@oimlsmart/platform-server 0.2.8 → 0.2.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oimlsmart/platform-server",
-  "version": "0.2.8",
+  "version": "0.2.10",
   "description": "The OIML SMART platform server kernel: the store seam (ServerStore + the D1 and SQLite implementations), the canonical D1 migration set both deployments apply, the instance profile, the mailer, the RBAC map, the OIDC/OAuth client cones, and the shared role/permission vocabulary. Consumed by the smart monorepo (browser/) and the identity service.",
   "type": "module",
   "repository": {

package/src/store/d1.ts

@@ -1456,6 +1456,16 @@ export class D1ServerStore implements ServerStore {
     return (res.meta.changes ?? 0) > 0
   }
 
+  /** The governance view's population read: the client's LIVE access-token
+   *  count (unexpired — the row's absence IS the revocation). */
+  async countOidcAccessTokensForClient(clientId: string): Promise<number> {
+    await this.ensureMembershipSupport()
+    const row = await this.stmt(
+      "SELECT COUNT(*) AS n FROM oidc_access_tokens WHERE client_id = ? AND datetime(expires_at) > datetime('now')", clientId,
+    ).first<{ n: number }>()
+    return row?.n ?? 0
+  }
+
   private static toRefreshToken(row: Record<string, unknown>): OidcRefreshToken {
     return {
       token: row.token as string,
@@ -1546,6 +1556,18 @@ export class D1ServerStore implements ServerStore {
     return res.meta.changes ?? 0
   }
 
+  /** The governance view's population read: the client's LIVE refresh-token
+   *  count (unconsumed AND unexpired — a revoked family is deleted
+   *  wholesale, so a live row's presence is the offline grant's standing). */
+  async countOidcRefreshTokensForClient(clientId: string): Promise<number> {
+    await this.ensureMembershipSupport()
+    await this.ensureOidcRefreshTokenSupport()
+    const row = await this.stmt(
+      "SELECT COUNT(*) AS n FROM oidc_refresh_tokens WHERE client_id = ? AND consumed_at IS NULL AND datetime(expires_at) > datetime('now')", clientId,
+    ).first<{ n: number }>()
+    return row?.n ?? 0
+  }
+
   async listOidcKeys(): Promise<OidcKeyRow[]> {
     const res = await this.stmt('SELECT * FROM oidc_keys ORDER BY created_at, kid').all<Record<string, unknown>>()
     return res.results.map(row => ({
@@ -1639,6 +1661,17 @@ export class D1ServerStore implements ServerStore {
     return (res.meta.changes ?? 0) > 0
   }
 
+  /** The client-registry governance view's per-client read: EVERY grant row
+   *  the client holds — live AND revoked, newest first. */
+  async listOidcConsentGrantsForClient(clientId: string): Promise<OidcConsentGrant[]> {
+    await this.ensureConsentGrantSupport()
+    const res = await this.stmt(
+      'SELECT * FROM oidc_consent_grants WHERE client_id = ? ORDER BY created_at DESC, rowid DESC',
+      clientId,
+    ).all<Record<string, unknown>>()
+    return res.results.map(D1ServerStore.toConsentGrant)
+  }
+
   // ── the upstream providers (TODO.identity/08) ─────────────────────
   // The provider + link rows port directly (D1 is SQLite).
 

package/src/store/sqlite/consent-grants-store.ts

@@ -77,6 +77,15 @@ export function listConsentGrants(userId: string): OidcConsentGrant[] {
   return rows.map(toConsentGrant)
 }
 
+/** The client-registry governance view's per-client read: EVERY grant row
+ *  the client holds — live AND revoked, newest first. */
+export function listOidcConsentGrantsForClient(clientId: string): OidcConsentGrant[] {
+  const rows = getDb().prepare(
+    'SELECT * FROM oidc_consent_grants WHERE client_id = ? ORDER BY created_at DESC, rowid DESC',
+  ).all(clientId) as Array<Record<string, unknown>>
+  return rows.map(toConsentGrant)
+}
+
 /** The guarded revoke: the owner's LIVE row flips, once. */
 export function revokeConsentGrant(id: string, userId: string): boolean {
   return getDb().prepare(

package/src/store/sqlite/op-store.ts

@@ -275,6 +275,15 @@ export function deleteOidcAccessToken(token: string, clientId: string): boolean
   return res.changes > 0
 }
 
+/** The governance view's population read: the client's LIVE access-token
+ *  count (unexpired — the row's absence IS the revocation). */
+export function countOidcAccessTokensForClient(clientId: string): number {
+  const row = getDb().prepare(
+    "SELECT COUNT(*) AS n FROM oidc_access_tokens WHERE client_id = ? AND datetime(expires_at) > datetime('now')",
+  ).get(clientId) as { n: number }
+  return row.n
+}
+
 function toOidcRefreshToken(row: Record<string, unknown>): OidcRefreshToken {
   return {
     token: row.token as string,
@@ -354,6 +363,16 @@ export function deleteOidcRefreshTokensForUserClient(userId: string, clientId: s
   return getDb().prepare('DELETE FROM oidc_refresh_tokens WHERE user_id = ? AND client_id = ?').run(userId, clientId).changes
 }
 
+/** The governance view's population read: the client's LIVE refresh-token
+ *  count (unconsumed AND unexpired — a revoked family is deleted wholesale,
+ *  so a live row's presence is the offline grant's standing). */
+export function countOidcRefreshTokensForClient(clientId: string): number {
+  const row = getDb().prepare(
+    "SELECT COUNT(*) AS n FROM oidc_refresh_tokens WHERE client_id = ? AND consumed_at IS NULL AND datetime(expires_at) > datetime('now')",
+  ).get(clientId) as { n: number }
+  return row.n
+}
+
 /** The amr column's honest parse (a JSON array of strings, else null —
  *  the provenance is absent on rows that predate the wave). */
 function parseJsonStringList(raw: unknown): string[] | null {

package/src/store/sqlite.ts

@@ -120,6 +120,8 @@ import {
 import {
   consumeOidcCode,
   consumeOidcRefreshToken,
+  countOidcAccessTokensForClient,
+  countOidcRefreshTokensForClient,
   createOidcAccessToken,
   createOidcAuthorization,
   createOidcCode,
@@ -223,6 +225,7 @@ import {
 import {
   getConsentGrant,
   listConsentGrants,
+  listOidcConsentGrantsForClient,
   recordConsentGrant,
   revokeConsentGrant,
 } from './sqlite/consent-grants-store'
@@ -672,6 +675,9 @@ export function createSqliteServerStore(): ServerStore {
     async deleteOidcAccessToken(token: string, clientId: string): Promise<boolean> {
       return deleteOidcAccessToken(token, clientId)
     },
+    async countOidcAccessTokensForClient(clientId: string): Promise<number> {
+      return countOidcAccessTokensForClient(clientId)
+    },
     async createOidcRefreshToken(input: {
       token: string
       userId: string
@@ -694,6 +700,9 @@ export function createSqliteServerStore(): ServerStore {
     async deleteOidcRefreshTokensForUserClient(userId: string, clientId: string): Promise<number> {
       return deleteOidcRefreshTokensForUserClient(userId, clientId)
     },
+    async countOidcRefreshTokensForClient(clientId: string): Promise<number> {
+      return countOidcRefreshTokensForClient(clientId)
+    },
     async listOidcKeys(): Promise<OidcKeyRow[]> {
       return listOidcKeys()
     },
@@ -717,6 +726,9 @@ export function createSqliteServerStore(): ServerStore {
     async revokeConsentGrant(id: string, userId: string): Promise<boolean> {
       return revokeConsentGrant(id, userId)
     },
+    async listOidcConsentGrantsForClient(clientId: string): Promise<OidcConsentGrant[]> {
+      return listOidcConsentGrantsForClient(clientId)
+    },
 
     // ── the upstream providers (TODO.identity/08) ──
     async listIdentityProviders(): Promise<IdentityProvider[]> {

package/src/store.ts

@@ -1684,6 +1684,12 @@ export interface ServerStore {
    *  client answers false). An absent row answers false too (the endpoint
    *  masks both behind its 200). */
   deleteOidcAccessToken(token: string, clientId: string): Promise<boolean>
+  /** The client-registry governance view's population read: the count of
+   *  the client's LIVE access tokens (unexpired — the row's absence IS the
+   *  revocation, so presence + liveness is standing). A count, never the
+   *  rows: the governance console answers "how many sessions stand behind
+   *  this client", never a token value. */
+  countOidcAccessTokensForClient(clientId: string): Promise<number>
   /** The refresh tokens (migration 0025 — the SSO wave-C token surface).
    *  The mint: token is the opaque value the route generated, familyId the
    *  rotation lineage (a fresh id at the code exchange's first mint, the
@@ -1717,6 +1723,12 @@ export interface ServerStore {
    *  (account, client) pair goes — the "Revoke access" act ends the
    *  offline half with the remembered consent. Answers the count. */
   deleteOidcRefreshTokensForUserClient(userId: string, clientId: string): Promise<number>
+  /** The client-registry governance view's population read: the count of
+   *  the client's LIVE refresh tokens (unconsumed AND unexpired — a
+   *  revoked family is DELETED wholesale, so a live row's presence is the
+   *  grant's standing). A count, never the rows: the console answers "how
+   *  many offline grants stand", never a token value. */
+  countOidcRefreshTokensForClient(clientId: string): Promise<number>
   /** The key rotation history (public halves). */
   listOidcKeys(): Promise<OidcKeyRow[]>
   upsertOidcKey(input: { kid: string; publicJwk: string }): Promise<void>
@@ -1743,6 +1755,13 @@ export interface ServerStore {
    *  live row — a second revoke or another account's row answers false
    *  (the PAT guard's posture). The row STAYS. */
   revokeConsentGrant(id: string, userId: string): Promise<boolean>
+  /** The client-registry governance view's per-client read: EVERY grant
+   *  row the client holds — live AND revoked (the account console's
+   *  listConsentGrants hides the revoked half; the governance view shows
+   *  the history the audit chain would otherwise carry alone), newest
+   *  first. Read-only: the acts stay on the account console and the
+   *  dashboard's revoke routes. */
+  listOidcConsentGrantsForClient(clientId: string): Promise<OidcConsentGrant[]>
 
   // ── the upstream providers (TODO.identity/08) ──
   /** The upstream registry (admin-managed; OP_UPSTREAM_SEED bootstraps).

package/src/vocab/permissions.ts

@@ -428,3 +428,87 @@ export const CREATION_PERMISSIONS: Record<string, readonly ActionPermission[]> =
 export const FIELD_GUARD_PERMISSIONS: Record<string, Record<string, readonly ActionPermission[]>> = {
   testReports: { signature_acknowledgment: ['tr.sign'] },
 }
+
+// ── The store-wide write gate (the 2026-09-07 security cone audit's
+//    F2) ────────────────────────────────────────────────────────────
+// ORG_FIELDS (store.ts) cones the org-fielded workflow stores and
+// STORE_MACHINES + CREATION/FIELD_GUARD gate the machinated ones — but
+// both leave holes the audit named: a store with NO org fields and NO
+// machine answered a generic PUT/DELETE from ANY authenticated role
+// (viewer included), and a machinated store gated only its status moves
+// — a field update without a status change, or a creation the CREATION
+// map does not name, computed NO requirement at all. The worst
+// amplification: organizations carries the submission_public_keys the
+// intake's signature check trusts.
+//
+// THIS map is the write side's store-class declaration for the stores
+// the org cone cannot carry: EVERY generic write to a listed store
+// (create, in-place update, delete — status change or not) requires the
+// actor to hold ANY of the named permissions, on top of every other
+// gate that fires (the machine's transitions, the creation acts, the
+// field guards). The consumer's entities router composes the classes:
+// org-fielded → the org cone; catalog → the catalog write gate;
+// machinated → the machine's edges; listed here → this gate; NONE of
+// those → the generic write refuses outright (deny-by-default). The
+// gate is uniform over roles: the platform roles pass because their map
+// grants the permission, never because the gate looks away.
+
+/** The store-wide write requirements (store → any-of permission set).
+ *  The assignments follow the app's actual write callers, audited
+ *  2026-09-07:
+ *
+ *  - the participants register (PD-03/PD-04/PD-08/PD-09): the Executive
+ *    Secretary administers (participants.manage), the RC assesses
+ *    (participants.review), the MC votes (participants.decide);
+ *  - the scheme-operations records (B 18 §7 — appeals, complaints,
+ *    misuse, deregistrations) are the operations console's;
+ *  - the §15.8 registered copies record at the registration act (the
+ *    IA's local register-with-BIML fallback holds certificate.register)
+ *    and at the operations console's corrections;
+ *  - the ANR validation letters record at issuance (the issuing
+ *    officer's certificate.issue) and at the operations console;
+ *  - the ANR declarations: the Utilizer/Associate staffer declares
+ *    (anr.declare), the registry moderates (anr.review) — the DRAFT's
+ *    in-place edits ride the declarer's permission;
+ *  - the instrument register's parties (organizations, manufacturers)
+ *    are instance-settings/registry records — organizations in
+ *    particular carries submission_public_keys, the intake signature
+ *    trust root, so its writes are the instance's own administration;
+ *    the manufacturer org rows are created at application intake (the
+ *    wizard's quick-create, the IA desk's white-gloves entry);
+ *  - the per-model determination records are the evaluation desk's
+ *    (er.review / the TR review that stamps them);
+ *  - the lab's work records (form instances, verification records, the
+ *    module-B markings/sealings/calibration records) ride their work
+ *    permissions; the IA's review desks write form instances on the
+ *    review/reopen legs;
+ *  - the certificate's document lists and annexes are the issuers'. */
+export const STORE_WRITE_PERMISSIONS: Record<string, readonly ActionPermission[]> = {
+  organizations: ['instance.settings'],
+  manufacturers: ['application.submit', 'application.review', 'instance.settings'],
+  experts: ['participants.manage'],
+  utilizers: ['participants.manage'],
+  associates: ['participants.manage'],
+  categorySchemes: ['participants.manage'],
+  approvalVotes: ['participants.decide'],
+  competenceEvidence: ['participants.review', 'participants.manage'],
+  participantApplications: ['participants.review', 'participants.manage'],
+  participantDeclarations: ['participants.manage'],
+  operatedSchemes: ['instance.settings'],
+  certificateDocumentLists: ['certificate.issue'],
+  certificateAnnexes: ['certificate.issue', 'certificate.manage'],
+  registeredCopies: ['certificate.register', 'operations.manage'],
+  validationLetters: ['certificate.issue', 'operations.manage'],
+  deregistrations: ['operations.manage'],
+  appeals: ['operations.manage'],
+  complaints: ['operations.manage'],
+  misuseCases: ['operations.manage'],
+  anrDeclarations: ['anr.declare', 'anr.review'],
+  testReportDeterminations: ['tr.review', 'er.review'],
+  formInstances: ['run.perform', 'tr.review', 'er.review'],
+  verificationRecords: ['verification.perform'],
+  certificateRegistrations: ['certificate.register'],
+  markings: ['markings.manage'],
+  sealings: ['markings.manage'],
+  calibrationRecords: ['markings.manage'],
+}