@litusarchieve18/agricore-utils 1.0.5 → 1.0.7

package/README.md

@@ -117,7 +117,11 @@ Run the publish command:
 Bash
 npm publish --access public
 📝 Version History
-v1.0.4 — refactor the code and edit readme
+v1.0.5 — add RESOURCE_MODULE_MAP
+
+v1.0.6 — adding more logic
+
+v1.0.5 — refactor the code and edit readme
 
 v1.0.4 — add generateInfrastructureFields, security access control and multi tenant boundary
 

package/dist/index.d.mts

@@ -487,6 +487,7 @@ declare const RESOURCE_PATHS: {
     teamStaff: string;
     teamTraining: string;
 };
+declare const RESOURCE_MODULE_MAP: Record<string, string[]>;
 declare const ACCESS_RANK: Record<AccessLevelType, number>;
 declare const ROLE_SECTIONS_BY_KEY: Record<string, UserRoleType[]>;
 declare function evaluateBaseAccess(resourcePath: string, session: {
@@ -494,7 +495,6 @@ declare function evaluateBaseAccess(resourcePath: string, session: {
     privileges?: string[];
     enabledModules?: string[];
 }, requirements?: {
-    module?: string;
     allowedRoles?: UserRoleType[];
     requiredPrivileges?: string[];
 }): AccessLevelType;
@@ -506,7 +506,8 @@ declare function evaluateBaseAccess(resourcePath: string, session: {
 declare function assertTenantBoundary(db: any, requesterCompanyId: string, targets: {
     targetUserId?: string;
     authScopeId?: string;
+    expectedScopeType?: 'company' | 'legalEntity' | 'facility';
 }): Promise<boolean>;
-declare function resolveEffectiveAccess(base: AccessLevelType, override?: AccessLevelType): AccessLevelType;
+declare function resolveEffectiveAccess(base: AccessLevelType, override?: AccessLevelType | null): AccessLevelType;
 
-export { ACCESS_RANK, ACT, AccessLevel, type AccessLevelType, type AgriCoreSession, AgriLogger, AppError, ApprovalStatus, ApprovalType, AuditStatus, AuditType, type AuthScopeFields, type AvailableScope, CAT, type CompanyConfig, Converter, CropCycleStatus, ERROR_DICTIONARY, EmitterType, EnabledModule, ErrorFactory, FORM_REGISTRY, FacilityType, type FormMeta, HarvestMethod, type InfrastructureFields, LinkedStatus, MOD, MODULE_LABELS, MicroclimateZone, MimeType, type ModCode, NettingType, NotificationMode, OrderStatus, type PermissionLevel, PhysicalState, PlantingMethod, RESOURCE_PATHS, ROLE_SECTIONS_BY_KEY, RelationshipType, type ResolvedError, type ResourceOverrides, RowOrientation, SENTINEL_UUID, type ScopeType, SoilTexture, TASK_TYPE_REGISTRY, type TabConfig, TargetEntityType, TaskStatus, TaskType, type TaskTypeConfig, TransactionType, TrellisType, UserPrivilege, UserRole, type UserRoleType, Validator, VigorRating, WaterSource, assertCanWrite, assertTenantBoundary, buildRlsFilter, canRead, canWrite, evaluateBaseAccess, extractAppCode, generateCanonicalId, generateInfrastructureFields, getAcceptedMimeTypes, getApproveAction, getFormMeta, getFormsGroupedByModule, getTaskTypeOptions, handleAppErrorResponse, isTabVisible, isTabWritable, resolveAccess, resolveAppError, resolveEffectiveAccess, resolveError, resolveMenuVisibility, withAgriLogging };
+export { ACCESS_RANK, ACT, AccessLevel, type AccessLevelType, type AgriCoreSession, AgriLogger, AppError, ApprovalStatus, ApprovalType, AuditStatus, AuditType, type AuthScopeFields, type AvailableScope, CAT, type CompanyConfig, Converter, CropCycleStatus, ERROR_DICTIONARY, EmitterType, EnabledModule, ErrorFactory, FORM_REGISTRY, FacilityType, type FormMeta, HarvestMethod, type InfrastructureFields, LinkedStatus, MOD, MODULE_LABELS, MicroclimateZone, MimeType, type ModCode, NettingType, NotificationMode, OrderStatus, type PermissionLevel, PhysicalState, PlantingMethod, RESOURCE_MODULE_MAP, RESOURCE_PATHS, ROLE_SECTIONS_BY_KEY, RelationshipType, type ResolvedError, type ResourceOverrides, RowOrientation, SENTINEL_UUID, type ScopeType, SoilTexture, TASK_TYPE_REGISTRY, type TabConfig, TargetEntityType, TaskStatus, TaskType, type TaskTypeConfig, TransactionType, TrellisType, UserPrivilege, UserRole, type UserRoleType, Validator, VigorRating, WaterSource, assertCanWrite, assertTenantBoundary, buildRlsFilter, canRead, canWrite, evaluateBaseAccess, extractAppCode, generateCanonicalId, generateInfrastructureFields, getAcceptedMimeTypes, getApproveAction, getFormMeta, getFormsGroupedByModule, getTaskTypeOptions, handleAppErrorResponse, isTabVisible, isTabWritable, resolveAccess, resolveAppError, resolveEffectiveAccess, resolveError, resolveMenuVisibility, withAgriLogging };

package/dist/index.d.ts

@@ -487,6 +487,7 @@ declare const RESOURCE_PATHS: {
     teamStaff: string;
     teamTraining: string;
 };
+declare const RESOURCE_MODULE_MAP: Record<string, string[]>;
 declare const ACCESS_RANK: Record<AccessLevelType, number>;
 declare const ROLE_SECTIONS_BY_KEY: Record<string, UserRoleType[]>;
 declare function evaluateBaseAccess(resourcePath: string, session: {
@@ -494,7 +495,6 @@ declare function evaluateBaseAccess(resourcePath: string, session: {
     privileges?: string[];
     enabledModules?: string[];
 }, requirements?: {
-    module?: string;
     allowedRoles?: UserRoleType[];
     requiredPrivileges?: string[];
 }): AccessLevelType;
@@ -506,7 +506,8 @@ declare function evaluateBaseAccess(resourcePath: string, session: {
 declare function assertTenantBoundary(db: any, requesterCompanyId: string, targets: {
     targetUserId?: string;
     authScopeId?: string;
+    expectedScopeType?: 'company' | 'legalEntity' | 'facility';
 }): Promise<boolean>;
-declare function resolveEffectiveAccess(base: AccessLevelType, override?: AccessLevelType): AccessLevelType;
+declare function resolveEffectiveAccess(base: AccessLevelType, override?: AccessLevelType | null): AccessLevelType;
 
-export { ACCESS_RANK, ACT, AccessLevel, type AccessLevelType, type AgriCoreSession, AgriLogger, AppError, ApprovalStatus, ApprovalType, AuditStatus, AuditType, type AuthScopeFields, type AvailableScope, CAT, type CompanyConfig, Converter, CropCycleStatus, ERROR_DICTIONARY, EmitterType, EnabledModule, ErrorFactory, FORM_REGISTRY, FacilityType, type FormMeta, HarvestMethod, type InfrastructureFields, LinkedStatus, MOD, MODULE_LABELS, MicroclimateZone, MimeType, type ModCode, NettingType, NotificationMode, OrderStatus, type PermissionLevel, PhysicalState, PlantingMethod, RESOURCE_PATHS, ROLE_SECTIONS_BY_KEY, RelationshipType, type ResolvedError, type ResourceOverrides, RowOrientation, SENTINEL_UUID, type ScopeType, SoilTexture, TASK_TYPE_REGISTRY, type TabConfig, TargetEntityType, TaskStatus, TaskType, type TaskTypeConfig, TransactionType, TrellisType, UserPrivilege, UserRole, type UserRoleType, Validator, VigorRating, WaterSource, assertCanWrite, assertTenantBoundary, buildRlsFilter, canRead, canWrite, evaluateBaseAccess, extractAppCode, generateCanonicalId, generateInfrastructureFields, getAcceptedMimeTypes, getApproveAction, getFormMeta, getFormsGroupedByModule, getTaskTypeOptions, handleAppErrorResponse, isTabVisible, isTabWritable, resolveAccess, resolveAppError, resolveEffectiveAccess, resolveError, resolveMenuVisibility, withAgriLogging };
+export { ACCESS_RANK, ACT, AccessLevel, type AccessLevelType, type AgriCoreSession, AgriLogger, AppError, ApprovalStatus, ApprovalType, AuditStatus, AuditType, type AuthScopeFields, type AvailableScope, CAT, type CompanyConfig, Converter, CropCycleStatus, ERROR_DICTIONARY, EmitterType, EnabledModule, ErrorFactory, FORM_REGISTRY, FacilityType, type FormMeta, HarvestMethod, type InfrastructureFields, LinkedStatus, MOD, MODULE_LABELS, MicroclimateZone, MimeType, type ModCode, NettingType, NotificationMode, OrderStatus, type PermissionLevel, PhysicalState, PlantingMethod, RESOURCE_MODULE_MAP, RESOURCE_PATHS, ROLE_SECTIONS_BY_KEY, RelationshipType, type ResolvedError, type ResourceOverrides, RowOrientation, SENTINEL_UUID, type ScopeType, SoilTexture, TASK_TYPE_REGISTRY, type TabConfig, TargetEntityType, TaskStatus, TaskType, type TaskTypeConfig, TransactionType, TrellisType, UserPrivilege, UserRole, type UserRoleType, Validator, VigorRating, WaterSource, assertCanWrite, assertTenantBoundary, buildRlsFilter, canRead, canWrite, evaluateBaseAccess, extractAppCode, generateCanonicalId, generateInfrastructureFields, getAcceptedMimeTypes, getApproveAction, getFormMeta, getFormsGroupedByModule, getTaskTypeOptions, handleAppErrorResponse, isTabVisible, isTabWritable, resolveAccess, resolveAppError, resolveEffectiveAccess, resolveError, resolveMenuVisibility, withAgriLogging };

package/dist/index.js

@@ -49,6 +49,7 @@ __export(index_exports, {
   OrderStatus: () => OrderStatus,
   PhysicalState: () => PhysicalState,
   PlantingMethod: () => PlantingMethod,
+  RESOURCE_MODULE_MAP: () => RESOURCE_MODULE_MAP,
   RESOURCE_PATHS: () => RESOURCE_PATHS,
   ROLE_SECTIONS_BY_KEY: () => ROLE_SECTIONS_BY_KEY,
   RelationshipType: () => RelationshipType,
@@ -842,6 +843,56 @@ var RESOURCE_PATHS = {
   teamStaff: "team.staff",
   teamTraining: "team.training"
 };
+var ALL_OPERATIONS = [
+  EnabledModule.FARM_MANAGEMENT,
+  EnabledModule.PACKHOUSE,
+  EnabledModule.ACCOMMODATION
+];
+var AGRI_ONLY = [
+  EnabledModule.FARM_MANAGEMENT,
+  EnabledModule.PACKHOUSE
+];
+var RESOURCE_MODULE_MAP = {
+  // ── Top-level menu sections ────────────────────────────────────────────────
+  // CORE features (accessible to everyone with an account)
+  [RESOURCE_PATHS.dashboard]: [],
+  [RESOURCE_PATHS.operations]: ALL_OPERATIONS,
+  [RESOURCE_PATHS.equipment]: ALL_OPERATIONS,
+  [RESOURCE_PATHS.safety]: ALL_OPERATIONS,
+  [RESOURCE_PATHS.team]: ALL_OPERATIONS,
+  [RESOURCE_PATHS.records]: ALL_OPERATIONS,
+  [RESOURCE_PATHS.adminSettings]: ALL_OPERATIONS,
+  // ── Records & Reports ──────────────────────────────────────────────────────
+  [RESOURCE_PATHS.documentHub]: ALL_OPERATIONS,
+  [RESOURCE_PATHS.documentHubTemplates]: ALL_OPERATIONS,
+  [RESOURCE_PATHS.documentHubFolder]: ALL_OPERATIONS,
+  [RESOURCE_PATHS.documentHubExtraction]: ALL_OPERATIONS,
+  [RESOURCE_PATHS.documentHubQueue]: ALL_OPERATIONS,
+  [RESOURCE_PATHS.analytics]: ALL_OPERATIONS,
+  // ── Admin Settings ─────────────────────────────────────────────────────────
+  [RESOURCE_PATHS.adminUserRoster]: ALL_OPERATIONS,
+  [RESOURCE_PATHS.adminBlueprintsSites]: ALL_OPERATIONS,
+  [RESOURCE_PATHS.adminRolesPermissions]: ALL_OPERATIONS,
+  [RESOURCE_PATHS.adminCompanySettings]: ALL_OPERATIONS,
+  // ── Operations ────────────────────────────────────────────────────────────
+  [RESOURCE_PATHS.farmManagement]: [EnabledModule.FARM_MANAGEMENT],
+  [RESOURCE_PATHS.packhouse]: [EnabledModule.PACKHOUSE],
+  [RESOURCE_PATHS.accommodation]: [EnabledModule.ACCOMMODATION],
+  // ── Equipment & Fleet ──────────────────────────────────────────────────────
+  [RESOURCE_PATHS.equipPreStart]: ALL_OPERATIONS,
+  [RESOURCE_PATHS.equipMaintenance]: ALL_OPERATIONS,
+  [RESOURCE_PATHS.equipFuelRegister]: ALL_OPERATIONS,
+  [RESOURCE_PATHS.equipCalibration]: AGRI_ONLY,
+  [RESOURCE_PATHS.equipFleet]: ALL_OPERATIONS,
+  // ── Safety, Quality & Compliance ──────────────────────────────────────────
+  [RESOURCE_PATHS.safetyAuditing]: ALL_OPERATIONS,
+  [RESOURCE_PATHS.safetyFood]: AGRI_ONLY,
+  [RESOURCE_PATHS.safetyWhs]: ALL_OPERATIONS,
+  [RESOURCE_PATHS.safetyCleaning]: ALL_OPERATIONS,
+  // ── Team & HR ──────────────────────────────────────────────────────────────
+  [RESOURCE_PATHS.teamStaff]: ALL_OPERATIONS,
+  [RESOURCE_PATHS.teamTraining]: ALL_OPERATIONS
+};
 var ACCESS_RANK = {
   NONE: 0,
   READ: 1,
@@ -859,18 +910,20 @@ var ROLE_SECTIONS_BY_KEY = {
 function evaluateBaseAccess(resourcePath, session, requirements = {}) {
   if (!session?.role) return "NONE";
   if (session.role === UserRole.OWNER) return "WRITE";
+  const requiredModules = RESOURCE_MODULE_MAP[resourcePath] || [];
+  if (requiredModules.length > 0) {
+    const hasModule = requiredModules.some((m) => session.enabledModules?.includes(m));
+    if (!hasModule) return "NONE";
+  }
   const topLevel = resourcePath.split(".")[0];
   const defaultRoles = ROLE_SECTIONS_BY_KEY[topLevel] || [];
-  if (requirements.module && !session.enabledModules?.includes(requirements.module)) return "NONE";
   const allowedRoles = requirements.allowedRoles?.length ? requirements.allowedRoles : defaultRoles;
   if (!allowedRoles.includes(session.role)) return "NONE";
   if (requirements.requiredPrivileges?.length) {
     const hasPrivilege = requirements.requiredPrivileges.some((p) => session.privileges?.includes(p));
     if (!hasPrivilege) return "NONE";
   }
-  const highRoles = [UserRole.OWNER, UserRole.MANAGER];
-  const isHighRole = highRoles.includes(session.role);
-  return isHighRole ? "WRITE" : "READ";
+  return session.role === UserRole.MANAGER ? "WRITE" : "READ";
 }
 async function assertTenantBoundary(db, requesterCompanyId, targets) {
   if (!requesterCompanyId) {
@@ -887,23 +940,29 @@ async function assertTenantBoundary(db, requesterCompanyId, targets) {
     }
   }
   if (targets.authScopeId) {
-    const [companyMatch, leMatch, facMatch] = await Promise.all([
-      db.Company.filter({ canonicalId: targets.authScopeId, id: requesterCompanyId }),
-      // Base44 id must match requester
-      db.LegalEntity.filter({ canonicalId: targets.authScopeId, companyId: requesterCompanyId }),
-      db.Facility.filter({ canonicalId: targets.authScopeId, companyId: requesterCompanyId })
-    ]);
-    const isValidScope = companyMatch.length > 0 || leMatch.length > 0 || facMatch.length > 0;
-    if (!isValidScope) {
-      console.error(`[SECURITY BREACH ATTEMPT] User tried to assign scope ${targets.authScopeId} outside company ${requesterCompanyId}`);
-      throw ErrorFactory.forbidden(MOD.ADMIN, ACT.EDIT, "Invalid authorization scope or tenant boundary violation.");
+    let matchFound = false;
+    if (targets.expectedScopeType === "company" || !targets.expectedScopeType) {
+      const c = await db.Company.filter({ canonicalId: targets.authScopeId, id: requesterCompanyId });
+      if (c.length > 0) matchFound = true;
+    }
+    if (!matchFound && (targets.expectedScopeType === "legalEntity" || !targets.expectedScopeType)) {
+      const le = await db.LegalEntity.filter({ canonicalId: targets.authScopeId, companyId: requesterCompanyId });
+      if (le.length > 0) matchFound = true;
+    }
+    if (!matchFound && (targets.expectedScopeType === "facility" || !targets.expectedScopeType)) {
+      const fac = await db.Facility.filter({ canonicalId: targets.authScopeId, companyId: requesterCompanyId });
+      if (fac.length > 0) matchFound = true;
+    }
+    if (!matchFound) {
+      console.error(`[SECURITY BREACH/VALIDATION ERROR] Scope ${targets.authScopeId} not found for type ${targets.expectedScopeType} in company ${requesterCompanyId}`);
+      throw ErrorFactory.forbidden(MOD.ADMIN, ACT.EDIT, "Invalid authorization scope level or tenant boundary violation.");
     }
   }
   return true;
 }
 function resolveEffectiveAccess(base, override) {
-  if (!override) return base;
-  return ACCESS_RANK[override] >= ACCESS_RANK[base] ? override : base;
+  if (override === void 0 || override === null) return base;
+  return override;
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
@@ -936,6 +995,7 @@ function resolveEffectiveAccess(base, override) {
   OrderStatus,
   PhysicalState,
   PlantingMethod,
+  RESOURCE_MODULE_MAP,
   RESOURCE_PATHS,
   ROLE_SECTIONS_BY_KEY,
   RelationshipType,

package/dist/index.mjs

@@ -748,6 +748,56 @@ var RESOURCE_PATHS = {
   teamStaff: "team.staff",
   teamTraining: "team.training"
 };
+var ALL_OPERATIONS = [
+  EnabledModule.FARM_MANAGEMENT,
+  EnabledModule.PACKHOUSE,
+  EnabledModule.ACCOMMODATION
+];
+var AGRI_ONLY = [
+  EnabledModule.FARM_MANAGEMENT,
+  EnabledModule.PACKHOUSE
+];
+var RESOURCE_MODULE_MAP = {
+  // ── Top-level menu sections ────────────────────────────────────────────────
+  // CORE features (accessible to everyone with an account)
+  [RESOURCE_PATHS.dashboard]: [],
+  [RESOURCE_PATHS.operations]: ALL_OPERATIONS,
+  [RESOURCE_PATHS.equipment]: ALL_OPERATIONS,
+  [RESOURCE_PATHS.safety]: ALL_OPERATIONS,
+  [RESOURCE_PATHS.team]: ALL_OPERATIONS,
+  [RESOURCE_PATHS.records]: ALL_OPERATIONS,
+  [RESOURCE_PATHS.adminSettings]: ALL_OPERATIONS,
+  // ── Records & Reports ──────────────────────────────────────────────────────
+  [RESOURCE_PATHS.documentHub]: ALL_OPERATIONS,
+  [RESOURCE_PATHS.documentHubTemplates]: ALL_OPERATIONS,
+  [RESOURCE_PATHS.documentHubFolder]: ALL_OPERATIONS,
+  [RESOURCE_PATHS.documentHubExtraction]: ALL_OPERATIONS,
+  [RESOURCE_PATHS.documentHubQueue]: ALL_OPERATIONS,
+  [RESOURCE_PATHS.analytics]: ALL_OPERATIONS,
+  // ── Admin Settings ─────────────────────────────────────────────────────────
+  [RESOURCE_PATHS.adminUserRoster]: ALL_OPERATIONS,
+  [RESOURCE_PATHS.adminBlueprintsSites]: ALL_OPERATIONS,
+  [RESOURCE_PATHS.adminRolesPermissions]: ALL_OPERATIONS,
+  [RESOURCE_PATHS.adminCompanySettings]: ALL_OPERATIONS,
+  // ── Operations ────────────────────────────────────────────────────────────
+  [RESOURCE_PATHS.farmManagement]: [EnabledModule.FARM_MANAGEMENT],
+  [RESOURCE_PATHS.packhouse]: [EnabledModule.PACKHOUSE],
+  [RESOURCE_PATHS.accommodation]: [EnabledModule.ACCOMMODATION],
+  // ── Equipment & Fleet ──────────────────────────────────────────────────────
+  [RESOURCE_PATHS.equipPreStart]: ALL_OPERATIONS,
+  [RESOURCE_PATHS.equipMaintenance]: ALL_OPERATIONS,
+  [RESOURCE_PATHS.equipFuelRegister]: ALL_OPERATIONS,
+  [RESOURCE_PATHS.equipCalibration]: AGRI_ONLY,
+  [RESOURCE_PATHS.equipFleet]: ALL_OPERATIONS,
+  // ── Safety, Quality & Compliance ──────────────────────────────────────────
+  [RESOURCE_PATHS.safetyAuditing]: ALL_OPERATIONS,
+  [RESOURCE_PATHS.safetyFood]: AGRI_ONLY,
+  [RESOURCE_PATHS.safetyWhs]: ALL_OPERATIONS,
+  [RESOURCE_PATHS.safetyCleaning]: ALL_OPERATIONS,
+  // ── Team & HR ──────────────────────────────────────────────────────────────
+  [RESOURCE_PATHS.teamStaff]: ALL_OPERATIONS,
+  [RESOURCE_PATHS.teamTraining]: ALL_OPERATIONS
+};
 var ACCESS_RANK = {
   NONE: 0,
   READ: 1,
@@ -765,18 +815,20 @@ var ROLE_SECTIONS_BY_KEY = {
 function evaluateBaseAccess(resourcePath, session, requirements = {}) {
   if (!session?.role) return "NONE";
   if (session.role === UserRole.OWNER) return "WRITE";
+  const requiredModules = RESOURCE_MODULE_MAP[resourcePath] || [];
+  if (requiredModules.length > 0) {
+    const hasModule = requiredModules.some((m) => session.enabledModules?.includes(m));
+    if (!hasModule) return "NONE";
+  }
   const topLevel = resourcePath.split(".")[0];
   const defaultRoles = ROLE_SECTIONS_BY_KEY[topLevel] || [];
-  if (requirements.module && !session.enabledModules?.includes(requirements.module)) return "NONE";
   const allowedRoles = requirements.allowedRoles?.length ? requirements.allowedRoles : defaultRoles;
   if (!allowedRoles.includes(session.role)) return "NONE";
   if (requirements.requiredPrivileges?.length) {
     const hasPrivilege = requirements.requiredPrivileges.some((p) => session.privileges?.includes(p));
     if (!hasPrivilege) return "NONE";
   }
-  const highRoles = [UserRole.OWNER, UserRole.MANAGER];
-  const isHighRole = highRoles.includes(session.role);
-  return isHighRole ? "WRITE" : "READ";
+  return session.role === UserRole.MANAGER ? "WRITE" : "READ";
 }
 async function assertTenantBoundary(db, requesterCompanyId, targets) {
   if (!requesterCompanyId) {
@@ -793,23 +845,29 @@ async function assertTenantBoundary(db, requesterCompanyId, targets) {
     }
   }
   if (targets.authScopeId) {
-    const [companyMatch, leMatch, facMatch] = await Promise.all([
-      db.Company.filter({ canonicalId: targets.authScopeId, id: requesterCompanyId }),
-      // Base44 id must match requester
-      db.LegalEntity.filter({ canonicalId: targets.authScopeId, companyId: requesterCompanyId }),
-      db.Facility.filter({ canonicalId: targets.authScopeId, companyId: requesterCompanyId })
-    ]);
-    const isValidScope = companyMatch.length > 0 || leMatch.length > 0 || facMatch.length > 0;
-    if (!isValidScope) {
-      console.error(`[SECURITY BREACH ATTEMPT] User tried to assign scope ${targets.authScopeId} outside company ${requesterCompanyId}`);
-      throw ErrorFactory.forbidden(MOD.ADMIN, ACT.EDIT, "Invalid authorization scope or tenant boundary violation.");
+    let matchFound = false;
+    if (targets.expectedScopeType === "company" || !targets.expectedScopeType) {
+      const c = await db.Company.filter({ canonicalId: targets.authScopeId, id: requesterCompanyId });
+      if (c.length > 0) matchFound = true;
+    }
+    if (!matchFound && (targets.expectedScopeType === "legalEntity" || !targets.expectedScopeType)) {
+      const le = await db.LegalEntity.filter({ canonicalId: targets.authScopeId, companyId: requesterCompanyId });
+      if (le.length > 0) matchFound = true;
+    }
+    if (!matchFound && (targets.expectedScopeType === "facility" || !targets.expectedScopeType)) {
+      const fac = await db.Facility.filter({ canonicalId: targets.authScopeId, companyId: requesterCompanyId });
+      if (fac.length > 0) matchFound = true;
+    }
+    if (!matchFound) {
+      console.error(`[SECURITY BREACH/VALIDATION ERROR] Scope ${targets.authScopeId} not found for type ${targets.expectedScopeType} in company ${requesterCompanyId}`);
+      throw ErrorFactory.forbidden(MOD.ADMIN, ACT.EDIT, "Invalid authorization scope level or tenant boundary violation.");
     }
   }
   return true;
 }
 function resolveEffectiveAccess(base, override) {
-  if (!override) return base;
-  return ACCESS_RANK[override] >= ACCESS_RANK[base] ? override : base;
+  if (override === void 0 || override === null) return base;
+  return override;
 }
 export {
   ACCESS_RANK,
@@ -841,6 +899,7 @@ export {
   OrderStatus,
   PhysicalState,
   PlantingMethod,
+  RESOURCE_MODULE_MAP,
   RESOURCE_PATHS,
   ROLE_SECTIONS_BY_KEY,
   RelationshipType,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@litusarchieve18/agricore-utils",
-  "version": "1.0.5",
+  "version": "1.0.7",
   "description": "Canonical Backend Utility Library for AgriCore",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",