@nodii/db-rls 0.11.0 → 0.13.0

package/bin/migrate-gen.mjs

@@ -7,12 +7,15 @@
 // Subcommands:
 //   migrate-gen <serviceName> [--out <dir>] [--stub]
 //   verify-rls  --tables <a,b,c> [--ref <x,y>] [--schema <name>] [--db <url>]
+//   install-fence [--db <url>] [--skip-grants]
+//   verify-fence  [--db <url>] [--schema <name>] [--strict-only]
 //
 // (Filename kept as migrate-gen.mjs for the package.json `bin` mapping;
 // it is the single `nodii-db-rls` entrypoint, not migrate-gen only.)
 
 import { runMigrateGenCli } from "../dist/migrate-gen.js";
 import { runVerifyRlsCli } from "../dist/verify-rls-cli.js";
+import { runInstallFenceCli, runVerifyFenceCli } from "../dist/fence-cli.js";
 
 const argv = process.argv.slice(2);
 const sub = argv[0];
@@ -22,6 +25,14 @@ if (sub === "verify-rls") {
   // Coverage failures (1) + usage (2) go to stderr; success (0) to stdout.
   (code === 0 ? console.log : console.error)(message);
   process.exit(code);
+} else if (sub === "install-fence") {
+  const { code, message } = await runInstallFenceCli(argv.slice(1));
+  (code === 0 ? console.log : console.error)(message);
+  process.exit(code);
+} else if (sub === "verify-fence") {
+  const { code, message } = await runVerifyFenceCli(argv.slice(1));
+  (code === 0 ? console.log : console.error)(message);
+  process.exit(code);
 } else {
   // migrate-gen (default + back-compat: runMigrateGenCli accepts the
   // leading "migrate-gen" token and prints usage on a missing serviceName).

package/dist/auth-schema.d.ts

@@ -4,7 +4,184 @@ import type { Pool, PoolClient } from "pg";
  * compliance requirement. Identical byte-equal payload across TS / Python
  * / Go ports (asserted by the parity-fence CI).
  */
-export declare const AUTH_SCHEMA_SQL = "CREATE SCHEMA IF NOT EXISTS auth;\n\nCREATE OR REPLACE FUNCTION auth.set_user_id(p_user_id uuid) RETURNS void\nLANGUAGE sql AS $$ SELECT set_config('app.user_id', p_user_id::text, true) $$;\n\nCREATE OR REPLACE FUNCTION auth.set_tenant_id(p_tenant_id uuid) RETURNS void\nLANGUAGE sql AS $$ SELECT set_config('app.tenant_id', p_tenant_id::text, true) $$;\n\nCREATE OR REPLACE FUNCTION auth.init(p_user_id uuid, p_tenant_id uuid) RETURNS void\nLANGUAGE sql AS $$\n  SELECT set_config('app.user_id', p_user_id::text, true);\n  SELECT set_config('app.tenant_id', p_tenant_id::text, true);\n$$;\n\nCREATE OR REPLACE FUNCTION auth.init_tenant(p_tenant_id uuid) RETURNS void\nLANGUAGE sql AS $$ SELECT set_config('app.tenant_id', p_tenant_id::text, true) $$;\n\nCREATE OR REPLACE FUNCTION auth.get_user_id() RETURNS uuid\nLANGUAGE sql STABLE AS $$ SELECT nullif(current_setting('app.user_id', true), '')::uuid $$;\n\nCREATE OR REPLACE FUNCTION auth.get_tenant_id() RETURNS uuid\nLANGUAGE sql STABLE AS $$ SELECT nullif(current_setting('app.tenant_id', true), '')::uuid $$;\n\n-- Stub variant. Replaced in-place by migrate-gen's 0001_user_tenant_ids.sql\n-- once the service has employees_mirror + customers_mirror tables.\nCREATE OR REPLACE FUNCTION auth.user_tenant_ids(p_user_id uuid) RETURNS SETOF uuid\nLANGUAGE sql STABLE AS $$ SELECT NULL::uuid WHERE false $$;\n";
+export declare const AUTH_SCHEMA_SQL = "CREATE SCHEMA IF NOT EXISTS auth;\n\nCREATE OR REPLACE FUNCTION auth.set_user_id(p_user_id uuid) RETURNS void\nLANGUAGE sql AS $$ SELECT set_config('app.user_id', p_user_id::text, true) $$;\n\nCREATE OR REPLACE FUNCTION auth.set_tenant_id(p_tenant_id uuid) RETURNS void\nLANGUAGE sql AS $$ SELECT set_config('app.tenant_id', p_tenant_id::text, true) $$;\n\nCREATE OR REPLACE FUNCTION auth.init(p_user_id uuid, p_tenant_id uuid) RETURNS void\nLANGUAGE sql AS $$\n  SELECT set_config('app.user_id', p_user_id::text, true);\n  SELECT set_config('app.tenant_id', p_tenant_id::text, true);\n$$;\n\nCREATE OR REPLACE FUNCTION auth.init_tenant(p_tenant_id uuid) RETURNS void\nLANGUAGE sql AS $$ SELECT set_config('app.tenant_id', p_tenant_id::text, true) $$;\n\nCREATE OR REPLACE FUNCTION auth.get_user_id() RETURNS uuid\nLANGUAGE sql STABLE AS $$ SELECT nullif(current_setting('app.user_id', true), '')::uuid $$;\n\nCREATE OR REPLACE FUNCTION auth.get_tenant_id() RETURNS uuid\nLANGUAGE sql STABLE AS $$ SELECT nullif(current_setting('app.tenant_id', true), '')::uuid $$;\n\n-- Stub variant, installed ONLY IF ABSENT. Replaced in-place by migrate-gen's\n-- 0001_user_tenant_ids.sql once the service has employees_mirror +\n-- customers_mirror tables.\n--\n-- IT IS A GUARDED CREATE, NOT A `CREATE OR REPLACE`, AND THAT IS LOAD-BEARING.\n-- As an unguarded REPLACE this statement silently overwrote a service's REAL\n-- membership helper with the dead stub every time the auth schema was\n-- re-applied \u2014 turning a correctly-fenced service into a deny-all one with no\n-- error, which is the same fail-silent shape this release exists to remove.\n-- It also made `INSTALL_SESSION_RESOLVER_SQL` unable to classify: running\n-- immediately after this block, it would read the stub this block had just\n-- stamped and conclude EVERY service needed the degraded body.\n--\n-- A bootstrap default must never win against the real thing it is standing in\n-- for.\nDO $ensure_user_tenant_ids$\nBEGIN\n  IF to_regprocedure('auth.user_tenant_ids(uuid)') IS NULL THEN\n    EXECUTE $utid$CREATE FUNCTION auth.user_tenant_ids(p_user_id uuid) RETURNS SETOF uuid\nLANGUAGE sql STABLE AS $utid_body$ SELECT NULL::uuid WHERE false $utid_body$;$utid$;\n  END IF;\nEND\n$ensure_user_tenant_ids$;\n";
+/**
+ * `auth.session_tenant_ids()` — THE authenticated-pool resolver.
+ *
+ * Returns AT MOST ONE tenant: the one bound to `app.tenant_id`, and only if the
+ * principal in `app.user_id` genuinely holds it per `auth.user_tenant_ids`.
+ * Edge-signed session tenant **INTERSECT** server-resolved membership.
+ *
+ * WHY THIS EXISTS. The `authenticated` predicate used to be
+ * `tenant_id IN (SELECT auth.user_tenant_ids(auth.get_user_id()))` — the UNION
+ * of every tenant the user belongs to, with no tenant fence at all. A session
+ * opened for a user with memberships in tenants A and B could read AND write
+ * both. Reproduced end-to-end: a legitimate tenant-A session transitioned a
+ * tenant-B approval task, got HTTP 200, and released a 250,000 INR refund.
+ *
+ * WHY SUBSTITUTION RATHER THAN APPENDING A FENCE. The obvious repair is to
+ * append `AND tenant_id = auth.get_tenant_id()` at the top level of each
+ * policy. That breaks every policy whose shape is not a bare tenant equality,
+ * and the fleet is full of them:
+ *
+ *   - tables with NO `tenant_id` column that reach it through a nested
+ *     `EXISTS` or a sub-`SELECT` (`tenant_role_permissions`, `fx_rate_cache`)
+ *   - platform-default escape hatches — `tenant_id IS NULL OR tenant_id IN (…)`
+ *     (hr's statutory masters, `pricing_snapshots`)
+ *   - additive ORs on a differently-named column — `is_public_listing = TRUE OR
+ *     developer_tenant_id IN (…)` (`oauth_apps` marketplace listings)
+ *   - policies fencing on a column that is not `tenant_id` at all (`tenants.id`,
+ *     `legal_documents.scope`, `impersonation_sessions.target_tenant_id`)
+ *   - TEXT-vs-uuid casts that need fixing in opposite directions per table
+ *
+ * Swapping the resolver INSIDE the subquery leaves the column, the cast and the
+ * surrounding OR untouched, so all of those keep working while the set the
+ * subquery yields narrows from "every tenant you belong to" to "the one you are
+ * logged into, if you really belong to it". One substitution, zero shape
+ * changes, and NO `AS RESTRICTIVE` (which would AND against the additive
+ * permissive master policies and kill every platform-default row).
+ *
+ * `user_tenant_ids` is deliberately LEFT INTACT. It still answers the honest
+ * question "which tenants does this user belong to", which a tenant-switcher or
+ * a login tenant-picker legitimately needs. Overloading it with session scope
+ * would have silently broken those callers with no error and no test coverage.
+ *
+ * SECURITY DEFINER is required, not decorative:
+ *   - `authenticated` has no privilege on the membership mirror, so an INVOKER
+ *     function raises `permission denied for table user_memberships`;
+ *   - if the mirror is itself RLS-policied, an INVOKER function re-enters its
+ *     own policy and dies with `stack depth limit exceeded` (54001).
+ *
+ * FAIL-CLOSED SPLIT, deliberate:
+ *   - GUCs unset  → RAISE 42501. Misconfiguration is LOUD. An unbound session
+ *     silently yielding an empty grid reads to a human as "there is no data
+ *     here", which is how a broken session survives a week of QA.
+ *   - bound, but no membership → EMPTY SET, no error. A legitimate non-member
+ *     seeing nothing is not an error condition, and platform-default rows
+ *     reached through a sibling `OR` must still resolve.
+ */
+export declare const SESSION_TENANT_IDS_SQL = "CREATE OR REPLACE FUNCTION auth.session_tenant_ids() RETURNS SETOF uuid\nLANGUAGE plpgsql STABLE SECURITY DEFINER\nSET search_path = pg_catalog, public, pg_temp\nAS $session$\nDECLARE\n  v_user uuid;\n  v_tenant uuid;\nBEGIN\n  v_user := nullif(current_setting('app.user_id', true), '')::uuid;\n  v_tenant := nullif(current_setting('app.tenant_id', true), '')::uuid;\n  IF v_user IS NULL THEN\n    RAISE EXCEPTION 'db_rls_session_user_missing: app.user_id is not bound on this connection'\n      USING ERRCODE = '42501',\n            HINT = 'The authenticated pool is the user-session pool; a session with no principal cannot be membership-checked. Open it with withUserContext({ userId, tenantId }, fn) from @nodii/db-rls.';\n  END IF;\n  IF v_tenant IS NULL THEN\n    RAISE EXCEPTION 'db_rls_session_tenant_missing: app.tenant_id is not bound on this connection'\n      USING ERRCODE = '42501',\n            HINT = 'Every authenticated-pool session must be EXPLICITLY tenant-scoped. Open it with withUserContext({ userId, tenantId }, fn) from @nodii/db-rls.';\n  END IF;\n  RETURN QUERY SELECT v_tenant WHERE v_tenant IN (SELECT auth.user_tenant_ids(v_user));\nEND\n$session$;\n";
+/**
+ * Marker embedded in the DEGRADED body so `pg_proc.prosrc` introspection can
+ * tell the two variants apart. {@link verifyTenantFence} reports any database
+ * running the degraded resolver — the point is that a service is never on it by
+ * accident.
+ */
+export declare const SESSION_TENANT_IDS_DEGRADED_MARKER = "DB_RLS_DEGRADED_NO_MEMBERSHIP_MIRROR";
+/**
+ * DEGRADED variant of {@link SESSION_TENANT_IDS_SQL} — fence ONLY, no
+ * membership intersect.
+ *
+ * FOR SERVICES THAT SHIP NO MEMBERSHIP MIRROR, AND NOTHING ELSE. Such a service
+ * has `auth.user_tenant_ids` as the bootstrap stub (`SELECT NULL::uuid WHERE
+ * false`), so the strict resolver intersects to the empty set and the entire
+ * authenticated pool becomes silently deny-all — the P0 shape of drift
+ * 199feabc, where crm's 430 policies were dead and nobody noticed.
+ *
+ * THE LIST BELOW IS DERIVED FROM THE REPOS, NOT FROM MEMORY. An earlier
+ * revision of this comment asserted "nodii-crm-service alone", which was wrong
+ * by six services and wrong about crm's urgency. Several repos ship a phase-004
+ * or phase-005 `0002_create_rls_helpers.sql` whose real `user_tenant_ids` is
+ * FULLY COMMENTED OUT, so the phase-002 stub is still the winner:
+ *
+ *   STUB + a LIVE authenticated pool  → deny-all TODAY, needs this variant:
+ *     - nodii-billing-service   77 call sites; saga + dsar migrations run at
+ *                               BOOT (`src/lib/bootstrap.ts`), so its
+ *                               `saga_outbox` / `lifecycle_requests` /
+ *                               `data_residency_holds` are library-owned. The
+ *                               money path. Highest risk in the fleet.
+ *     - nodii-finance-service   14 call sites. Already self-mitigates via
+ *                               `010-lib-auth-pool-mode`, which rewrites the
+ *                               lib policies to `= auth.get_tenant_id()`.
+ *     - nodii-notification-service  3 call sites. Its own policies use
+ *                               `= auth.get_tenant_id()` and keep working, so
+ *                               only the library-owned tables go dark — which
+ *                               is exactly the shape nobody notices.
+ *
+ *   STUB + a pool that is built but has ZERO handler call sites → not broken
+ *   today, breaks the moment a handler uses it:
+ *     - nodii-crm-service, nodii-kyc-service, nodii-ticketing-service,
+ *       nodii-product-service
+ *
+ *   Does NOT need it: nodii-geo-service (no authenticated pool at all —
+ *   2-pool), nodii-edge (no `user_tenant_ids`, RLS mode `single`),
+ *   nodii-customer-service and nodii-vendor-service (already GUC-bodied),
+ *   nodii-auth / nodii-hr-service / nodii-task-tracking / nodii-tenant-service
+ *   (REAL membership helpers).
+ *
+ * WHAT YOU GIVE UP. The database stops verifying the principal. Isolation rests
+ * entirely on the application binding `app.tenant_id` correctly — RLS degrades
+ * from an independent second layer into "the app said so". A forged or simply
+ * mistaken tenant binding becomes access. That is a real reduction in
+ * defence-in-depth and it is why this is a separate, named, reported constant
+ * rather than a boolean flag on the strict one.
+ *
+ * THE EXIT. Land a membership mirror, point `auth.user_tenant_ids` at it, then
+ * apply {@link SESSION_TENANT_IDS_SQL} over this. No policy changes — the
+ * predicate at every call site is identical for both variants.
+ */
+export declare const SESSION_TENANT_IDS_DEGRADED_SQL = "CREATE OR REPLACE FUNCTION auth.session_tenant_ids() RETURNS SETOF uuid\nLANGUAGE plpgsql STABLE SECURITY DEFINER\nSET search_path = pg_catalog, public, pg_temp\nAS $session$\nDECLARE\n  v_tenant uuid;\nBEGIN\n  -- DB_RLS_DEGRADED_NO_MEMBERSHIP_MIRROR: no membership mirror in this service,\n  -- so the session tenant is accepted WITHOUT proving the principal holds it.\n  -- Replace with the strict resolver as soon as a mirror exists.\n  IF nullif(current_setting('app.user_id', true), '') IS NULL THEN\n    RAISE EXCEPTION 'db_rls_session_user_missing: app.user_id is not bound on this connection'\n      USING ERRCODE = '42501',\n            HINT = 'Open the session with withUserContext({ userId, tenantId }, fn) from @nodii/db-rls.';\n  END IF;\n  v_tenant := nullif(current_setting('app.tenant_id', true), '')::uuid;\n  IF v_tenant IS NULL THEN\n    RAISE EXCEPTION 'db_rls_session_tenant_missing: app.tenant_id is not bound on this connection'\n      USING ERRCODE = '42501',\n            HINT = 'Every authenticated-pool session must be EXPLICITLY tenant-scoped. Open it with withUserContext({ userId, tenantId }, fn) from @nodii/db-rls.';\n  END IF;\n  RETURN QUERY SELECT v_tenant;\nEND\n$session$;\n";
+/** Grant for the resolver. Separate from {@link AUTH_SCHEMA_GRANTS_SQL} for the
+ *  same reason: the roles must exist before the GRANT runs. */
+export declare const SESSION_TENANT_IDS_GRANTS_SQL = "GRANT EXECUTE ON FUNCTION auth.session_tenant_ids() TO nodii_services, authenticated;\n";
+/**
+ * THE DELIVERY UNIT. One idempotent, re-runnable, SELF-CLASSIFYING statement
+ * that installs whichever resolver body this database can actually support.
+ *
+ * WHY IT SELF-CLASSIFIES RATHER THAN TAKING A FLAG.
+ *
+ * The strict and degraded bodies are not interchangeable, and picking the wrong
+ * one is silent in BOTH directions:
+ *
+ *   - strict on a service whose `auth.user_tenant_ids` is the bootstrap stub
+ *     (`SELECT NULL::uuid WHERE false`) intersects to the EMPTY SET, so every
+ *     authenticated policy denies every row. No error. Measured live on
+ *     `nodii-dev-postgres`: crm carries 507 authenticated policies, and a strict
+ *     install there takes ALL 507 dark, not just the 85 already dead.
+ *   - degraded on a service that HAS a real membership mirror silently drops
+ *     the principal check, which is the defence-in-depth this release exists to
+ *     add.
+ *
+ * A caller-supplied boolean makes that choice a thing somebody has to know. The
+ * library shipped exactly such a list in prose — and it was WRONG BY SIX
+ * SERVICES on the first pass and had to be re-derived from the repos. A list
+ * that was wrong once, maintained by hand, across fifteen repos, on a
+ * fail-silent switch, is not a control. It is a countdown.
+ *
+ * So the choice is made from what the database ACTUALLY CONTAINS, at the moment
+ * of install, by the same structural test `isStubMembershipHelper` applies in
+ * TypeScript: a membership helper that is absent, or whose body can never
+ * return a row, cannot support the intersect. Nobody has to know anything, and
+ * there is no list to get wrong.
+ *
+ * D415 (LOCKED) is the governing decision: a single-tenant-session service
+ * whose `user_tenant_ids` is absent, stubbed or uncalled MAY fence on the
+ * session tenant — isolation-equivalent, forfeiting no cross-tenant protection.
+ * The predicate at every call site is IDENTICAL for both bodies, which is what
+ * makes this substitutable at all.
+ *
+ * IT IS ALSO D415's SUNSET, AUTOMATED. D415's exit path is "land a membership
+ * mirror → repoint the helper → swap in the strict body". Because this block
+ * re-reads the catalog on EVERY run and is `CREATE OR REPLACE`, the swap
+ * happens by itself on the next boot after the mirror lands. Nobody files a
+ * follow-up ticket, because there is nothing to follow up.
+ *
+ * THE ONE-WAY RATCHET. The condition is "absent OR stub", so a real helper
+ * ALWAYS yields strict. This block can upgrade degraded → strict; it can never
+ * downgrade strict → degraded. That direction is the one that matters: it means
+ * this delivery path cannot overwrite a correctly-strict service, and cannot
+ * overwrite crm's deliberately-degraded body with a strict one either, because
+ * crm's helper is still the stub and will keep classifying as such until it
+ * genuinely isn't.
+ *
+ * Byte-identical across the TS / Go / Python ports (asserted by the parity
+ * test). The nested dollar-quote tags are all distinct — `$fence_install$`
+ * outer, `$fence_strict$` / `$fence_degraded$` for the EXECUTE literals,
+ * `$session$` inside the bodies — so the statement survives every dollar-quote
+ * -aware splitter in the fleet, including the ones in @nodii/saga and
+ * @nodii/dsar that split the mirrors' DDL on `;\n`.
+ */
+export declare const INSTALL_SESSION_RESOLVER_SQL: string;
 /**
  * Grants for the 7 helper functions. Emitted separately because they
  * reference roles that must exist before the GRANT runs — applied last
@@ -33,6 +210,35 @@ type AnyExecutor = Pool | PoolClient | SqlExecutor;
  */
 export declare function applyAuthSchemaMigrations(client: AnyExecutor, opts?: {
     includeGrants?: boolean;
+    degradedSessionResolver?: boolean;
+}): Promise<void>;
+/**
+ * THE WHOLE DELIVERY UNIT AS ONE STRING — resolver + gate, self-classifying,
+ * idempotent, re-runnable, and safe to apply on every boot.
+ *
+ * This is what the three mirrors inline byte-equal, what the CLI applies, and
+ * what a service with no other delivery path should call directly from its boot
+ * sequence, BEFORE any code that opens an authenticated transaction:
+ *
+ *     import { applySessionFenceBootstrap } from "@nodii/db-rls";
+ *     await applySessionFenceBootstrap(ownerSql);
+ *
+ * Grants are separate (as everywhere else in this package) because the runtime
+ * roles must exist before a GRANT naming them can run, and on a fresh database
+ * they do not yet.
+ */
+export declare const SESSION_FENCE_BOOTSTRAP_SQL: string;
+/**
+ * Apply {@link SESSION_FENCE_BOOTSTRAP_SQL} against an owner-privileged client.
+ *
+ * Idempotent and safe on every boot: the resolver and gate are
+ * `CREATE OR REPLACE`, the schema is `IF NOT EXISTS`, and the body selection
+ * re-derives from the catalog each run — so a service that lands a membership
+ * mirror upgrades itself from the degraded body to the strict one on its next
+ * restart, with no migration and no policy change (D415's exit path).
+ */
+export declare function applySessionFenceBootstrap(client: AnyExecutor, opts?: {
+    includeGrants?: boolean;
 }): Promise<void>;
 /**
  * Composite full DDL — the schema + helpers + grants, joined.

package/dist/auth-schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-schema.d.ts","sourceRoot":"","sources":["../src/auth-schema.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAE3C;;;;GAIG;AACH,eAAO,MAAM,eAAe,s1CA2B3B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,8oBAQlC,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtC;AAED,KAAK,WAAW,GAAG,IAAI,GAAG,UAAU,GAAG,WAAW,CAAC;AAEnD;;;;;;;;;;;GAWG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,WAAW,EACnB,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GACrC,OAAO,CAAC,IAAI,CAAC,CASf;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GACrC,MAAM,CAKR"}
+{"version":3,"file":"auth-schema.d.ts","sourceRoot":"","sources":["../src/auth-schema.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAO3C;;;;GAIG;AACH,eAAO,MAAM,eAAe,0uEA8C3B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,eAAO,MAAM,sBAAsB,iqCAuBlC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kCAAkC,yCACP,CAAC;AAEzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,eAAO,MAAM,+BAA+B,isCAwB3C,CAAC;AAEF;+DAC+D;AAC/D,eAAO,MAAM,6BAA6B,4FACzC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,eAAO,MAAM,4BAA4B,QA4BxC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,8oBAQlC,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtC;AAED,KAAK,WAAW,GAAG,IAAI,GAAG,UAAU,GAAG,WAAW,CAAC;AAEnD;;;;;;;;;;;GAWG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,WAAW,EACnB,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAC;IAAC,uBAAuB,CAAC,EAAE,OAAO,CAAA;CAAO,GACxE,OAAO,CAAC,IAAI,CAAC,CAgCf;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,2BAA2B,EAAE,MAEzC,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,WAAW,EACnB,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GACrC,OAAO,CAAC,IAAI,CAAC,CAOf;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GACrC,MAAM,CAKR"}

package/dist/auth-schema.js

@@ -19,6 +19,7 @@
 // fails closed if a service applies the helpers but hasn't yet emitted
 // the real per-service helper via `migrate-gen`. Once `migrate-gen` ships
 // the real helper, `CREATE OR REPLACE` replaces this stub in place.
+import { sessionFenceBootstrapSql, TENANT_FENCE_GATE_GRANTS_SQL, TENANT_FENCE_GATE_SQL, } from "./tenant-fence-gate.js";
 /**
  * Canonical SQL string exported as a module-level constant per the R1
  * compliance requirement. Identical byte-equal payload across TS / Python
@@ -47,10 +48,282 @@ LANGUAGE sql STABLE AS $$ SELECT nullif(current_setting('app.user_id', true), ''
 CREATE OR REPLACE FUNCTION auth.get_tenant_id() RETURNS uuid
 LANGUAGE sql STABLE AS $$ SELECT nullif(current_setting('app.tenant_id', true), '')::uuid $$;
 
--- Stub variant. Replaced in-place by migrate-gen's 0001_user_tenant_ids.sql
--- once the service has employees_mirror + customers_mirror tables.
-CREATE OR REPLACE FUNCTION auth.user_tenant_ids(p_user_id uuid) RETURNS SETOF uuid
-LANGUAGE sql STABLE AS $$ SELECT NULL::uuid WHERE false $$;
+-- Stub variant, installed ONLY IF ABSENT. Replaced in-place by migrate-gen's
+-- 0001_user_tenant_ids.sql once the service has employees_mirror +
+-- customers_mirror tables.
+--
+-- IT IS A GUARDED CREATE, NOT A \`CREATE OR REPLACE\`, AND THAT IS LOAD-BEARING.
+-- As an unguarded REPLACE this statement silently overwrote a service's REAL
+-- membership helper with the dead stub every time the auth schema was
+-- re-applied — turning a correctly-fenced service into a deny-all one with no
+-- error, which is the same fail-silent shape this release exists to remove.
+-- It also made \`INSTALL_SESSION_RESOLVER_SQL\` unable to classify: running
+-- immediately after this block, it would read the stub this block had just
+-- stamped and conclude EVERY service needed the degraded body.
+--
+-- A bootstrap default must never win against the real thing it is standing in
+-- for.
+DO $ensure_user_tenant_ids$
+BEGIN
+  IF to_regprocedure('auth.user_tenant_ids(uuid)') IS NULL THEN
+    EXECUTE $utid$CREATE FUNCTION auth.user_tenant_ids(p_user_id uuid) RETURNS SETOF uuid
+LANGUAGE sql STABLE AS $utid_body$ SELECT NULL::uuid WHERE false $utid_body$;$utid$;
+  END IF;
+END
+$ensure_user_tenant_ids$;
+`;
+/**
+ * `auth.session_tenant_ids()` — THE authenticated-pool resolver.
+ *
+ * Returns AT MOST ONE tenant: the one bound to `app.tenant_id`, and only if the
+ * principal in `app.user_id` genuinely holds it per `auth.user_tenant_ids`.
+ * Edge-signed session tenant **INTERSECT** server-resolved membership.
+ *
+ * WHY THIS EXISTS. The `authenticated` predicate used to be
+ * `tenant_id IN (SELECT auth.user_tenant_ids(auth.get_user_id()))` — the UNION
+ * of every tenant the user belongs to, with no tenant fence at all. A session
+ * opened for a user with memberships in tenants A and B could read AND write
+ * both. Reproduced end-to-end: a legitimate tenant-A session transitioned a
+ * tenant-B approval task, got HTTP 200, and released a 250,000 INR refund.
+ *
+ * WHY SUBSTITUTION RATHER THAN APPENDING A FENCE. The obvious repair is to
+ * append `AND tenant_id = auth.get_tenant_id()` at the top level of each
+ * policy. That breaks every policy whose shape is not a bare tenant equality,
+ * and the fleet is full of them:
+ *
+ *   - tables with NO `tenant_id` column that reach it through a nested
+ *     `EXISTS` or a sub-`SELECT` (`tenant_role_permissions`, `fx_rate_cache`)
+ *   - platform-default escape hatches — `tenant_id IS NULL OR tenant_id IN (…)`
+ *     (hr's statutory masters, `pricing_snapshots`)
+ *   - additive ORs on a differently-named column — `is_public_listing = TRUE OR
+ *     developer_tenant_id IN (…)` (`oauth_apps` marketplace listings)
+ *   - policies fencing on a column that is not `tenant_id` at all (`tenants.id`,
+ *     `legal_documents.scope`, `impersonation_sessions.target_tenant_id`)
+ *   - TEXT-vs-uuid casts that need fixing in opposite directions per table
+ *
+ * Swapping the resolver INSIDE the subquery leaves the column, the cast and the
+ * surrounding OR untouched, so all of those keep working while the set the
+ * subquery yields narrows from "every tenant you belong to" to "the one you are
+ * logged into, if you really belong to it". One substitution, zero shape
+ * changes, and NO `AS RESTRICTIVE` (which would AND against the additive
+ * permissive master policies and kill every platform-default row).
+ *
+ * `user_tenant_ids` is deliberately LEFT INTACT. It still answers the honest
+ * question "which tenants does this user belong to", which a tenant-switcher or
+ * a login tenant-picker legitimately needs. Overloading it with session scope
+ * would have silently broken those callers with no error and no test coverage.
+ *
+ * SECURITY DEFINER is required, not decorative:
+ *   - `authenticated` has no privilege on the membership mirror, so an INVOKER
+ *     function raises `permission denied for table user_memberships`;
+ *   - if the mirror is itself RLS-policied, an INVOKER function re-enters its
+ *     own policy and dies with `stack depth limit exceeded` (54001).
+ *
+ * FAIL-CLOSED SPLIT, deliberate:
+ *   - GUCs unset  → RAISE 42501. Misconfiguration is LOUD. An unbound session
+ *     silently yielding an empty grid reads to a human as "there is no data
+ *     here", which is how a broken session survives a week of QA.
+ *   - bound, but no membership → EMPTY SET, no error. A legitimate non-member
+ *     seeing nothing is not an error condition, and platform-default rows
+ *     reached through a sibling `OR` must still resolve.
+ */
+export const SESSION_TENANT_IDS_SQL = `CREATE OR REPLACE FUNCTION auth.session_tenant_ids() RETURNS SETOF uuid
+LANGUAGE plpgsql STABLE SECURITY DEFINER
+SET search_path = pg_catalog, public, pg_temp
+AS $session$
+DECLARE
+  v_user uuid;
+  v_tenant uuid;
+BEGIN
+  v_user := nullif(current_setting('app.user_id', true), '')::uuid;
+  v_tenant := nullif(current_setting('app.tenant_id', true), '')::uuid;
+  IF v_user IS NULL THEN
+    RAISE EXCEPTION 'db_rls_session_user_missing: app.user_id is not bound on this connection'
+      USING ERRCODE = '42501',
+            HINT = 'The authenticated pool is the user-session pool; a session with no principal cannot be membership-checked. Open it with withUserContext({ userId, tenantId }, fn) from @nodii/db-rls.';
+  END IF;
+  IF v_tenant IS NULL THEN
+    RAISE EXCEPTION 'db_rls_session_tenant_missing: app.tenant_id is not bound on this connection'
+      USING ERRCODE = '42501',
+            HINT = 'Every authenticated-pool session must be EXPLICITLY tenant-scoped. Open it with withUserContext({ userId, tenantId }, fn) from @nodii/db-rls.';
+  END IF;
+  RETURN QUERY SELECT v_tenant WHERE v_tenant IN (SELECT auth.user_tenant_ids(v_user));
+END
+$session$;
+`;
+/**
+ * Marker embedded in the DEGRADED body so `pg_proc.prosrc` introspection can
+ * tell the two variants apart. {@link verifyTenantFence} reports any database
+ * running the degraded resolver — the point is that a service is never on it by
+ * accident.
+ */
+export const SESSION_TENANT_IDS_DEGRADED_MARKER = "DB_RLS_DEGRADED_NO_MEMBERSHIP_MIRROR";
+/**
+ * DEGRADED variant of {@link SESSION_TENANT_IDS_SQL} — fence ONLY, no
+ * membership intersect.
+ *
+ * FOR SERVICES THAT SHIP NO MEMBERSHIP MIRROR, AND NOTHING ELSE. Such a service
+ * has `auth.user_tenant_ids` as the bootstrap stub (`SELECT NULL::uuid WHERE
+ * false`), so the strict resolver intersects to the empty set and the entire
+ * authenticated pool becomes silently deny-all — the P0 shape of drift
+ * 199feabc, where crm's 430 policies were dead and nobody noticed.
+ *
+ * THE LIST BELOW IS DERIVED FROM THE REPOS, NOT FROM MEMORY. An earlier
+ * revision of this comment asserted "nodii-crm-service alone", which was wrong
+ * by six services and wrong about crm's urgency. Several repos ship a phase-004
+ * or phase-005 `0002_create_rls_helpers.sql` whose real `user_tenant_ids` is
+ * FULLY COMMENTED OUT, so the phase-002 stub is still the winner:
+ *
+ *   STUB + a LIVE authenticated pool  → deny-all TODAY, needs this variant:
+ *     - nodii-billing-service   77 call sites; saga + dsar migrations run at
+ *                               BOOT (`src/lib/bootstrap.ts`), so its
+ *                               `saga_outbox` / `lifecycle_requests` /
+ *                               `data_residency_holds` are library-owned. The
+ *                               money path. Highest risk in the fleet.
+ *     - nodii-finance-service   14 call sites. Already self-mitigates via
+ *                               `010-lib-auth-pool-mode`, which rewrites the
+ *                               lib policies to `= auth.get_tenant_id()`.
+ *     - nodii-notification-service  3 call sites. Its own policies use
+ *                               `= auth.get_tenant_id()` and keep working, so
+ *                               only the library-owned tables go dark — which
+ *                               is exactly the shape nobody notices.
+ *
+ *   STUB + a pool that is built but has ZERO handler call sites → not broken
+ *   today, breaks the moment a handler uses it:
+ *     - nodii-crm-service, nodii-kyc-service, nodii-ticketing-service,
+ *       nodii-product-service
+ *
+ *   Does NOT need it: nodii-geo-service (no authenticated pool at all —
+ *   2-pool), nodii-edge (no `user_tenant_ids`, RLS mode `single`),
+ *   nodii-customer-service and nodii-vendor-service (already GUC-bodied),
+ *   nodii-auth / nodii-hr-service / nodii-task-tracking / nodii-tenant-service
+ *   (REAL membership helpers).
+ *
+ * WHAT YOU GIVE UP. The database stops verifying the principal. Isolation rests
+ * entirely on the application binding `app.tenant_id` correctly — RLS degrades
+ * from an independent second layer into "the app said so". A forged or simply
+ * mistaken tenant binding becomes access. That is a real reduction in
+ * defence-in-depth and it is why this is a separate, named, reported constant
+ * rather than a boolean flag on the strict one.
+ *
+ * THE EXIT. Land a membership mirror, point `auth.user_tenant_ids` at it, then
+ * apply {@link SESSION_TENANT_IDS_SQL} over this. No policy changes — the
+ * predicate at every call site is identical for both variants.
+ */
+export const SESSION_TENANT_IDS_DEGRADED_SQL = `CREATE OR REPLACE FUNCTION auth.session_tenant_ids() RETURNS SETOF uuid
+LANGUAGE plpgsql STABLE SECURITY DEFINER
+SET search_path = pg_catalog, public, pg_temp
+AS $session$
+DECLARE
+  v_tenant uuid;
+BEGIN
+  -- ${SESSION_TENANT_IDS_DEGRADED_MARKER}: no membership mirror in this service,
+  -- so the session tenant is accepted WITHOUT proving the principal holds it.
+  -- Replace with the strict resolver as soon as a mirror exists.
+  IF nullif(current_setting('app.user_id', true), '') IS NULL THEN
+    RAISE EXCEPTION 'db_rls_session_user_missing: app.user_id is not bound on this connection'
+      USING ERRCODE = '42501',
+            HINT = 'Open the session with withUserContext({ userId, tenantId }, fn) from @nodii/db-rls.';
+  END IF;
+  v_tenant := nullif(current_setting('app.tenant_id', true), '')::uuid;
+  IF v_tenant IS NULL THEN
+    RAISE EXCEPTION 'db_rls_session_tenant_missing: app.tenant_id is not bound on this connection'
+      USING ERRCODE = '42501',
+            HINT = 'Every authenticated-pool session must be EXPLICITLY tenant-scoped. Open it with withUserContext({ userId, tenantId }, fn) from @nodii/db-rls.';
+  END IF;
+  RETURN QUERY SELECT v_tenant;
+END
+$session$;
+`;
+/** Grant for the resolver. Separate from {@link AUTH_SCHEMA_GRANTS_SQL} for the
+ *  same reason: the roles must exist before the GRANT runs. */
+export const SESSION_TENANT_IDS_GRANTS_SQL = `GRANT EXECUTE ON FUNCTION auth.session_tenant_ids() TO nodii_services, authenticated;
+`;
+/**
+ * THE DELIVERY UNIT. One idempotent, re-runnable, SELF-CLASSIFYING statement
+ * that installs whichever resolver body this database can actually support.
+ *
+ * WHY IT SELF-CLASSIFIES RATHER THAN TAKING A FLAG.
+ *
+ * The strict and degraded bodies are not interchangeable, and picking the wrong
+ * one is silent in BOTH directions:
+ *
+ *   - strict on a service whose `auth.user_tenant_ids` is the bootstrap stub
+ *     (`SELECT NULL::uuid WHERE false`) intersects to the EMPTY SET, so every
+ *     authenticated policy denies every row. No error. Measured live on
+ *     `nodii-dev-postgres`: crm carries 507 authenticated policies, and a strict
+ *     install there takes ALL 507 dark, not just the 85 already dead.
+ *   - degraded on a service that HAS a real membership mirror silently drops
+ *     the principal check, which is the defence-in-depth this release exists to
+ *     add.
+ *
+ * A caller-supplied boolean makes that choice a thing somebody has to know. The
+ * library shipped exactly such a list in prose — and it was WRONG BY SIX
+ * SERVICES on the first pass and had to be re-derived from the repos. A list
+ * that was wrong once, maintained by hand, across fifteen repos, on a
+ * fail-silent switch, is not a control. It is a countdown.
+ *
+ * So the choice is made from what the database ACTUALLY CONTAINS, at the moment
+ * of install, by the same structural test `isStubMembershipHelper` applies in
+ * TypeScript: a membership helper that is absent, or whose body can never
+ * return a row, cannot support the intersect. Nobody has to know anything, and
+ * there is no list to get wrong.
+ *
+ * D415 (LOCKED) is the governing decision: a single-tenant-session service
+ * whose `user_tenant_ids` is absent, stubbed or uncalled MAY fence on the
+ * session tenant — isolation-equivalent, forfeiting no cross-tenant protection.
+ * The predicate at every call site is IDENTICAL for both bodies, which is what
+ * makes this substitutable at all.
+ *
+ * IT IS ALSO D415's SUNSET, AUTOMATED. D415's exit path is "land a membership
+ * mirror → repoint the helper → swap in the strict body". Because this block
+ * re-reads the catalog on EVERY run and is `CREATE OR REPLACE`, the swap
+ * happens by itself on the next boot after the mirror lands. Nobody files a
+ * follow-up ticket, because there is nothing to follow up.
+ *
+ * THE ONE-WAY RATCHET. The condition is "absent OR stub", so a real helper
+ * ALWAYS yields strict. This block can upgrade degraded → strict; it can never
+ * downgrade strict → degraded. That direction is the one that matters: it means
+ * this delivery path cannot overwrite a correctly-strict service, and cannot
+ * overwrite crm's deliberately-degraded body with a strict one either, because
+ * crm's helper is still the stub and will keep classifying as such until it
+ * genuinely isn't.
+ *
+ * Byte-identical across the TS / Go / Python ports (asserted by the parity
+ * test). The nested dollar-quote tags are all distinct — `$fence_install$`
+ * outer, `$fence_strict$` / `$fence_degraded$` for the EXECUTE literals,
+ * `$session$` inside the bodies — so the statement survives every dollar-quote
+ * -aware splitter in the fleet, including the ones in @nodii/saga and
+ * @nodii/dsar that split the mirrors' DDL on `;\n`.
+ */
+export const INSTALL_SESSION_RESOLVER_SQL = `CREATE SCHEMA IF NOT EXISTS auth;
+DO $fence_install$
+DECLARE
+  v_src text;
+  v_is_stub boolean;
+BEGIN
+  SELECT p.prosrc INTO v_src
+    FROM pg_proc p
+    JOIN pg_namespace n ON n.oid = p.pronamespace
+   WHERE n.nspname = 'auth' AND p.proname = 'user_tenant_ids'
+   LIMIT 1;
+
+  -- Structural, not an exact-string compare: the bootstrap stub is
+  -- \`SELECT NULL::uuid WHERE false\` — an unsatisfiable WHERE and no FROM. A
+  -- reformatted or re-indented copy of the same dead body still classifies as a
+  -- stub. Mirrors isStubMembershipHelper() in tenant-fence.ts exactly; the two
+  -- are asserted equivalent in the test-suite so a fix to one cannot leave the
+  -- other behind.
+  v_is_stub := v_src IS NULL
+               OR (v_src ~* 'where\\s+false' AND v_src !~* 'from\\s+\\w');
+
+  IF v_is_stub THEN
+    EXECUTE $fence_degraded$${SESSION_TENANT_IDS_DEGRADED_SQL.trimEnd()}$fence_degraded$;
+  ELSE
+    EXECUTE $fence_strict$${SESSION_TENANT_IDS_SQL.trimEnd()}$fence_strict$;
+  END IF;
+END
+$fence_install$;
 `;
 /**
  * Grants for the 7 helper functions. Emitted separately because they
@@ -84,8 +357,62 @@ export async function applyAuthSchemaMigrations(client, opts = {}) {
     // SqlExecutor`; cast to the minimal shape.
     const exec = client;
     await exec.query(AUTH_SCHEMA_SQL);
+    // The resolver is applied unconditionally alongside the seven. A database
+    // where the policies reference `auth.session_tenant_ids()` but the function is
+    // absent does not merely misbehave — Postgres validates the reference at
+    // CREATE POLICY time, so the migration itself fails with `function
+    // auth.session_tenant_ids() does not exist`. Installing both together makes
+    // that unreachable.
+    //
+    // WHICH BODY IS NOT A DECISION THIS FUNCTION MAKES. It is derived from the
+    // membership helper actually present in THIS database — see
+    // INSTALL_SESSION_RESOLVER_SQL. `degradedSessionResolver` remains as an
+    // explicit override for the one case derivation cannot cover: a service that
+    // has a real-looking helper but knows it is not yet populated. Passing it is
+    // a deliberate, argued act; the default is derivation, so a caller who knows
+    // nothing gets the right body.
+    await exec.query(opts.degradedSessionResolver
+        ? SESSION_TENANT_IDS_DEGRADED_SQL
+        : INSTALL_SESSION_RESOLVER_SQL);
+    // The gate ships with the resolver, always. See sessionFenceBootstrapSql.
+    await exec.query(TENANT_FENCE_GATE_SQL);
     if (includeGrants) {
         await exec.query(AUTH_SCHEMA_GRANTS_SQL);
+        await exec.query(SESSION_TENANT_IDS_GRANTS_SQL);
+        await exec.query(TENANT_FENCE_GATE_GRANTS_SQL);
+    }
+}
+/**
+ * THE WHOLE DELIVERY UNIT AS ONE STRING — resolver + gate, self-classifying,
+ * idempotent, re-runnable, and safe to apply on every boot.
+ *
+ * This is what the three mirrors inline byte-equal, what the CLI applies, and
+ * what a service with no other delivery path should call directly from its boot
+ * sequence, BEFORE any code that opens an authenticated transaction:
+ *
+ *     import { applySessionFenceBootstrap } from "@nodii/db-rls";
+ *     await applySessionFenceBootstrap(ownerSql);
+ *
+ * Grants are separate (as everywhere else in this package) because the runtime
+ * roles must exist before a GRANT naming them can run, and on a fresh database
+ * they do not yet.
+ */
+export const SESSION_FENCE_BOOTSTRAP_SQL = sessionFenceBootstrapSql(INSTALL_SESSION_RESOLVER_SQL);
+/**
+ * Apply {@link SESSION_FENCE_BOOTSTRAP_SQL} against an owner-privileged client.
+ *
+ * Idempotent and safe on every boot: the resolver and gate are
+ * `CREATE OR REPLACE`, the schema is `IF NOT EXISTS`, and the body selection
+ * re-derives from the catalog each run — so a service that lands a membership
+ * mirror upgrades itself from the degraded body to the strict one on its next
+ * restart, with no migration and no policy change (D415's exit path).
+ */
+export async function applySessionFenceBootstrap(client, opts = {}) {
+    const exec = client;
+    await exec.query(SESSION_FENCE_BOOTSTRAP_SQL);
+    if (opts.includeGrants ?? false) {
+        await exec.query(SESSION_TENANT_IDS_GRANTS_SQL);
+        await exec.query(TENANT_FENCE_GATE_GRANTS_SQL);
     }
 }
 /**

package/dist/auth-schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-schema.js","sourceRoot":"","sources":["../src/auth-schema.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,EAAE;AACF,oEAAoE;AACpE,qEAAqE;AACrE,2BAA2B;AAC3B,EAAE;AACF,mEAAmE;AACnE,qBAAqB;AACrB,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,qEAAqE;AACrE,4FAA4F;AAC5F,8DAA8D;AAC9D,8DAA8D;AAC9D,0EAA0E;AAC1E,EAAE;AACF,yEAAyE;AACzE,uEAAuE;AACvE,0EAA0E;AAC1E,oEAAoE;AAIpE;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2B9B,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;;;;;;;;CAQrC,CAAC;AAYF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,MAAmB,EACnB,OAAoC,EAAE;IAEtC,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC;IACjD,wEAAwE;IACxE,2CAA2C;IAC3C,MAAM,IAAI,GAAG,MAAqB,CAAC;IACnC,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAClC,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAoC,EAAE;IAEtC,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC;IACjD,OAAO,aAAa;QAClB,CAAC,CAAC,GAAG,eAAe,KAAK,sBAAsB,EAAE;QACjD,CAAC,CAAC,eAAe,CAAC;AACtB,CAAC"}
+{"version":3,"file":"auth-schema.js","sourceRoot":"","sources":["../src/auth-schema.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,EAAE;AACF,oEAAoE;AACpE,qEAAqE;AACrE,2BAA2B;AAC3B,EAAE;AACF,mEAAmE;AACnE,qBAAqB;AACrB,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,qEAAqE;AACrE,4FAA4F;AAC5F,8DAA8D;AAC9D,8DAA8D;AAC9D,0EAA0E;AAC1E,EAAE;AACF,yEAAyE;AACzE,uEAAuE;AACvE,0EAA0E;AAC1E,oEAAoE;AAGpE,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAEhC;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8C9B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;;;;;;;;;;;;;;;;;;;;;;;CAuBrC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAC7C,sCAAsC,CAAC;AAEzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG;;;;;;;OAOxC,kCAAkC;;;;;;;;;;;;;;;;;CAiBxC,CAAC;AAEF;+DAC+D;AAC/D,MAAM,CAAC,MAAM,6BAA6B,GAAG;CAC5C,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG;;;;;;;;;;;;;;;;;;;;;;8BAsBd,+BAA+B,CAAC,OAAO,EAAE;;4BAE3C,sBAAsB,CAAC,OAAO,EAAE;;;;CAI3D,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;;;;;;;;CAQrC,CAAC;AAYF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,MAAmB,EACnB,OAAuE,EAAE;IAEzE,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC;IACjD,wEAAwE;IACxE,2CAA2C;IAC3C,MAAM,IAAI,GAAG,MAAqB,CAAC;IACnC,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAClC,0EAA0E;IAC1E,+EAA+E;IAC/E,yEAAyE;IACzE,mEAAmE;IACnE,4EAA4E;IAC5E,oBAAoB;IACpB,EAAE;IACF,2EAA2E;IAC3E,4DAA4D;IAC5D,wEAAwE;IACxE,6EAA6E;IAC7E,6EAA6E;IAC7E,6EAA6E;IAC7E,+BAA+B;IAC/B,MAAM,IAAI,CAAC,KAAK,CACd,IAAI,CAAC,uBAAuB;QAC1B,CAAC,CAAC,+BAA+B;QACjC,CAAC,CAAC,4BAA4B,CACjC,CAAC;IACF,0EAA0E;IAC1E,MAAM,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACxC,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACzC,MAAM,IAAI,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAChD,MAAM,IAAI,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAW,wBAAwB,CACzE,4BAA4B,CAC7B,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAAmB,EACnB,OAAoC,EAAE;IAEtC,MAAM,IAAI,GAAG,MAAqB,CAAC;IACnC,MAAM,IAAI,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC9C,IAAI,IAAI,CAAC,aAAa,IAAI,KAAK,EAAE,CAAC;QAChC,MAAM,IAAI,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAChD,MAAM,IAAI,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAoC,EAAE;IAEtC,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC;IACjD,OAAO,aAAa;QAClB,CAAC,CAAC,GAAG,eAAe,KAAK,sBAAsB,EAAE;QACjD,CAAC,CAAC,eAAe,CAAC;AACtB,CAAC"}