@marinoscar/platform-api 0.0.0-stage → 0.1.0-next.10

package/dist/credentials/org-credentials.service.js

@@ -0,0 +1,270 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var OrgCredentialsService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OrgCredentialsService = void 0;
+const common_1 = require("@nestjs/common");
+const index_1 = require("../core/index");
+const credential_internals_1 = require("./credential-internals");
+const registry_1 = require("./registry");
+// =============================================================================
+// OrgCredentialsService — an ORGANIZATION's own encrypted credentials (#735)
+// =============================================================================
+//
+// The third tier of the credential store, between a user's own keys and the
+// deployment's: secrets an organization owns (its AI provider key, its own
+// storage or mail account), addressed by `(orgId, purpose, name)` in
+// `org_credentials`.
+//
+// THE SAME INVARIANTS AS THE OTHER TWO STORES (read `CredentialsService`):
+//
+//   1. NO PLAINTEXT EGRESS. `getSecret` returns plaintext and is server-side
+//      only; `describe`/`list`/`setSecret` return `OrgCredentialInfo`, which
+//      has no field able to carry a secret. No log line or error carries a
+//      secret or a hint.
+//   2. BLANK PRESERVES. A blank secret keeps the stored ciphertext; erasing is
+//      `deleteSecret`. A blank secret with nothing stored is a 400.
+//
+// PLUS TWO OF ITS OWN:
+//
+//   - AN ORG-BOUND CIPHER DOMAIN, `org:<orgId>:<purpose>`
+//     (`orgCredentialPurpose`): a ciphertext copied into another
+//     organization's row fails GCM authentication.
+//   - TENANT ISOLATION IN THE DATABASE. `org_credentials` is under FORCEd
+//     row-level security; every query runs through `forOrg(prisma, orgId)`
+//     (core), which sets the transaction-local `app.org_id`. A query for
+//     another organization sees nothing, whatever its `where` says.
+//
+// `orgId` comes from the principal (`activeOrgId`) or a job payload, never
+// from request input. WRITES NEED A REGISTERED PURPOSE with the `org` tier
+// (`registerCredentialPurpose`); anything else is a programming error (500).
+// =============================================================================
+/** Columns making up an `OrgCredentialInfo`: the ciphertext is never selected. */
+const ORG_CREDENTIAL_INFO_SELECT = {
+    purpose: true,
+    name: true,
+    hint: true,
+    label: true,
+    updatedByUserId: true,
+    createdAt: true,
+    updatedAt: true,
+};
+/**
+ * An organization's encrypted credentials, addressed by
+ * `(orgId, purpose, name)`, encrypted under `org:<orgId>:<purpose>` and read
+ * only inside that organization's row-level-security scope.
+ *
+ * @example
+ * ```ts
+ * await orgCredentials.setSecret(principal.activeOrgId, 'ai', 'openai', typedKey, {
+ *   label: 'OpenAI key',
+ *   updatedByUserId: principal.userId,
+ * });
+ * ```
+ *
+ * @stability experimental
+ */
+let OrgCredentialsService = OrgCredentialsService_1 = class OrgCredentialsService {
+    prisma;
+    logger = new common_1.Logger(OrgCredentialsService_1.name);
+    /**
+     * @param prisma - the app's Prisma client, through the core `PLATFORM_PRISMA` port.
+     */
+    constructor(prisma) {
+        this.prisma = prisma;
+    }
+    /** This organization's credentials, through the org-scoped (RLS) client. */
+    credentialsOf(orgId) {
+        return (0, index_1.forOrg)(this.prisma, orgId).orgCredential;
+    }
+    // ---------------------------------------------------------------------------
+    // Reads
+    // ---------------------------------------------------------------------------
+    /**
+     * SERVER-SIDE ONLY. RETURNS PLAINTEXT. NEVER CALL THIS FROM A CONTROLLER.
+     *
+     * @param orgId - the owning organization (a canonical UUID).
+     * @param purpose - the purpose.
+     * @param name - the name within it; defaults to `'default'`.
+     * @returns the plaintext, or `null` when nothing is stored at this address.
+     * @throws InternalServerErrorException when the row exists but will not
+     *   decrypt (a changed key, a tampered row, or a row moved from another
+     *   organization). Never reported as "not configured".
+     */
+    async getSecret(orgId, purpose, name = registry_1.DEFAULT_USER_CREDENTIAL_NAME) {
+        this.assertAddress(orgId, purpose, name);
+        const row = await this.credentialsOf(orgId).findUnique({
+            where: { orgId_purpose_name: { orgId, purpose, name } },
+            select: { secret: true },
+        });
+        if (!row)
+            return null;
+        try {
+            return (0, index_1.decryptSecret)(row.secret, (0, index_1.orgCredentialPurpose)(orgId, purpose));
+        }
+        catch {
+            // Swallowed rather than chained, as in `CredentialsService.getSecret`.
+            this.logger.error(`Failed to decrypt org credential "${purpose}/${name}" for organization ${orgId}: the payload is corrupt, belongs to another organization, or SECRETS_ENCRYPTION_KEY has changed. The credential must be re-entered.`);
+            throw new common_1.InternalServerErrorException(`Credential "${purpose}/${name}" could not be decrypted. It must be set again.`);
+        }
+    }
+    /**
+     * Presentation read for one credential. Safe to serialise.
+     *
+     * @param orgId - the owning organization.
+     * @param purpose - the purpose.
+     * @param name - the name within it; defaults to `'default'`.
+     * @returns the info, or `null` when nothing is stored at this address.
+     */
+    async describe(orgId, purpose, name = registry_1.DEFAULT_USER_CREDENTIAL_NAME) {
+        this.assertAddress(orgId, purpose, name);
+        const row = await this.credentialsOf(orgId).findUnique({
+            where: { orgId_purpose_name: { orgId, purpose, name } },
+            select: ORG_CREDENTIAL_INFO_SELECT,
+        });
+        return row ? toInfo(row) : null;
+    }
+    /**
+     * Presentation read for this organization's credentials, all of them or
+     * only those under `purpose`, ordered by purpose then name.
+     *
+     * @param orgId - the owning organization.
+     * @param purpose - restricts the list to one purpose.
+     * @returns the infos; empty when there are none.
+     */
+    async list(orgId, purpose) {
+        this.assertOrg(orgId);
+        if (purpose !== undefined)
+            (0, credential_internals_1.assertCredentialPurpose)(purpose);
+        const rows = await this.credentialsOf(orgId).findMany({
+            where: purpose === undefined ? { orgId } : { orgId, purpose },
+            select: ORG_CREDENTIAL_INFO_SELECT,
+            orderBy: [{ purpose: 'asc' }, { name: 'asc' }],
+        });
+        return rows.map(toInfo);
+    }
+    // ---------------------------------------------------------------------------
+    // Writes
+    // ---------------------------------------------------------------------------
+    /**
+     * Create or update the credential at `(orgId, purpose, name)`.
+     *
+     * BLANK PRESERVES: `undefined`, `null` or `''` keeps the stored ciphertext
+     * and hint and applies only `meta`.
+     *
+     * @param orgId - the owning organization.
+     * @param purpose - a purpose registered with the `org` tier.
+     * @param name - the name within it.
+     * @param secret - the plaintext, or blank to keep the stored one.
+     * @param meta - label and provenance.
+     * @returns the stored credential's info.
+     * @throws InternalServerErrorException for an unregistered purpose (a
+     *   programming error).
+     * @throws BadRequestException on a blank secret with nothing stored yet, or
+     *   a malformed address.
+     */
+    async setSecret(orgId, purpose, name, secret, meta = {}) {
+        this.assertAddress(orgId, purpose, name);
+        const problem = (0, registry_1.writablePurposeProblem)(purpose, 'org');
+        if (problem)
+            throw new common_1.InternalServerErrorException(problem);
+        const metaUpdate = {};
+        if (meta.label !== undefined)
+            metaUpdate.label = meta.label;
+        if (meta.updatedByUserId !== undefined)
+            metaUpdate.updatedByUserId = meta.updatedByUserId;
+        const delegate = this.credentialsOf(orgId);
+        const where = { orgId_purpose_name: { orgId, purpose, name } };
+        if ((0, credential_internals_1.isBlankSecret)(secret)) {
+            const existing = await delegate.findUnique({ where, select: { id: true } });
+            if (!existing) {
+                throw new common_1.BadRequestException(`Cannot create credential "${purpose}/${name}" without a secret. A blank value preserves an existing secret, but there is none stored at this address yet.`);
+            }
+            if (Object.keys(metaUpdate).length === 0) {
+                return (await this.describe(orgId, purpose, name));
+            }
+            const updated = await delegate.update({
+                where,
+                data: metaUpdate,
+                select: ORG_CREDENTIAL_INFO_SELECT,
+            });
+            this.logger.log(`Updated metadata for org credential "${purpose}/${name}" for organization ${orgId} (secret preserved)`);
+            return toInfo(updated);
+        }
+        const encrypted = (0, index_1.encryptSecret)(secret, (0, index_1.orgCredentialPurpose)(orgId, purpose));
+        const hint = (0, credential_internals_1.deriveHint)(secret);
+        const row = await delegate.upsert({
+            where,
+            create: {
+                orgId,
+                purpose,
+                name,
+                secret: encrypted,
+                hint,
+                label: meta.label ?? null,
+                updatedByUserId: meta.updatedByUserId ?? null,
+            },
+            update: { secret: encrypted, hint, ...metaUpdate },
+            select: ORG_CREDENTIAL_INFO_SELECT,
+        });
+        // Address only — never `secret`, `encrypted` or `hint`.
+        this.logger.log(`Stored org credential "${purpose}/${name}" for organization ${orgId}`);
+        return toInfo(row);
+    }
+    /**
+     * Remove the credential at `(orgId, purpose, name)`. The ONLY way to erase
+     * one. Idempotent: deleting an absent credential is a no-op.
+     *
+     * @param orgId - the owning organization.
+     * @param purpose - the purpose.
+     * @param name - the name within it.
+     */
+    async deleteSecret(orgId, purpose, name) {
+        this.assertAddress(orgId, purpose, name);
+        const { count } = await this.credentialsOf(orgId).deleteMany({ where: { orgId, purpose, name } });
+        if (count > 0)
+            this.logger.log(`Deleted org credential "${purpose}/${name}" for organization ${orgId}`);
+    }
+    // ---------------------------------------------------------------------------
+    // Internals
+    // ---------------------------------------------------------------------------
+    assertOrg(orgId) {
+        if (!(0, index_1.isCanonicalUuid)(orgId)) {
+            throw new common_1.BadRequestException('Credential organization must be a canonical (lowercase, hyphenated) UUID.');
+        }
+    }
+    assertAddress(orgId, purpose, name) {
+        this.assertOrg(orgId);
+        (0, credential_internals_1.assertCredentialAddress)(purpose, name);
+    }
+};
+exports.OrgCredentialsService = OrgCredentialsService;
+exports.OrgCredentialsService = OrgCredentialsService = OrgCredentialsService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(index_1.PLATFORM_PRISMA)),
+    __metadata("design:paramtypes", [Object])
+], OrgCredentialsService);
+/** Build an `OrgCredentialInfo` field by field — never by spreading a row. */
+function toInfo(row) {
+    return {
+        purpose: row.purpose,
+        name: row.name,
+        hint: row.hint,
+        label: row.label,
+        updatedByUserId: row.updatedByUserId,
+        createdAt: row.createdAt,
+        updatedAt: row.updatedAt,
+    };
+}
+//# sourceMappingURL=org-credentials.service.js.map

package/dist/credentials/org-credentials.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-credentials.service.js","sourceRoot":"","sources":["../../src/credentials/org-credentials.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAMwB;AAExB,yCAA6H;AAC7H,iEAKgC;AAGhC,yCAAkF;AAElF,gFAAgF;AAChF,6EAA6E;AAC7E,gFAAgF;AAChF,EAAE;AACF,4EAA4E;AAC5E,2EAA2E;AAC3E,qEAAqE;AACrE,qBAAqB;AACrB,EAAE;AACF,2EAA2E;AAC3E,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,2EAA2E;AAC3E,yBAAyB;AACzB,+EAA+E;AAC/E,oEAAoE;AACpE,EAAE;AACF,uBAAuB;AACvB,EAAE;AACF,0DAA0D;AAC1D,iEAAiE;AACjE,mDAAmD;AACnD,0EAA0E;AAC1E,2EAA2E;AAC3E,yEAAyE;AACzE,oEAAoE;AACpE,EAAE;AACF,2EAA2E;AAC3E,2EAA2E;AAC3E,6EAA6E;AAC7E,gFAAgF;AAEhF,kFAAkF;AAClF,MAAM,0BAA0B,GAA0C;IACxE,OAAO,EAAE,IAAI;IACb,IAAI,EAAE,IAAI;IACV,IAAI,EAAE,IAAI;IACV,KAAK,EAAE,IAAI;IACX,eAAe,EAAE,IAAI;IACrB,SAAS,EAAE,IAAI;IACf,SAAS,EAAE,IAAI;CAChB,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AAEI,IAAM,qBAAqB,6BAA3B,MAAM,qBAAqB;IAMsB;IALrC,MAAM,GAAG,IAAI,eAAM,CAAC,uBAAqB,CAAC,IAAI,CAAC,CAAC;IAEjE;;OAEG;IACH,YAAsD,MAAyB;QAAzB,WAAM,GAAN,MAAM,CAAmB;IAAG,CAAC;IAEnF,4EAA4E;IACpE,aAAa,CAAC,KAAa;QACjC,OAAQ,IAAA,cAAM,EAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAkC,CAAC,aAAa,CAAC;IACpF,CAAC;IAED,8EAA8E;IAC9E,QAAQ;IACR,8EAA8E;IAE9E;;;;;;;;;;OAUG;IACH,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,OAAe,EAAE,OAAe,uCAA4B;QACzF,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAEzC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,UAAU,CAAqB;YACzE,KAAK,EAAE,EAAE,kBAAkB,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;YACvD,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;SACzB,CAAC,CAAC;QACH,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QAEtB,IAAI,CAAC;YACH,OAAO,IAAA,qBAAa,EAAC,GAAG,CAAC,MAAM,EAAE,IAAA,4BAAoB,EAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;YACvE,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,qCAAqC,OAAO,IAAI,IAAI,sBAAsB,KAAK,sIAAsI,CACtN,CAAC;YACF,MAAM,IAAI,qCAA4B,CAAC,eAAe,OAAO,IAAI,IAAI,iDAAiD,CAAC,CAAC;QAC1H,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,QAAQ,CAAC,KAAa,EAAE,OAAe,EAAE,OAAe,uCAA4B;QACxF,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,UAAU,CAAoB;YACxE,KAAK,EAAE,EAAE,kBAAkB,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;YACvD,MAAM,EAAE,0BAA0B;SACnC,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,IAAI,CAAC,KAAa,EAAE,OAAgB;QACxC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACtB,IAAI,OAAO,KAAK,SAAS;YAAE,IAAA,8CAAuB,EAAC,OAAO,CAAC,CAAC;QAE5D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAoB;YACvE,KAAK,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE;YAC7D,MAAM,EAAE,0BAA0B;YAClC,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;SAC/C,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IAED,8EAA8E;IAC9E,SAAS;IACT,8EAA8E;IAE9E;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,SAAS,CACb,KAAa,EACb,OAAe,EACf,IAAY,EACZ,MAAiC,EACjC,OAA0B,EAAE;QAE5B,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,IAAA,iCAAsB,EAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACvD,IAAI,OAAO;YAAE,MAAM,IAAI,qCAA4B,CAAC,OAAO,CAAC,CAAC;QAE7D,MAAM,UAAU,GAAyB,EAAE,CAAC;QAC5C,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,UAAU,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAC5D,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS;YAAE,UAAU,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;QAE1F,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,EAAE,kBAAkB,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;QAE/D,IAAI,IAAA,oCAAa,EAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAiB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YAC5F,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,4BAAmB,CAC3B,6BAA6B,OAAO,IAAI,IAAI,+GAA+G,CAC5J,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzC,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAsB,CAAC;YAC1E,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAoB;gBACvD,KAAK;gBACL,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,0BAA0B;aACnC,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,wCAAwC,OAAO,IAAI,IAAI,sBAAsB,KAAK,qBAAqB,CAAC,CAAC;YACzH,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;QAED,MAAM,SAAS,GAAG,IAAA,qBAAa,EAAC,MAAM,EAAE,IAAA,4BAAoB,EAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;QAC9E,MAAM,IAAI,GAAG,IAAA,iCAAU,EAAC,MAAM,CAAC,CAAC;QAEhC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAoB;YACnD,KAAK;YACL,MAAM,EAAE;gBACN,KAAK;gBACL,OAAO;gBACP,IAAI;gBACJ,MAAM,EAAE,SAAS;gBACjB,IAAI;gBACJ,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;gBACzB,eAAe,EAAE,IAAI,CAAC,eAAe,IAAI,IAAI;aAC9C;YACD,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,UAAU,EAAE;YAClD,MAAM,EAAE,0BAA0B;SACnC,CAAC,CAAC;QAEH,wDAAwD;QACxD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,0BAA0B,OAAO,IAAI,IAAI,sBAAsB,KAAK,EAAE,CAAC,CAAC;QACxF,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,OAAe,EAAE,IAAY;QAC7D,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACzC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAClG,IAAI,KAAK,GAAG,CAAC;YAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,2BAA2B,OAAO,IAAI,IAAI,sBAAsB,KAAK,EAAE,CAAC,CAAC;IAC1G,CAAC;IAED,8EAA8E;IAC9E,YAAY;IACZ,8EAA8E;IAEtE,SAAS,CAAC,KAAa;QAC7B,IAAI,CAAC,IAAA,uBAAe,EAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,4BAAmB,CAAC,2EAA2E,CAAC,CAAC;QAC7G,CAAC;IACH,CAAC;IAEO,aAAa,CAAC,KAAa,EAAE,OAAe,EAAE,IAAY;QAChE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACtB,IAAA,8CAAuB,EAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;CACF,CAAA;AAlMY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,mBAAU,GAAE;IAOE,WAAA,IAAA,eAAM,EAAC,uBAAe,CAAC,CAAA;;GANzB,qBAAqB,CAkMjC;AAED,8EAA8E;AAC9E,SAAS,MAAM,CAAC,GAAsB;IACpC,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,eAAe,EAAE,GAAG,CAAC,eAAe;QACpC,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC;AACJ,CAAC"}

package/dist/credentials/ownership.d.ts

@@ -0,0 +1,30 @@
+import type { ModelOwnershipDef, UserOwnedModelDef } from '../core/index';
+/**
+ * The slice's three models in the model ownership registry
+ * (`registerModelOwnership`): the deployment store is `system`, a user's own
+ * store `user`, and an organization's store `org` (row-level security on
+ * `org_id`, policy `org_credentials_org_isolation`).
+ *
+ * @example
+ * ```ts
+ * registerModelOwnership(CREDENTIALS_MODEL_OWNERSHIP);
+ * ```
+ *
+ * @extensionPoint registry
+ * @stability experimental
+ */
+export declare const CREDENTIALS_MODEL_OWNERSHIP: readonly ModelOwnershipDef<'Credential' | 'UserCredential' | 'OrgCredential'>[];
+/**
+ * The slice's models with a foreign key to `User`, for the app's
+ * user-owned-data registry (`registerUserOwnedModels`).
+ *
+ * @example
+ * ```ts
+ * registerUserOwnedModels(CREDENTIALS_USER_OWNED_MODELS);
+ * ```
+ *
+ * @extensionPoint registry
+ * @stability experimental
+ */
+export declare const CREDENTIALS_USER_OWNED_MODELS: readonly UserOwnedModelDef<'Credential' | 'UserCredential' | 'OrgCredential'>[];
+//# sourceMappingURL=ownership.d.ts.map

package/dist/credentials/ownership.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ownership.d.ts","sourceRoot":"","sources":["../../src/credentials/ownership.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAE1E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,2BAA2B,EAAE,SAAS,iBAAiB,CAAC,YAAY,GAAG,gBAAgB,GAAG,eAAe,CAAC,EAQtH,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,6BAA6B,EAAE,SAAS,iBAAiB,CAAC,YAAY,GAAG,gBAAgB,GAAG,eAAe,CAAC,EAwBxH,CAAC"}

package/dist/credentials/ownership.js

@@ -0,0 +1,74 @@
+"use strict";
+// =============================================================================
+// The credentials slice's model ownership and user-owned data (issue #735)
+// =============================================================================
+//
+// Pure data for the app's two registries (the reference app registers them in
+// `prisma/ownership/*.manifest.ts`, beside the platform's other entries):
+//
+//   Credential.updatedByUserId       ACTOR: purge sets null (SetNull)    system table
+//   UserCredential.userId            OWNER: purge deletes (Cascade)      user table
+//   OrgCredential.updatedByUserId    ACTOR: purge sets null (SetNull)    org table (RLS)
+// =============================================================================
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CREDENTIALS_USER_OWNED_MODELS = exports.CREDENTIALS_MODEL_OWNERSHIP = void 0;
+/**
+ * The slice's three models in the model ownership registry
+ * (`registerModelOwnership`): the deployment store is `system`, a user's own
+ * store `user`, and an organization's store `org` (row-level security on
+ * `org_id`, policy `org_credentials_org_isolation`).
+ *
+ * @example
+ * ```ts
+ * registerModelOwnership(CREDENTIALS_MODEL_OWNERSHIP);
+ * ```
+ *
+ * @extensionPoint registry
+ * @stability experimental
+ */
+exports.CREDENTIALS_MODEL_OWNERSHIP = [
+    { model: 'Credential', kind: 'system', rationale: 'Deployment-wide encrypted credentials (SMTP, storage, VAPID).' },
+    { model: 'UserCredential', kind: 'user', rationale: "A user's own encrypted key." },
+    {
+        model: 'OrgCredential',
+        kind: 'org',
+        rationale: "An organization's own encrypted key, encrypted under the org-bound sub-key; another organization must never read or overwrite it.",
+    },
+];
+/**
+ * The slice's models with a foreign key to `User`, for the app's
+ * user-owned-data registry (`registerUserOwnedModels`).
+ *
+ * @example
+ * ```ts
+ * registerUserOwnedModels(CREDENTIALS_USER_OWNED_MODELS);
+ * ```
+ *
+ * @extensionPoint registry
+ * @stability experimental
+ */
+exports.CREDENTIALS_USER_OWNED_MODELS = [
+    {
+        model: 'UserCredential',
+        ownerField: 'userId',
+        purge: 'delete',
+        export: 'include',
+        exportOmit: ['secret'],
+        rationale: "The user's own encrypted keys (bring your own key). The export lists the addresses and hints; the ciphertext never leaves the server.",
+    },
+    {
+        model: 'Credential',
+        actorFields: ['updatedByUserId'],
+        purge: 'detach',
+        export: 'exclude',
+        rationale: 'A deployment-owned secret; the user only last changed it.',
+    },
+    {
+        model: 'OrgCredential',
+        actorFields: ['updatedByUserId'],
+        purge: 'detach',
+        export: 'exclude',
+        rationale: "An organization-owned secret; the user only last changed it, and it outlives them.",
+    },
+];
+//# sourceMappingURL=ownership.js.map

package/dist/credentials/ownership.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ownership.js","sourceRoot":"","sources":["../../src/credentials/ownership.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,2EAA2E;AAC3E,gFAAgF;AAChF,EAAE;AACF,8EAA8E;AAC9E,0EAA0E;AAC1E,EAAE;AACF,sFAAsF;AACtF,oFAAoF;AACpF,yFAAyF;AACzF,gFAAgF;;;AAIhF;;;;;;;;;;;;;GAaG;AACU,QAAA,2BAA2B,GAAoF;IAC1H,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,+DAA+D,EAAE;IACnH,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,6BAA6B,EAAE;IACnF;QACE,KAAK,EAAE,eAAe;QACtB,IAAI,EAAE,KAAK;QACX,SAAS,EAAE,mIAAmI;KAC/I;CACF,CAAC;AAEF;;;;;;;;;;;GAWG;AACU,QAAA,6BAA6B,GAAoF;IAC5H;QACE,KAAK,EAAE,gBAAgB;QACvB,UAAU,EAAE,QAAQ;QACpB,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,SAAS;QACjB,UAAU,EAAE,CAAC,QAAQ,CAAC;QACtB,SAAS,EACP,uIAAuI;KAC1I;IACD;QACE,KAAK,EAAE,YAAY;QACnB,WAAW,EAAE,CAAC,iBAAiB,CAAC;QAChC,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE,2DAA2D;KACvE;IACD;QACE,KAAK,EAAE,eAAe;QACtB,WAAW,EAAE,CAAC,iBAAiB,CAAC;QAChC,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE,oFAAoF;KAChG;CACF,CAAC"}

package/dist/credentials/registry.d.ts

@@ -0,0 +1,181 @@
+import { type Registry } from '../core/index';
+/**
+ * The tiers a system or org purpose may be stored in: `system` is the
+ * deployment store (`credentials`), `org` an organization's (`org_credentials`).
+ *
+ * @stability experimental
+ */
+export type CredentialTier = 'system' | 'org';
+/**
+ * One system or org credential purpose.
+ *
+ * @stability experimental
+ */
+export interface CredentialPurposeDef {
+    /** The stored purpose and sub-key domain (`'smtp'`). No `:`; permanent once rows exist. */
+    readonly purpose: string;
+    /** Who declared it: a platform slice id (`'email'`) or an app owner (`'app'`). */
+    readonly owner: string;
+    /** Short, human description for logs and the Doctor ("SMTP password"). */
+    readonly label: string;
+    /** The tiers it may be stored in; at least one. */
+    readonly tiers: readonly CredentialTier[];
+}
+/**
+ * Where a credential lives in the deployment or an organization store.
+ *
+ * @stability experimental
+ */
+export interface SystemCredentialAddress {
+    /** A registered purpose with the matching tier. */
+    readonly purpose: string;
+    /** The name within it (`'default'`). */
+    readonly name: string;
+}
+/**
+ * The org-tier counterpart's address; same shape as {@link SystemCredentialAddress}.
+ *
+ * @stability experimental
+ */
+export type OrgCredentialAddress = SystemCredentialAddress;
+/**
+ * A step of the resolver's fallback after the user's own key.
+ *
+ * @stability experimental
+ */
+export type CredentialFallbackTier = 'org' | 'system';
+/**
+ * One kind of key a user may supply themselves.
+ *
+ * @stability experimental
+ */
+export interface UserCredentialPurposeDef {
+    /**
+     * Stable identifier, stored on every row and bound into the cipher domain
+     * `user:<userId>:<purpose>`, so renaming it strands every stored key. No `:`.
+     */
+    readonly purpose: string;
+    /** Short user-facing name ("Webhook signing secret"). */
+    readonly label: string;
+    /** One or two sentences of user-facing copy: what the key is used for. */
+    readonly description: string;
+    /**
+     * The deployment's own key for the same thing, or `null` when there is no
+     * deployment-wide counterpart.
+     */
+    readonly system: SystemCredentialAddress | null;
+    /**
+     * The organization's key for the same thing, in `org_credentials`, or
+     * `null`/absent when there is none.
+     */
+    readonly org?: OrgCredentialAddress | null;
+    /**
+     * Where the resolver looks after the user's own key, in order.
+     *
+     * @defaultValue `['system']` when `system` is set, `[]` otherwise (the
+     *   behaviour before organizations existed).
+     */
+    readonly fallback?: readonly CredentialFallbackTier[];
+}
+/**
+ * The `name` a user's credential is stored under when a purpose has one key.
+ *
+ * @stability experimental
+ */
+export declare const DEFAULT_USER_CREDENTIAL_NAME = "default";
+/**
+ * Every system and org credential purpose. Read it; register with
+ * {@link registerCredentialPurpose}.
+ *
+ * @stability experimental
+ */
+export declare const credentialPurposeRegistry: Registry<CredentialPurposeDef>;
+/**
+ * Declares a system or org credential purpose. Call it at import time from
+ * the owner's manifest, before the application bootstraps.
+ *
+ * @param def - the purpose, its owner, a label and the tiers it is stored in.
+ * @throws RegistryError `DUPLICATE_ID` when another owner already claimed the
+ *   purpose, `INVALID_ID` / `INVALID_ENTRY` for a malformed one, `FROZEN`
+ *   after bootstrap.
+ *
+ * @example
+ * ```ts
+ * registerCredentialPurpose({ purpose: 'smtp', owner: 'email', label: 'SMTP password', tiers: ['system'] });
+ * ```
+ *
+ * @extensionPoint registry
+ * @stability experimental
+ */
+export declare function registerCredentialPurpose(def: CredentialPurposeDef): void;
+/**
+ * Every kind of key a user may bring. Read it (the resolver reads it through
+ * the `USER_CREDENTIAL_PURPOSE_REGISTRY` token); register with
+ * {@link registerUserCredentialPurpose}.
+ *
+ * @stability experimental
+ */
+export declare const userCredentialPurposeRegistry: Registry<UserCredentialPurposeDef>;
+/**
+ * Declares a kind of key a user may bring themselves. Call it at import time
+ * from the owner's manifest, before the application bootstraps.
+ *
+ * @param def - the purpose, its copy, its system and org counterparts and the
+ *   fallback order.
+ * @throws RegistryError `DUPLICATE_ID` for a purpose already declared,
+ *   `INVALID_ENTRY` for a malformed one, `FROZEN` after bootstrap.
+ *
+ * @example
+ * ```ts
+ * registerUserCredentialPurpose({
+ *   purpose: 'webhook_signing_key',
+ *   label: 'Webhook signing secret',
+ *   description: 'Signs the webhooks sent on your behalf.',
+ *   system: null,
+ * });
+ * ```
+ *
+ * @extensionPoint registry
+ * @stability experimental
+ */
+export declare function registerUserCredentialPurpose(def: UserCredentialPurposeDef): void;
+/**
+ * The resolver's fallback order for a purpose: its `fallback`, or the default
+ * (`['system']` when it has a system counterpart, `[]` otherwise).
+ *
+ * @param def - a user credential purpose.
+ * @returns the tiers consulted after the user's own key, in order.
+ *
+ * @stability experimental
+ */
+export declare function fallbackOf(def: UserCredentialPurposeDef): readonly CredentialFallbackTier[];
+/**
+ * Look up one purpose in a registry snapshot; `undefined` when it is not
+ * declared.
+ *
+ * @param registry - the purposes, as the `USER_CREDENTIAL_PURPOSE_REGISTRY` token provides them.
+ * @param purpose - the purpose to find.
+ * @returns the entry, or `undefined`.
+ *
+ * @stability experimental
+ */
+export declare function findUserCredentialPurpose(registry: readonly UserCredentialPurposeDef[], purpose: string): UserCredentialPurposeDef | undefined;
+/**
+ * The problems that make a user credential purpose point nowhere: a system or
+ * org address that names no registered purpose of that tier.
+ *
+ * @param defs - the user credential purposes.
+ * @param purposes - the system and org purposes (default: the registry).
+ * @returns one message per problem; empty when every address resolves.
+ *
+ * @stability experimental
+ */
+export declare function danglingCredentialAddresses(defs: readonly UserCredentialPurposeDef[], purposes?: Pick<Registry<CredentialPurposeDef>, 'get'>): string[];
+/**
+ * The registered system/org purpose that may be written in `tier`, or a
+ * message saying why not. Used by the stores' write paths.
+ *
+ * @internal
+ */
+export declare function writablePurposeProblem(purpose: string, tier: CredentialTier): string | null;
+//# sourceMappingURL=registry.d.ts.map

package/dist/credentials/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/credentials/registry.ts"],"names":[],"mappings":"AA+BA,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAC;AAS9D;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE9C;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,2FAA2F;IAC3F,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,kFAAkF;IAClF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,mDAAmD;IACnD,QAAQ,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,CAAC;CAC3C;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,mDAAmD;IACnD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,wCAAwC;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AAE3D;;;;GAIG;AACH,MAAM,MAAM,sBAAsB,GAAG,KAAK,GAAG,QAAQ,CAAC;AAEtD;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,yDAAyD;IACzD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,0EAA0E;IAC1E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,uBAAuB,GAAG,IAAI,CAAC;IAChD;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAC;CACvD;AAED;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,YAAY,CAAC;AAMtD;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,oBAAoB,CAgBnE,CAAC;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,oBAAoB,GAAG,IAAI,CAEzE;AAED;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,EAAE,QAAQ,CAAC,wBAAwB,CAK3E,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,6BAA6B,CAAC,GAAG,EAAE,wBAAwB,GAAG,IAAI,CAEjF;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,wBAAwB,GAAG,SAAS,sBAAsB,EAAE,CAE3F;AA4BD;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,SAAS,wBAAwB,EAAE,EAC7C,OAAO,EAAE,MAAM,GACd,wBAAwB,GAAG,SAAS,CAEtC;AAED;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,SAAS,wBAAwB,EAAE,EACzC,QAAQ,GAAE,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,KAAK,CAA6B,GAChF,MAAM,EAAE,CAgBV;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,CAK3F"}