@objectstack/core 16.0.0 → 16.1.0

package/dist/index.d.cts

@@ -1781,6 +1781,56 @@ interface ResolveAuthzInput {
  * never throws. Anonymous requests yield `{ positions: [], permissions: [], ... }`.
  */
 declare function resolveAuthzContext(input: ResolveAuthzInput): Promise<ResolvedAuthzContext>;
+/** The authorization grants a KNOWN user holds — a subset of {@link ResolvedAuthzContext}. */
+interface UserAuthzGrants {
+    positions: string[];
+    permissions: string[];
+    systemPermissions: string[];
+    /** Fellow-org user IDs for RLS scoping of identity tables (`id IN (...)`). */
+    org_user_ids: string[];
+    tabPermissions?: Record<string, 'visible' | 'hidden' | 'default_on' | 'default_off'>;
+    posture?: AuthzPosture;
+    /** The user's unique email (`sys_user`), for `current_user.email` owner RLS. */
+    email?: string;
+}
+interface ResolveUserAuthzGrantsOptions {
+    /** Active org/tenant id — scopes org-bound grants (a null-org row is global). */
+    tenantId?: string;
+    /** Clock injection for grant validity windows (tests). */
+    nowMs?: number;
+    /**
+     * Permission names the CALLER already resolved (e.g. API-key scopes) to seed
+     * `permissions` BEFORE permission-set names are appended, so a mixed
+     * API-key+session principal keeps every scope and the ordering is preserved.
+     * Copied, never mutated.
+     */
+    seedPermissions?: string[];
+    /** A caller-supplied email (e.g. from the session) that wins over the `sys_user` read. */
+    seedEmail?: string;
+}
+/**
+ * resolveUserAuthzGrants — the userId-driven core of {@link resolveAuthzContext}.
+ *
+ * Given a KNOWN user id, aggregate the authorization grants that user holds:
+ * org-admin positions (`sys_member`), platform-RBAC positions
+ * (`sys_user_position`), user- and position-bound permission sets
+ * (`sys_user_permission_set` / `sys_position_permission_set` →
+ * `sys_permission_set`), the derived `platform_admin` built-in + posture rung,
+ * fellow-org peers for identity-table RLS, and the env-side `ai_seat`.
+ *
+ * Factored out of `resolveAuthzContext` so a surface that already knows WHO the
+ * principal is — with no HTTP request to resolve it from — can build the SAME
+ * envelope through the ONE resolver, instead of re-reading `sys_member` /
+ * `sys_user_position` / `sys_*_permission_set` itself. The motivating consumer
+ * is a `runAs:'user'` automation run resolving the triggering user's grants
+ * (#3356): the record-change hook session carries only a `userId`, so the
+ * automation engine calls this to run the flow's data ops exactly as that user
+ * — not the bare member/everyone fallback the missing grants used to leave it.
+ *
+ * Fail-closed like its parent: every read is defensive, a missing engine/table
+ * yields an empty-but-valid envelope, and it never throws.
+ */
+declare function resolveUserAuthzGrants(ql: any, userId: string, opts?: ResolveUserAuthzGrantsOptions): Promise<UserAuthzGrants>;
 interface ResolveLocalizationInput {
     ql: any;
     /** Settings service exposing `get(namespace, key, { tenantId, userId })`. */
@@ -2637,4 +2687,4 @@ declare class NamespaceResolver {
     private suggestAlternative;
 }
 
-export { ANONYMOUS_DENY_BODY, ANONYMOUS_DENY_CODE, ANONYMOUS_DENY_MESSAGE, ANONYMOUS_DENY_STATUS, API_KEY_PREFIX, type AnonymousDenyInput, type ApiKeyPrincipal, ApiRegistry, type ApiRegistryPluginConfig, type AuthGate, type BucketGranularity, type BulkWriteOptions, type BulkWriteRowResult, CORE_FALLBACK_FACTORIES, type CalendarParts, DependencyResolver, type GeneratedApiKey, type GrantValidityWindow, HotReloadManager, type KernelState, type KeyInput, type LadderPrincipal, type LadderRow, LiteKernel, type NamespaceCheckResult, type NamespaceConflict, type NamespaceEntry, NamespaceResolver, ObjectKernel, ObjectKernelBase, type ObjectKernelConfig, ObjectLogger, POSTURE_INJECTION_RULE, POSTURE_LADDER, POSTURE_RANK, type ParsedSignature, type PermissionCheckResult$1 as PermissionCheckResult, type PermissionGrant, type Plugin, type PluginArtifactVerifyResult, PluginConfigValidator, type PluginContext, PluginHealthMonitor, type PluginHealthStatus, type PluginLoadResult, PluginLoader, type PluginMetadata, type PermissionCheckResult as PluginPermissionCheckResult, PluginPermissionEnforcer, PluginPermissionManager, type PluginPermissions, PluginSandboxRuntime, PluginSecurityScanner, type PluginSignatureConfig, PluginSignatureVerifier, type PluginStartupResult, type PostureEvidence, type PublisherVerifyResult, index as QA, type ResolveAuthzInput, type ResolveLocalizationInput, type ResolvedAuthzContext, type ResourceUsage, type RetryOptions, SIGNATURE_ALG, type SandboxContext, type ScanTarget, SecurePluginContext, type SecurityIssue, SemanticVersionManager, type ServiceFactory, ServiceLifecycle, type ServiceRegistration, type SignatureVerificationResult, type VersionCompatibility, bucketKeyToCalendarRange, buildPermissionsFromGrants, bulkWrite, calendarPartsInTz, calendarPartsInTzOrUtc, counterSignPayload, createApiRegistryPlugin, createMemoryCache, createMemoryI18n, createMemoryJob, createMemoryMetadata, createMemoryQueue, createPluginConfigValidator, createPluginPermissionEnforcer, deepMerge, defaultIsTransientError, derivePosture, evaluateAuthGate, extractApiKey, generateApiKey, generateEd25519KeyPair, getEnv, getMemoryUsage, hashApiKey, isAuthGateAllowlisted, isExpired, isGrantActive, isGrantExpired, isNode, parseScopes, parseSignature, postureVisibleRows, readAuthoredTranslationLayer, resolveApiKeyPrincipal, resolveAuthzContext, resolveLocale, resolveLocalizationContext, safeExit, shouldDenyAnonymous, signPayload, verifyPayload, verifyPlatformSignature, verifyPluginArtifact, verifyPublisherSignature, wireAuthoredTranslationSync, withTransientRetry, zonedDateStartToUtcMs };
+export { ANONYMOUS_DENY_BODY, ANONYMOUS_DENY_CODE, ANONYMOUS_DENY_MESSAGE, ANONYMOUS_DENY_STATUS, API_KEY_PREFIX, type AnonymousDenyInput, type ApiKeyPrincipal, ApiRegistry, type ApiRegistryPluginConfig, type AuthGate, type BucketGranularity, type BulkWriteOptions, type BulkWriteRowResult, CORE_FALLBACK_FACTORIES, type CalendarParts, DependencyResolver, type GeneratedApiKey, type GrantValidityWindow, HotReloadManager, type KernelState, type KeyInput, type LadderPrincipal, type LadderRow, LiteKernel, type NamespaceCheckResult, type NamespaceConflict, type NamespaceEntry, NamespaceResolver, ObjectKernel, ObjectKernelBase, type ObjectKernelConfig, ObjectLogger, POSTURE_INJECTION_RULE, POSTURE_LADDER, POSTURE_RANK, type ParsedSignature, type PermissionCheckResult$1 as PermissionCheckResult, type PermissionGrant, type Plugin, type PluginArtifactVerifyResult, PluginConfigValidator, type PluginContext, PluginHealthMonitor, type PluginHealthStatus, type PluginLoadResult, PluginLoader, type PluginMetadata, type PermissionCheckResult as PluginPermissionCheckResult, PluginPermissionEnforcer, PluginPermissionManager, type PluginPermissions, PluginSandboxRuntime, PluginSecurityScanner, type PluginSignatureConfig, PluginSignatureVerifier, type PluginStartupResult, type PostureEvidence, type PublisherVerifyResult, index as QA, type ResolveAuthzInput, type ResolveLocalizationInput, type ResolveUserAuthzGrantsOptions, type ResolvedAuthzContext, type ResourceUsage, type RetryOptions, SIGNATURE_ALG, type SandboxContext, type ScanTarget, SecurePluginContext, type SecurityIssue, SemanticVersionManager, type ServiceFactory, ServiceLifecycle, type ServiceRegistration, type SignatureVerificationResult, type UserAuthzGrants, type VersionCompatibility, bucketKeyToCalendarRange, buildPermissionsFromGrants, bulkWrite, calendarPartsInTz, calendarPartsInTzOrUtc, counterSignPayload, createApiRegistryPlugin, createMemoryCache, createMemoryI18n, createMemoryJob, createMemoryMetadata, createMemoryQueue, createPluginConfigValidator, createPluginPermissionEnforcer, deepMerge, defaultIsTransientError, derivePosture, evaluateAuthGate, extractApiKey, generateApiKey, generateEd25519KeyPair, getEnv, getMemoryUsage, hashApiKey, isAuthGateAllowlisted, isExpired, isGrantActive, isGrantExpired, isNode, parseScopes, parseSignature, postureVisibleRows, readAuthoredTranslationLayer, resolveApiKeyPrincipal, resolveAuthzContext, resolveLocale, resolveLocalizationContext, resolveUserAuthzGrants, safeExit, shouldDenyAnonymous, signPayload, verifyPayload, verifyPlatformSignature, verifyPluginArtifact, verifyPublisherSignature, wireAuthoredTranslationSync, withTransientRetry, zonedDateStartToUtcMs };

package/dist/index.d.ts

@@ -1781,6 +1781,56 @@ interface ResolveAuthzInput {
  * never throws. Anonymous requests yield `{ positions: [], permissions: [], ... }`.
  */
 declare function resolveAuthzContext(input: ResolveAuthzInput): Promise<ResolvedAuthzContext>;
+/** The authorization grants a KNOWN user holds — a subset of {@link ResolvedAuthzContext}. */
+interface UserAuthzGrants {
+    positions: string[];
+    permissions: string[];
+    systemPermissions: string[];
+    /** Fellow-org user IDs for RLS scoping of identity tables (`id IN (...)`). */
+    org_user_ids: string[];
+    tabPermissions?: Record<string, 'visible' | 'hidden' | 'default_on' | 'default_off'>;
+    posture?: AuthzPosture;
+    /** The user's unique email (`sys_user`), for `current_user.email` owner RLS. */
+    email?: string;
+}
+interface ResolveUserAuthzGrantsOptions {
+    /** Active org/tenant id — scopes org-bound grants (a null-org row is global). */
+    tenantId?: string;
+    /** Clock injection for grant validity windows (tests). */
+    nowMs?: number;
+    /**
+     * Permission names the CALLER already resolved (e.g. API-key scopes) to seed
+     * `permissions` BEFORE permission-set names are appended, so a mixed
+     * API-key+session principal keeps every scope and the ordering is preserved.
+     * Copied, never mutated.
+     */
+    seedPermissions?: string[];
+    /** A caller-supplied email (e.g. from the session) that wins over the `sys_user` read. */
+    seedEmail?: string;
+}
+/**
+ * resolveUserAuthzGrants — the userId-driven core of {@link resolveAuthzContext}.
+ *
+ * Given a KNOWN user id, aggregate the authorization grants that user holds:
+ * org-admin positions (`sys_member`), platform-RBAC positions
+ * (`sys_user_position`), user- and position-bound permission sets
+ * (`sys_user_permission_set` / `sys_position_permission_set` →
+ * `sys_permission_set`), the derived `platform_admin` built-in + posture rung,
+ * fellow-org peers for identity-table RLS, and the env-side `ai_seat`.
+ *
+ * Factored out of `resolveAuthzContext` so a surface that already knows WHO the
+ * principal is — with no HTTP request to resolve it from — can build the SAME
+ * envelope through the ONE resolver, instead of re-reading `sys_member` /
+ * `sys_user_position` / `sys_*_permission_set` itself. The motivating consumer
+ * is a `runAs:'user'` automation run resolving the triggering user's grants
+ * (#3356): the record-change hook session carries only a `userId`, so the
+ * automation engine calls this to run the flow's data ops exactly as that user
+ * — not the bare member/everyone fallback the missing grants used to leave it.
+ *
+ * Fail-closed like its parent: every read is defensive, a missing engine/table
+ * yields an empty-but-valid envelope, and it never throws.
+ */
+declare function resolveUserAuthzGrants(ql: any, userId: string, opts?: ResolveUserAuthzGrantsOptions): Promise<UserAuthzGrants>;
 interface ResolveLocalizationInput {
     ql: any;
     /** Settings service exposing `get(namespace, key, { tenantId, userId })`. */
@@ -2637,4 +2687,4 @@ declare class NamespaceResolver {
     private suggestAlternative;
 }
 
-export { ANONYMOUS_DENY_BODY, ANONYMOUS_DENY_CODE, ANONYMOUS_DENY_MESSAGE, ANONYMOUS_DENY_STATUS, API_KEY_PREFIX, type AnonymousDenyInput, type ApiKeyPrincipal, ApiRegistry, type ApiRegistryPluginConfig, type AuthGate, type BucketGranularity, type BulkWriteOptions, type BulkWriteRowResult, CORE_FALLBACK_FACTORIES, type CalendarParts, DependencyResolver, type GeneratedApiKey, type GrantValidityWindow, HotReloadManager, type KernelState, type KeyInput, type LadderPrincipal, type LadderRow, LiteKernel, type NamespaceCheckResult, type NamespaceConflict, type NamespaceEntry, NamespaceResolver, ObjectKernel, ObjectKernelBase, type ObjectKernelConfig, ObjectLogger, POSTURE_INJECTION_RULE, POSTURE_LADDER, POSTURE_RANK, type ParsedSignature, type PermissionCheckResult$1 as PermissionCheckResult, type PermissionGrant, type Plugin, type PluginArtifactVerifyResult, PluginConfigValidator, type PluginContext, PluginHealthMonitor, type PluginHealthStatus, type PluginLoadResult, PluginLoader, type PluginMetadata, type PermissionCheckResult as PluginPermissionCheckResult, PluginPermissionEnforcer, PluginPermissionManager, type PluginPermissions, PluginSandboxRuntime, PluginSecurityScanner, type PluginSignatureConfig, PluginSignatureVerifier, type PluginStartupResult, type PostureEvidence, type PublisherVerifyResult, index as QA, type ResolveAuthzInput, type ResolveLocalizationInput, type ResolvedAuthzContext, type ResourceUsage, type RetryOptions, SIGNATURE_ALG, type SandboxContext, type ScanTarget, SecurePluginContext, type SecurityIssue, SemanticVersionManager, type ServiceFactory, ServiceLifecycle, type ServiceRegistration, type SignatureVerificationResult, type VersionCompatibility, bucketKeyToCalendarRange, buildPermissionsFromGrants, bulkWrite, calendarPartsInTz, calendarPartsInTzOrUtc, counterSignPayload, createApiRegistryPlugin, createMemoryCache, createMemoryI18n, createMemoryJob, createMemoryMetadata, createMemoryQueue, createPluginConfigValidator, createPluginPermissionEnforcer, deepMerge, defaultIsTransientError, derivePosture, evaluateAuthGate, extractApiKey, generateApiKey, generateEd25519KeyPair, getEnv, getMemoryUsage, hashApiKey, isAuthGateAllowlisted, isExpired, isGrantActive, isGrantExpired, isNode, parseScopes, parseSignature, postureVisibleRows, readAuthoredTranslationLayer, resolveApiKeyPrincipal, resolveAuthzContext, resolveLocale, resolveLocalizationContext, safeExit, shouldDenyAnonymous, signPayload, verifyPayload, verifyPlatformSignature, verifyPluginArtifact, verifyPublisherSignature, wireAuthoredTranslationSync, withTransientRetry, zonedDateStartToUtcMs };
+export { ANONYMOUS_DENY_BODY, ANONYMOUS_DENY_CODE, ANONYMOUS_DENY_MESSAGE, ANONYMOUS_DENY_STATUS, API_KEY_PREFIX, type AnonymousDenyInput, type ApiKeyPrincipal, ApiRegistry, type ApiRegistryPluginConfig, type AuthGate, type BucketGranularity, type BulkWriteOptions, type BulkWriteRowResult, CORE_FALLBACK_FACTORIES, type CalendarParts, DependencyResolver, type GeneratedApiKey, type GrantValidityWindow, HotReloadManager, type KernelState, type KeyInput, type LadderPrincipal, type LadderRow, LiteKernel, type NamespaceCheckResult, type NamespaceConflict, type NamespaceEntry, NamespaceResolver, ObjectKernel, ObjectKernelBase, type ObjectKernelConfig, ObjectLogger, POSTURE_INJECTION_RULE, POSTURE_LADDER, POSTURE_RANK, type ParsedSignature, type PermissionCheckResult$1 as PermissionCheckResult, type PermissionGrant, type Plugin, type PluginArtifactVerifyResult, PluginConfigValidator, type PluginContext, PluginHealthMonitor, type PluginHealthStatus, type PluginLoadResult, PluginLoader, type PluginMetadata, type PermissionCheckResult as PluginPermissionCheckResult, PluginPermissionEnforcer, PluginPermissionManager, type PluginPermissions, PluginSandboxRuntime, PluginSecurityScanner, type PluginSignatureConfig, PluginSignatureVerifier, type PluginStartupResult, type PostureEvidence, type PublisherVerifyResult, index as QA, type ResolveAuthzInput, type ResolveLocalizationInput, type ResolveUserAuthzGrantsOptions, type ResolvedAuthzContext, type ResourceUsage, type RetryOptions, SIGNATURE_ALG, type SandboxContext, type ScanTarget, SecurePluginContext, type SecurityIssue, SemanticVersionManager, type ServiceFactory, ServiceLifecycle, type ServiceRegistration, type SignatureVerificationResult, type UserAuthzGrants, type VersionCompatibility, bucketKeyToCalendarRange, buildPermissionsFromGrants, bulkWrite, calendarPartsInTz, calendarPartsInTzOrUtc, counterSignPayload, createApiRegistryPlugin, createMemoryCache, createMemoryI18n, createMemoryJob, createMemoryMetadata, createMemoryQueue, createPluginConfigValidator, createPluginPermissionEnforcer, deepMerge, defaultIsTransientError, derivePosture, evaluateAuthGate, extractApiKey, generateApiKey, generateEd25519KeyPair, getEnv, getMemoryUsage, hashApiKey, isAuthGateAllowlisted, isExpired, isGrantActive, isGrantExpired, isNode, parseScopes, parseSignature, postureVisibleRows, readAuthoredTranslationLayer, resolveApiKeyPrincipal, resolveAuthzContext, resolveLocale, resolveLocalizationContext, resolveUserAuthzGrants, safeExit, shouldDenyAnonymous, signPayload, verifyPayload, verifyPlatformSignature, verifyPluginArtifact, verifyPublisherSignature, wireAuthoredTranslationSync, withTransientRetry, zonedDateStartToUtcMs };

package/dist/index.js

@@ -4346,6 +4346,31 @@ async function resolveAuthzContext(input) {
   ctx.userId = userId;
   if (tenantId) ctx.tenantId = tenantId;
   if (!ql || typeof ql.find !== "function") return ctx;
+  const grants = await resolveUserAuthzGrants(ql, userId, {
+    tenantId,
+    nowMs: input.nowMs,
+    seedPermissions: ctx.permissions,
+    seedEmail: ctx.email
+  });
+  ctx.positions = grants.positions;
+  ctx.permissions = grants.permissions;
+  ctx.systemPermissions = grants.systemPermissions;
+  ctx.org_user_ids = grants.org_user_ids;
+  if (grants.tabPermissions) ctx.tabPermissions = grants.tabPermissions;
+  if (grants.posture) ctx.posture = grants.posture;
+  if (grants.email && !ctx.email) ctx.email = grants.email;
+  return ctx;
+}
+async function resolveUserAuthzGrants(ql, userId, opts = {}) {
+  const { tenantId } = opts;
+  const grants = {
+    positions: [],
+    permissions: Array.isArray(opts.seedPermissions) ? [...opts.seedPermissions] : [],
+    systemPermissions: [],
+    org_user_ids: [userId]
+  };
+  if (opts.seedEmail) grants.email = opts.seedEmail;
+  if (!ql || typeof ql.find !== "function") return grants;
   let userRowLoaded = false;
   let userRow;
   const getUserRow = async () => {
@@ -4356,9 +4381,9 @@ async function resolveAuthzContext(input) {
     }
     return userRow;
   };
-  if (!ctx.email) {
+  if (!grants.email) {
     const u = await getUserRow();
-    if (u?.email) ctx.email = String(u.email);
+    if (u?.email) grants.email = String(u.email);
   }
   const memberWhere = tenantId ? { user_id: userId, organization_id: tenantId } : { user_id: userId };
   const members = await tryFind(ql, "sys_member", memberWhere, 50);
@@ -4366,18 +4391,18 @@ async function resolveAuthzContext(input) {
     if (m.role && typeof m.role === "string") {
       for (const raw of m.role.split(",").map((s) => s.trim()).filter(Boolean)) {
         const r = mapMembershipRole(raw);
-        if (!ctx.positions.includes(r)) ctx.positions.push(r);
+        if (!grants.positions.includes(r)) grants.positions.push(r);
       }
     }
   }
-  const nowMs = input.nowMs ?? Date.now();
+  const nowMs = opts.nowMs ?? Date.now();
   const userPositionRows = await tryFind(ql, "sys_user_position", { user_id: userId }, 200);
   for (const ur of userPositionRows) {
     const org = ur.organization_id ?? null;
     if (org && tenantId && org !== tenantId) continue;
     if (!isGrantActive(ur, nowMs)) continue;
     const r = ur.position;
-    if (typeof r === "string" && r && !ctx.positions.includes(r)) ctx.positions.push(r);
+    if (typeof r === "string" && r && !grants.positions.includes(r)) grants.positions.push(r);
   }
   if (tenantId) {
     const orgMembers = await tryFind(ql, "sys_member", { organization_id: tenantId }, 1e3);
@@ -4385,9 +4410,7 @@ async function resolveAuthzContext(input) {
       orgMembers.map((m) => m.user_id ?? m.userId).filter((v) => typeof v === "string" && v.length > 0)
     );
     ids.add(userId);
-    ctx.org_user_ids = Array.from(ids);
-  } else {
-    ctx.org_user_ids = [userId];
+    grants.org_user_ids = Array.from(ids);
   }
   const upsRowsAll = await tryFind(ql, "sys_user_permission_set", { user_id: userId }, 100);
   const upsRows = upsRowsAll.filter((r) => isGrantActive(r, nowMs));
@@ -4401,9 +4424,9 @@ async function resolveAuthzContext(input) {
     upsRows.filter((r) => (r.organization_id ?? r.organizationId ?? null) === null).map((r) => r.permission_set_id ?? r.permissionSetId).filter(Boolean)
   );
   let hasPlatformAdminGrant = false;
-  if (!ctx.positions.includes("everyone")) ctx.positions.push("everyone");
-  if (ctx.positions.length > 0) {
-    const positionRows = await tryFind(ql, "sys_position", { name: { $in: ctx.positions } }, 100);
+  if (!grants.positions.includes("everyone")) grants.positions.push("everyone");
+  if (grants.positions.length > 0) {
+    const positionRows = await tryFind(ql, "sys_position", { name: { $in: grants.positions } }, 100);
     const positionIds = positionRows.map((r) => r.id).filter(Boolean);
     if (positionIds.length > 0) {
       const rpsRows = await tryFind(ql, "sys_position_permission_set", { position_id: { $in: positionIds } }, 500);
@@ -4418,12 +4441,12 @@ async function resolveAuthzContext(input) {
     const tabRank = { hidden: 0, default_off: 1, default_on: 2, visible: 3 };
     const mergedTabs = {};
     for (const ps of psRows) {
-      if (ps.name && !ctx.permissions.includes(ps.name)) ctx.permissions.push(ps.name);
+      if (ps.name && !grants.permissions.includes(ps.name)) grants.permissions.push(ps.name);
       if (ps.name === ADMIN_FULL_ACCESS && unscopedUserPsIds.has(ps.id)) hasPlatformAdminGrant = true;
       const sysPerms = typeof ps.system_permissions === "string" ? safeJsonParse2(ps.system_permissions, []) : ps.system_permissions ?? ps.systemPermissions;
       if (Array.isArray(sysPerms)) {
         for (const p of sysPerms) {
-          if (typeof p === "string" && !ctx.systemPermissions.includes(p)) ctx.systemPermissions.push(p);
+          if (typeof p === "string" && !grants.systemPermissions.includes(p)) grants.systemPermissions.push(p);
         }
       }
       const tabs = typeof ps.tab_permissions === "string" ? safeJsonParse2(ps.tab_permissions, {}) : ps.tab_permissions ?? ps.tabPermissions;
@@ -4437,20 +4460,20 @@ async function resolveAuthzContext(input) {
         }
       }
     }
-    if (Object.keys(mergedTabs).length > 0) ctx.tabPermissions = mergedTabs;
+    if (Object.keys(mergedTabs).length > 0) grants.tabPermissions = mergedTabs;
   }
-  if (hasPlatformAdminGrant && !ctx.positions.includes(BUILTIN_IDENTITY_PLATFORM_ADMIN)) {
-    ctx.positions.unshift(BUILTIN_IDENTITY_PLATFORM_ADMIN);
+  if (hasPlatformAdminGrant && !grants.positions.includes(BUILTIN_IDENTITY_PLATFORM_ADMIN)) {
+    grants.positions.unshift(BUILTIN_IDENTITY_PLATFORM_ADMIN);
   }
-  ctx.posture = derivePosture({
+  grants.posture = derivePosture({
     isPlatformAdmin: hasPlatformAdminGrant,
-    isTenantAdmin: ctx.permissions.includes(ORGANIZATION_ADMIN)
+    isTenantAdmin: grants.permissions.includes(ORGANIZATION_ADMIN)
   });
-  if (!ctx.permissions.includes("ai_seat")) {
+  if (!grants.permissions.includes("ai_seat")) {
     const aiAccess = (await getUserRow())?.ai_access;
-    if (aiAccess === true || aiAccess === 1 || aiAccess === "1") ctx.permissions.push("ai_seat");
+    if (aiAccess === true || aiAccess === 1 || aiAccess === "1") grants.permissions.push("ai_seat");
   }
-  return ctx;
+  return grants;
 }
 function isValidTimeZone(tz) {
   try {
@@ -5774,6 +5797,7 @@ export {
   resolveAuthzContext,
   resolveLocale,
   resolveLocalizationContext,
+  resolveUserAuthzGrants,
   safeExit,
   shouldDenyAnonymous,
   signPayload,