@marinoscar/platform-api 0.0.0-stage → 0.1.0-next.11

package/dist/sharing/links/link-grants.service.js

@@ -0,0 +1,582 @@
+"use strict";
+// =============================================================================
+// LinkGrantsService: link shares as a grant kind (issue #730, PP-7.3)
+// =============================================================================
+//
+// A link grant shares ONE record with anyone holding its token, with one of
+// the roles the resource type lists under `grantable.link` (links are off for
+// a type that lists none), an expiry and soft revocation like every grant.
+//
+// MINTING (`POST /api/grants/links`). The caller passes the type's
+// `share_link` action when it declares one (MemoriaHub lets a collaborator
+// create links), `share` otherwise. The token (`lnk_` + 32 random bytes) is
+// returned ONCE in the response body; the row stores only its SHA-256 hash
+// (the lookup key) and its ciphertext under the cipher domain
+// `sharing.link:<grantId>`, the id chosen before the insert so the domain
+// binds the row. Without `SECRETS_ENCRYPTION_KEY` creation fails closed with
+// 503: a token is never stored in clear.
+//
+// RESOLUTION (`resolve`, used by `LinkGrantGuard`). The token arrives in the
+// `X-Link-Token` header only. The ONE cross-organization read of the slice
+// looks up `link_token_hash` on the system bypass client (reason
+// `link-resolution`: one row, by a unique hash); everything after it runs in
+// the grant's organization scope: the type's `loadOwners` confirms the
+// record still exists there.
+//
+// `withLinkScope(link, fn)` then runs an app's reads in ONE transaction
+// scoped to the link's organization with NO user id, so row-level security
+// still confines them to that organization even when the app forgets its
+// own `where`.
+//
+// Resolutions are counted (`app.sharing.link_resolutions`), never audited:
+// a public link can be opened thousands of times a day, and the audit trail
+// records who CHANGED access, not every read. Creation, update and
+// revocation are audited (`grant:link:create|update|revoke`).
+// =============================================================================
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LinkGrantsService = exports.ANY_LINK_RESOURCE_TYPE = exports.LINK_GRANTS_CLOCK = void 0;
+exports.linkFailureOutcome = linkFailureOutcome;
+exports.linkShareAction = linkShareAction;
+exports.resolveLinkExpiry = resolveLinkExpiry;
+exports.toLinkGrantView = toLinkGrantView;
+exports.importLegacyToken = importLegacyToken;
+exports.writeLinkAudit = writeLinkAudit;
+exports.linkEventPayload = linkEventPayload;
+const node_crypto_1 = require("node:crypto");
+const common_1 = require("@nestjs/common");
+const sharing_1 = require("@marinoscar/platform-contract/sharing");
+const index_1 = require("../../core/index");
+const index_2 = require("../../otel-core/index");
+const access_policy_service_1 = require("../access/access-policy.service");
+const resource_types_1 = require("../access/resource-types");
+const sharing_tx_1 = require("../data/sharing-tx");
+const errors_1 = require("../errors");
+const events_1 = require("../events");
+const group_common_1 = require("../groups/group-common");
+const sharing_effects_1 = require("../groups/sharing-effects");
+const ports_1 = require("../ports");
+const sharing_options_1 = require("../sharing.options");
+const link_token_1 = require("./link-token");
+/**
+ * Optional injection token of the link service's clock (ms since epoch).
+ *
+ * @stability experimental
+ */
+exports.LINK_GRANTS_CLOCK = Symbol.for('@marinoscar/platform/sharing/LINK_GRANTS_CLOCK');
+/** One day, in milliseconds. */
+const DAY_MS = 86_400_000;
+/**
+ * The resource type a guarded route accepts any link for: the platform's own
+ * resolution route (`GET /api/public/links/current`). An app route always
+ * names its type.
+ *
+ * @stability experimental
+ */
+exports.ANY_LINK_RESOURCE_TYPE = '*';
+/** The counter outcome of each failure. */
+const FAILURE_OUTCOME = Object.freeze({
+    missing: 'not_found',
+    malformed: 'not_found',
+    unknown: 'not_found',
+    revoked: 'revoked',
+    expired: 'expired',
+    wrong_type: 'wrong_type',
+    links_off: 'not_found',
+    insufficient_role: 'not_found',
+    resource_gone: 'not_found',
+});
+/**
+ * The `outcome` label of a failure.
+ *
+ * @param failure - why it failed.
+ * @returns the counter's outcome.
+ *
+ * @stability experimental
+ */
+function linkFailureOutcome(failure) {
+    return FAILURE_OUTCOME[failure];
+}
+/**
+ * The action that manages a type's links: `share_link` when the type declares
+ * it (MemoriaHub lets a collaborator create links), `share` otherwise.
+ *
+ * @param rt - the resolved type.
+ * @returns the action name.
+ */
+function linkShareAction(rt) {
+    return rt.required('share_link') !== undefined ? 'share_link' : 'share';
+}
+/**
+ * A link's expiry from the request, defaulted and capped by the `links`
+ * options: absent means `defaultTtlDays` (on creation; `undefined` is kept
+ * on an update), `null` means none; a date must be in the future; the result
+ * never lies beyond `maxTtlDays` from now (a later or absent expiry is
+ * brought back to it).
+ *
+ * @param value - the request's `expiresAt`.
+ * @param links - the resolved link options.
+ * @param now - the current time, ms since epoch.
+ * @param mode - `create` (absent: the default lifetime) or `update` (absent: unchanged).
+ * @returns the expiry, `null` for none, `undefined` for unchanged.
+ * @throws BadRequestException 400 `EXPIRY_IN_PAST`.
+ *
+ * @stability experimental
+ */
+function resolveLinkExpiry(value, links, now, mode) {
+    let at;
+    if (value === undefined) {
+        if (mode === 'update')
+            return undefined;
+        at = links.defaultTtlDays === null ? null : new Date(now + links.defaultTtlDays * DAY_MS);
+    }
+    else if (value === null) {
+        at = null;
+    }
+    else {
+        at = new Date(value);
+        if (!(at.getTime() > now))
+            throw (0, errors_1.expiryInPast)();
+    }
+    if (links.maxTtlDays !== null) {
+        const max = now + links.maxTtlDays * DAY_MS;
+        if (at === null || at.getTime() > max)
+            at = new Date(max);
+    }
+    return at;
+}
+/**
+ * The share URL of a stored link grant, re-derived from its ciphertext, or
+ * `null` when it cannot be shown (revoked, or the key changed).
+ *
+ * @param row - the link grant row.
+ * @param appUrl - the public origin, or `undefined` for a root-relative URL.
+ * @returns the URL or `null`.
+ */
+function storedLinkUrl(row, appUrl) {
+    if (row.revokedAt || !row.linkTokenCiphertext)
+        return null;
+    try {
+        return (0, sharing_1.buildLinkUrl)(appUrl ?? '', (0, index_1.decryptSecret)(row.linkTokenCiphertext, (0, link_token_1.linkTokenPurpose)(row.id)));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * One link grant as its record's sharer sees it.
+ *
+ * @param row - the link grant row.
+ * @param appUrl - the public origin.
+ * @returns the wire shape; `url` re-derived (or `null`).
+ *
+ * @stability experimental
+ */
+function toLinkGrantView(row, appUrl) {
+    return {
+        id: row.id,
+        orgId: row.orgId,
+        resourceType: row.resourceType,
+        resourceId: row.resourceId,
+        role: row.role,
+        label: row.linkLabel,
+        url: storedLinkUrl(row, appUrl),
+        expiresAt: (0, group_common_1.iso)(row.expiresAt),
+        revokedAt: (0, group_common_1.iso)(row.revokedAt),
+        grantedById: row.grantedById,
+        createdAt: (0, group_common_1.iso)(row.createdAt),
+    };
+}
+/**
+ * Imports an existing clear-text share token as a link grant: hashes and
+ * encrypts it exactly as a minted one, inside the caller's transaction. FOR
+ * DATA MIGRATIONS ONLY (never a request path), and it needs
+ * `SECRETS_ENCRYPTION_KEY`.
+ *
+ * MIGRATION RECIPE (MemoriaHub's `MediaShare`, #765). An old link is
+ * `/s/<token>`, with the token in the PATH. The imported token is
+ * `lnk_<token>`, so:
+ *
+ * 1. In the migration, call `importLegacyToken` once per `MediaShare` row,
+ *    with its organization, resource type and id, `role: 'viewer'`, the old
+ *    `token`, and its `expiresAt`, `revokedAt`, `createdById` (as
+ *    `grantedById`) and `createdAt`; then drop the clear column.
+ * 2. Optionally keep a web redirect from `/s/:token` to `/s#lnk_:token`, so
+ *    links already handed out keep working. The FIRST request of an old link
+ *    still carries the token in its path, so it is logged once (nginx
+ *    `$request`, the server span's `url.path`); revoke and re-share a link
+ *    that must never have been logged.
+ *
+ * @param tx - the migration's transaction client (the system bypass, or scoped to `input.orgId`).
+ * @param input - the record, the role and the old token.
+ * @returns the new grant's id and the token as it is now stored (`lnk_...`).
+ * @throws Error when the token is not 43 base64url characters (or a well-formed `lnk_` token),
+ *   or when `SECRETS_ENCRYPTION_KEY` is not configured.
+ *
+ * @extensionPoint hook
+ * @example
+ * ```ts
+ * await prisma.runAsSystem('migration-tooling', async (tx) => {
+ *   for (const share of shares) await importLegacyToken(tx, { orgId, resourceType: 'album', resourceId: share.albumId, role: 'viewer', token: share.token });
+ * });
+ * ```
+ *
+ * @stability experimental
+ */
+async function importLegacyToken(tx, input) {
+    const token = input.token.startsWith(sharing_1.LINK_TOKEN_PREFIX) ? input.token : `${sharing_1.LINK_TOKEN_PREFIX}${input.token}`;
+    if (!(0, link_token_1.isLinkToken)(token))
+        throw new Error('importLegacyToken: the token must be 43 base64url characters (32 random bytes), optionally prefixed with lnk_.');
+    (0, index_1.assertEncryptionKeyConfigured)();
+    const grantId = (0, node_crypto_1.randomUUID)();
+    await (0, sharing_tx_1.asSharingTx)(tx).grant.create({
+        data: {
+            id: grantId,
+            orgId: input.orgId,
+            resourceType: input.resourceType,
+            resourceId: input.resourceId,
+            granteeKind: 'link',
+            role: input.role,
+            linkTokenHash: (0, link_token_1.hashLinkToken)(token),
+            linkTokenCiphertext: (0, index_1.encryptSecret)(token, (0, link_token_1.linkTokenPurpose)(grantId)),
+            linkLabel: input.label ?? null,
+            expiresAt: input.expiresAt ?? null,
+            revokedAt: input.revokedAt ?? null,
+            grantedById: input.grantedById ?? null,
+            ...(input.createdAt ? { createdAt: input.createdAt } : {}),
+        },
+        select: { id: true },
+    });
+    return { grantId, token };
+}
+/**
+ * Mints, lists and resolves link grants, and runs an app's public reads in a
+ * link's organization scope. Update and revocation go through the generic
+ * `PATCH` / `DELETE /api/grants/:id` (`GrantsService`).
+ *
+ * @stability experimental
+ */
+let LinkGrantsService = class LinkGrantsService {
+    data;
+    policy;
+    effects;
+    options;
+    now;
+    constructor(data, policy, effects, options, now = Date.now) {
+        this.data = data;
+        this.policy = policy;
+        this.effects = effects;
+        this.options = options;
+        this.now = now;
+    }
+    appUrl() {
+        const value = this.options.links.appUrl();
+        return typeof value === 'string' && value.length > 0 ? value : undefined;
+    }
+    registered(type) {
+        const rt = (0, resource_types_1.findResourceType)(type);
+        if (!rt)
+            throw (0, errors_1.resourceNotFound)();
+        return rt;
+    }
+    /**
+     * `POST /api/grants/links`: mints a link to one record, or with
+     * `reuseActive` returns the caller's active link with the same role.
+     *
+     * @param principal - the caller (`sharing:write`).
+     * @param input - the record, the role, the expiry, the label.
+     * @returns the link, its URL and its token (the only time the token is returned).
+     * @throws ServiceUnavailableException 503 `LINKS_UNAVAILABLE` without `SECRETS_ENCRYPTION_KEY`.
+     * @throws NotFoundException 404 when the caller may not share the record (or the type is unknown).
+     * @throws UnprocessableEntityException 422 `ROLE_NOT_GRANTABLE` (also for a type with no link roles).
+     * @throws ConflictException 409 `LINK_LIMIT_REACHED` or `GRANT_LIMIT_REACHED`.
+     * @throws BadRequestException 400 `EXPIRY_IN_PAST`.
+     */
+    async create(principal, input) {
+        try {
+            (0, index_1.assertEncryptionKeyConfigured)();
+        }
+        catch {
+            throw (0, errors_1.linksUnavailable)();
+        }
+        const orgId = (0, group_common_1.requireActiveOrg)(principal);
+        const rt = this.registered(input.resourceType);
+        const now = this.now();
+        const expiresAt = resolveLinkExpiry(input.expiresAt, this.options.links, now, 'create');
+        const ref = { type: rt.type, id: input.resourceId };
+        const appUrl = this.appUrl();
+        const outcome = await this.data.runInOrg({ orgId, userId: principal.userId }, async (raw) => {
+            const tx = (0, sharing_tx_1.asSharingTx)(raw);
+            await this.policy.requireIn(raw, principal, linkShareAction(rt), ref);
+            const grantable = rt.grantable('link');
+            const role = input.role ?? grantable[0];
+            if (role === undefined || !grantable.includes(role))
+                throw (0, errors_1.roleNotGrantable)(input.role ?? rt.roles[0], 'link', grantable);
+            const activeLinks = {
+                orgId,
+                resourceType: rt.type,
+                resourceId: ref.id,
+                granteeKind: 'link',
+                revokedAt: null,
+                OR: [{ expiresAt: null }, { expiresAt: { gt: new Date(now) } }],
+            };
+            if (input.reuseActive) {
+                const existing = await tx.grant.findFirst({
+                    where: { ...activeLinks, role, grantedById: principal.userId },
+                    orderBy: [{ createdAt: 'desc' }, { id: 'desc' }],
+                });
+                const token = existing?.linkTokenCiphertext ? this.decryptOrNull(existing) : null;
+                if (existing && token)
+                    return { row: existing, token, created: false };
+            }
+            if ((await tx.grant.count({ where: activeLinks })) >= this.options.links.maxActivePerResource) {
+                throw (0, errors_1.conflict)(errors_1.SHARING_ERROR_REASONS.LINK_LIMIT_REACHED, 'This record has reached its limit of active links. Revoke one first.');
+            }
+            if ((await tx.grant.count({ where: { resourceType: rt.type, resourceId: ref.id, revokedAt: null } })) >= rt.maxGrantsPerResource) {
+                throw (0, errors_1.conflict)(errors_1.SHARING_ERROR_REASONS.GRANT_LIMIT_REACHED, 'This record has reached its share limit');
+            }
+            // The id first, so the cipher domain binds THIS row.
+            const id = (0, node_crypto_1.randomUUID)();
+            const token = (0, link_token_1.mintLinkToken)();
+            const row = await tx.grant.create({
+                data: {
+                    id,
+                    orgId,
+                    resourceType: rt.type,
+                    resourceId: ref.id,
+                    granteeKind: 'link',
+                    role,
+                    linkTokenHash: (0, link_token_1.hashLinkToken)(token),
+                    linkTokenCiphertext: (0, index_1.encryptSecret)(token, (0, link_token_1.linkTokenPurpose)(id)),
+                    linkLabel: input.label ?? null,
+                    expiresAt,
+                    grantedById: principal.userId,
+                },
+            });
+            await writeLinkAudit(tx, { orgId, actorUserId: principal.userId, action: 'grant:link:create', row, previousRole: null });
+            return { row, token, created: true };
+        });
+        if (outcome.created) {
+            this.effects.grantCommitted([{ name: events_1.SHARING_EVENTS.GRANT_CREATED, payload: linkEventPayload(outcome.row, null, principal.userId) }]);
+        }
+        const url = (0, sharing_1.buildLinkUrl)(appUrl ?? '', outcome.token);
+        return { grant: { ...toLinkGrantView(outcome.row, appUrl), url }, url, token: outcome.token };
+    }
+    decryptOrNull(row) {
+        try {
+            return (0, index_1.decryptSecret)(row.linkTokenCiphertext, (0, link_token_1.linkTokenPurpose)(row.id));
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * `GET /api/grants/links?resourceType&resourceId`: the record's links that
+     * are not revoked (expired ones included, so the sharer sees them), newest
+     * first, each with its re-derived URL.
+     *
+     * @param principal - the caller (`sharing:read`).
+     * @param query - the record and the page.
+     * @returns a page of links.
+     * @throws NotFoundException 404 when the caller may not manage the record's links.
+     */
+    async list(principal, query) {
+        const orgId = (0, group_common_1.requireActiveOrg)(principal);
+        const rt = this.registered(query.resourceType);
+        const appUrl = this.appUrl();
+        return this.data.runInOrg({ orgId, userId: principal.userId }, async (raw) => {
+            const tx = (0, sharing_tx_1.asSharingTx)(raw);
+            await this.policy.requireIn(raw, principal, linkShareAction(rt), { type: rt.type, id: query.resourceId });
+            const where = { orgId, resourceType: rt.type, resourceId: query.resourceId, granteeKind: 'link', revokedAt: null };
+            const total = await tx.grant.count({ where });
+            const rows = await tx.grant.findMany({
+                where,
+                orderBy: [{ createdAt: 'desc' }, { id: 'desc' }],
+                skip: (query.page - 1) * query.pageSize,
+                take: query.pageSize,
+            });
+            return (0, group_common_1.paged)(rows.map((row) => toLinkGrantView(row, appUrl)), total, query.page, query.pageSize);
+        });
+    }
+    /**
+     * Resolves a token for a route. Never throws for a bad token: the caller
+     * (`LinkGrantGuard`) turns every failure into the same 404. The token is
+     * hashed and looked up on the system bypass client (one row, by its unique
+     * hash); the record check runs in the grant's organization.
+     *
+     * @param token - the `X-Link-Token` value (anything).
+     * @param expect - the route's resource type and action.
+     * @returns the resolved link, or why it failed.
+     * @throws Error when `expect.action` is not an action of the grant's type (a programming error).
+     */
+    async resolve(token, expect) {
+        if (token === undefined || token === null || token === '')
+            return { ok: false, failure: 'missing', resourceType: null };
+        if (!(0, link_token_1.isLinkToken)(token))
+            return { ok: false, failure: 'malformed', resourceType: null };
+        const hash = (0, link_token_1.hashLinkToken)(token);
+        const row = await this.data.runAsSystem('link-resolution', (raw) => (0, sharing_tx_1.asSharingTx)(raw).grant.findUnique({
+            where: { linkTokenHash: hash },
+            select: { id: true, orgId: true, resourceType: true, resourceId: true, granteeKind: true, role: true, expiresAt: true, revokedAt: true },
+        }));
+        if (!row || row.granteeKind !== 'link')
+            return { ok: false, failure: 'unknown', resourceType: null };
+        const type = row.resourceType;
+        if (row.revokedAt)
+            return { ok: false, failure: 'revoked', resourceType: type };
+        if (row.expiresAt && row.expiresAt.getTime() <= this.now())
+            return { ok: false, failure: 'expired', resourceType: type };
+        if (expect.resourceType !== exports.ANY_LINK_RESOURCE_TYPE && expect.resourceType !== type)
+            return { ok: false, failure: 'wrong_type', resourceType: type };
+        const rt = (0, resource_types_1.findResourceType)(type);
+        // A type no longer registered, or no longer granting this role to links: links are off.
+        if (!rt || !rt.grantable('link').includes(row.role))
+            return { ok: false, failure: 'links_off', resourceType: type };
+        if (expect.action !== undefined) {
+            const required = rt.required(expect.action);
+            if (required === undefined) {
+                throw new Error(`Resource type "${type}" declares no action "${expect.action}" (declared: ${Object.keys(rt.def.actions).join(', ')}).`);
+            }
+            if (rt.rank(required) > rt.rank(row.role))
+                return { ok: false, failure: 'insufficient_role', resourceType: type };
+        }
+        const owners = await this.data.runInOrg({ orgId: row.orgId }, (raw) => rt.def.loadOwners([row.resourceId], raw));
+        if (owners.get(row.resourceId)?.orgId !== row.orgId)
+            return { ok: false, failure: 'resource_gone', resourceType: type };
+        return {
+            ok: true,
+            link: Object.freeze({
+                grantId: row.id,
+                orgId: row.orgId,
+                resourceType: type,
+                resourceId: row.resourceId,
+                role: row.role,
+                expiresAt: row.expiresAt,
+            }),
+        };
+    }
+    /**
+     * Runs `fn` in ONE transaction scoped to the link's organization, with no
+     * user id: row-level security confines every query of `fn` to that
+     * organization; the app's own `where` limits it to the one record.
+     *
+     * FILE BYTES ARE NEVER STREAMED WITH THE TOKEN. An `<img src>` cannot send
+     * the `X-Link-Token` header, so a public route returns PRESIGNED download
+     * URLs minted by the app's storage provider (`StorageProvider` of the
+     * reference app) instead of proxying the bytes; the presigned URL is short
+     * lived and carries no link token.
+     *
+     * @param link - the resolved link (`@CurrentLinkGrant()`).
+     * @param fn - the app's reads, given the app's transaction client.
+     * @returns what `fn` returns.
+     *
+     * @example
+     * ```ts
+     * return this.links.withLinkScope(link, (tx) =>
+     *   (tx as Prisma.TransactionClient).mediaItem.findUnique({ where: { id: link.resourceId } }),
+     * );
+     * ```
+     *
+     * @extensionPoint hook
+     * @stability experimental
+     */
+    withLinkScope(link, fn) {
+        return this.data.runInOrg({ orgId: link.orgId }, fn);
+    }
+    /**
+     * The record's title (the type's `describe()`), read in the link's scope.
+     *
+     * @param link - the resolved link.
+     * @returns the title, or `null` when the type describes nothing.
+     */
+    async titleOf(link) {
+        const rt = (0, resource_types_1.findResourceType)(link.resourceType);
+        if (!rt?.def.describe)
+            return null;
+        const describe = rt.def.describe.bind(rt.def);
+        return this.withLinkScope(link, async (tx) => (await describe([link.resourceId], tx)).get(link.resourceId)?.title ?? null);
+    }
+    /**
+     * {@link importLegacyToken} as a method, for a migration that injects the service.
+     *
+     * @param tx - the migration's transaction client.
+     * @param input - the record, the role and the old token.
+     * @returns the new grant's id and its stored token.
+     */
+    importLegacyToken(tx, input) {
+        return importLegacyToken(tx, input);
+    }
+};
+exports.LinkGrantsService = LinkGrantsService;
+__decorate([
+    (0, index_2.Trace)('sharing.link.create'),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], LinkGrantsService.prototype, "create", null);
+__decorate([
+    (0, index_2.Trace)('sharing.link.list'),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], LinkGrantsService.prototype, "list", null);
+exports.LinkGrantsService = LinkGrantsService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(ports_1.SHARING_DATA)),
+    __param(3, (0, common_1.Inject)(sharing_options_1.SHARING_OPTIONS)),
+    __param(4, (0, common_1.Optional)()),
+    __param(4, (0, common_1.Inject)(exports.LINK_GRANTS_CLOCK)),
+    __metadata("design:paramtypes", [Object, access_policy_service_1.AccessPolicy,
+        sharing_effects_1.SharingEffects, Object, Function])
+], LinkGrantsService);
+/**
+ * Writes one link audit row INSIDE the caller's transaction: ids, the role
+ * and the expiry only, never the token, its hash, its ciphertext or the label.
+ */
+async function writeLinkAudit(tx, input) {
+    const { row } = input;
+    await tx.auditEvent.create({
+        data: {
+            actorUserId: input.actorUserId,
+            action: input.action,
+            targetType: 'grant',
+            targetId: row.id,
+            orgId: input.orgId,
+            meta: {
+                resourceType: row.resourceType,
+                resourceId: row.resourceId,
+                granteeKind: 'link',
+                granteeId: null,
+                role: row.role,
+                previousRole: input.previousRole,
+                expiresAt: (0, group_common_1.iso)(row.expiresAt),
+            },
+        },
+    });
+}
+/** The event payload of a link grant: ids and roles only. */
+function linkEventPayload(row, previousRole, actorUserId) {
+    return {
+        orgId: row.orgId,
+        grantId: row.id,
+        resourceType: row.resourceType,
+        resourceId: row.resourceId,
+        granteeKind: 'link',
+        granteeId: null,
+        role: row.role,
+        previousRole,
+        actorUserId,
+    };
+}
+//# sourceMappingURL=link-grants.service.js.map

package/dist/sharing/links/link-grants.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"link-grants.service.js","sourceRoot":"","sources":["../../../src/sharing/links/link-grants.service.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,sEAAsE;AACtE,gFAAgF;AAChF,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,2EAA2E;AAC3E,EAAE;AACF,mEAAmE;AACnE,2EAA2E;AAC3E,4EAA4E;AAC5E,2EAA2E;AAC3E,8DAA8D;AAC9D,0EAA0E;AAC1E,6EAA6E;AAC7E,yCAAyC;AACzC,EAAE;AACF,6EAA6E;AAC7E,2EAA2E;AAC3E,iEAAiE;AACjE,6EAA6E;AAC7E,uEAAuE;AACvE,6BAA6B;AAC7B,EAAE;AACF,wEAAwE;AACxE,2EAA2E;AAC3E,yEAAyE;AACzE,eAAe;AACf,EAAE;AACF,2EAA2E;AAC3E,4EAA4E;AAC5E,mEAAmE;AACnE,8DAA8D;AAC9D,gFAAgF;;;;;;;;;;;;;;;AA2GhF,gDAEC;AA0CD,0CAEC;AAkBD,8CAqBC;AA4BD,0CAcC;AAkFD,8CAwBC;AA2QD,wCAuBC;AAGD,4CAYC;AAnoBD,6CAAyC;AAEzC,2CAA8D;AAC9D,mEAQ+C;AAE/C,4CAA+G;AAC/G,iDAA8C;AAC9C,2EAA+D;AAC/D,6DAAuF;AACvF,mDAAgF;AAChF,sCAAgI;AAChI,sCAAmE;AACnE,yDAAsE;AACtE,+DAA2D;AAE3D,oCAA8D;AAC9D,wDAAwF;AACxF,6CAA2F;AAE3F;;;;GAIG;AACU,QAAA,iBAAiB,GAAkB,MAAM,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;AAE7G,gCAAgC;AAChC,MAAM,MAAM,GAAG,UAAU,CAAC;AAE1B;;;;;;GAMG;AACU,QAAA,sBAAsB,GAAG,GAAG,CAAC;AAwC1C,2CAA2C;AAC3C,MAAM,eAAe,GAA0E,MAAM,CAAC,MAAM,CAAC;IAC3G,OAAO,EAAE,WAAW;IACpB,SAAS,EAAE,WAAW;IACtB,OAAO,EAAE,WAAW;IACpB,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,SAAS;IAClB,UAAU,EAAE,YAAY;IACxB,SAAS,EAAE,WAAW;IACtB,iBAAiB,EAAE,WAAW;IAC9B,aAAa,EAAE,WAAW;CAC3B,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,SAAgB,kBAAkB,CAAC,OAA8B;IAC/D,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;AAClC,CAAC;AAmCD;;;;;;GAMG;AACH,SAAgB,eAAe,CAAC,EAAwB;IACtD,OAAO,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC;AAC1E,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,iBAAiB,CAC/B,KAAgC,EAChC,KAAmF,EACnF,GAAW,EACX,IAAyB;IAEzB,IAAI,EAAe,CAAC;IACpB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACxC,EAAE,GAAG,KAAK,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,cAAc,GAAG,MAAM,CAAC,CAAC;IAC5F,CAAC;SAAM,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1B,EAAE,GAAG,IAAI,CAAC;IACZ,CAAC;SAAM,CAAC;QACN,EAAE,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,IAAI,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC;YAAE,MAAM,IAAA,qBAAY,GAAE,CAAC;IAClD,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,GAAG,GAAG,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC;QAC5C,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,GAAG;YAAE,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,GAAa,EAAE,MAA0B;IAC9D,IAAI,GAAG,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,mBAAmB;QAAE,OAAO,IAAI,CAAC;IAC3D,IAAI,CAAC;QACH,OAAO,IAAA,sBAAY,EAAC,MAAM,IAAI,EAAE,EAAE,IAAA,qBAAa,EAAC,GAAG,CAAC,mBAAmB,EAAE,IAAA,6BAAgB,EAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACtG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,eAAe,CAAC,GAAa,EAAE,MAA0B;IACvE,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,KAAK,EAAE,GAAG,CAAC,SAAS;QACpB,GAAG,EAAE,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC;QAC/B,SAAS,EAAE,IAAA,kBAAG,EAAC,GAAG,CAAC,SAAS,CAAC;QAC7B,SAAS,EAAE,IAAA,kBAAG,EAAC,GAAG,CAAC,SAAS,CAAC;QAC7B,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,SAAS,EAAE,IAAA,kBAAG,EAAC,GAAG,CAAC,SAAS,CAAE;KAC/B,CAAC;AACJ,CAAC;AA8CD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACI,KAAK,UAAU,iBAAiB,CAAC,EAAW,EAAE,KAAuB;IAC1E,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,2BAAiB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,2BAAiB,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;IAC7G,IAAI,CAAC,IAAA,wBAAW,EAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gHAAgH,CAAC,CAAC;IAC3J,IAAA,qCAA6B,GAAE,CAAC;IAChC,MAAM,OAAO,GAAG,IAAA,wBAAU,GAAE,CAAC;IAC7B,MAAM,IAAA,wBAAW,EAAC,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;QACjC,IAAI,EAAE;YACJ,EAAE,EAAE,OAAO;YACX,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,WAAW,EAAE,MAAM;YACnB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,aAAa,EAAE,IAAA,0BAAa,EAAC,KAAK,CAAC;YACnC,mBAAmB,EAAE,IAAA,qBAAa,EAAC,KAAK,EAAE,IAAA,6BAAgB,EAAC,OAAO,CAAC,CAAC;YACpE,SAAS,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;YAC9B,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YAClC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YAClC,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;YACtC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D;QACD,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;KACrB,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;GAMG;AAEI,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAEa;IACtB;IACA;IACyB;IACc;IAL1D,YACyC,IAAqB,EAC3C,MAAoB,EACpB,OAAuB,EACE,OAAqC,EACvB,MAAoB,IAAI,CAAC,GAAG;QAJ7C,SAAI,GAAJ,IAAI,CAAiB;QAC3C,WAAM,GAAN,MAAM,CAAc;QACpB,YAAO,GAAP,OAAO,CAAgB;QACE,YAAO,GAAP,OAAO,CAA8B;QACvB,QAAG,GAAH,GAAG,CAAyB;IACnF,CAAC;IAEI,MAAM;QACZ,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAC1C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,CAAC;IAEO,UAAU,CAAC,IAAY;QAC7B,MAAM,EAAE,GAAG,IAAA,iCAAgB,EAAC,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,EAAE;YAAE,MAAM,IAAA,yBAAgB,GAAE,CAAC;QAClC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;;;;;;;;;;;OAYG;IAEG,AAAN,KAAK,CAAC,MAAM,CAAC,SAAoB,EAAE,KAAsB;QACvD,IAAI,CAAC;YACH,IAAA,qCAA6B,GAAE,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAA,yBAAgB,GAAE,CAAC;QAC3B,CAAC;QACD,MAAM,KAAK,GAAG,IAAA,+BAAgB,EAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAgB,CAAC;QACvG,MAAM,GAAG,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAE7B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC1F,MAAM,EAAE,GAAG,IAAA,wBAAW,EAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,EAAE,eAAe,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;YACtE,MAAM,SAAS,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACvC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC;YACxC,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAA,yBAAgB,EAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;YAE3H,MAAM,WAAW,GAAG;gBAClB,KAAK;gBACL,YAAY,EAAE,EAAE,CAAC,IAAI;gBACrB,UAAU,EAAE,GAAG,CAAC,EAAE;gBAClB,WAAW,EAAE,MAAM;gBACnB,SAAS,EAAE,IAAI;gBACf,EAAE,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;aAChE,CAAC;YACF,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;gBACtB,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAW;oBAClD,KAAK,EAAE,EAAE,GAAG,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,MAAM,EAAE;oBAC9D,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;iBACjD,CAAC,CAAC;gBACH,MAAM,KAAK,GAAG,QAAQ,EAAE,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAClF,IAAI,QAAQ,IAAI,KAAK;oBAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YACzE,CAAC;YAED,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,CAAC;gBAC9F,MAAM,IAAA,iBAAQ,EAAC,8BAAqB,CAAC,kBAAkB,EAAE,sEAAsE,CAAC,CAAC;YACnI,CAAC;YACD,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,YAAY,EAAE,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,oBAAoB,EAAE,CAAC;gBACjI,MAAM,IAAA,iBAAQ,EAAC,8BAAqB,CAAC,mBAAmB,EAAE,yCAAyC,CAAC,CAAC;YACvG,CAAC;YAED,qDAAqD;YACrD,MAAM,EAAE,GAAG,IAAA,wBAAU,GAAE,CAAC;YACxB,MAAM,KAAK,GAAG,IAAA,0BAAa,GAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAW;gBAC1C,IAAI,EAAE;oBACJ,EAAE;oBACF,KAAK;oBACL,YAAY,EAAE,EAAE,CAAC,IAAI;oBACrB,UAAU,EAAE,GAAG,CAAC,EAAE;oBAClB,WAAW,EAAE,MAAM;oBACnB,IAAI;oBACJ,aAAa,EAAE,IAAA,0BAAa,EAAC,KAAK,CAAC;oBACnC,mBAAmB,EAAE,IAAA,qBAAa,EAAC,KAAK,EAAE,IAAA,6BAAgB,EAAC,EAAE,CAAC,CAAC;oBAC/D,SAAS,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;oBAC9B,SAAS;oBACT,WAAW,EAAE,SAAS,CAAC,MAAM;iBAC9B;aACF,CAAC,CAAC;YACH,MAAM,cAAc,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;YACzH,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,EAAE,IAAI,EAAE,uBAAc,CAAC,aAAa,EAAE,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QACxI,CAAC;QACD,MAAM,GAAG,GAAG,IAAA,sBAAY,EAAC,MAAM,IAAI,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACtD,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;IAChG,CAAC;IAEO,aAAa,CAAC,GAAa;QACjC,IAAI,CAAC;YACH,OAAO,IAAA,qBAAa,EAAC,GAAG,CAAC,mBAAoB,EAAE,IAAA,6BAAgB,EAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IAEG,AAAN,KAAK,CAAC,IAAI,CAAC,SAAoB,EAAE,KAAqB;QACpD,MAAM,KAAK,GAAG,IAAA,+BAAgB,EAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC3E,MAAM,EAAE,GAAG,IAAA,wBAAW,EAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,EAAE,eAAe,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;YAC1G,MAAM,KAAK,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YACnH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAW;gBAC7C,KAAK;gBACL,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;gBAChD,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,QAAQ;gBACvC,IAAI,EAAE,KAAK,CAAC,QAAQ;aACrB,CAAC,CAAC;YACH,OAAO,IAAA,oBAAK,EAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnG,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,OAAO,CAAC,KAAc,EAAE,MAAiC;QAC7D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QACxH,IAAI,CAAC,IAAA,wBAAW,EAAC,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QACxF,MAAM,IAAI,GAAG,IAAA,0BAAa,EAAC,KAAK,CAAC,CAAC;QAClC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,iBAAiB,EAAE,CAAC,GAAG,EAAE,EAAE,CACjE,IAAA,wBAAW,EAAC,GAAG,CAAC,CAAC,KAAK,CAAC,UAAU,CAAsH;YACrJ,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE;YAC9B,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;SACzI,CAAC,CACH,CAAC;QACF,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,KAAK,MAAM;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QACrG,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC;QAC9B,IAAI,GAAG,CAAC,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QAChF,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QACzH,IAAI,MAAM,CAAC,YAAY,KAAK,8BAAsB,IAAI,MAAM,CAAC,YAAY,KAAK,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QACpJ,MAAM,EAAE,GAAG,IAAA,iCAAgB,EAAC,IAAI,CAAC,CAAC;QAClC,wFAAwF;QACxF,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QACpH,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC5C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,yBAAyB,MAAM,CAAC,MAAM,gBAAgB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1I,CAAC;YACD,IAAI,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QACpH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACjH,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,KAAK,KAAK,GAAG,CAAC,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QACxH,OAAO;YACL,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;gBAClB,OAAO,EAAE,GAAG,CAAC,EAAE;gBACf,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,YAAY,EAAE,IAAI;gBAClB,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,SAAS,EAAE,GAAG,CAAC,SAAS;aACzB,CAAC;SACH,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,aAAa,CAAI,IAAuB,EAAE,EAA+B;QACvE,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IACvD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,IAAuB;QACnC,MAAM,EAAE,GAAG,IAAA,iCAAgB,EAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC/C,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,QAAQ,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,QAAQ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC;IAC7H,CAAC;IAED;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAW,EAAE,KAAuB;QACpD,OAAO,iBAAiB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACtC,CAAC;CACF,CAAA;AAxPY,8CAAiB;AAkCtB;IADL,IAAA,aAAK,EAAC,qBAAqB,CAAC;;;;+CAwE5B;AAqBK;IADL,IAAA,aAAK,EAAC,mBAAmB,CAAC;;;;6CAkB1B;4BA/IU,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,oBAAY,CAAC,CAAA;IAGpB,WAAA,IAAA,eAAM,EAAC,iCAAe,CAAC,CAAA;IACvB,WAAA,IAAA,iBAAQ,GAAE,CAAA;IAAE,WAAA,IAAA,eAAM,EAAC,yBAAiB,CAAC,CAAA;6CAHb,oCAAY;QACX,gCAAc;GAJ/B,iBAAiB,CAwP7B;AAKD;;;GAGG;AACI,KAAK,UAAU,cAAc,CAClC,EAAa,EACb,KAAkH;IAElH,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;IACtB,MAAM,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;QACzB,IAAI,EAAE;YACJ,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,OAAO;YACnB,QAAQ,EAAE,GAAG,CAAC,EAAE;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE;gBACJ,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,WAAW,EAAE,MAAM;gBACnB,SAAS,EAAE,IAAI;gBACf,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,SAAS,EAAE,IAAA,kBAAG,EAAC,GAAG,CAAC,SAAS,CAAC;aAC9B;SACF;KACF,CAAC,CAAC;AACL,CAAC;AAED,6DAA6D;AAC7D,SAAgB,gBAAgB,CAAC,GAAa,EAAE,YAA2B,EAAE,WAAmB;IAC9F,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,OAAO,EAAE,GAAG,CAAC,EAAE;QACf,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,WAAW,EAAE,MAAM;QACnB,SAAS,EAAE,IAAI;QACf,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,YAAY;QACZ,WAAW;KACZ,CAAC;AACJ,CAAC"}

package/dist/sharing/links/link-miss-throttle.d.ts

@@ -0,0 +1,15 @@
+import { MemberLookupThrottle, type MemberLookupThrottleOptions } from '../groups/member-lookup-throttle';
+/**
+ * Per-address throttle on failed public link resolutions. Configured by
+ * `SharingModule.forRoot({ links: { maxMissesPerIp } })` (default 30 per 10
+ * minutes); keys are client addresses.
+ *
+ * @stability experimental
+ */
+export declare class LinkMissThrottle extends MemberLookupThrottle {
+    /**
+     * @param options - the bounds; defaults 30 misses per 10 minutes, 10 000 addresses.
+     */
+    constructor(options?: MemberLookupThrottleOptions);
+}
+//# sourceMappingURL=link-miss-throttle.d.ts.map

package/dist/sharing/links/link-miss-throttle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"link-miss-throttle.d.ts","sourceRoot":"","sources":["../../../src/sharing/links/link-miss-throttle.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,oBAAoB,EAAE,KAAK,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAE1G;;;;;;GAMG;AACH,qBACa,gBAAiB,SAAQ,oBAAoB;IACxD;;OAEG;gBACS,OAAO,GAAE,2BAAgC;CAGtD"}