@oimlsmart/platform-server 0.2.8 → 0.2.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oimlsmart/platform-server",
-  "version": "0.2.8",
+  "version": "0.2.9",
   "description": "The OIML SMART platform server kernel: the store seam (ServerStore + the D1 and SQLite implementations), the canonical D1 migration set both deployments apply, the instance profile, the mailer, the RBAC map, the OIDC/OAuth client cones, and the shared role/permission vocabulary. Consumed by the smart monorepo (browser/) and the identity service.",
   "type": "module",
   "repository": {

package/src/vocab/permissions.ts

@@ -428,3 +428,87 @@ export const CREATION_PERMISSIONS: Record<string, readonly ActionPermission[]> =
 export const FIELD_GUARD_PERMISSIONS: Record<string, Record<string, readonly ActionPermission[]>> = {
   testReports: { signature_acknowledgment: ['tr.sign'] },
 }
+
+// ── The store-wide write gate (the 2026-09-07 security cone audit's
+//    F2) ────────────────────────────────────────────────────────────
+// ORG_FIELDS (store.ts) cones the org-fielded workflow stores and
+// STORE_MACHINES + CREATION/FIELD_GUARD gate the machinated ones — but
+// both leave holes the audit named: a store with NO org fields and NO
+// machine answered a generic PUT/DELETE from ANY authenticated role
+// (viewer included), and a machinated store gated only its status moves
+// — a field update without a status change, or a creation the CREATION
+// map does not name, computed NO requirement at all. The worst
+// amplification: organizations carries the submission_public_keys the
+// intake's signature check trusts.
+//
+// THIS map is the write side's store-class declaration for the stores
+// the org cone cannot carry: EVERY generic write to a listed store
+// (create, in-place update, delete — status change or not) requires the
+// actor to hold ANY of the named permissions, on top of every other
+// gate that fires (the machine's transitions, the creation acts, the
+// field guards). The consumer's entities router composes the classes:
+// org-fielded → the org cone; catalog → the catalog write gate;
+// machinated → the machine's edges; listed here → this gate; NONE of
+// those → the generic write refuses outright (deny-by-default). The
+// gate is uniform over roles: the platform roles pass because their map
+// grants the permission, never because the gate looks away.
+
+/** The store-wide write requirements (store → any-of permission set).
+ *  The assignments follow the app's actual write callers, audited
+ *  2026-09-07:
+ *
+ *  - the participants register (PD-03/PD-04/PD-08/PD-09): the Executive
+ *    Secretary administers (participants.manage), the RC assesses
+ *    (participants.review), the MC votes (participants.decide);
+ *  - the scheme-operations records (B 18 §7 — appeals, complaints,
+ *    misuse, deregistrations) are the operations console's;
+ *  - the §15.8 registered copies record at the registration act (the
+ *    IA's local register-with-BIML fallback holds certificate.register)
+ *    and at the operations console's corrections;
+ *  - the ANR validation letters record at issuance (the issuing
+ *    officer's certificate.issue) and at the operations console;
+ *  - the ANR declarations: the Utilizer/Associate staffer declares
+ *    (anr.declare), the registry moderates (anr.review) — the DRAFT's
+ *    in-place edits ride the declarer's permission;
+ *  - the instrument register's parties (organizations, manufacturers)
+ *    are instance-settings/registry records — organizations in
+ *    particular carries submission_public_keys, the intake signature
+ *    trust root, so its writes are the instance's own administration;
+ *    the manufacturer org rows are created at application intake (the
+ *    wizard's quick-create, the IA desk's white-gloves entry);
+ *  - the per-model determination records are the evaluation desk's
+ *    (er.review / the TR review that stamps them);
+ *  - the lab's work records (form instances, verification records, the
+ *    module-B markings/sealings/calibration records) ride their work
+ *    permissions; the IA's review desks write form instances on the
+ *    review/reopen legs;
+ *  - the certificate's document lists and annexes are the issuers'. */
+export const STORE_WRITE_PERMISSIONS: Record<string, readonly ActionPermission[]> = {
+  organizations: ['instance.settings'],
+  manufacturers: ['application.submit', 'application.review', 'instance.settings'],
+  experts: ['participants.manage'],
+  utilizers: ['participants.manage'],
+  associates: ['participants.manage'],
+  categorySchemes: ['participants.manage'],
+  approvalVotes: ['participants.decide'],
+  competenceEvidence: ['participants.review', 'participants.manage'],
+  participantApplications: ['participants.review', 'participants.manage'],
+  participantDeclarations: ['participants.manage'],
+  operatedSchemes: ['instance.settings'],
+  certificateDocumentLists: ['certificate.issue'],
+  certificateAnnexes: ['certificate.issue', 'certificate.manage'],
+  registeredCopies: ['certificate.register', 'operations.manage'],
+  validationLetters: ['certificate.issue', 'operations.manage'],
+  deregistrations: ['operations.manage'],
+  appeals: ['operations.manage'],
+  complaints: ['operations.manage'],
+  misuseCases: ['operations.manage'],
+  anrDeclarations: ['anr.declare', 'anr.review'],
+  testReportDeterminations: ['tr.review', 'er.review'],
+  formInstances: ['run.perform', 'tr.review', 'er.review'],
+  verificationRecords: ['verification.perform'],
+  certificateRegistrations: ['certificate.register'],
+  markings: ['markings.manage'],
+  sealings: ['markings.manage'],
+  calibrationRecords: ['markings.manage'],
+}