@ketvietlab/ketsuite 0.1.3 → 0.1.6

package/dist/modules/user/authorization.js

@@ -1,5 +1,5 @@
 import { randomUUID } from 'node:crypto';
-import { asc, defineFn, deleteFrom, eq, from, inArray, isNotNull, KetError, permissionDigest, } from '@ketvietlab/ketjs';
+import { and, desc, ilike, lt, or, isNull, defineFn, deleteFrom, eq, from, inArray, isNotNull, KetError, permissionDigest, } from '@ketvietlab/ketjs';
 const issue = (field, code, params) => ({
     field,
     code,
@@ -14,10 +14,10 @@ class AuthorizationAbort extends Error {
         this.result = result;
     }
 }
-const abort = (result) => {
+export const abortAuthorization = (result) => {
     throw new AuthorizationAbort(result);
 };
-const authorizationTransaction = async (ctx, body) => {
+export const authorizationTransaction = async (ctx, body) => {
     try {
         return await ctx.tx(body);
     }
@@ -130,11 +130,11 @@ const bumpRevision = async (ctx, expected) => {
 export const recordAuthorizationAudit = async (ctx, values) => {
     await ctx.db.insert('user.SecurityAudit', {
         id: randomUUID(),
-        userId: null,
+        userId: values.userId ?? values.after?.userId ?? values.before?.userId ?? null,
         event: values.event,
         occurredAt: nowIso(),
         networkFingerprint: null,
-        metadata: null,
+        metadata: values.metadata ?? { roleId: values.source, assignmentId: values.targetId },
         actorKey: ctx.actor,
         targetKind: values.targetKind,
         targetId: values.targetId,
@@ -212,14 +212,15 @@ export const managedRoleHealthIssues = (manifest, role, grants, sources) => {
         ? ['stale-managed-provenance']
         : [];
 };
-/** Resolve and explain the exact set used by request authorization. */
-export async function resolveEffectivePermissions(ctx, userId) {
+export async function resolveEffectivePermissions(ctx, userId, projection = {}) {
+    const selectedCompany = projection.companyId === undefined ? ctx.scope.company : projection.companyId;
+    const selectedBranch = projection.branchId === undefined ? ctx.scope.branch : projection.branchId;
     const revision = await authorizationRevisionOf(ctx);
     const empty = (issues = []) => ({
         revision,
         context: {
-            companyId: ctx.scope.company ?? null,
-            branchId: ctx.scope.branch ?? null,
+            companyId: selectedCompany ?? null,
+            branchId: selectedBranch ?? null,
         },
         superuser: false,
         functions: [],
@@ -234,18 +235,18 @@ export async function resolveEffectivePermissions(ctx, userId) {
         if (expiresAt == null || expiresAt > Date.now())
             return { ...empty(), superuser: true };
     }
-    const companyId = String(ctx.scope.company ?? '');
+    const companyId = String(selectedCompany ?? '');
     if (!companyId)
         return empty([{ code: 'invalid-company-context' }]);
-    const companyIds = await activeCompanyMemberships(ctx, userId);
+    const companyIds = projection.companies ?? (await activeCompanyMemberships(ctx, userId));
     if (!companyIds.has(companyId))
         return empty([{ code: 'invalid-company-context' }]);
-    const branchId = String(ctx.scope.branch ?? '');
-    const branches = await activeBranchMemberships(ctx, userId, companyIds);
+    const branchId = String(selectedBranch ?? '');
+    const branches = projection.branches ?? (await activeBranchMemberships(ctx, userId, companyIds));
     if (branchId && branches.get(branchId) !== companyId)
         return empty([{ code: 'invalid-branch-context' }]);
     const A = ctx.table('user.Assignment');
-    const assignments = (await ctx.db.all(from(A).where(eq(A.userId, userId)))).filter((assignment) => roleApplies(assignment, companyId, branchId));
+    const assignments = (projection.assignments ?? (await ctx.db.all(from(A).where(eq(A.userId, userId))))).filter((assignment) => roleApplies(assignment, companyId, branchId));
     if (!assignments.length)
         return empty();
     const roleIds = [...new Set(assignments.map((assignment) => String(assignment.roleId)))];
@@ -397,7 +398,7 @@ const roleTemplatePreview = async (ctx, roleId, templateKey) => {
         highRiskAdded,
     };
 };
-const AUTHORIZATION_EFFECTS = [
+export const AUTHORIZATION_EFFECTS = [
     'read:user.User',
     'write:user.User',
     'read:user.Role',
@@ -446,7 +447,7 @@ export const authorizationFunctions = {
         }),
     }),
     effectiveAccess: defineFn({
-        input: { userId: 'id' },
+        input: { userId: 'id', companyId: 'id?', branchId: 'id?' },
         output: {
             revision: 'int',
             context: 'json',
@@ -455,7 +456,10 @@ export const authorizationFunctions = {
             issues: 'json',
         },
         effects: AUTHORIZATION_EFFECTS.filter((effect) => !effect.startsWith('write:')),
-        handler: (ctx, args) => resolveEffectivePermissions(ctx, String(args.userId)),
+        handler: (ctx, args) => resolveEffectivePermissions(ctx, String(args.userId), {
+            companyId: args.companyId,
+            branchId: args.branchId,
+        }),
     }),
     previewRoleTemplate: defineFn({
         input: { roleId: 'id?', templateKey: 'text' },
@@ -505,7 +509,7 @@ export const authorizationFunctions = {
             return authorizationTransaction(ctx, async (tx) => {
                 const replay = await operationReplay(tx, operationId, args);
                 if ('conflict' in replay)
-                    abort(invalid([issue('idempotencyKey', 'E_ROLE_TEMPLATE_CONFLICT')]));
+                    abortAuthorization(invalid([issue('idempotencyKey', 'E_ROLE_TEMPLATE_CONFLICT')]));
                 if ('replay' in replay && replay.replay)
                     return {
                         ...replay.result,
@@ -516,15 +520,15 @@ export const authorizationFunctions = {
                 const role = await tx.db.one(from(R).where(eq(R.id, roleId)));
                 const expectedRoleRevision = Number(args.expectedRoleRevision);
                 if (Number(role?.revision ?? 0) !== expectedRoleRevision)
-                    abort(invalid([issue('expectedRoleRevision', 'E_ROLE_TEMPLATE_CONFLICT')]));
+                    abortAuthorization(invalid([issue('expectedRoleRevision', 'E_ROLE_TEMPLATE_CONFLICT')]));
                 if (role && String(role.mode ?? 'custom') !== 'managed')
-                    abort(invalid([issue('roleId', 'E_ROLE_TEMPLATE_CONFLICT')]));
+                    abortAuthorization(invalid([issue('roleId', 'E_ROLE_TEMPLATE_CONFLICT')]));
                 if (role && Number(role.templateVersion ?? 0) > template.version)
-                    abort(invalid([issue('templateKey', 'E_ROLE_TEMPLATE_STALE')]));
+                    abortAuthorization(invalid([issue('templateKey', 'E_ROLE_TEMPLATE_STALE')]));
                 if ((await authorizationRevisionOf(tx)) !== Number(args.expectedAuthorizationRevision))
-                    abort(invalid([issue('expectedAuthorizationRevision', 'E_AUTHORIZATION_REVISION_CONFLICT')]));
+                    abortAuthorization(invalid([issue('expectedAuthorizationRevision', 'E_AUTHORIZATION_REVISION_CONFLICT')]));
                 const preview = await roleTemplatePreview(tx, roleId, templateKey);
-                const validPreview = preview.ok ? preview : abort(preview);
+                const validPreview = preview.ok ? preview : abortAuthorization(preview);
                 if (role &&
                     role.templateKey === templateKey &&
                     Number(role.templateVersion) === template.version &&
@@ -533,7 +537,7 @@ export const authorizationFunctions = {
                     validPreview.managedAdded.length === 0 &&
                     validPreview.managedRemoved.length === 0) {
                     if ((await authorizationRevisionOf(tx)) !== Number(args.expectedAuthorizationRevision))
-                        abort(invalid([issue('expectedAuthorizationRevision', 'E_AUTHORIZATION_REVISION_CONFLICT')]));
+                        abortAuthorization(invalid([issue('expectedAuthorizationRevision', 'E_AUTHORIZATION_REVISION_CONFLICT')]));
                     const result = {
                         ok: true,
                         roleId,
@@ -557,7 +561,7 @@ export const authorizationFunctions = {
                         revision: 1,
                     });
                     if (!('dryRun' in inserted) && !inserted.inserted)
-                        abort(invalid([issue('roleId', 'E_ROLE_TEMPLATE_CONFLICT')]));
+                        abortAuthorization(invalid([issue('roleId', 'E_ROLE_TEMPLATE_CONFLICT')]));
                 }
                 else {
                     const changed = await tx.db.compareAndSet('user.Role', { id: roleId }, { revision: expectedRoleRevision }, {
@@ -570,7 +574,7 @@ export const authorizationFunctions = {
                         revision: expectedRoleRevision + 1,
                     });
                     if (!('dryRun' in changed) && !changed.matched)
-                        abort(invalid([issue('expectedRoleRevision', 'E_ROLE_TEMPLATE_CONFLICT')]));
+                        abortAuthorization(invalid([issue('expectedRoleRevision', 'E_ROLE_TEMPLATE_CONFLICT')]));
                 }
                 const S = tx.table('user.GrantSource');
                 const G = tx.table('user.Grant');
@@ -606,7 +610,7 @@ export const authorizationFunctions = {
                         await tx.db.del(deleteFrom(G).where(eq(G.roleId, roleId), eq(G.fnKey, fnKey)));
                 }
                 const revision = (await bumpRevision(tx, Number(args.expectedAuthorizationRevision))) ??
-                    abort(invalid([issue('expectedAuthorizationRevision', 'E_AUTHORIZATION_REVISION_CONFLICT')]));
+                    abortAuthorization(invalid([issue('expectedAuthorizationRevision', 'E_AUTHORIZATION_REVISION_CONFLICT')]));
                 const result = {
                     ok: true,
                     roleId,
@@ -665,13 +669,13 @@ export const authorizationFunctions = {
                 return invalid([issue('reason', 'user.error.required')]);
             return authorizationTransaction(ctx, async (tx) => {
                 const liveScope = await normalizeAssignmentScope(tx, String(args.userId), args);
-                const scope = liveScope.ok ? liveScope.scope : abort(liveScope);
+                const scope = liveScope.ok ? liveScope.scope : abortAuthorization(liveScope);
                 const replay = await operationReplay(tx, operationId, {
                     ...args,
                     scope,
                 });
                 if ('conflict' in replay)
-                    abort(invalid([issue('idempotencyKey', 'E_AUTHORIZATION_REVISION_CONFLICT')]));
+                    abortAuthorization(invalid([issue('idempotencyKey', 'E_AUTHORIZATION_REVISION_CONFLICT')]));
                 if ('replay' in replay && replay.replay)
                     return {
                         ...replay.result,
@@ -679,15 +683,15 @@ export const authorizationFunctions = {
                     };
                 const R = tx.table('user.Role');
                 if (!(await tx.db.one(from(R).where(eq(R.id, args.roleId)))))
-                    abort(invalid([issue('roleId', 'user.error.roleMissing')]));
+                    abortAuthorization(invalid([issue('roleId', 'user.error.roleMissing')]));
                 if ((await authorizationRevisionOf(tx)) !== Number(args.expectedAuthorizationRevision))
-                    abort(invalid([issue('expectedAuthorizationRevision', 'E_AUTHORIZATION_REVISION_CONFLICT')]));
+                    abortAuthorization(invalid([issue('expectedAuthorizationRevision', 'E_AUTHORIZATION_REVISION_CONFLICT')]));
                 const A = tx.table('user.Assignment');
                 const held = await tx.db.one(from(A).where(eq(A.userId, args.userId), eq(A.roleId, args.roleId), eq(A.scopeKey, scope.scopeKey)));
                 const assignmentId = String(held?.id ?? args.id);
                 if (held) {
                     if ((await authorizationRevisionOf(tx)) !== Number(args.expectedAuthorizationRevision))
-                        abort(invalid([issue('expectedAuthorizationRevision', 'E_AUTHORIZATION_REVISION_CONFLICT')]));
+                        abortAuthorization(invalid([issue('expectedAuthorizationRevision', 'E_AUTHORIZATION_REVISION_CONFLICT')]));
                     const result = {
                         ok: true,
                         id: assignmentId,
@@ -705,7 +709,7 @@ export const authorizationFunctions = {
                     ...scope,
                 });
                 const revision = (await bumpRevision(tx, Number(args.expectedAuthorizationRevision))) ??
-                    abort(invalid([issue('expectedAuthorizationRevision', 'E_AUTHORIZATION_REVISION_CONFLICT')]));
+                    abortAuthorization(invalid([issue('expectedAuthorizationRevision', 'E_AUTHORIZATION_REVISION_CONFLICT')]));
                 const result = {
                     ok: true,
                     id: assignmentId,
@@ -732,6 +736,7 @@ export const authorizationFunctions = {
     unassignScopedRole: defineFn({
         input: {
             userId: 'id',
+            assignmentId: 'id?',
             roleId: 'id',
             scopeKey: 'text',
             expectedAuthorizationRevision: 'int',
@@ -755,19 +760,24 @@ export const authorizationFunctions = {
             return authorizationTransaction(ctx, async (tx) => {
                 const replay = await operationReplay(tx, operationId, args);
                 if ('conflict' in replay)
-                    abort(invalid([issue('idempotencyKey', 'E_AUTHORIZATION_REVISION_CONFLICT')]));
+                    abortAuthorization(invalid([issue('idempotencyKey', 'E_AUTHORIZATION_REVISION_CONFLICT')]));
                 if ('replay' in replay && replay.replay)
                     return {
                         ...replay.result,
                         replayed: true,
                     };
                 if ((await authorizationRevisionOf(tx)) !== Number(args.expectedAuthorizationRevision))
-                    abort(invalid([issue('expectedAuthorizationRevision', 'E_AUTHORIZATION_REVISION_CONFLICT')]));
+                    abortAuthorization(invalid([issue('expectedAuthorizationRevision', 'E_AUTHORIZATION_REVISION_CONFLICT')]));
                 const A = tx.table('user.Assignment');
-                const before = await tx.db.one(from(A).where(eq(A.userId, args.userId), eq(A.roleId, args.roleId), eq(A.scopeKey, args.scopeKey)));
+                let selected = from(A).where(eq(A.userId, args.userId), eq(A.roleId, args.roleId), args.scopeKey === 'tenant'
+                    ? or(eq(A.scopeKey, 'tenant'), isNull(A.scopeKey))
+                    : eq(A.scopeKey, args.scopeKey));
+                if (args.assignmentId)
+                    selected = selected.where(eq(A.id, args.assignmentId));
+                const before = await tx.db.one(selected);
                 if (!before) {
                     if ((await authorizationRevisionOf(tx)) !== Number(args.expectedAuthorizationRevision))
-                        abort(invalid([issue('expectedAuthorizationRevision', 'E_AUTHORIZATION_REVISION_CONFLICT')]));
+                        abortAuthorization(invalid([issue('expectedAuthorizationRevision', 'E_AUTHORIZATION_REVISION_CONFLICT')]));
                     const result = {
                         ok: true,
                         removed: 0,
@@ -777,9 +787,9 @@ export const authorizationFunctions = {
                     await completeOperation(tx, operationId, result);
                     return result;
                 }
-                const removed = (await tx.db.del(deleteFrom(A).where(eq(A.userId, args.userId), eq(A.roleId, args.roleId), eq(A.scopeKey, args.scopeKey)))).changes;
+                const removed = (await tx.db.del(deleteFrom(A).where(eq(A.id, before.id)))).changes;
                 const revision = (await bumpRevision(tx, Number(args.expectedAuthorizationRevision))) ??
-                    abort(invalid([issue('expectedAuthorizationRevision', 'E_AUTHORIZATION_REVISION_CONFLICT')]));
+                    abortAuthorization(invalid([issue('expectedAuthorizationRevision', 'E_AUTHORIZATION_REVISION_CONFLICT')]));
                 const result = { ok: true, removed, revision, replayed: false };
                 await recordAuthorizationAudit(tx, {
                     event: 'authorization.assignment.removed',
@@ -824,7 +834,7 @@ export const authorizationFunctions = {
             return authorizationTransaction(ctx, async (tx) => {
                 const replay = await operationReplay(tx, operationId, args);
                 if ('conflict' in replay)
-                    abort(invalid([issue('idempotencyKey', 'E_ROLE_TEMPLATE_CONFLICT')]));
+                    abortAuthorization(invalid([issue('idempotencyKey', 'E_ROLE_TEMPLATE_CONFLICT')]));
                 if ('replay' in replay && replay.replay)
                     return {
                         ...replay.result,
@@ -834,9 +844,9 @@ export const authorizationFunctions = {
                 const sourceRow = await tx.db.one(from(R).where(eq(R.id, args.sourceRoleId)));
                 const source = sourceRow && String(sourceRow.mode ?? 'custom') === 'managed'
                     ? sourceRow
-                    : abort(invalid([issue('sourceRoleId', 'E_ROLE_TEMPLATE_CONFLICT')]));
+                    : abortAuthorization(invalid([issue('sourceRoleId', 'E_ROLE_TEMPLATE_CONFLICT')]));
                 if ((await authorizationRevisionOf(tx)) !== Number(args.expectedAuthorizationRevision))
-                    abort(invalid([issue('expectedAuthorizationRevision', 'E_AUTHORIZATION_REVISION_CONFLICT')]));
+                    abortAuthorization(invalid([issue('expectedAuthorizationRevision', 'E_AUTHORIZATION_REVISION_CONFLICT')]));
                 const inserted = await tx.db.insertIfAbsent('user.Role', {
                     id: args.id,
                     name,
@@ -848,7 +858,7 @@ export const authorizationFunctions = {
                     revision: 1,
                 });
                 if (!('dryRun' in inserted) && !inserted.inserted)
-                    abort(invalid([issue('id', 'E_ROLE_TEMPLATE_CONFLICT')]));
+                    abortAuthorization(invalid([issue('id', 'E_ROLE_TEMPLATE_CONFLICT')]));
                 const G = tx.table('user.Grant');
                 for (const grant of await tx.db.all(from(G).where(eq(G.roleId, args.sourceRoleId)))) {
                     const fnKey = String(grant.fnKey);
@@ -867,7 +877,7 @@ export const authorizationFunctions = {
                     });
                 }
                 const revision = (await bumpRevision(tx, Number(args.expectedAuthorizationRevision))) ??
-                    abort(invalid([issue('expectedAuthorizationRevision', 'E_AUTHORIZATION_REVISION_CONFLICT')]));
+                    abortAuthorization(invalid([issue('expectedAuthorizationRevision', 'E_AUTHORIZATION_REVISION_CONFLICT')]));
                 const result = { ok: true, id: args.id, revision, replayed: false };
                 await recordAuthorizationAudit(tx, {
                     event: 'authorization.role.cloned',
@@ -926,19 +936,19 @@ export const authorizationFunctions = {
                     reason,
                 });
                 if ('conflict' in replay)
-                    abort(invalid([issue('idempotencyKey', 'E_AUTHORIZATION_REVISION_CONFLICT')]));
+                    abortAuthorization(invalid([issue('idempotencyKey', 'E_AUTHORIZATION_REVISION_CONFLICT')]));
                 if ('replay' in replay && replay.replay)
                     return {
                         ...replay.result,
                         replayed: true,
                     };
                 if ((await authorizationRevisionOf(tx)) !== Number(args.expectedAuthorizationRevision))
-                    abort(invalid([issue('expectedAuthorizationRevision', 'E_AUTHORIZATION_REVISION_CONFLICT')]));
+                    abortAuthorization(invalid([issue('expectedAuthorizationRevision', 'E_AUTHORIZATION_REVISION_CONFLICT')]));
                 const U = tx.table('user.User');
-                const user = await tx.db.one(from(U).where(eq(U.id, args.userId), eq(U.active, true)));
+                const user = await tx.db.one(from(U).where(eq(U.id, args.userId)));
                 if (!user || String(user.accessKind) !== 'internal')
-                    abort(invalid([issue('userId', 'user.error.userMissing')]));
-                const target = user ?? abort(invalid([issue('userId', 'user.error.userMissing')]));
+                    abortAuthorization(invalid([issue('userId', 'user.error.userMissing')]));
+                const target = user ?? abortAuthorization(invalid([issue('userId', 'user.error.userMissing')]));
                 const after = enabled
                     ? {
                         superuser: true,
@@ -959,7 +969,7 @@ export const authorizationFunctions = {
                         after.superuserExpiresAt;
                 if (unchanged) {
                     if ((await authorizationRevisionOf(tx)) !== Number(args.expectedAuthorizationRevision))
-                        abort(invalid([issue('expectedAuthorizationRevision', 'E_AUTHORIZATION_REVISION_CONFLICT')]));
+                        abortAuthorization(invalid([issue('expectedAuthorizationRevision', 'E_AUTHORIZATION_REVISION_CONFLICT')]));
                     const result = {
                         ok: true,
                         userId: String(args.userId),
@@ -973,7 +983,7 @@ export const authorizationFunctions = {
                 }
                 await tx.db.update('user.User', { id: args.userId }, after);
                 const revision = (await bumpRevision(tx, Number(args.expectedAuthorizationRevision))) ??
-                    abort(invalid([issue('expectedAuthorizationRevision', 'E_AUTHORIZATION_REVISION_CONFLICT')]));
+                    abortAuthorization(invalid([issue('expectedAuthorizationRevision', 'E_AUTHORIZATION_REVISION_CONFLICT')]));
                 const result = {
                     ok: true,
                     userId: String(args.userId),
@@ -1006,11 +1016,21 @@ export const authorizationFunctions = {
         },
     }),
     listAuthorizationAudit: defineFn({
-        input: { targetKind: 'text?', targetId: 'text?', limit: 'int?' },
+        input: {
+            id: 'id?',
+            targetKind: 'text?',
+            targetId: 'text?',
+            userId: 'id?',
+            limit: 'int?',
+            beforeRevision: 'int?',
+            beforeId: 'id?',
+        },
         output: {
             id: 'id',
             event: 'text',
             occurredAt: 'datetime',
+            userId: 'id?',
+            metadata: 'json?',
             actorKey: 'text?',
             targetKind: 'text?',
             targetId: 'text?',
@@ -1027,7 +1047,15 @@ export const authorizationFunctions = {
             const A = ctx.table('user.SecurityAudit');
             let query = from(A)
                 .where(isNotNull(A.authorizationRevision))
-                .orderBy(asc(A.authorizationRevision), asc(A.id));
+                .orderBy(desc(A.authorizationRevision), desc(A.id));
+            if (args.id)
+                query = query.where(eq(A.id, args.id));
+            if (args.beforeRevision != null)
+                query = query.where(args.beforeId
+                    ? or(lt(A.authorizationRevision, args.beforeRevision), and(eq(A.authorizationRevision, args.beforeRevision), lt(A.id, args.beforeId)))
+                    : lt(A.authorizationRevision, args.beforeRevision));
+            if (args.userId)
+                query = query.where(eq(A.userId, args.userId));
             if (args.targetKind)
                 query = query.where(eq(A.targetKind, args.targetKind));
             if (args.targetId)
@@ -1036,4 +1064,368 @@ export const authorizationFunctions = {
         },
     }),
 };
+/** Transaction-aware primitives shared by the backend and identity adapter. */
+export const USER_ACCESS_EFFECTS = [
+    ...AUTHORIZATION_EFFECTS,
+    'write:user.Membership',
+    'write:user.BranchMembership',
+    'read:user.EmailReservation',
+    'write:user.EmailReservation',
+];
+const required = (field, code) => abortAuthorization(invalid([issue(field, code)]));
+export async function assertAssignableRoles(ctx, ids) {
+    if (ids.length > 100 || new Set(ids).size !== ids.length)
+        required('roleIds', 'E_ROLE_SELECTION_INVALID');
+    const result = [];
+    for (const id of ids) {
+        const R = ctx.table('user.Role');
+        const row = await ctx.db.one(from(R).where(eq(R.id, id)));
+        if (row?.mode !== 'managed')
+            required('roleIds', 'E_ROLE_NOT_ASSIGNABLE');
+        const template = ctx.manifest.permissions.roleTemplates[String(row.templateKey)];
+        if (!template ||
+            template.version !== Number(row.templateVersion) ||
+            template.digest !== row.templateDigest)
+            required('roleIds', 'E_ROLE_NOT_ASSIGNABLE');
+        const G = ctx.table('user.Grant'), S = ctx.table('user.GrantSource');
+        const grants = await ctx.db.all(from(G).where(eq(G.roleId, id)));
+        const sources = await ctx.db.all(from(S).where(eq(S.roleId, id)));
+        if (managedRoleHealthIssues(ctx.manifest, row, grants, sources).length)
+            required('roleIds', 'E_ROLE_NOT_ASSIGNABLE');
+        result.push(row);
+    }
+    return result;
+}
+async function selectionState(ctx, args, removing = false) {
+    const U = ctx.table('user.User');
+    const person = await ctx.db.one(from(U).where(eq(U.id, args.userId)));
+    if (!person || (!removing && (!person.active || person.accessKind !== 'internal')))
+        required('userId', 'user.error.userMissing');
+    if (!['tenant', 'company', 'branch'].includes(args.scopeKind))
+        required('scopeKind', 'E_ASSIGNMENT_SCOPE_INVALID');
+    const companies = await activeCompanyMemberships(ctx, args.userId);
+    const branches = await activeBranchMemberships(ctx, args.userId, companies);
+    const companyId = args.scopeKind === 'tenant' ? null : args.companyId || null;
+    const branchId = args.scopeKind === 'branch' ? args.branchId || null : null;
+    if (companyId && !removing) {
+        const C = ctx.table('company.Company');
+        if (!(await ctx.db.one(from(C).where(eq(C.id, companyId), eq(C.active, true)))))
+            required('companyId', 'E_ASSIGNMENT_SCOPE_INVALID');
+    }
+    else if (!companyId && args.scopeKind !== 'tenant' && !removing)
+        required('companyId', 'E_ASSIGNMENT_SCOPE_INVALID');
+    if (args.scopeKind === 'branch' && !removing) {
+        const B = ctx.table('company.Branch');
+        if (!branchId ||
+            !(await ctx.db.one(from(B).where(eq(B.id, branchId), eq(B.companyId, companyId), eq(B.active, true)))))
+            required('branchId', 'E_ASSIGNMENT_SCOPE_INVALID');
+    }
+    const addCompany = !!companyId && !companies.has(companyId);
+    const addBranch = !!branchId && !branches.has(branchId);
+    if (!removing && (addCompany || addBranch)) {
+        if (!args.addMembership)
+            required('addMembership', 'E_ASSIGNMENT_MEMBERSHIP_REQUIRED');
+        if (!ctx.actor)
+            required('actor', 'E_ACTOR_REQUIRED');
+        const allowed = await effectiveFunctionKeys(ctx, ctx.actor);
+        if (allowed &&
+            ((addCompany && !allowed.includes('user.grantCompany')) ||
+                (addBranch && !allowed.includes('user.grantBranch'))))
+            required('addMembership', 'E_MEMBERSHIP_FORBIDDEN');
+    }
+    if (companyId && !removing)
+        companies.add(companyId);
+    if (branchId && !removing)
+        branches.set(branchId, companyId);
+    if (!companies.size && !removing)
+        required('companyId', 'E_ASSIGNMENT_MEMBERSHIP_REQUIRED');
+    const scope = {
+        scopeKind: args.scopeKind,
+        companyId,
+        branchId,
+        scopeKey: args.scopeKind === 'tenant'
+            ? 'tenant'
+            : branchId
+                ? `branch:${companyId}:${branchId}`
+                : `company:${companyId}`,
+    };
+    const A = ctx.table('user.Assignment');
+    const assignments = await ctx.db.all(from(A).where(eq(A.userId, args.userId)));
+    return { companies, branches, scope, assignments, addCompany, addBranch };
+}
+export async function addSelectedRoles(ctx, args) {
+    await assertAssignableRoles(ctx, args.roleIds);
+    const state = await selectionState(ctx, args);
+    if (state.assignments.some((a) => args.roleIds.includes(String(a.roleId)) && String(a.scopeKey ?? 'tenant') === state.scope.scopeKey))
+        required('roleIds', 'E_ROLE_ALREADY_ASSIGNED');
+    if (state.addCompany)
+        await ctx.db.insert('user.Membership', {
+            id: randomUUID(),
+            userId: args.userId,
+            companyId: state.scope.companyId,
+        });
+    if (state.addBranch)
+        await ctx.db.insert('user.BranchMembership', {
+            id: randomUUID(),
+            userId: args.userId,
+            branchId: state.scope.branchId,
+        });
+    const added = [];
+    for (const roleId of args.roleIds) {
+        const row = { id: randomUUID(), userId: args.userId, roleId, ...state.scope };
+        await ctx.db.insert('user.Assignment', row);
+        added.push(row);
+    }
+    return { assignments: added, scope: state.scope };
+}
+const selectionInput = {
+    userId: 'id',
+    roleIds: 'json',
+    scopeKind: 'text',
+    companyId: 'id?',
+    branchId: 'id?',
+    addMembership: 'bool?',
+};
+const parseSelection = (args) => ({
+    userId: String(args.userId),
+    roleIds: Array.isArray(args.roleIds)
+        ? args.roleIds.map(String)
+        : required('roleIds', 'E_ROLE_SELECTION_INVALID'),
+    scopeKind: String(args.scopeKind),
+    companyId: args.companyId,
+    branchId: args.branchId,
+    addMembership: args.addMembership === true,
+});
+export async function checkUserEmail(ctx, email, userId) {
+    const normalized = email.trim().toLowerCase();
+    if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/u.test(normalized))
+        return { ok: false, available: false, code: 'invalid' };
+    const U = ctx.table('user.User'), E = ctx.table('user.EmailReservation');
+    const users = await ctx.db.all(from(U).where(ilike(U.email, normalized.replace(/[\\%_]/g, '\\$&'), true)));
+    const held = await ctx.db.one(from(E).where(eq(E.id, normalized)));
+    return { ok: true, available: !users.some((p) => p.id !== userId) && (!held || held.userId === userId) };
+}
+export async function reserveUserEmail(ctx, email, userId) {
+    const normalized = email?.trim().toLowerCase() ?? '';
+    const E = ctx.table('user.EmailReservation');
+    if (normalized && !(await checkUserEmail(ctx, normalized, userId)).available)
+        required('email', 'E_EMAIL_UNAVAILABLE');
+    const previous = await ctx.db.all(from(E).where(eq(E.userId, userId)));
+    if (previous.some((row) => row.id === normalized))
+        return;
+    await ctx.db.del(deleteFrom(E).where(eq(E.userId, userId)));
+    if (normalized) {
+        const held = await ctx.db.insertIfAbsent('user.EmailReservation', { id: normalized, userId });
+        if (!('dryRun' in held) && !held.inserted)
+            required('email', 'E_EMAIL_UNAVAILABLE');
+    }
+}
+export const accessWorkflowFunctions = {
+    checkUserEmail: defineFn({
+        input: { email: 'text' },
+        output: { ok: 'bool', available: 'bool', code: 'text?' },
+        effects: ['read:user.User', 'read:user.EmailReservation'],
+        handler: (ctx, args) => checkUserEmail(ctx, String(args.email)),
+    }),
+    assignRoles: defineFn({
+        input: {
+            ...selectionInput,
+            reason: 'text',
+            expectedAuthorizationRevision: 'int',
+            idempotencyKey: 'text',
+        },
+        output: { ok: 'bool', revision: 'int?', errors: 'json?', replayed: 'bool?' },
+        effects: USER_ACCESS_EFFECTS,
+        idempotent: true,
+        handler: (ctx, args) => authorizationTransaction(ctx, async (tx) => {
+            const op = `role-batch:${String(args.idempotencyKey).trim()}`;
+            if (!String(args.reason).trim() || op.endsWith(':'))
+                required('reason', 'user.error.required');
+            const replay = await operationReplay(tx, op, args);
+            if ('conflict' in replay)
+                required('idempotencyKey', 'E_AUTHORIZATION_REVISION_CONFLICT');
+            if ('replay' in replay && replay.replay)
+                return { ...replay.result, replayed: true };
+            const selection = parseSelection(args);
+            if (!selection.roleIds.length)
+                required('roleIds', 'E_ROLE_SELECTION_INVALID');
+            if ((await authorizationRevisionOf(tx)) !== args.expectedAuthorizationRevision)
+                required('expectedAuthorizationRevision', 'E_AUTHORIZATION_REVISION_CONFLICT');
+            const added = await addSelectedRoles(tx, selection);
+            const revision = (await bumpRevision(tx, Number(args.expectedAuthorizationRevision))) ??
+                required('expectedAuthorizationRevision', 'E_AUTHORIZATION_REVISION_CONFLICT');
+            await recordAuthorizationAudit(tx, {
+                event: 'authorization.assignment.created',
+                targetKind: 'user',
+                targetId: selection.userId,
+                userId: selection.userId,
+                scopeKey: added.scope.scopeKey,
+                source: 'system-roles',
+                reason: String(args.reason).trim(),
+                before: null,
+                after: added.assignments,
+                revision,
+                metadata: { roleIds: selection.roleIds, assignmentIds: added.assignments.map((a) => a.id) },
+            });
+            const result = { ok: true, revision };
+            await completeOperation(tx, op, result);
+            return result;
+        }),
+    }),
+    previewRoleAssignment: defineFn({
+        input: { ...selectionInput, assignmentId: 'id?' },
+        output: { ok: 'bool', revision: 'int?', contexts: 'json?', errors: 'json?' },
+        effects: AUTHORIZATION_EFFECTS.filter((x) => !x.startsWith('write:')),
+        handler: (ctx, args) => authorizationTransaction(ctx, async (tx) => {
+            const selection = parseSelection(args), state = await selectionState(tx, selection, !!args.assignmentId);
+            let next;
+            if (args.assignmentId) {
+                if (!state.assignments.some((a) => a.id === args.assignmentId))
+                    required('assignmentId', 'user.error.roleMissing');
+                next = state.assignments.filter((a) => a.id !== args.assignmentId);
+            }
+            else {
+                await assertAssignableRoles(tx, selection.roleIds);
+                if (state.assignments.some((a) => selection.roleIds.includes(String(a.roleId)) &&
+                    String(a.scopeKey ?? 'tenant') === state.scope.scopeKey))
+                    required('roleIds', 'E_ROLE_ALREADY_ASSIGNED');
+                next = [
+                    ...state.assignments,
+                    ...selection.roleIds.map((roleId) => ({
+                        id: `preview:${roleId}`,
+                        userId: selection.userId,
+                        roleId,
+                        ...state.scope,
+                    })),
+                ];
+            }
+            const contexts = [...state.companies]
+                .filter((c) => !state.scope.companyId || c === state.scope.companyId)
+                .flatMap((companyId) => [
+                ...(!state.scope.branchId ? [{ companyId, branchId: null }] : []),
+                ...[...state.branches]
+                    .filter(([b, c]) => c === companyId && (!state.scope.branchId || b === state.scope.branchId))
+                    .map(([branchId]) => ({ companyId, branchId })),
+            ]);
+            const results = [];
+            for (const context of contexts) {
+                const before = await resolveEffectivePermissions(tx, selection.userId, context);
+                const after = await resolveEffectivePermissions(tx, selection.userId, {
+                    ...context,
+                    assignments: next,
+                    companies: state.companies,
+                    branches: state.branches,
+                });
+                const old = new Set(before.functions.map((f) => f.key)), fresh = new Set(after.functions.map((f) => f.key));
+                const added = [...fresh].filter((k) => !old.has(k)), removed = [...old].filter((k) => !fresh.has(k));
+                const bundles = Object.values(tx.manifest.permissions.bundles)
+                    .filter((b) => b.functions.some((k) => added.includes(k) || removed.includes(k)))
+                    .map((b) => ({
+                    key: b.key,
+                    labels: b.labels,
+                    before: b.functions.filter((k) => old.has(k)).length,
+                    after: b.functions.filter((k) => fresh.has(k)).length,
+                    total: b.functions.length,
+                }));
+                results.push({
+                    ...context,
+                    superuser: before.superuser,
+                    added,
+                    removed,
+                    bundles,
+                    retainedBundles: Object.values(tx.manifest.permissions.bundles)
+                        .filter((b) => b.functions.some((k) => old.has(k) && fresh.has(k)))
+                        .map((b) => ({
+                        key: b.key,
+                        labels: b.labels,
+                        complete: b.functions.every((k) => fresh.has(k)),
+                    })),
+                    sensitiveChange: [...added, ...removed].some((k) => ['sensitive', 'security'].includes(tx.manifest.permissions.functions[k]?.risk ?? '')),
+                    retained: [...old].filter((k) => fresh.has(k)),
+                });
+            }
+            const B = tx.table('company.Branch');
+            const roots = new Set((await tx.db.all(from(B).where(isNotNull(B.rootKey)))).map((b) => String(b.id)));
+            const contextsWithoutDuplicateRoots = results.filter((c) => {
+                if (!c.branchId || !roots.has(c.branchId))
+                    return true;
+                const parent = results.find((p) => p.companyId === c.companyId && !p.branchId);
+                return (!parent ||
+                    permissionDigest({
+                        added: parent.added,
+                        removed: parent.removed,
+                        retained: parent.retained,
+                        superuser: parent.superuser,
+                    }) !==
+                        permissionDigest({
+                            added: c.added,
+                            removed: c.removed,
+                            retained: c.retained,
+                            superuser: c.superuser,
+                        }));
+            });
+            return {
+                ok: true,
+                revision: await authorizationRevisionOf(tx),
+                contexts: contextsWithoutDuplicateRoots,
+            };
+        }),
+    }),
+};
+/** Caller owns the identity adapter; this primitive owns the atomic local account/access boundary. */
+export async function createInternalUserWithAccess(ctx, input, afterCreate) {
+    return authorizationTransaction(ctx, async (tx) => {
+        const name = input.name.trim(), login = input.login.normalize('NFKC').trim().toLowerCase(), email = input.email.trim().toLowerCase();
+        if (!name || !login || !input.reason.trim())
+            required('name', 'user.error.required');
+        const U = tx.table('user.User');
+        if (await tx.db.one(from(U).where(eq(U.login, login))))
+            required('login', 'user.error.loginUnique');
+        if (!(await checkUserEmail(tx, email)).available)
+            required('email', 'E_EMAIL_UNAVAILABLE');
+        const reserved = await tx.db.insertIfAbsent('user.EmailReservation', { id: email, userId: input.id });
+        if (!('dryRun' in reserved) && !reserved.inserted)
+            required('email', 'E_EMAIL_UNAVAILABLE');
+        await tx.db.insert('user.User', {
+            id: input.id,
+            name,
+            login,
+            email,
+            passwordHash: null,
+            partnerId: null,
+            lang: null,
+            timezone: null,
+            defaultCompanyId: input.companyId,
+            defaultBranchId: input.branchId || null,
+            accessKind: 'internal',
+            securityVersion: 0,
+            lastLoginAt: null,
+            superuser: false,
+            active: true,
+        });
+        const added = await addSelectedRoles(tx, {
+            userId: input.id,
+            roleIds: input.roleIds,
+            scopeKind: input.branchId ? 'branch' : 'company',
+            companyId: input.companyId,
+            branchId: input.branchId,
+            addMembership: true,
+        });
+        const revision = await advanceAuthorizationRevision(tx);
+        await recordAuthorizationAudit(tx, {
+            event: 'authorization.user.created',
+            targetKind: 'user',
+            targetId: input.id,
+            userId: input.id,
+            scopeKey: added.scope.scopeKey,
+            source: 'system-roles',
+            reason: input.reason.trim(),
+            before: null,
+            after: added.assignments,
+            revision,
+            metadata: { roleIds: input.roleIds, assignmentIds: added.assignments.map((a) => a.id) },
+        });
+        return { ok: true, userId: input.id, ...(await afterCreate(tx)) };
+    });
+}
 //# sourceMappingURL=authorization.js.map