    required('branchIds', 'user.error.branchCompanyMembership');
+                branchIds.add(branchId);
+            }
+            // Where they land has to be somewhere they work.
+            const defaultCompanyId = String(args.defaultCompanyId);
+            const defaultBranchId = String(args.defaultBranchId);
+            if (!held.has(defaultCompanyId))
+                required('defaultCompanyId', 'user.error.defaultCompanyRevoke');
+            if (!branchIds.has(defaultBranchId))
+                required('defaultBranchId', 'user.error.branchMissing');
+            const defaultBranch = await tx.db.one(from(B).where(eq(B.id, defaultBranchId)));
+            if (String(defaultBranch?.companyId ?? '') !== defaultCompanyId)
+                required('defaultBranchId', 'user.error.branchCompanyMembership');
+            const M = tx.table('user.Membership');
+            const BM = tx.table('user.BranchMembership');
+            const beforeCompanies = (await tx.db.all(from(M).where(eq(M.userId, userId)))).map((row) => String(row.companyId));
+            const beforeBranches = (await tx.db.all(from(BM).where(eq(BM.userId, userId)))).map((row) => String(row.branchId));
+            for (const companyId of companyIds)
+                await tx.db.insertIfAbsent('user.Membership', {
+                    id: `membership:${userId}:${companyId}`,
+                    userId,
+                    companyId,
+                });
+            for (const branchId of branchIds)
+                await tx.db.insertIfAbsent('user.BranchMembership', {
+                    id: `branch:${userId}:${branchId}`,
+                    userId,
+                    branchId,
+                });
+            const goneCompanies = beforeCompanies.filter((id) => !held.has(id));
+            if (goneCompanies.length)
+                await tx.db.del(deleteFrom(M).where(eq(M.userId, userId), inArray(M.companyId, goneCompanies)));
+            const goneBranches = beforeBranches.filter((id) => !branchIds.has(id));
+            if (goneBranches.length)
+                await tx.db.del(deleteFrom(BM).where(eq(BM.userId, userId), inArray(BM.branchId, goneBranches)));
+            await tx.db.update('user.User', { id: userId }, { defaultCompanyId, defaultBranchId });
+            const revision = await bumpRevision(tx, Number(args.expectedAuthorizationRevision));
+            if (revision == null)
+                required('expectedAuthorizationRevision', 'E_AUTHORIZATION_REVISION_CONFLICT');
+            await recordAuthorizationAudit(tx, {
+                event: 'authorization.scope.updated',
+                targetKind: 'user',
+                targetId: userId,
+                scopeKey: `company:${defaultCompanyId}`,
+                source: 'membership',
+                reason,
+                userId,
+                before: { companies: beforeCompanies, branches: beforeBranches },
+                after: { companies: companyIds, branches: [...branchIds], defaultCompanyId, defaultBranchId },
+                revision: revision,
+                metadata: { companyIds, branchIds: [...branchIds], defaultCompanyId, defaultBranchId },
+            });
+            const result = { ok: true, revision };
+            await completeOperation(tx, op, result);
+            return result;
+        }),
+    }),
+    /**
+     * What a custom role is allowed to do, decided by area rather than by key.
+     *
+     * The screen offers the catalogue's bundles, because that is the vocabulary a
+     * business has; this turns the chosen bundles into the function keys they stand
+     * for and makes the role hold exactly those. Areas dropped from the selection go
+     * with their grants, so the form is the whole answer rather than an addition.
+     *
+     * A managed role is refused: its authority comes from a template this deployment
+     * ships, and editing it here would put a local decision where everyone reads the
+     * shipped one. Copy it first.
+     */
+    setRoleBundles: defineFn({
+        input: {
+            roleId: 'id',
+            bundleKeys: 'json',
+            reason: 'text?',
+            expectedAuthorizationRevision: 'int',
+            idempotencyKey: 'text',
+        },
+        output: { ok: 'bool', revision: 'int?', errors: 'json?', replayed: 'bool?' },
+        effects: [
+            ...USER_ACCESS_EFFECTS,
+            'read:user.Role',
+            'read:user.Grant',
+            'write:user.Grant',
+            'read:user.GrantSource',
+            'write:user.GrantSource',
+        ],
+        idempotent: true,
+        handler: (ctx, args) => authorizationTransaction(ctx, async (tx) => {
+            const op = `set-role-bundles:${String(args.idempotencyKey).trim()}`;
+            const reason = String(args.reason ?? '').trim();
+            if (op.endsWith(':'))
+                required('idempotencyKey', 'user.error.required');
+            const replay = await operationReplay(tx, op, args);
+            if ('conflict' in replay)
+                required('idempotencyKey', 'E_AUTHORIZATION_REVISION_CONFLICT');
+            if ('replay' in replay && replay.replay)
+                return { ...replay.result, replayed: true };
+            if ((await authorizationRevisionOf(tx)) !== args.expectedAuthorizationRevision)
+                required('expectedAuthorizationRevision', 'E_AUTHORIZATION_REVISION_CONFLICT');
+            const roleId = String(args.roleId);
+            const R = tx.table('user.Role');
+            const role = await tx.db.one(from(R).where(eq(R.id, roleId)));
+            if (!role)
+                required('roleId', 'user.error.roleMissing');
+            if (String(role.mode ?? '') === 'managed')
+                required('roleId', 'E_ROLE_NOT_ASSIGNABLE');
+            const catalogue = tx.manifest.permissions.bundles ?? {};
+            const wanted = new Set();
+            for (const key of new Set(args.bundleKeys.map(String))) {
+                const bundle = catalogue[key];
+                if (!bundle)
+                    required('bundleKeys', 'user.error.bundleMissing');
+                for (const fnKey of bundle.functions ?? [])
+                    if (tx.manifest.functions[fnKey])
+                        wanted.add(fnKey);
+            }
+            const G = tx.table('user.Grant');
+            const S = tx.table('user.GrantSource');
+            const before = (await tx.db.all(from(G).where(eq(G.roleId, roleId)))).map((row) => String(row.fnKey));
+            const gone = before.filter((fnKey) => !wanted.has(fnKey));
+            for (const fnKey of wanted) {
+                await tx.db.insertIfAbsent('user.GrantSource', {
+                    id: `custom:${roleId}:${fnKey}`,
+                    roleId,
+                    fnKey,
+                    sourceKind: 'custom',
+                    sourceKey: 'direct',
+                    sourceVersion: null,
+                });
+                await tx.db.insertIfAbsent('user.Grant', { id: `grant:${roleId}:${fnKey}`, roleId, fnKey });
+            }
+            if (gone.length) {
+                await tx.db.del(deleteFrom(G).where(eq(G.roleId, roleId), inArray(G.fnKey, gone)));
+                await tx.db.del(deleteFrom(S).where(eq(S.roleId, roleId), inArray(S.fnKey, gone)));
+            }
+            const revision = await bumpRevision(tx, Number(args.expectedAuthorizationRevision));
+            if (revision == null)
+                required('expectedAuthorizationRevision', 'E_AUTHORIZATION_REVISION_CONFLICT');
+            await recordAuthorizationAudit(tx, {
+                event: 'authorization.role.updated',
+                targetKind: 'role',
+                targetId: roleId,
+                source: 'bundles',
+                reason,
+                before: { functions: before },
+                after: { functions: [...wanted] },
+                revision: revision,
+                metadata: { bundleKeys: [...new Set(args.bundleKeys.map(String))] },
+            });
+            const result = { ok: true, revision };
+            await completeOperation(tx, op, result);
+            return result;
+        }),
+    }),
     previewRoleAssignment: defineFn({
         input: { ...selectionInput, assignmentId: 'id?' },
         output: { ok: 'bool', revision: 'int?', contexts: 'json?', errors: 'json?' },
@@ -1490,7 +1796,7 @@ export const accessWorkflowFunctions = {
 export async function createInternalUserWithAccess(ctx, input, afterCreate) {
     return authorizationTransaction(ctx, async (tx) => {
         const name = input.name.trim(), login = input.login.normalize('NFKC').trim().toLowerCase(), email = input.email.trim().toLowerCase();
-        if (!name || !login || !input.reason.trim())
+        if (!name || !login)
             required('name', 'user.error.required');
         const U = tx.table('user.User');
         if (await tx.db.one(from(U).where(eq(U.login, login))))
@@ -1533,7 +1839,7 @@ export async function createInternalUserWithAccess(ctx, input, afterCreate) {
             userId: input.id,
             scopeKey: added.scope.scopeKey,
             source: 'system-roles',
-            reason: input.reason.trim(),
+            reason: (input.reason ?? '').trim(),
             before: null,
             after: added.assignments,
             revision,