@nextage/era-lib 1.0.192 → 1.0.194

package/build/enums.d.ts

@@ -1,5 +1,11 @@
 /**
- * Identifiers for security-audit log events (login outcomes, password changes).
+ * Identifiers for security-audit log events (login outcomes, password changes,
+ * cross-organization grants).
+ *
+ * `orgGrantAdded`/`orgGrantRevoked` are here and not among the CRUD events on
+ * purpose: a grant is the only way an account reaches data OUTSIDE the
+ * organization it belongs to, so opening or closing one is a security event in
+ * the same sense a login is - and belongs to the same trail (ADR-0005 section 3).
  */
 export declare enum SecurityLogs {
     changePwdFailed = "changePwdFailed",
@@ -10,7 +16,9 @@ export declare enum SecurityLogs {
     loginUserNotActive = "loginUserNotActive",
     loginSuccess = "loginSuccess",
     loginAttempts = "loginAttempts",
-    authRequired = "authRequired"
+    authRequired = "authRequired",
+    orgGrantAdded = "orgGrantAdded",
+    orgGrantRevoked = "orgGrantRevoked"
 }
 export declare enum SecurityLogLevel {
     info = "info",

package/build/enums.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"enums.d.ts","sourceRoot":"","sources":["../src/enums.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,oBAAY,YAAY;IACtB,eAAe,oBAAsB;IACrC,gBAAgB,qBAAsB;IACtC,eAAe,oBAAsB;IACrC,eAAe,oBAAsB;IACrC,gBAAgB,qBAAsB;IACtC,kBAAkB,uBAAsB;IACxC,YAAY,iBAAsB;IAClC,aAAa,kBAAsB;IACnC,YAAY,iBAAsB;CACnC;AAED,oBAAY,gBAAgB;IAC1B,IAAI,SAAY;IAChB,OAAO,SAAS;IAChB,KAAK,UAAY;IACjB,KAAK,UAAY;CAClB;AAED,oBAAY,UAAU;IACpB,IAAI,SAAW;IACf,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,GAAG,WAAc;CAClB;AAED,oBAAY,YAAY;IACtB,cAAc,iBAAkB;IAChC,eAAe,kBAAkB;IACjC,YAAY,gBAAmB;IAC/B,OAAO,YAAoB;CAC5B;AAED;;;;;;;;;;GAUG;AACH,oBAAY,SAAS;IACnB,MAAM,eAAuB;IAC7B,KAAK,UAAmB;IACxB,UAAU,eAAmB;IAC7B,cAAc,mBAAmB;IACjC,WAAW,gBAAmB;IAC9B,UAAU,eAAmB;IAC7B,UAAU,eAAmB;CAC9B;AAED,oBAAY,SAAS;IACnB,GAAG,QAAQ;IACX,GAAG,QAAQ;CACZ;AAED;;;;;;;;;;GAUG;AACH,oBAAY,YAAY;IACtB,QAAQ,aAAa;IACrB,MAAM,WAAa;IACnB,OAAO,YAAa;CACrB;AAED,oBAAY,iBAAiB;IAC3B,OAAO,YAAuB;IAC9B,UAAU,eAAuB;IACjC,eAAe,oBAAuB;IACtC,kBAAkB,uBAAuB;IACzC,QAAQ,aAAuB;CAChC"}
+{"version":3,"file":"enums.d.ts","sourceRoot":"","sources":["../src/enums.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,oBAAY,YAAY;IACtB,eAAe,oBAAsB;IACrC,gBAAgB,qBAAsB;IACtC,eAAe,oBAAsB;IACrC,eAAe,oBAAsB;IACrC,gBAAgB,qBAAsB;IACtC,kBAAkB,uBAAsB;IACxC,YAAY,iBAAsB;IAClC,aAAa,kBAAsB;IACnC,YAAY,iBAAsB;IAClC,aAAa,kBAAsB;IACnC,eAAe,oBAAsB;CACtC;AAED,oBAAY,gBAAgB;IAC1B,IAAI,SAAY;IAChB,OAAO,SAAS;IAChB,KAAK,UAAY;IACjB,KAAK,UAAY;CAClB;AAED,oBAAY,UAAU;IACpB,IAAI,SAAW;IACf,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,GAAG,WAAc;CAClB;AAED,oBAAY,YAAY;IACtB,cAAc,iBAAkB;IAChC,eAAe,kBAAkB;IACjC,YAAY,gBAAmB;IAC/B,OAAO,YAAoB;CAC5B;AAED;;;;;;;;;;GAUG;AACH,oBAAY,SAAS;IACnB,MAAM,eAAuB;IAC7B,KAAK,UAAmB;IACxB,UAAU,eAAmB;IAC7B,cAAc,mBAAmB;IACjC,WAAW,gBAAmB;IAC9B,UAAU,eAAmB;IAC7B,UAAU,eAAmB;CAC9B;AAED,oBAAY,SAAS;IACnB,GAAG,QAAQ;IACX,GAAG,QAAQ;CACZ;AAED;;;;;;;;;;GAUG;AACH,oBAAY,YAAY;IACtB,QAAQ,aAAa;IACrB,MAAM,WAAa;IACnB,OAAO,YAAa;CACrB;AAED,oBAAY,iBAAiB;IAC3B,OAAO,YAAuB;IAC9B,UAAU,eAAuB;IACjC,eAAe,oBAAuB;IACtC,kBAAkB,uBAAuB;IACzC,QAAQ,aAAuB;CAChC"}

package/build/enums.js

@@ -2,7 +2,13 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.UserCrudEventType = exports.OrgScopeTier = exports.RolesType = exports.BaseRoles = exports.LOGIN_ERRORS = exports.AuthIssuer = exports.SecurityLogLevel = exports.SecurityLogs = void 0;
 /**
- * Identifiers for security-audit log events (login outcomes, password changes).
+ * Identifiers for security-audit log events (login outcomes, password changes,
+ * cross-organization grants).
+ *
+ * `orgGrantAdded`/`orgGrantRevoked` are here and not among the CRUD events on
+ * purpose: a grant is the only way an account reaches data OUTSIDE the
+ * organization it belongs to, so opening or closing one is a security event in
+ * the same sense a login is - and belongs to the same trail (ADR-0005 section 3).
  */
 var SecurityLogs;
 (function (SecurityLogs) {
@@ -15,6 +21,8 @@ var SecurityLogs;
     SecurityLogs["loginSuccess"] = "loginSuccess";
     SecurityLogs["loginAttempts"] = "loginAttempts";
     SecurityLogs["authRequired"] = "authRequired";
+    SecurityLogs["orgGrantAdded"] = "orgGrantAdded";
+    SecurityLogs["orgGrantRevoked"] = "orgGrantRevoked";
 })(SecurityLogs || (exports.SecurityLogs = SecurityLogs = {}));
 var SecurityLogLevel;
 (function (SecurityLogLevel) {

package/build/enums.js.map

@@ -1 +1 @@
-{"version":3,"file":"enums.js","sourceRoot":"","sources":["../src/enums.ts"],"names":[],"mappings":";;;AAAA;;GAEG;AACH,IAAY,YAUX;AAVD,WAAY,YAAY;IACtB,mDAAqC,CAAA;IACrC,qDAAsC,CAAA;IACtC,mDAAqC,CAAA;IACrC,mDAAqC,CAAA;IACrC,qDAAsC,CAAA;IACtC,yDAAwC,CAAA;IACxC,6CAAkC,CAAA;IAClC,+CAAmC,CAAA;IACnC,6CAAkC,CAAA;AACpC,CAAC,EAVW,YAAY,4BAAZ,YAAY,QAUvB;AAED,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAC1B,iCAAgB,CAAA;IAChB,oCAAgB,CAAA;IAChB,mCAAiB,CAAA;IACjB,mCAAiB,CAAA;AACnB,CAAC,EALW,gBAAgB,gCAAhB,gBAAgB,QAK3B;AAED,IAAY,UAKX;AALD,WAAY,UAAU;IACpB,2BAAe,CAAA;IACf,+BAAiB,CAAA;IACjB,+BAAiB,CAAA;IACjB,4BAAiB,CAAA;AACnB,CAAC,EALW,UAAU,0BAAV,UAAU,QAKrB;AAED,IAAY,YAKX;AALD,WAAY,YAAY;IACtB,+CAAgC,CAAA;IAChC,iDAAiC,CAAA;IACjC,4CAA+B,CAAA;IAC/B,mCAA2B,CAAA;AAC7B,CAAC,EALW,YAAY,4BAAZ,YAAY,QAKvB;AAED;;;;;;;;;;GAUG;AACH,IAAY,SAQX;AARD,WAAY,SAAS;IACnB,kCAA6B,CAAA;IAC7B,4BAAwB,CAAA;IACxB,sCAA6B,CAAA;IAC7B,8CAAiC,CAAA;IACjC,wCAA8B,CAAA;IAC9B,sCAA6B,CAAA;IAC7B,sCAA6B,CAAA;AAC/B,CAAC,EARW,SAAS,yBAAT,SAAS,QAQpB;AAED,IAAY,SAGX;AAHD,WAAY,SAAS;IACnB,wBAAW,CAAA;IACX,wBAAW,CAAA;AACb,CAAC,EAHW,SAAS,yBAAT,SAAS,QAGpB;AAED;;;;;;;;;;GAUG;AACH,IAAY,YAIX;AAJD,WAAY,YAAY;IACtB,qCAAqB,CAAA;IACrB,iCAAmB,CAAA;IACnB,mCAAoB,CAAA;AACtB,CAAC,EAJW,YAAY,4BAAZ,YAAY,QAIvB;AAED,IAAY,iBAMX;AAND,WAAY,iBAAiB;IAC3B,wCAA8B,CAAA;IAC9B,8CAAiC,CAAA;IACjC,wDAAsC,CAAA;IACtC,8DAAyC,CAAA;IACzC,0CAA+B,CAAA;AACjC,CAAC,EANW,iBAAiB,iCAAjB,iBAAiB,QAM5B"}
+{"version":3,"file":"enums.js","sourceRoot":"","sources":["../src/enums.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;GAQG;AACH,IAAY,YAYX;AAZD,WAAY,YAAY;IACtB,mDAAqC,CAAA;IACrC,qDAAsC,CAAA;IACtC,mDAAqC,CAAA;IACrC,mDAAqC,CAAA;IACrC,qDAAsC,CAAA;IACtC,yDAAwC,CAAA;IACxC,6CAAkC,CAAA;IAClC,+CAAmC,CAAA;IACnC,6CAAkC,CAAA;IAClC,+CAAmC,CAAA;IACnC,mDAAqC,CAAA;AACvC,CAAC,EAZW,YAAY,4BAAZ,YAAY,QAYvB;AAED,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAC1B,iCAAgB,CAAA;IAChB,oCAAgB,CAAA;IAChB,mCAAiB,CAAA;IACjB,mCAAiB,CAAA;AACnB,CAAC,EALW,gBAAgB,gCAAhB,gBAAgB,QAK3B;AAED,IAAY,UAKX;AALD,WAAY,UAAU;IACpB,2BAAe,CAAA;IACf,+BAAiB,CAAA;IACjB,+BAAiB,CAAA;IACjB,4BAAiB,CAAA;AACnB,CAAC,EALW,UAAU,0BAAV,UAAU,QAKrB;AAED,IAAY,YAKX;AALD,WAAY,YAAY;IACtB,+CAAgC,CAAA;IAChC,iDAAiC,CAAA;IACjC,4CAA+B,CAAA;IAC/B,mCAA2B,CAAA;AAC7B,CAAC,EALW,YAAY,4BAAZ,YAAY,QAKvB;AAED;;;;;;;;;;GAUG;AACH,IAAY,SAQX;AARD,WAAY,SAAS;IACnB,kCAA6B,CAAA;IAC7B,4BAAwB,CAAA;IACxB,sCAA6B,CAAA;IAC7B,8CAAiC,CAAA;IACjC,wCAA8B,CAAA;IAC9B,sCAA6B,CAAA;IAC7B,sCAA6B,CAAA;AAC/B,CAAC,EARW,SAAS,yBAAT,SAAS,QAQpB;AAED,IAAY,SAGX;AAHD,WAAY,SAAS;IACnB,wBAAW,CAAA;IACX,wBAAW,CAAA;AACb,CAAC,EAHW,SAAS,yBAAT,SAAS,QAGpB;AAED;;;;;;;;;;GAUG;AACH,IAAY,YAIX;AAJD,WAAY,YAAY;IACtB,qCAAqB,CAAA;IACrB,iCAAmB,CAAA;IACnB,mCAAoB,CAAA;AACtB,CAAC,EAJW,YAAY,4BAAZ,YAAY,QAIvB;AAED,IAAY,iBAMX;AAND,WAAY,iBAAiB;IAC3B,wCAA8B,CAAA;IAC9B,8CAAiC,CAAA;IACjC,wDAAsC,CAAA;IACtC,8DAAyC,CAAA;IACzC,0CAA+B,CAAA;AACjC,CAAC,EANW,iBAAiB,iCAAjB,iBAAiB,QAM5B"}

package/build/interfaces.d.ts

@@ -38,12 +38,41 @@ export interface BaseEntity extends BaseDBItem {
  * meaningless. The same user may therefore be ORG_MANAGER on one organization
  * and ORG_EDITOR on another.
  *
- * `id`/`code`/`name` are denormalized exactly like `organizations[]`, to avoid a
- * join on every authorization check; `organization` stays the source of truth.
+ * The pair `{ id, role }` is ALL of authorization: `resolveOrgScope` and
+ * `reachableOrgIds` read nothing else, and it is verbatim what travels in the
+ * `grn` claim. It is NOT denormalized: `code`/`name` used to be carried here "to
+ * avoid a join on every authorization check", but no check has ever read them -
+ * they were display data on the authorization path, and the only effect of
+ * keeping them was a second copy of the organization registry to keep in sync.
+ * The UI resolves the name from `organization`, the source of truth.
  */
-export interface OrgGrant extends BaseEntity {
+export interface OrgGrant {
+    id: string;
     role: BaseRoles;
 }
+/**
+ * A grant AS PERSISTED on `users.grants[]`.
+ *
+ * Splits provenance from authorization on purpose: `grantedBy`/`grantedAt` answer
+ * "who opened this door, and when" - an audit question - and are read only when
+ * the grant is displayed or reviewed. Keeping them off `OrgGrant` is what stops
+ * them from ending up in the access token, which is repeated on every request and
+ * whose contents cannot be revoked before expiry.
+ *
+ * Both are OPTIONAL, and not out of laziness: this is the type of `BaseUser.grants`,
+ * and on a resource service that user is rebuilt from the TOKEN, which carries
+ * `{ id, role }` and nothing else. Provenance is genuinely absent there, so a
+ * required field would be a promise the type could not keep. It is written in full
+ * by the single write path (`OrganizationCtrl.grantOrgRole`) and by nothing else.
+ *
+ * `grantedBy` is the granter's user ID and nothing else: the display name is
+ * resolved from `users` when shown, so no personal datum is copied into a
+ * different user's document.
+ */
+export interface OrgGrantRecord extends OrgGrant {
+    grantedBy?: string;
+    grantedAt?: Date;
+}
 /**
  * Base shape for a versioned MongoDB entity whose `name`/`description` are
  * internationalised (per-language map or plain string).

package/build/interfaces.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../src/interfaces.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAC9F,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAc,SAAS,CAAC;AAEjF,MAAM,MAAM,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,GAAG,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,KAAK,IAAI,CAAA;AAEhE;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAI,MAAM,CAAC;IACjB,MAAM,EAAI,MAAM,CAAC;IACjB,MAAM,EAAI,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAI,gBAAgB,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,CAAC,EAAG,MAAM,CAAC;IACpB,OAAO,EAAM,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,UAAW,SAAQ,UAAU;IAC5C,IAAI,CAAC,EAAK,MAAM,CAAC;IACjB,IAAI,CAAC,EAAK,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,QAAS,SAAQ,UAAU;IAC1C,IAAI,EAAE,SAAS,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD,IAAI,CAAC,EAAS,MAAM,CAAC;IACrB,IAAI,CAAC,EAAS,YAAY,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAC5C,WAAW,CAAC,EAAE,YAAY,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAC5C,OAAO,CAAC,EAAM,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,OAAO;IACtB,MAAM,EAAM,MAAM,CAAC;IACnB,IAAI,EAAQ,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAK,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,EAAW,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,GAAG,CAAC,EAAa,MAAM,CAAC;IACxB,MAAM,CAAC,EAAU,MAAM,CAAC;IACxB,MAAM,CAAC,EAAU,MAAM,CAAC;IACxB,MAAM,CAAC,EAAU,MAAM,CAAC;IACxB,OAAO,CAAC,EAAS,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,CAAC,EAAG,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAOD,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAW,QAAQ,CAAC;IACzB,OAAO,CAAC,EAAQ,GAAG,CAAC;IACpB,OAAO,CAAC,EAAQ,kBAAkB,GAAG,iBAAiB,CAAC;IACvD,SAAS,CAAC,EAAM,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB"}
+{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../src/interfaces.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAC9F,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAc,SAAS,CAAC;AAEjF,MAAM,MAAM,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,GAAG,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,KAAK,IAAI,CAAA;AAEhE;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAI,MAAM,CAAC;IACjB,MAAM,EAAI,MAAM,CAAC;IACjB,MAAM,EAAI,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAI,gBAAgB,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,CAAC,EAAG,MAAM,CAAC;IACpB,OAAO,EAAM,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,UAAW,SAAQ,UAAU;IAC5C,IAAI,CAAC,EAAK,MAAM,CAAC;IACjB,IAAI,CAAC,EAAK,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAI,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,cAAe,SAAQ,QAAQ;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD,IAAI,CAAC,EAAS,MAAM,CAAC;IACrB,IAAI,CAAC,EAAS,YAAY,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAC5C,WAAW,CAAC,EAAE,YAAY,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAC5C,OAAO,CAAC,EAAM,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,OAAO;IACtB,MAAM,EAAM,MAAM,CAAC;IACnB,IAAI,EAAQ,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAK,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,EAAW,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,GAAG,CAAC,EAAa,MAAM,CAAC;IACxB,MAAM,CAAC,EAAU,MAAM,CAAC;IACxB,MAAM,CAAC,EAAU,MAAM,CAAC;IACxB,MAAM,CAAC,EAAU,MAAM,CAAC;IACxB,OAAO,CAAC,EAAS,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,CAAC,EAAG,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAOD,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAW,QAAQ,CAAC;IACzB,OAAO,CAAC,EAAQ,GAAG,CAAC;IACpB,OAAO,CAAC,EAAQ,kBAAkB,GAAG,iBAAiB,CAAC;IACvD,SAAS,CAAC,EAAM,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB"}

package/build/types/base-user/index.d.ts

@@ -1,8 +1,8 @@
-import { BaseEntity, OrgGrant } from '../../interfaces';
+import { BaseEntity, OrgGrantRecord } from '../../interfaces';
 declare module '@nextage/nx-frame-be' {
     interface BaseUser {
         organizations?: BaseEntity[];
-        grants?: OrgGrant[];
+        grants?: OrgGrantRecord[];
     }
 }
 //# sourceMappingURL=index.d.ts.map

package/build/types/base-user/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/types/base-user/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAExD,OAAO,QAAQ,sBAAsB,CAAC;IACpC,UAAU,QAAQ;QAKhB,aAAa,CAAC,EAAE,UAAU,EAAE,CAAC;QAI7B,MAAM,CAAC,EAAS,QAAQ,EAAE,CAAC;KAC5B;CACF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/types/base-user/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAE9D,OAAO,QAAQ,sBAAsB,CAAC;IACpC,UAAU,QAAQ;QAKhB,aAAa,CAAC,EAAE,UAAU,EAAE,CAAC;QAS7B,MAAM,CAAC,EAAS,cAAc,EAAE,CAAC;KAClC;CACF"}

package/build/utils/claims.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"claims.d.ts","sourceRoot":"","sources":["../../src/utils/claims.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;+FAiB+F;AAE/F,OAAO,EAAE,QAAQ,EAAE,MAAuB,sBAAsB,CAAC;AAGjE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEhE;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,UAAU,CAWnE;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG,aAAa,CAS5E"}
+{"version":3,"file":"claims.d.ts","sourceRoot":"","sources":["../../src/utils/claims.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;+FAiB+F;AAE/F,OAAO,EAAE,QAAQ,EAAE,MAAuB,sBAAsB,CAAC;AAGjE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEhE;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,UAAU,CAcnE;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG,aAAa,CAS5E"}

package/build/utils/claims.interfaces.d.ts

@@ -4,29 +4,23 @@
  * Kept separate from the logic in `claims.ts` (house-style: types live in a
  * dedicated `*.interfaces.ts`, never mixed with the logic that consumes them).
  */
-import { BaseRoles } from '../enums';
 import { BaseEntity, OrgGrant } from '../interfaces';
-/**
- * A grant as it travels INSIDE the token.
- *
- * Only `id` and `role` are carried: they are all authorization needs. The
- * denormalized `code`/`name` exist for the UI and are re-read from the database
- * when displayed, so keeping them out bounds the token size as grants grow.
- */
-export interface GrantClaim {
-    id: string;
-    role: BaseRoles;
-}
 /**
  * The identity portion of the access-token payload.
  *
  * Deliberately terse: these keys are repeated in every request. `rls` and `orgs`
  * predate this ADR and keep their historic names and shapes.
+ *
+ * `grn` carries `OrgGrant` VERBATIM, not a token-specific shape: the pair
+ * `{ id, role }` is the whole of authorization, so a separate claim type could
+ * only ever drift from it. Provenance (`OrgGrantRecord.grantedBy`/`grantedAt`)
+ * stays out - it is audit data, and the token is neither the place to repeat it
+ * on every request nor a place anything can be revoked from before expiry.
  */
 export interface AuthClaims {
     rls: string[];
     orgs: string[];
-    grn?: GrantClaim[];
+    grn?: OrgGrant[];
 }
 /**
  * The identity rebuilt from a token by a resource service.

package/build/utils/claims.interfaces.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"claims.interfaces.d.ts","sourceRoot":"","sources":["../../src/utils/claims.interfaces.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAiB,UAAU,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAErD;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB,EAAE,EAAI,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,GAAG,EAAG,MAAM,EAAE,CAAC;IACf,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,CAAC,EAAE,UAAU,EAAE,CAAC;CACpB;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAU,MAAM,EAAE,CAAC;IACxB,aAAa,EAAE,UAAU,EAAE,CAAC;IAC5B,MAAM,EAAS,QAAQ,EAAE,CAAC;CAC3B"}
+{"version":3,"file":"claims.interfaces.d.ts","sourceRoot":"","sources":["../../src/utils/claims.interfaces.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAErD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,UAAU;IACzB,GAAG,EAAG,MAAM,EAAE,CAAC;IACf,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC;CAClB;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAU,MAAM,EAAE,CAAC;IACxB,aAAa,EAAE,UAAU,EAAE,CAAC;IAC5B,MAAM,EAAS,QAAQ,EAAE,CAAC;CAC3B"}

package/build/utils/claims.js

@@ -30,9 +30,12 @@ exports.identityFromClaims = identityFromClaims;
  * @returns the identity claims to sign
  */
 function buildAuthClaims(user) {
+    // rebuilt entry by entry, never spread: `user.grants` is an `OrgGrantRecord[]`
+    // read from the database, and spreading it would carry `grantedBy`/`grantedAt`
+    // into every request's token. The pair below is the whole of authorization.
     const grants = (user.grants ?? [])
         .filter(g => g.id && g.role)
-        .map(g => ({ id: g.id, role: g.role }));
+        .map(g => ({ id: String(g.id), role: g.role }));
     return {
         rls: user.roles ?? [],
         orgs: (user.organizations ?? []).map(o => o.id).filter(Boolean),

package/build/utils/claims.js.map

@@ -1 +1 @@
-{"version":3,"file":"claims.js","sourceRoot":"","sources":["../../src/utils/claims.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;+FAiB+F;;AAgB/F,0CAWC;AAYD,gDASC;AAzCD;;;;;;;;GAQG;AACH,SAAgB,eAAe,CAAC,IAAuB;IAErD,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;SAC/B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC;SAC3B,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAE3C,OAAO;QACL,GAAG,EAAG,IAAI,CAAC,KAAK,IAAI,EAAE;QACtB,IAAI,EAAE,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;QAChE,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;KACtC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,kBAAkB,CAAC,IAA0B;IAE3D,OAAO;QACL,KAAK,EAAU,IAAI,EAAE,GAAG,IAAI,EAAE;QAC9B,aAAa,EAAE,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACrD,MAAM,EAAS,CAAC,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;aAC7B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC;aAC7B,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAiB,EAAE,CAAC,CAAC;KACvD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"claims.js","sourceRoot":"","sources":["../../src/utils/claims.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;+FAiB+F;;AAgB/F,0CAcC;AAYD,gDASC;AA5CD;;;;;;;;GAQG;AACH,SAAgB,eAAe,CAAC,IAAuB;IAErD,+EAA+E;IAC/E,+EAA+E;IAC/E,4EAA4E;IAC5E,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;SAC/B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC;SAC3B,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAElD,OAAO;QACL,GAAG,EAAG,IAAI,CAAC,KAAK,IAAI,EAAE;QACtB,IAAI,EAAE,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;QAChE,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;KACtC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,kBAAkB,CAAC,IAA0B;IAE3D,OAAO;QACL,KAAK,EAAU,IAAI,EAAE,GAAG,IAAI,EAAE;QAC9B,aAAa,EAAE,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACrD,MAAM,EAAS,CAAC,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;aAC7B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC;aAC7B,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAiB,EAAE,CAAC,CAAC;KACvD,CAAC;AACJ,CAAC"}

package/build/utils/tenant.d.ts

@@ -9,7 +9,7 @@
  *                                                                                           *
  *********************************************************************************************/
 import { BaseUser, NxContext, NxObject } from '@nextage/nx-frame-be';
-import { ScopedReadModel } from './tenant.interfaces';
+import { ExistenceCheckModel, ScopedReadModel } from './tenant.interfaces';
 /**
  * Resolves the organization a request operates on - ALWAYS exactly one.
  *
@@ -95,4 +95,73 @@ export declare function getTenant(user?: BaseUser): string;
  * @throws `AppError('messages.notFound')` when the document is out of scope
  */
 export declare function assertTenantScope(model: ScopedReadModel, id: string, context?: NxContext): Promise<string>;
+/**
+ * Answers whether the organization NAMED by a request actually exists (T49).
+ *
+ * {@link resolveTenant} answers one question - "may this user REACH the
+ * selection" - and for a cross-tenant role the answer is "any of them", so it
+ * hands the value back untouched. EXISTENCE was nobody's job: an `orgId` naming
+ * no organization, never created or since deleted, travelled through unchecked.
+ *
+ * On reads that costs nothing: the filter matches no document and the caller gets
+ * an empty list. It bites on WRITES, because {@link setTenant} also runs inside
+ * `beforeCreate`: the document is stored with a `tenantId` pointing nowhere,
+ * unreachable by every later query and invisible to any tenant-wide cascade,
+ * which keys off an `OrganizationRemoved` event that will never arrive for an
+ * organization that never existed.
+ *
+ * ### Where to call it
+ *
+ * In the REQUEST CONTEXT of the service - the one place `orgId` enters, crossed
+ * ONCE per request - and NOT inside `resolveTenant`. That helper is synchronous
+ * and `setTenant` calls it from `beforeCreate`/`beforeGet`/`updateFilters`, hooks
+ * that run on every single query: making it asynchronous would cost a database
+ * round trip per query, and a signature change rippling through every caller, to
+ * answer a question that only changes when the request does.
+ *
+ * ⚠️ A service whose `orgId` reaches it only through checked paths does NOT need
+ * this: auth-srv, for one, takes the organization from mutation ARGUMENTS and
+ * passes it to `assertOrgScope`, which re-reads the document and fails when it is
+ * missing - the check there would be dead code. Wire it where the selection
+ * enters raw, from a header or from connection params.
+ *
+ * ### Fail-closed, and mute
+ *
+ * A non-existent selection is refused with the very same `messages.forbidden` as
+ * an out-of-reach one: telling them apart would answer a question the caller is
+ * not entitled to ask - whether someone else's organization exists, or has been
+ * deleted.
+ *
+ * A malformed value is refused likewise and deliberately BEFORE the query: the
+ * selection is client-supplied, and handing an arbitrary string to mongoose would
+ * raise a CastError - a 500 where a denial belongs. Note that `toObjectId` does
+ * NOT throw on a bad value, it returns the string unchanged, so the guard cannot
+ * be left to it.
+ *
+ * NO selection means "the caller's own organization" (rule 1) and there is
+ * nothing to verify: the check is a no-op, so requests that simply do not select
+ * are unaffected.
+ *
+ * @param model the organization model, or any local projection standing in for it
+ * @param orgId the organization named by the request, when any
+ * @returns `true` when the selection is usable, `false` when it names nothing
+ */
+export declare function selectedOrgExists(model: ExistenceCheckModel, orgId?: string): Promise<boolean>;
+/**
+ * {@link selectedOrgExists} in throwing form, for GraphQL context builders.
+ *
+ * A rejected context aborts the whole operation, which is exactly what a refusal
+ * means here.
+ *
+ * ⚠️ An Express middleware may NOT be able to use this shape: if the service
+ * registers its error handler BEFORE the routes, the error never reaches it, and
+ * `AppError` carries its code in `extensions.code` rather than in `.status`, so
+ * the handler would answer 500 on an already-written response. There, call
+ * {@link selectedOrgExists} and write the refusal directly.
+ *
+ * @param model the organization model, or any local projection standing in for it
+ * @param orgId the organization named by the request, when any
+ * @throws `AppError('messages.forbidden')` when the selection names no organization
+ */
+export declare function assertSelectedOrgExists(model: ExistenceCheckModel, orgId?: string): Promise<void>;
 //# sourceMappingURL=tenant.d.ts.map

package/build/utils/tenant.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenant.d.ts","sourceRoot":"","sources":["../../src/utils/tenant.ts"],"names":[],"mappings":"AAAA;;;;;;;;;+FAS+F;AAE/F,OAAO,EAAY,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAG/E,OAAO,EAAE,eAAe,EAAE,MAA8B,qBAAqB,CAAC;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,aAAa,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAerE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,GAAE,SAAc,GAAG,IAAI,CAGvE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,CAAC,IAAI,CAAC,EAAE,QAAQ,GAAG,MAAM,CAMjD;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,GAAE,SAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAMpH"}
+{"version":3,"file":"tenant.d.ts","sourceRoot":"","sources":["../../src/utils/tenant.ts"],"names":[],"mappings":"AAAA;;;;;;;;;+FAS+F;AAE/F,OAAO,EAAY,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAI/E,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAS,qBAAqB,CAAC;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,aAAa,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAerE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,GAAE,SAAc,GAAG,IAAI,CAGvE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,CAAC,IAAI,CAAC,EAAE,QAAQ,GAAG,MAAM,CAMjD;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,GAAE,SAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAMpH;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,mBAAmB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CASpG;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,uBAAuB,CAAC,KAAK,EAAE,mBAAmB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIvG"}

package/build/utils/tenant.interfaces.d.ts

@@ -16,4 +16,19 @@ import { NxContext } from '@nextage/nx-frame-be';
 export interface ScopedReadModel {
     get(id: string, context: NxContext): Promise<unknown>;
 }
+/**
+ * A model of which only "does a document with this `_id` exist" is needed.
+ *
+ * Structural for the same reason as {@link ScopedReadModel}, and deliberately
+ * built on `mgModel.exists` rather than on `get`: the question is whether the
+ * document EXISTS AT ALL, so it must NOT go through `beforeGet` and the tenant
+ * scoping it applies - a scoped read would answer "no" for an organization that
+ * exists but the caller cannot reach, which is a different question with a
+ * different answer.
+ */
+export interface ExistenceCheckModel {
+    mgModel: {
+        exists(filter: Record<string, unknown>): Promise<unknown>;
+    };
+}
 //# sourceMappingURL=tenant.interfaces.d.ts.map

package/build/utils/tenant.interfaces.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenant.interfaces.d.ts","sourceRoot":"","sources":["../../src/utils/tenant.interfaces.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACvD"}
+{"version":3,"file":"tenant.interfaces.d.ts","sourceRoot":"","sources":["../../src/utils/tenant.interfaces.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACvD;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE;QACP,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KAC3D,CAAC;CACH"}

package/build/utils/tenant.js

@@ -14,7 +14,10 @@ exports.resolveTenant = resolveTenant;
 exports.setTenant = setTenant;
 exports.getTenant = getTenant;
 exports.assertTenantScope = assertTenantScope;
+exports.selectedOrgExists = selectedOrgExists;
+exports.assertSelectedOrgExists = assertSelectedOrgExists;
 const nx_frame_be_1 = require("@nextage/nx-frame-be");
+const mongo_utils_1 = require("@nextage/nx-frame-be/build/common/base/mongo-utils");
 const scope_1 = require("./scope");
 /**
  * Resolves the organization a request operates on - ALWAYS exactly one.
@@ -121,4 +124,82 @@ async function assertTenantScope(model, id, context = {}) {
         throw new nx_frame_be_1.AppError('messages.notFound');
     return id;
 }
+/**
+ * Answers whether the organization NAMED by a request actually exists (T49).
+ *
+ * {@link resolveTenant} answers one question - "may this user REACH the
+ * selection" - and for a cross-tenant role the answer is "any of them", so it
+ * hands the value back untouched. EXISTENCE was nobody's job: an `orgId` naming
+ * no organization, never created or since deleted, travelled through unchecked.
+ *
+ * On reads that costs nothing: the filter matches no document and the caller gets
+ * an empty list. It bites on WRITES, because {@link setTenant} also runs inside
+ * `beforeCreate`: the document is stored with a `tenantId` pointing nowhere,
+ * unreachable by every later query and invisible to any tenant-wide cascade,
+ * which keys off an `OrganizationRemoved` event that will never arrive for an
+ * organization that never existed.
+ *
+ * ### Where to call it
+ *
+ * In the REQUEST CONTEXT of the service - the one place `orgId` enters, crossed
+ * ONCE per request - and NOT inside `resolveTenant`. That helper is synchronous
+ * and `setTenant` calls it from `beforeCreate`/`beforeGet`/`updateFilters`, hooks
+ * that run on every single query: making it asynchronous would cost a database
+ * round trip per query, and a signature change rippling through every caller, to
+ * answer a question that only changes when the request does.
+ *
+ * ⚠️ A service whose `orgId` reaches it only through checked paths does NOT need
+ * this: auth-srv, for one, takes the organization from mutation ARGUMENTS and
+ * passes it to `assertOrgScope`, which re-reads the document and fails when it is
+ * missing - the check there would be dead code. Wire it where the selection
+ * enters raw, from a header or from connection params.
+ *
+ * ### Fail-closed, and mute
+ *
+ * A non-existent selection is refused with the very same `messages.forbidden` as
+ * an out-of-reach one: telling them apart would answer a question the caller is
+ * not entitled to ask - whether someone else's organization exists, or has been
+ * deleted.
+ *
+ * A malformed value is refused likewise and deliberately BEFORE the query: the
+ * selection is client-supplied, and handing an arbitrary string to mongoose would
+ * raise a CastError - a 500 where a denial belongs. Note that `toObjectId` does
+ * NOT throw on a bad value, it returns the string unchanged, so the guard cannot
+ * be left to it.
+ *
+ * NO selection means "the caller's own organization" (rule 1) and there is
+ * nothing to verify: the check is a no-op, so requests that simply do not select
+ * are unaffected.
+ *
+ * @param model the organization model, or any local projection standing in for it
+ * @param orgId the organization named by the request, when any
+ * @returns `true` when the selection is usable, `false` when it names nothing
+ */
+async function selectedOrgExists(model, orgId) {
+    if (!orgId)
+        return true;
+    if (!(0, mongo_utils_1.isValidObjectId)(orgId))
+        return false;
+    return !!await model.mgModel.exists({ _id: (0, mongo_utils_1.toObjectId)(orgId) });
+}
+/**
+ * {@link selectedOrgExists} in throwing form, for GraphQL context builders.
+ *
+ * A rejected context aborts the whole operation, which is exactly what a refusal
+ * means here.
+ *
+ * ⚠️ An Express middleware may NOT be able to use this shape: if the service
+ * registers its error handler BEFORE the routes, the error never reaches it, and
+ * `AppError` carries its code in `extensions.code` rather than in `.status`, so
+ * the handler would answer 500 on an already-written response. There, call
+ * {@link selectedOrgExists} and write the refusal directly.
+ *
+ * @param model the organization model, or any local projection standing in for it
+ * @param orgId the organization named by the request, when any
+ * @throws `AppError('messages.forbidden')` when the selection names no organization
+ */
+async function assertSelectedOrgExists(model, orgId) {
+    if (!await selectedOrgExists(model, orgId))
+        throw new nx_frame_be_1.AppError('messages.forbidden');
+}
 //# sourceMappingURL=tenant.js.map

package/build/utils/tenant.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenant.js","sourceRoot":"","sources":["../../src/utils/tenant.ts"],"names":[],"mappings":";AAAA;;;;;;;;;+FAS+F;;AAyC/F,sCAeC;AAcD,8BAGC;AAaD,8BAMC;AA0BD,8CAMC;AA1HD,sDAA+E;AAE/E,mCAAkE;AAGlE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,SAAgB,aAAa,CAAC,IAAe,EAAE,KAAc;IAE3D,IAAI,CAAC,KAAK;QACR,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;IAEzB,MAAM,SAAS,GAAG,IAAA,uBAAe,EAAC,IAAI,CAAC,CAAC;IAExC,sEAAsE;IACtE,IAAI,CAAC,SAAS;QACZ,OAAO,KAAK,CAAC;IAEf,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC5B,MAAM,IAAI,sBAAQ,CAAC,oBAAoB,CAAC,CAAC;IAE3C,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAgB,SAAS,CAAC,IAAc,EAAE,UAAqB,EAAE;IAE/D,IAAI,CAAC,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,SAAS,CAAC,IAAe;IAEvC,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM;QAC9B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAE1D,OAAO,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACI,KAAK,UAAU,iBAAiB,CAAC,KAAsB,EAAE,EAAU,EAAE,UAAqB,EAAE;IAEjG,IAAI,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC;QAC/B,MAAM,IAAI,sBAAQ,CAAC,mBAAmB,CAAC,CAAC;IAE1C,OAAO,EAAE,CAAC;AACZ,CAAC"}
+{"version":3,"file":"tenant.js","sourceRoot":"","sources":["../../src/utils/tenant.ts"],"names":[],"mappings":";AAAA;;;;;;;;;+FAS+F;;AA0C/F,sCAeC;AAcD,8BAGC;AAaD,8BAMC;AA0BD,8CAMC;AAqDD,8CASC;AAkBD,0DAIC;AA/MD,sDAA+E;AAC/E,oFAA6G;AAE7G,mCAAkE;AAGlE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,SAAgB,aAAa,CAAC,IAAe,EAAE,KAAc;IAE3D,IAAI,CAAC,KAAK;QACR,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;IAEzB,MAAM,SAAS,GAAG,IAAA,uBAAe,EAAC,IAAI,CAAC,CAAC;IAExC,sEAAsE;IACtE,IAAI,CAAC,SAAS;QACZ,OAAO,KAAK,CAAC;IAEf,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC5B,MAAM,IAAI,sBAAQ,CAAC,oBAAoB,CAAC,CAAC;IAE3C,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAgB,SAAS,CAAC,IAAc,EAAE,UAAqB,EAAE;IAE/D,IAAI,CAAC,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,SAAS,CAAC,IAAe;IAEvC,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM;QAC9B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAE1D,OAAO,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACI,KAAK,UAAU,iBAAiB,CAAC,KAAsB,EAAE,EAAU,EAAE,UAAqB,EAAE;IAEjG,IAAI,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC;QAC/B,MAAM,IAAI,sBAAQ,CAAC,mBAAmB,CAAC,CAAC;IAE1C,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACI,KAAK,UAAU,iBAAiB,CAAC,KAA0B,EAAE,KAAc;IAEhF,IAAI,CAAC,KAAK;QACR,OAAO,IAAI,CAAC;IAEd,IAAI,CAAC,IAAA,6BAAe,EAAC,KAAK,CAAC;QACzB,OAAO,KAAK,CAAC;IAEf,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,IAAA,wBAAU,EAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACI,KAAK,UAAU,uBAAuB,CAAC,KAA0B,EAAE,KAAc;IAEtF,IAAI,CAAC,MAAM,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC;QACxC,MAAM,IAAI,sBAAQ,CAAC,oBAAoB,CAAC,CAAC;AAC7C,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nextage/era-lib",
-  "version": "1.0.192",
+  "version": "1.0.194",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",
   "files": [