@open-mercato/core 0.10.1-develop.7741.1.61a2652671 → 0.10.1-develop.7749.1.ea3edf75e3

package/dist/modules/attachments/api/transfer/route.js

@@ -1,3 +1,11 @@
+import { LockMode } from "@mikro-orm/core";
+import { findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { Attachment } from "../../data/entities.js";
+import { createAttachmentAccessContext } from "../../lib/access-runner.js";
+import { assertAttachmentOwnerAccess } from "../../lib/access-query.js";
+import { withAttachmentAccessErrors, throwAttachmentAccessError } from "../../lib/access-errors.js";
+import { prepareAttachmentMutation } from "../../lib/access-mutation.js";
+import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
 import { NextResponse } from "next/server";
 import { z } from "zod";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
@@ -18,56 +26,72 @@ const transferSchema = z.object({
 const metadata = {
   POST: { requireAuth: true, requireFeatures: ["attachments.manage"] }
 };
-async function POST(req) {
+async function transferAttachments(req) {
   const auth = await getAuthFromRequest(req);
   if (!auth || !auth.tenantId || !auth.orgId) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   }
-  const json = await req.json().catch(() => null);
+  const json = await readJsonSafe(req, null);
   const parsed = transferSchema.safeParse(json);
   if (!parsed.success) {
     return NextResponse.json({ error: "Invalid payload" }, { status: 400 });
   }
-  const { attachmentIds, entityId, fromRecordId, toRecordId } = parsed.data;
-  const { resolve } = await createRequestContainer();
-  const em = resolve("em");
-  let AttachmentEntity;
-  try {
-    const mod = await import("@open-mercato/core/modules/attachments/data/entities");
-    AttachmentEntity = mod.Attachment;
-  } catch {
-    return NextResponse.json({ error: "Attachment model missing" }, { status: 500 });
-  }
+  const container = await createRequestContainer();
+  const em = container.resolve("em");
+  const guard = await prepareAttachmentMutation({ container, req, auth, operation: "update", payload: parsed.data });
+  const effective = transferSchema.safeParse(guard.modifiedPayload ?? parsed.data);
+  if (!effective.success) return throwAttachmentAccessError(403);
+  const { attachmentIds, entityId, fromRecordId } = effective.data;
   const filters = {
-    id: { $in: attachmentIds },
+    id: { $in: [...new Set(attachmentIds)].sort((left, right) => left < right ? -1 : left > right ? 1 : 0) },
     entityId,
     tenantId: auth.tenantId,
-    organizationId: auth.orgId
+    organizationId: auth.orgId,
+    ...fromRecordId ? { recordId: fromRecordId } : {}
   };
-  if (fromRecordId) {
-    filters.recordId = fromRecordId;
-  }
-  const records = await em.find(AttachmentEntity, filters);
-  if (!records.length) {
-    return NextResponse.json({ error: "Attachments not found" }, { status: 404 });
-  }
-  for (const record of records) {
-    const previousRecordId = record.recordId;
-    record.recordId = toRecordId;
-    const metadata2 = readAttachmentMetadata(record.storageMetadata);
-    const nextAssignments = metadata2.assignments?.map((assignment) => {
-      const matchesType = assignment.type === entityId;
-      const matchesRecord = fromRecordId ? assignment.id === fromRecordId : assignment.id === previousRecordId;
-      if (matchesType && matchesRecord) {
-        return { ...assignment, id: toRecordId };
+  const accessContext = createAttachmentAccessContext(container);
+  const outcome = await em.transactional(async (tx) => {
+    const records = await findWithDecryption(tx, Attachment, filters, {
+      orderBy: { id: "asc" },
+      lockMode: LockMode.PESSIMISTIC_WRITE,
+      refresh: true
+    }, { tenantId: auth.tenantId, organizationId: auth.orgId });
+    if (records.length !== new Set(attachmentIds).size) return throwAttachmentAccessError(404);
+    const changes = [];
+    for (const record of records) {
+      const recordPayload = { ...effective.data, attachmentIds: [record.id] };
+      const recordGuard = await prepareAttachmentMutation({
+        container,
+        req,
+        auth,
+        recordId: record.id,
+        operation: "update",
+        payload: recordPayload
+      });
+      const recordEffective = transferSchema.safeParse(recordGuard.modifiedPayload ?? recordPayload);
+      if (!recordEffective.success || recordEffective.data.attachmentIds.length !== 1 || recordEffective.data.attachmentIds[0] !== record.id || recordEffective.data.entityId !== record.entityId || recordEffective.data.fromRecordId && recordEffective.data.fromRecordId !== record.recordId) {
+        return throwAttachmentAccessError(403);
       }
-      return assignment;
-    }) ?? [];
-    record.storageMetadata = mergeAttachmentMetadata(record.storageMetadata, { assignments: nextAssignments });
-  }
-  await em.persist(records).flush();
-  return NextResponse.json({ ok: true, updated: records.length });
+      const destinationId = recordEffective.data.toRecordId;
+      const metadata2 = readAttachmentMetadata(record.storageMetadata);
+      const assignments = metadata2.assignments?.map((assignment) => assignment.type === entityId && assignment.id === (fromRecordId ?? record.recordId) ? { ...assignment, id: destinationId } : assignment) ?? [];
+      const storageMetadata = mergeAttachmentMetadata(record.storageMetadata, { assignments });
+      await assertAttachmentOwnerAccess({ em: tx, context: accessContext, auth, attachment: record, action: "reassign", persistProtection: true });
+      await assertAttachmentOwnerAccess({ em: tx, context: accessContext, auth, attachment: { ...record, recordId: destinationId, storageMetadata }, action: "reassign" });
+      changes.push({ record, storageMetadata, destinationId, guard: recordGuard });
+    }
+    for (const { record, storageMetadata, destinationId } of changes) {
+      record.recordId = destinationId;
+      record.storageMetadata = storageMetadata;
+    }
+    await tx.flush();
+    return { updated: records.length, guards: changes.map((change) => change.guard) };
+  });
+  await guard.runAfterSuccess();
+  for (const recordGuard of outcome.guards) await recordGuard.runAfterSuccess();
+  return NextResponse.json({ ok: true, updated: outcome.updated });
 }
+const POST = withAttachmentAccessErrors(transferAttachments);
 const openApi = {
   tag: attachmentsTag,
   summary: "Transfer attachments between records",
@@ -86,7 +110,9 @@ const openApi = {
         { status: 400, description: "Invalid payload", schema: attachmentErrorSchema },
         { status: 401, description: "Unauthorized", schema: attachmentErrorSchema },
         { status: 404, description: "Attachments not found", schema: attachmentErrorSchema },
-        { status: 500, description: "Attachment model missing", schema: attachmentErrorSchema }
+        { status: 500, description: "Attachment model missing", schema: attachmentErrorSchema },
+        { status: 403, description: "Owner policy denies access", schema: attachmentErrorSchema },
+        { status: 504, description: "Owner authorization timed out", schema: attachmentErrorSchema }
       ]
     }
   }

package/dist/modules/attachments/api/transfer/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/attachments/api/transfer/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { mergeAttachmentMetadata, readAttachmentMetadata } from '../../lib/metadata'\nimport {\n  attachmentsTag,\n  transferAttachmentsRequestSchema,\n  transferAttachmentsResponseSchema,\n  attachmentErrorSchema,\n} from '../openapi'\n\nconst transferSchema = z.object({\n  entityId: z.string().min(1),\n  attachmentIds: z.array(z.string().uuid()).min(1),\n  fromRecordId: z.string().min(1).optional(),\n  toRecordId: z.string().min(1),\n})\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['attachments.manage'] },\n}\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  const json = await req.json().catch(() => null)\n  const parsed = transferSchema.safeParse(json)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid payload' }, { status: 400 })\n  }\n  const { attachmentIds, entityId, fromRecordId, toRecordId } = parsed.data\n  const { resolve } = await createRequestContainer()\n  const em = resolve('em') as any\n  let AttachmentEntity: any\n  try {\n    const mod = await import('@open-mercato/core/modules/attachments/data/entities')\n    AttachmentEntity = mod.Attachment\n  } catch {\n    return NextResponse.json({ error: 'Attachment model missing' }, { status: 500 })\n  }\n  const filters: Record<string, unknown> = {\n    id: { $in: attachmentIds },\n    entityId,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n  }\n  if (fromRecordId) {\n    filters.recordId = fromRecordId\n  }\n  const records = await em.find(AttachmentEntity, filters)\n  if (!records.length) {\n    return NextResponse.json({ error: 'Attachments not found' }, { status: 404 })\n  }\n  for (const record of records) {\n    const previousRecordId = record.recordId\n    record.recordId = toRecordId\n    const metadata = readAttachmentMetadata(record.storageMetadata)\n    const nextAssignments =\n      metadata.assignments?.map((assignment) => {\n        const matchesType = assignment.type === entityId\n        const matchesRecord = fromRecordId\n          ? assignment.id === fromRecordId\n          : assignment.id === previousRecordId\n        if (matchesType && matchesRecord) {\n          return { ...assignment, id: toRecordId }\n        }\n        return assignment\n      }) ?? []\n    record.storageMetadata = mergeAttachmentMetadata(record.storageMetadata, { assignments: nextAssignments })\n  }\n  await em.persist(records).flush()\n  return NextResponse.json({ ok: true, updated: records.length })\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: attachmentsTag,\n  summary: 'Transfer attachments between records',\n  methods: {\n    POST: {\n      summary: 'Transfer attachments to different record',\n      description: 'Transfers one or more attachments from one record to another within the same entity type. Updates attachment assignments and metadata to reflect the new record.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: transferAttachmentsRequestSchema,\n      },\n      responses: [\n        { status: 200, description: 'Attachments transferred successfully', schema: transferAttachmentsResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid payload', schema: attachmentErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: attachmentErrorSchema },\n        { status: 404, description: 'Attachments not found', schema: attachmentErrorSchema },\n        { status: 500, description: 'Attachment model missing', schema: attachmentErrorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,yBAAyB,8BAA8B;AAChE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC;AAAA,EAC/C,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACzC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC;AAC9B,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,oBAAoB,EAAE;AACrE;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAC,KAAK,OAAO;AAC1C,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAC9C,QAAM,SAAS,eAAe,UAAU,IAAI;AAC5C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxE;AACA,QAAM,EAAE,eAAe,UAAU,cAAc,WAAW,IAAI,OAAO;AACrE,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,KAAK,QAAQ,IAAI;AACvB,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,MAAM,OAAO,sDAAsD;AAC/E,uBAAmB,IAAI;AAAA,EACzB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjF;AACA,QAAM,UAAmC;AAAA,IACvC,IAAI,EAAE,KAAK,cAAc;AAAA,IACzB;AAAA,IACA,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,EACvB;AACA,MAAI,cAAc;AAChB,YAAQ,WAAW;AAAA,EACrB;AACA,QAAM,UAAU,MAAM,GAAG,KAAK,kBAAkB,OAAO;AACvD,MAAI,CAAC,QAAQ,QAAQ;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AACA,aAAW,UAAU,SAAS;AAC5B,UAAM,mBAAmB,OAAO;AAChC,WAAO,WAAW;AAClB,UAAMA,YAAW,uBAAuB,OAAO,eAAe;AAC9D,UAAM,kBACJA,UAAS,aAAa,IAAI,CAAC,eAAe;AACxC,YAAM,cAAc,WAAW,SAAS;AACxC,YAAM,gBAAgB,eAClB,WAAW,OAAO,eAClB,WAAW,OAAO;AACtB,UAAI,eAAe,eAAe;AAChC,eAAO,EAAE,GAAG,YAAY,IAAI,WAAW;AAAA,MACzC;AACA,aAAO;AAAA,IACT,CAAC,KAAK,CAAC;AACT,WAAO,kBAAkB,wBAAwB,OAAO,iBAAiB,EAAE,aAAa,gBAAgB,CAAC;AAAA,EAC3G;AACA,QAAM,GAAG,QAAQ,OAAO,EAAE,MAAM;AAChC,SAAO,aAAa,KAAK,EAAE,IAAI,MAAM,SAAS,QAAQ,OAAO,CAAC;AAChE;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,wCAAwC,QAAQ,kCAAkC;AAAA,MAChH;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,sBAAsB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,sBAAsB;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,sBAAsB;AAAA,QACnF,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,sBAAsB;AAAA,MACxF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { LockMode } from '@mikro-orm/core'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { Attachment } from '../../data/entities'\nimport { createAttachmentAccessContext } from '../../lib/access-runner'\nimport { assertAttachmentOwnerAccess } from '../../lib/access-query'\nimport { withAttachmentAccessErrors, throwAttachmentAccessError } from '../../lib/access-errors'\nimport { prepareAttachmentMutation } from '../../lib/access-mutation'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { mergeAttachmentMetadata, readAttachmentMetadata } from '../../lib/metadata'\nimport {\n  attachmentsTag,\n  transferAttachmentsRequestSchema,\n  transferAttachmentsResponseSchema,\n  attachmentErrorSchema,\n} from '../openapi'\n\nconst transferSchema = z.object({\n  entityId: z.string().min(1),\n  attachmentIds: z.array(z.string().uuid()).min(1),\n  fromRecordId: z.string().min(1).optional(),\n  toRecordId: z.string().min(1),\n})\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['attachments.manage'] },\n}\n\nasync function transferAttachments(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  const json = await readJsonSafe(req, null)\n  const parsed = transferSchema.safeParse(json)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid payload' }, { status: 400 })\n  }\n  const container = await createRequestContainer()\n  const em = container.resolve<EntityManager>('em')\n  const guard = await prepareAttachmentMutation({ container, req, auth, operation: 'update', payload: parsed.data })\n  const effective = transferSchema.safeParse(guard.modifiedPayload ?? parsed.data)\n  if (!effective.success) return throwAttachmentAccessError(403)\n  const { attachmentIds, entityId, fromRecordId } = effective.data\n  const filters: Record<string, unknown> = {\n    id: { $in: [...new Set(attachmentIds)].sort((left, right) => left < right ? -1 : left > right ? 1 : 0) }, entityId,\n    tenantId: auth.tenantId, organizationId: auth.orgId,\n    ...(fromRecordId ? { recordId: fromRecordId } : {}),\n  }\n  const accessContext = createAttachmentAccessContext(container)\n  const outcome = await em.transactional(async (tx) => {\n    const records = await findWithDecryption(tx, Attachment, filters, {\n      orderBy: { id: 'asc' }, lockMode: LockMode.PESSIMISTIC_WRITE, refresh: true,\n    }, { tenantId: auth.tenantId, organizationId: auth.orgId })\n    if (records.length !== new Set(attachmentIds).size) return throwAttachmentAccessError(404)\n    const changes = []\n    for (const record of records) {\n      const recordPayload = { ...effective.data, attachmentIds: [record.id] }\n      const recordGuard = await prepareAttachmentMutation({\n        container, req, auth, recordId: record.id, operation: 'update', payload: recordPayload,\n      })\n      const recordEffective = transferSchema.safeParse(recordGuard.modifiedPayload ?? recordPayload)\n      if (!recordEffective.success\n        || recordEffective.data.attachmentIds.length !== 1\n        || recordEffective.data.attachmentIds[0] !== record.id\n        || recordEffective.data.entityId !== record.entityId\n        || (recordEffective.data.fromRecordId && recordEffective.data.fromRecordId !== record.recordId)) {\n        return throwAttachmentAccessError(403)\n      }\n      const destinationId = recordEffective.data.toRecordId\n      const metadata = readAttachmentMetadata(record.storageMetadata)\n      const assignments = metadata.assignments?.map((assignment) => (\n        assignment.type === entityId && assignment.id === (fromRecordId ?? record.recordId)\n          ? { ...assignment, id: destinationId } : assignment\n      )) ?? []\n      const storageMetadata = mergeAttachmentMetadata(record.storageMetadata, { assignments })\n      await assertAttachmentOwnerAccess({ em: tx, context: accessContext, auth, attachment: record, action: 'reassign', persistProtection: true })\n      await assertAttachmentOwnerAccess({ em: tx, context: accessContext, auth, attachment: { ...record, recordId: destinationId, storageMetadata }, action: 'reassign' })\n      changes.push({ record, storageMetadata, destinationId, guard: recordGuard })\n    }\n    for (const { record, storageMetadata, destinationId } of changes) {\n      record.recordId = destinationId\n      record.storageMetadata = storageMetadata\n    }\n    await tx.flush()\n    return { updated: records.length, guards: changes.map((change) => change.guard) }\n  })\n  await guard.runAfterSuccess()\n  for (const recordGuard of outcome.guards) await recordGuard.runAfterSuccess()\n  return NextResponse.json({ ok: true, updated: outcome.updated })\n}\n\nexport const POST = withAttachmentAccessErrors(transferAttachments)\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: attachmentsTag,\n  summary: 'Transfer attachments between records',\n  methods: {\n    POST: {\n      summary: 'Transfer attachments to different record',\n      description: 'Transfers one or more attachments from one record to another within the same entity type. Updates attachment assignments and metadata to reflect the new record.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: transferAttachmentsRequestSchema,\n      },\n      responses: [\n        { status: 200, description: 'Attachments transferred successfully', schema: transferAttachmentsResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid payload', schema: attachmentErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: attachmentErrorSchema },\n        { status: 404, description: 'Attachments not found', schema: attachmentErrorSchema },\n        { status: 500, description: 'Attachment model missing', schema: attachmentErrorSchema },\n        { status: 403, description: 'Owner policy denies access', schema: attachmentErrorSchema },\n        { status: 504, description: 'Owner authorization timed out', schema: attachmentErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AACA,SAAS,gBAAgB;AACzB,SAAS,0BAA0B;AACnC,SAAS,kBAAkB;AAC3B,SAAS,qCAAqC;AAC9C,SAAS,mCAAmC;AAC5C,SAAS,4BAA4B,kCAAkC;AACvE,SAAS,iCAAiC;AAC1C,SAAS,oBAAoB;AAC7B,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,yBAAyB,8BAA8B;AAChE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC;AAAA,EAC/C,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACzC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC;AAC9B,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,oBAAoB,EAAE;AACrE;AAEA,eAAe,oBAAoB,KAAc;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAC,KAAK,OAAO;AAC1C,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,QAAM,OAAO,MAAM,aAAa,KAAK,IAAI;AACzC,QAAM,SAAS,eAAe,UAAU,IAAI;AAC5C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxE;AACA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAuB,IAAI;AAChD,QAAM,QAAQ,MAAM,0BAA0B,EAAE,WAAW,KAAK,MAAM,WAAW,UAAU,SAAS,OAAO,KAAK,CAAC;AACjH,QAAM,YAAY,eAAe,UAAU,MAAM,mBAAmB,OAAO,IAAI;AAC/E,MAAI,CAAC,UAAU,QAAS,QAAO,2BAA2B,GAAG;AAC7D,QAAM,EAAE,eAAe,UAAU,aAAa,IAAI,UAAU;AAC5D,QAAM,UAAmC;AAAA,IACvC,IAAI,EAAE,KAAK,CAAC,GAAG,IAAI,IAAI,aAAa,CAAC,EAAE,KAAK,CAAC,MAAM,UAAU,OAAO,QAAQ,KAAK,OAAO,QAAQ,IAAI,CAAC,EAAE;AAAA,IAAG;AAAA,IAC1G,UAAU,KAAK;AAAA,IAAU,gBAAgB,KAAK;AAAA,IAC9C,GAAI,eAAe,EAAE,UAAU,aAAa,IAAI,CAAC;AAAA,EACnD;AACA,QAAM,gBAAgB,8BAA8B,SAAS;AAC7D,QAAM,UAAU,MAAM,GAAG,cAAc,OAAO,OAAO;AACnD,UAAM,UAAU,MAAM,mBAAmB,IAAI,YAAY,SAAS;AAAA,MAChE,SAAS,EAAE,IAAI,MAAM;AAAA,MAAG,UAAU,SAAS;AAAA,MAAmB,SAAS;AAAA,IACzE,GAAG,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM,CAAC;AAC1D,QAAI,QAAQ,WAAW,IAAI,IAAI,aAAa,EAAE,KAAM,QAAO,2BAA2B,GAAG;AACzF,UAAM,UAAU,CAAC;AACjB,eAAW,UAAU,SAAS;AAC5B,YAAM,gBAAgB,EAAE,GAAG,UAAU,MAAM,eAAe,CAAC,OAAO,EAAE,EAAE;AACtE,YAAM,cAAc,MAAM,0BAA0B;AAAA,QAClD;AAAA,QAAW;AAAA,QAAK;AAAA,QAAM,UAAU,OAAO;AAAA,QAAI,WAAW;AAAA,QAAU,SAAS;AAAA,MAC3E,CAAC;AACD,YAAM,kBAAkB,eAAe,UAAU,YAAY,mBAAmB,aAAa;AAC7F,UAAI,CAAC,gBAAgB,WAChB,gBAAgB,KAAK,cAAc,WAAW,KAC9C,gBAAgB,KAAK,cAAc,CAAC,MAAM,OAAO,MACjD,gBAAgB,KAAK,aAAa,OAAO,YACxC,gBAAgB,KAAK,gBAAgB,gBAAgB,KAAK,iBAAiB,OAAO,UAAW;AACjG,eAAO,2BAA2B,GAAG;AAAA,MACvC;AACA,YAAM,gBAAgB,gBAAgB,KAAK;AAC3C,YAAMA,YAAW,uBAAuB,OAAO,eAAe;AAC9D,YAAM,cAAcA,UAAS,aAAa,IAAI,CAAC,eAC7C,WAAW,SAAS,YAAY,WAAW,QAAQ,gBAAgB,OAAO,YACtE,EAAE,GAAG,YAAY,IAAI,cAAc,IAAI,UAC5C,KAAK,CAAC;AACP,YAAM,kBAAkB,wBAAwB,OAAO,iBAAiB,EAAE,YAAY,CAAC;AACvF,YAAM,4BAA4B,EAAE,IAAI,IAAI,SAAS,eAAe,MAAM,YAAY,QAAQ,QAAQ,YAAY,mBAAmB,KAAK,CAAC;AAC3I,YAAM,4BAA4B,EAAE,IAAI,IAAI,SAAS,eAAe,MAAM,YAAY,EAAE,GAAG,QAAQ,UAAU,eAAe,gBAAgB,GAAG,QAAQ,WAAW,CAAC;AACnK,cAAQ,KAAK,EAAE,QAAQ,iBAAiB,eAAe,OAAO,YAAY,CAAC;AAAA,IAC7E;AACA,eAAW,EAAE,QAAQ,iBAAiB,cAAc,KAAK,SAAS;AAChE,aAAO,WAAW;AAClB,aAAO,kBAAkB;AAAA,IAC3B;AACA,UAAM,GAAG,MAAM;AACf,WAAO,EAAE,SAAS,QAAQ,QAAQ,QAAQ,QAAQ,IAAI,CAAC,WAAW,OAAO,KAAK,EAAE;AAAA,EAClF,CAAC;AACD,QAAM,MAAM,gBAAgB;AAC5B,aAAW,eAAe,QAAQ,OAAQ,OAAM,YAAY,gBAAgB;AAC5E,SAAO,aAAa,KAAK,EAAE,IAAI,MAAM,SAAS,QAAQ,QAAQ,CAAC;AACjE;AAEO,MAAM,OAAO,2BAA2B,mBAAmB;AAE3D,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,wCAAwC,QAAQ,kCAAkC;AAAA,MAChH;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,sBAAsB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,sBAAsB;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,sBAAsB;AAAA,QACnF,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,sBAAsB;AAAA,QACtF,EAAE,QAAQ,KAAK,aAAa,8BAA8B,QAAQ,sBAAsB;AAAA,QACxF,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,sBAAsB;AAAA,MAC7F;AAAA,IACF;AAAA,EACF;AACF;",
   "names": ["metadata"]
 }

package/dist/modules/attachments/data/entities.js

@@ -39,6 +39,9 @@ __decorateClass([
 __decorateClass([
   Property({ name: "config_json", type: "json", nullable: true })
 ], AttachmentPartition.prototype, "configJson", 2);
+__decorateClass([
+  Property({ name: "access_resolver_requirements", type: "jsonb", nullable: true })
+], AttachmentPartition.prototype, "accessResolverRequirements", 2);
 __decorateClass([
   Property({ name: "is_public", type: "boolean", default: false })
 ], AttachmentPartition.prototype, "isPublic", 2);

package/dist/modules/attachments/data/entities.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/attachments/data/entities.ts"],
-  "sourcesContent": ["import { BigIntType, OptionalProps } from '@mikro-orm/core'\nimport { Entity, Index, PrimaryKey, Property, Unique } from '@mikro-orm/decorators/legacy'\nimport { resolveDefaultAttachmentOcrEnabled } from '../lib/ocrConfig'\n\n@Entity({ tableName: 'attachment_partitions' })\n@Unique({ name: 'attachment_partitions_code_unique', properties: ['code'] })\nexport class AttachmentPartition {\n  [OptionalProps]?: 'createdAt' | 'updatedAt'\n\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ type: 'text' })\n  code!: string\n\n  @Property({ type: 'text' })\n  title!: string\n\n  @Property({ type: 'text', nullable: true })\n  description?: string | null\n\n  @Property({ name: 'storage_driver', type: 'text', default: 'local' })\n  storageDriver: string = 'local'\n\n  @Property({ name: 'config_json', type: 'json', nullable: true })\n  configJson?: Record<string, unknown> | null\n\n  @Property({ name: 'is_public', type: 'boolean', default: false })\n  isPublic: boolean = false\n\n  @Property({ name: 'requires_ocr', type: 'boolean', default: resolveDefaultAttachmentOcrEnabled() })\n  requiresOcr: boolean = resolveDefaultAttachmentOcrEnabled()\n\n  @Property({ name: 'ocr_model', type: 'text', nullable: true })\n  ocrModel?: string | null\n\n  @Property({ name: 'organization_id', type: 'uuid', nullable: true })\n  organizationId?: string | null\n\n  @Property({ name: 'tenant_id', type: 'uuid', nullable: true })\n  @Index({ name: 'attachment_partitions_tenant_idx' })\n  tenantId?: string | null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onUpdate: () => new Date() })\n  updatedAt: Date = new Date()\n}\n\n@Entity({ tableName: 'attachments' })\n@Index({ name: 'attachments_storage_reference_idx', properties: ['partitionCode', 'storagePath'] })\nexport class Attachment {\n  [OptionalProps]?: 'createdAt'\n\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ name: 'entity_id', type: 'text' })\n  entityId!: string\n\n  @Property({ name: 'record_id', type: 'text' })\n  @Index({ name: 'attachments_entity_record_idx' })\n  recordId!: string\n\n  @Property({ name: 'organization_id', type: 'uuid', nullable: true })\n  organizationId?: string | null\n\n  @Property({ name: 'tenant_id', type: 'uuid', nullable: true })\n  tenantId?: string | null\n\n  @Property({ name: 'partition_code', type: 'text' })\n  @Index({ name: 'attachments_partition_code_idx' })\n  partitionCode!: string\n\n  @Property({ name: 'file_name', type: 'text' })\n  fileName!: string\n\n  @Property({ name: 'mime_type', type: 'text' })\n  mimeType!: string\n\n  @Property({ name: 'file_size', type: 'int' })\n  fileSize!: number\n\n  @Property({ name: 'storage_driver', type: 'text', default: 'local' })\n  storageDriver: string = 'local'\n\n  @Property({ name: 'storage_path', type: 'text' })\n  storagePath!: string\n\n  @Property({ name: 'storage_metadata', type: 'jsonb', nullable: true })\n  storageMetadata?: Record<string, unknown> | null\n\n  @Property({ name: 'url', type: 'text' })\n  url!: string\n\n  @Property({ name: 'content', type: 'text', nullable: true })\n  content: string | null = null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n}\n\n@Entity({ tableName: 'attachment_quota_reservations' })\n@Unique({\n  name: 'attachment_quota_reservations_scope_path_unique',\n  properties: ['tenantId', 'storageDriver', 'storagePath'],\n})\n@Index({\n  name: 'attachment_quota_reservations_tenant_status_idx',\n  properties: ['tenantId', 'status'],\n})\nexport class AttachmentQuotaReservation {\n  [OptionalProps]?: 'actualBytes' | 'createdAt' | 'status' | 'updatedAt' | 'uploadTokenHash'\n\n  @PrimaryKey({ type: 'uuid' })\n  id!: string\n\n  @Property({ name: 'tenant_id', type: 'uuid' })\n  tenantId!: string\n\n  @Property({ name: 'organization_id', type: 'uuid' })\n  organizationId!: string\n\n  /** Backed by a `bigint` column; hydrate as `number` (safe under Number.MAX_SAFE_INTEGER for attachment byte counts) instead of MikroORM's default JS `bigint`. */\n  @Property({ name: 'reserved_bytes', type: new BigIntType('number') })\n  reservedBytes!: number\n\n  /** Backed by a `bigint` column; hydrate as `number`, not MikroORM's default JS `bigint`. */\n  @Property({ name: 'actual_bytes', type: new BigIntType('number'), nullable: true })\n  actualBytes?: number | null\n\n  @Property({ type: 'text', default: 'reserved' })\n  status: 'reserved' | 'storing' | 'stored' | 'recovering' | 'committed' = 'reserved'\n\n  @Property({ type: 'text' })\n  source!: string\n\n  @Property({ name: 'storage_driver', type: 'text' })\n  storageDriver!: string\n\n  @Property({ name: 'partition_code', type: 'text', nullable: true })\n  partitionCode?: string | null\n\n  @Property({ name: 'storage_path', type: 'text' })\n  storagePath!: string\n\n  @Property({ name: 'lease_token', type: 'uuid' })\n  leaseToken!: string\n\n  @Property({ name: 'upload_token_hash', type: 'text', nullable: true })\n  uploadTokenHash?: string | null\n\n  @Property({ name: 'expires_at', type: Date, nullable: true })\n  @Index({ name: 'attachment_quota_reservations_expires_idx' })\n  expiresAt?: Date | null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onUpdate: () => new Date() })\n  updatedAt: Date = new Date()\n}\n"],
-  "mappings": ";;;;;;;;;;AAAA,SAAS,YAAY,qBAAqB;AAC1C,SAAS,QAAQ,OAAO,YAAY,UAAU,cAAc;AAC5D,SAAS,0CAA0C;AAKhD;AADI,IAAM,sBAAN,MAA0B;AAAA,EAA1B;AAgBL,yBAAwB;AAMxB,oBAAoB;AAGpB,uBAAuB,mCAAmC;AAa1D,qBAAkB,oBAAI,KAAK;AAG3B,qBAAkB,oBAAI,KAAK;AAAA;AAC7B;AAtCE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GAHlD,oBAIX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,GANf,oBAOX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,GATf,oBAUX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAZ/B,oBAaX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,kBAAkB,MAAM,QAAQ,SAAS,QAAQ,CAAC;AAAA,GAfzD,oBAgBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAlBpD,oBAmBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,WAAW,SAAS,MAAM,CAAC;AAAA,GArBrD,oBAsBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,WAAW,SAAS,mCAAmC,EAAE,CAAC;AAAA,GAxBvF,oBAyBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GA3BlD,oBA4BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GA9BxD,oBA+BX;AAIA;AAAA,EAFC,SAAS,EAAE,MAAM,aAAa,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,EAC5D,MAAM,EAAE,MAAM,mCAAmC,CAAC;AAAA,GAlCxC,oBAmCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GArC7D,oBAsCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAxC7D,oBAyCX;AAzCW,sBAAN;AAAA,EAFN,OAAO,EAAE,WAAW,wBAAwB,CAAC;AAAA,EAC7C,OAAO,EAAE,MAAM,qCAAqC,YAAY,CAAC,MAAM,EAAE,CAAC;AAAA,GAC9D;AA+CV;AADI,IAAM,aAAN,MAAiB;AAAA,EAAjB;AAiCL,yBAAwB;AAYxB,mBAAyB;AAGzB,qBAAkB,oBAAI,KAAK;AAAA;AAC7B;AA7CE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GAHlD,WAIX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GANlC,WAOX;AAIA;AAAA,EAFC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,EAC5C,MAAM,EAAE,MAAM,gCAAgC,CAAC;AAAA,GAVrC,WAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAbxD,WAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAhBlD,WAiBX;AAIA;AAAA,EAFC,SAAS,EAAE,MAAM,kBAAkB,MAAM,OAAO,CAAC;AAAA,EACjD,MAAM,EAAE,MAAM,iCAAiC,CAAC;AAAA,GApBtC,WAqBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GAvBlC,WAwBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GA1BlC,WA2BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,MAAM,CAAC;AAAA,GA7BjC,WA8BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,kBAAkB,MAAM,QAAQ,SAAS,QAAQ,CAAC;AAAA,GAhCzD,WAiCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,OAAO,CAAC;AAAA,GAnCrC,WAoCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,oBAAoB,MAAM,SAAS,UAAU,KAAK,CAAC;AAAA,GAtC1D,WAuCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,MAAM,OAAO,CAAC;AAAA,GAzC5B,WA0CX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,WAAW,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GA5ChD,WA6CX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GA/C7D,WAgDX;AAhDW,aAAN;AAAA,EAFN,OAAO,EAAE,WAAW,cAAc,CAAC;AAAA,EACnC,MAAM,EAAE,MAAM,qCAAqC,YAAY,CAAC,iBAAiB,aAAa,EAAE,CAAC;AAAA,GACrF;AA6DV;AADI,IAAM,6BAAN,MAAiC;AAAA,EAAjC;AAqBL,kBAAyE;AAyBzE,qBAAkB,oBAAI,KAAK;AAG3B,qBAAkB,oBAAI,KAAK;AAAA;AAC7B;AA9CE;AAAA,EADC,WAAW,EAAE,MAAM,OAAO,CAAC;AAAA,GAHjB,2BAIX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GANlC,2BAOX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,OAAO,CAAC;AAAA,GATxC,2BAUX;AAIA;AAAA,EADC,SAAS,EAAE,MAAM,kBAAkB,MAAM,IAAI,WAAW,QAAQ,EAAE,CAAC;AAAA,GAbzD,2BAcX;AAIA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,IAAI,WAAW,QAAQ,GAAG,UAAU,KAAK,CAAC;AAAA,GAjBvE,2BAkBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,QAAQ,SAAS,WAAW,CAAC;AAAA,GApBpC,2BAqBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,GAvBf,2BAwBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,kBAAkB,MAAM,OAAO,CAAC;AAAA,GA1BvC,2BA2BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,kBAAkB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GA7BvD,2BA8BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,OAAO,CAAC;AAAA,GAhCrC,2BAiCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,OAAO,CAAC;AAAA,GAnCpC,2BAoCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,qBAAqB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAtC1D,2BAuCX;AAIA;AAAA,EAFC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,EAC3D,MAAM,EAAE,MAAM,4CAA4C,CAAC;AAAA,GA1CjD,2BA2CX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GA7C7D,2BA8CX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAhD7D,2BAiDX;AAjDW,6BAAN;AAAA,EATN,OAAO,EAAE,WAAW,gCAAgC,CAAC;AAAA,EACrD,OAAO;AAAA,IACN,MAAM;AAAA,IACN,YAAY,CAAC,YAAY,iBAAiB,aAAa;AAAA,EACzD,CAAC;AAAA,EACA,MAAM;AAAA,IACL,MAAM;AAAA,IACN,YAAY,CAAC,YAAY,QAAQ;AAAA,EACnC,CAAC;AAAA,GACY;",
+  "sourcesContent": ["import { BigIntType, OptionalProps } from '@mikro-orm/core'\nimport { Entity, Index, PrimaryKey, Property, Unique } from '@mikro-orm/decorators/legacy'\nimport { resolveDefaultAttachmentOcrEnabled } from '../lib/ocrConfig'\nimport type { AttachmentAccessRequirement } from '../lib/access-types'\n\n@Entity({ tableName: 'attachment_partitions' })\n@Unique({ name: 'attachment_partitions_code_unique', properties: ['code'] })\nexport class AttachmentPartition {\n  [OptionalProps]?: 'createdAt' | 'updatedAt'\n\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ type: 'text' })\n  code!: string\n\n  @Property({ type: 'text' })\n  title!: string\n\n  @Property({ type: 'text', nullable: true })\n  description?: string | null\n\n  @Property({ name: 'storage_driver', type: 'text', default: 'local' })\n  storageDriver: string = 'local'\n\n  @Property({ name: 'config_json', type: 'json', nullable: true })\n  configJson?: Record<string, unknown> | null\n\n  @Property({ name: 'access_resolver_requirements', type: 'jsonb', nullable: true })\n  accessResolverRequirements?: AttachmentAccessRequirement[] | null\n\n  @Property({ name: 'is_public', type: 'boolean', default: false })\n  isPublic: boolean = false\n\n  @Property({ name: 'requires_ocr', type: 'boolean', default: resolveDefaultAttachmentOcrEnabled() })\n  requiresOcr: boolean = resolveDefaultAttachmentOcrEnabled()\n\n  @Property({ name: 'ocr_model', type: 'text', nullable: true })\n  ocrModel?: string | null\n\n  @Property({ name: 'organization_id', type: 'uuid', nullable: true })\n  organizationId?: string | null\n\n  @Property({ name: 'tenant_id', type: 'uuid', nullable: true })\n  @Index({ name: 'attachment_partitions_tenant_idx' })\n  tenantId?: string | null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onUpdate: () => new Date() })\n  updatedAt: Date = new Date()\n}\n\n@Entity({ tableName: 'attachments' })\n@Index({ name: 'attachments_storage_reference_idx', properties: ['partitionCode', 'storagePath'] })\nexport class Attachment {\n  [OptionalProps]?: 'createdAt'\n\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ name: 'entity_id', type: 'text' })\n  entityId!: string\n\n  @Property({ name: 'record_id', type: 'text' })\n  @Index({ name: 'attachments_entity_record_idx' })\n  recordId!: string\n\n  @Property({ name: 'organization_id', type: 'uuid', nullable: true })\n  organizationId?: string | null\n\n  @Property({ name: 'tenant_id', type: 'uuid', nullable: true })\n  tenantId?: string | null\n\n  @Property({ name: 'partition_code', type: 'text' })\n  @Index({ name: 'attachments_partition_code_idx' })\n  partitionCode!: string\n\n  @Property({ name: 'file_name', type: 'text' })\n  fileName!: string\n\n  @Property({ name: 'mime_type', type: 'text' })\n  mimeType!: string\n\n  @Property({ name: 'file_size', type: 'int' })\n  fileSize!: number\n\n  @Property({ name: 'storage_driver', type: 'text', default: 'local' })\n  storageDriver: string = 'local'\n\n  @Property({ name: 'storage_path', type: 'text' })\n  storagePath!: string\n\n  @Property({ name: 'storage_metadata', type: 'jsonb', nullable: true })\n  storageMetadata?: Record<string, unknown> | null\n\n  @Property({ name: 'url', type: 'text' })\n  url!: string\n\n  @Property({ name: 'content', type: 'text', nullable: true })\n  content: string | null = null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n}\n\n@Entity({ tableName: 'attachment_quota_reservations' })\n@Unique({\n  name: 'attachment_quota_reservations_scope_path_unique',\n  properties: ['tenantId', 'storageDriver', 'storagePath'],\n})\n@Index({\n  name: 'attachment_quota_reservations_tenant_status_idx',\n  properties: ['tenantId', 'status'],\n})\nexport class AttachmentQuotaReservation {\n  [OptionalProps]?: 'actualBytes' | 'createdAt' | 'status' | 'updatedAt' | 'uploadTokenHash'\n\n  @PrimaryKey({ type: 'uuid' })\n  id!: string\n\n  @Property({ name: 'tenant_id', type: 'uuid' })\n  tenantId!: string\n\n  @Property({ name: 'organization_id', type: 'uuid' })\n  organizationId!: string\n\n  /** Backed by a `bigint` column; hydrate as `number` (safe under Number.MAX_SAFE_INTEGER for attachment byte counts) instead of MikroORM's default JS `bigint`. */\n  @Property({ name: 'reserved_bytes', type: new BigIntType('number') })\n  reservedBytes!: number\n\n  /** Backed by a `bigint` column; hydrate as `number`, not MikroORM's default JS `bigint`. */\n  @Property({ name: 'actual_bytes', type: new BigIntType('number'), nullable: true })\n  actualBytes?: number | null\n\n  @Property({ type: 'text', default: 'reserved' })\n  status: 'reserved' | 'storing' | 'stored' | 'recovering' | 'committed' = 'reserved'\n\n  @Property({ type: 'text' })\n  source!: string\n\n  @Property({ name: 'storage_driver', type: 'text' })\n  storageDriver!: string\n\n  @Property({ name: 'partition_code', type: 'text', nullable: true })\n  partitionCode?: string | null\n\n  @Property({ name: 'storage_path', type: 'text' })\n  storagePath!: string\n\n  @Property({ name: 'lease_token', type: 'uuid' })\n  leaseToken!: string\n\n  @Property({ name: 'upload_token_hash', type: 'text', nullable: true })\n  uploadTokenHash?: string | null\n\n  @Property({ name: 'expires_at', type: Date, nullable: true })\n  @Index({ name: 'attachment_quota_reservations_expires_idx' })\n  expiresAt?: Date | null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onUpdate: () => new Date() })\n  updatedAt: Date = new Date()\n}\n"],
+  "mappings": ";;;;;;;;;;AAAA,SAAS,YAAY,qBAAqB;AAC1C,SAAS,QAAQ,OAAO,YAAY,UAAU,cAAc;AAC5D,SAAS,0CAA0C;AAMhD;AADI,IAAM,sBAAN,MAA0B;AAAA,EAA1B;AAgBL,yBAAwB;AASxB,oBAAoB;AAGpB,uBAAuB,mCAAmC;AAa1D,qBAAkB,oBAAI,KAAK;AAG3B,qBAAkB,oBAAI,KAAK;AAAA;AAC7B;AAzCE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GAHlD,oBAIX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,GANf,oBAOX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,GATf,oBAUX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAZ/B,oBAaX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,kBAAkB,MAAM,QAAQ,SAAS,QAAQ,CAAC;AAAA,GAfzD,oBAgBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAlBpD,oBAmBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gCAAgC,MAAM,SAAS,UAAU,KAAK,CAAC;AAAA,GArBtE,oBAsBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,WAAW,SAAS,MAAM,CAAC;AAAA,GAxBrD,oBAyBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,WAAW,SAAS,mCAAmC,EAAE,CAAC;AAAA,GA3BvF,oBA4BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GA9BlD,oBA+BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAjCxD,oBAkCX;AAIA;AAAA,EAFC,SAAS,EAAE,MAAM,aAAa,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,EAC5D,MAAM,EAAE,MAAM,mCAAmC,CAAC;AAAA,GArCxC,oBAsCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAxC7D,oBAyCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GA3C7D,oBA4CX;AA5CW,sBAAN;AAAA,EAFN,OAAO,EAAE,WAAW,wBAAwB,CAAC;AAAA,EAC7C,OAAO,EAAE,MAAM,qCAAqC,YAAY,CAAC,MAAM,EAAE,CAAC;AAAA,GAC9D;AAkDV;AADI,IAAM,aAAN,MAAiB;AAAA,EAAjB;AAiCL,yBAAwB;AAYxB,mBAAyB;AAGzB,qBAAkB,oBAAI,KAAK;AAAA;AAC7B;AA7CE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GAHlD,WAIX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GANlC,WAOX;AAIA;AAAA,EAFC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,EAC5C,MAAM,EAAE,MAAM,gCAAgC,CAAC;AAAA,GAVrC,WAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAbxD,WAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAhBlD,WAiBX;AAIA;AAAA,EAFC,SAAS,EAAE,MAAM,kBAAkB,MAAM,OAAO,CAAC;AAAA,EACjD,MAAM,EAAE,MAAM,iCAAiC,CAAC;AAAA,GApBtC,WAqBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GAvBlC,WAwBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GA1BlC,WA2BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,MAAM,CAAC;AAAA,GA7BjC,WA8BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,kBAAkB,MAAM,QAAQ,SAAS,QAAQ,CAAC;AAAA,GAhCzD,WAiCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,OAAO,CAAC;AAAA,GAnCrC,WAoCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,oBAAoB,MAAM,SAAS,UAAU,KAAK,CAAC;AAAA,GAtC1D,WAuCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,MAAM,OAAO,CAAC;AAAA,GAzC5B,WA0CX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,WAAW,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GA5ChD,WA6CX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GA/C7D,WAgDX;AAhDW,aAAN;AAAA,EAFN,OAAO,EAAE,WAAW,cAAc,CAAC;AAAA,EACnC,MAAM,EAAE,MAAM,qCAAqC,YAAY,CAAC,iBAAiB,aAAa,EAAE,CAAC;AAAA,GACrF;AA6DV;AADI,IAAM,6BAAN,MAAiC;AAAA,EAAjC;AAqBL,kBAAyE;AAyBzE,qBAAkB,oBAAI,KAAK;AAG3B,qBAAkB,oBAAI,KAAK;AAAA;AAC7B;AA9CE;AAAA,EADC,WAAW,EAAE,MAAM,OAAO,CAAC;AAAA,GAHjB,2BAIX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GANlC,2BAOX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,OAAO,CAAC;AAAA,GATxC,2BAUX;AAIA;AAAA,EADC,SAAS,EAAE,MAAM,kBAAkB,MAAM,IAAI,WAAW,QAAQ,EAAE,CAAC;AAAA,GAbzD,2BAcX;AAIA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,IAAI,WAAW,QAAQ,GAAG,UAAU,KAAK,CAAC;AAAA,GAjBvE,2BAkBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,QAAQ,SAAS,WAAW,CAAC;AAAA,GApBpC,2BAqBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,GAvBf,2BAwBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,kBAAkB,MAAM,OAAO,CAAC;AAAA,GA1BvC,2BA2BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,kBAAkB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GA7BvD,2BA8BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,OAAO,CAAC;AAAA,GAhCrC,2BAiCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,OAAO,CAAC;AAAA,GAnCpC,2BAoCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,qBAAqB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAtC1D,2BAuCX;AAIA;AAAA,EAFC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,EAC3D,MAAM,EAAE,MAAM,4CAA4C,CAAC;AAAA,GA1CjD,2BA2CX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GA7C7D,2BA8CX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAhD7D,2BAiDX;AAjDW,6BAAN;AAAA,EATN,OAAO,EAAE,WAAW,gCAAgC,CAAC;AAAA,EACrD,OAAO;AAAA,IACN,MAAM;AAAA,IACN,YAAY,CAAC,YAAY,iBAAiB,aAAa;AAAA,EACzD,CAAC;AAAA,EACA,MAAM;AAAA,IACL,MAAM;AAAA,IACN,YAAY,CAAC,YAAY,QAAQ;AAAA,EACnC,CAAC;AAAA,GACY;",
   "names": []
 }

package/dist/modules/attachments/data/validators.js

@@ -0,0 +1,41 @@
+import { z } from "zod";
+const attachmentAccessActionSchema = z.enum(["read", "render", "metadata", "reassign", "delete", "export"]);
+const attachmentAccessSubjectFeaturesSchema = z.array(z.string());
+const attachmentAccessSelectorSchema = z.string().min(1).max(200).regex(/^(?:\*|[^*\s]+(?:\.\*)?)$/);
+const resolverIdSchema = z.string().min(3).max(200).regex(/^[a-zA-Z0-9_-]+\.[a-zA-Z0-9_.-]+$/);
+const attachmentAccessRequirementSchema = z.object({
+  resolverId: resolverIdSchema,
+  targetEntity: attachmentAccessSelectorSchema
+}).strict();
+const protectedAttachmentTargetSchema = attachmentAccessRequirementSchema.extend({
+  targetPartition: attachmentAccessSelectorSchema
+});
+const attachmentAccessResolverSchema = z.object({
+  id: resolverIdSchema,
+  targetPartition: attachmentAccessSelectorSchema,
+  targetEntity: attachmentAccessSelectorSchema.optional(),
+  actions: z.array(attachmentAccessActionSchema).min(1).optional(),
+  priority: z.number().finite().optional(),
+  timeoutMs: z.number().int().min(1).max(15e3).optional(),
+  resolve: z.custom((value) => typeof value === "function")
+}).strict();
+const attachmentAccessRequirementsSchema = z.array(attachmentAccessRequirementSchema);
+const attachmentAccessDecisionSchema = z.discriminatedUnion("ok", [
+  z.object({ ok: z.literal(true) }).strict(),
+  z.object({
+    ok: z.literal(false),
+    status: z.union([z.literal(401), z.literal(403), z.literal(404), z.literal(504)]),
+    reason: z.string().min(1).max(200).regex(/^[a-zA-Z0-9_.:-]+$/)
+  }).strict()
+]);
+export {
+  attachmentAccessActionSchema,
+  attachmentAccessDecisionSchema,
+  attachmentAccessRequirementSchema,
+  attachmentAccessRequirementsSchema,
+  attachmentAccessResolverSchema,
+  attachmentAccessSelectorSchema,
+  attachmentAccessSubjectFeaturesSchema,
+  protectedAttachmentTargetSchema
+};
+//# sourceMappingURL=validators.js.map

package/dist/modules/attachments/data/validators.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/attachments/data/validators.ts"],
+  "sourcesContent": ["import { z } from 'zod'\nimport type { AttachmentAccessResolver } from '../lib/access-types'\n\nexport const attachmentAccessActionSchema = z.enum(['read', 'render', 'metadata', 'reassign', 'delete', 'export'])\nexport const attachmentAccessSubjectFeaturesSchema = z.array(z.string())\nexport const attachmentAccessSelectorSchema = z.string().min(1).max(200).regex(/^(?:\\*|[^*\\s]+(?:\\.\\*)?)$/)\nconst resolverIdSchema = z.string().min(3).max(200).regex(/^[a-zA-Z0-9_-]+\\.[a-zA-Z0-9_.-]+$/)\n\nexport const attachmentAccessRequirementSchema = z.object({\n  resolverId: resolverIdSchema,\n  targetEntity: attachmentAccessSelectorSchema,\n}).strict()\n\nexport const protectedAttachmentTargetSchema = attachmentAccessRequirementSchema.extend({\n  targetPartition: attachmentAccessSelectorSchema,\n})\n\nexport const attachmentAccessResolverSchema = z.object({\n  id: resolverIdSchema,\n  targetPartition: attachmentAccessSelectorSchema,\n  targetEntity: attachmentAccessSelectorSchema.optional(),\n  actions: z.array(attachmentAccessActionSchema).min(1).optional(),\n  priority: z.number().finite().optional(),\n  timeoutMs: z.number().int().min(1).max(15_000).optional(),\n  resolve: z.custom<AttachmentAccessResolver['resolve']>((value) => typeof value === 'function'),\n}).strict()\n\nexport const attachmentAccessRequirementsSchema = z.array(attachmentAccessRequirementSchema)\nexport const attachmentAccessDecisionSchema = z.discriminatedUnion('ok', [\n  z.object({ ok: z.literal(true) }).strict(),\n  z.object({\n    ok: z.literal(false),\n    status: z.union([z.literal(401), z.literal(403), z.literal(404), z.literal(504)]),\n    reason: z.string().min(1).max(200).regex(/^[a-zA-Z0-9_.:-]+$/),\n  }).strict(),\n])\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAGX,MAAM,+BAA+B,EAAE,KAAK,CAAC,QAAQ,UAAU,YAAY,YAAY,UAAU,QAAQ,CAAC;AAC1G,MAAM,wCAAwC,EAAE,MAAM,EAAE,OAAO,CAAC;AAChE,MAAM,iCAAiC,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,MAAM,2BAA2B;AAC1G,MAAM,mBAAmB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,MAAM,mCAAmC;AAEtF,MAAM,oCAAoC,EAAE,OAAO;AAAA,EACxD,YAAY;AAAA,EACZ,cAAc;AAChB,CAAC,EAAE,OAAO;AAEH,MAAM,kCAAkC,kCAAkC,OAAO;AAAA,EACtF,iBAAiB;AACnB,CAAC;AAEM,MAAM,iCAAiC,EAAE,OAAO;AAAA,EACrD,IAAI;AAAA,EACJ,iBAAiB;AAAA,EACjB,cAAc,+BAA+B,SAAS;AAAA,EACtD,SAAS,EAAE,MAAM,4BAA4B,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC/D,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EACvC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,IAAM,EAAE,SAAS;AAAA,EACxD,SAAS,EAAE,OAA4C,CAAC,UAAU,OAAO,UAAU,UAAU;AAC/F,CAAC,EAAE,OAAO;AAEH,MAAM,qCAAqC,EAAE,MAAM,iCAAiC;AACpF,MAAM,iCAAiC,EAAE,mBAAmB,MAAM;AAAA,EACvE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,EAAE,OAAO;AAAA,EACzC,EAAE,OAAO;AAAA,IACP,IAAI,EAAE,QAAQ,KAAK;AAAA,IACnB,QAAQ,EAAE,MAAM,CAAC,EAAE,QAAQ,GAAG,GAAG,EAAE,QAAQ,GAAG,GAAG,EAAE,QAAQ,GAAG,GAAG,EAAE,QAAQ,GAAG,CAAC,CAAC;AAAA,IAChF,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,MAAM,oBAAoB;AAAA,EAC/D,CAAC,EAAE,OAAO;AACZ,CAAC;",
+  "names": []
+}

package/dist/modules/attachments/di.js

@@ -1,3 +1,4 @@
+import { createAttachmentAccessContext } from "./lib/access-runner.js";
 import { asFunction, asValue } from "awilix";
 import { StorageDriverFactory } from "./lib/drivers/driverFactory.js";
 import { DefaultAttachmentService } from "./lib/attachment-service.js";
@@ -6,13 +7,14 @@ import { scheduleAttachmentQuotaRecovery } from "./lib/quota-recovery-queue.js";
 import { AttachmentTargetAccessService } from "./lib/target-access-service.js";
 import { ScopedAttachmentUploadService } from "./lib/scoped-upload-service.js";
 function register(container) {
+  const accessContext = () => createAttachmentAccessContext(container);
   container.register({
     attachmentQuotaRecoveryScheduler: asValue(scheduleAttachmentQuotaRecovery),
     attachmentQuotaService: asFunction(
       ({ em }) => createAttachmentQuotaService(em)
     ).scoped().proxy(),
     attachmentTargetAccessService: asFunction(
-      ({ em }) => new AttachmentTargetAccessService(em)
+      ({ em }) => new AttachmentTargetAccessService(em, accessContext)
     ).scoped().proxy(),
     attachmentScopedUploadService: asFunction(({
       em,
@@ -37,7 +39,8 @@ function register(container) {
     attachmentService: asFunction((cradle) => new DefaultAttachmentService(
       cradle.em,
       cradle.storageDriverFactory,
-      () => cradle.attachmentScopedUploadService ?? null
+      () => cradle.attachmentScopedUploadService ?? null,
+      accessContext
     )).scoped().proxy()
   });
 }

package/dist/modules/attachments/di.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/attachments/di.ts"],
-  "sourcesContent": ["import { asFunction, asValue } from 'awilix'\nimport type { AppContainer } from '@open-mercato/shared/lib/di/container'\nimport type { DataEngine } from '@open-mercato/shared/lib/data/engine'\nimport { StorageDriverFactory } from './lib/drivers/driverFactory'\nimport { DefaultAttachmentService } from './lib/attachment-service'\nimport { createAttachmentQuotaService, type AttachmentQuotaService } from './lib/quota-service'\nimport { scheduleAttachmentQuotaRecovery } from './lib/quota-recovery-queue'\nimport { AttachmentTargetAccessService } from './lib/target-access-service'\nimport { ScopedAttachmentUploadService } from './lib/scoped-upload-service'\n\nexport function register(container: AppContainer) {\n  container.register({\n    attachmentQuotaRecoveryScheduler: asValue(scheduleAttachmentQuotaRecovery),\n    attachmentQuotaService: asFunction(({ em }: { em: ConstructorParameters<typeof StorageDriverFactory>[0] }) =>\n      createAttachmentQuotaService(em),\n    )\n      .scoped()\n      .proxy(),\n    attachmentTargetAccessService: asFunction(({ em }: { em: ConstructorParameters<typeof StorageDriverFactory>[0] }) =>\n      new AttachmentTargetAccessService(em),\n    )\n      .scoped()\n      .proxy(),\n    attachmentScopedUploadService: asFunction(({\n      em,\n      dataEngine,\n      storageDriverFactory,\n      attachmentQuotaService,\n      attachmentQuotaRecoveryScheduler,\n    }: {\n      em: ConstructorParameters<typeof StorageDriverFactory>[0]\n      dataEngine: DataEngine\n      storageDriverFactory: StorageDriverFactory\n      attachmentQuotaService: AttachmentQuotaService\n      attachmentQuotaRecoveryScheduler: typeof scheduleAttachmentQuotaRecovery\n    }) => new ScopedAttachmentUploadService({\n      em,\n      dataEngine,\n      storageDriverFactory,\n      attachmentQuotaService,\n      attachmentQuotaRecoveryScheduler,\n    }))\n      .scoped()\n      .proxy(),\n    storageDriverFactory: asFunction(({ em }: { em: ConstructorParameters<typeof StorageDriverFactory>[0] }) =>\n      new StorageDriverFactory(em),\n    )\n      .singleton()\n      .proxy(),\n    // The scoped upload service is handed over as a lazy resolver so module\n    // uploads share the public attachment route's single fenced reservation\n    // ledger, without dragging that service's own dependencies into every\n    // container that merely constructs an `attachmentService`.\n    attachmentService: asFunction((cradle: {\n      em: ConstructorParameters<typeof DefaultAttachmentService>[0]\n      storageDriverFactory: ConstructorParameters<typeof DefaultAttachmentService>[1]\n      attachmentScopedUploadService: ScopedAttachmentUploadService\n    }) => new DefaultAttachmentService(\n      cradle.em,\n      cradle.storageDriverFactory,\n      () => cradle.attachmentScopedUploadService ?? null,\n    ))\n      .scoped()\n      .proxy(),\n  })\n}\n"],
-  "mappings": "AAAA,SAAS,YAAY,eAAe;AAGpC,SAAS,4BAA4B;AACrC,SAAS,gCAAgC;AACzC,SAAS,oCAAiE;AAC1E,SAAS,uCAAuC;AAChD,SAAS,qCAAqC;AAC9C,SAAS,qCAAqC;AAEvC,SAAS,SAAS,WAAyB;AAChD,YAAU,SAAS;AAAA,IACjB,kCAAkC,QAAQ,+BAA+B;AAAA,IACzE,wBAAwB;AAAA,MAAW,CAAC,EAAE,GAAG,MACvC,6BAA6B,EAAE;AAAA,IACjC,EACG,OAAO,EACP,MAAM;AAAA,IACT,+BAA+B;AAAA,MAAW,CAAC,EAAE,GAAG,MAC9C,IAAI,8BAA8B,EAAE;AAAA,IACtC,EACG,OAAO,EACP,MAAM;AAAA,IACT,+BAA+B,WAAW,CAAC;AAAA,MACzC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,MAMM,IAAI,8BAA8B;AAAA,MACtC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC,CAAC,EACC,OAAO,EACP,MAAM;AAAA,IACT,sBAAsB;AAAA,MAAW,CAAC,EAAE,GAAG,MACrC,IAAI,qBAAqB,EAAE;AAAA,IAC7B,EACG,UAAU,EACV,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA,IAKT,mBAAmB,WAAW,CAAC,WAIzB,IAAI;AAAA,MACR,OAAO;AAAA,MACP,OAAO;AAAA,MACP,MAAM,OAAO,iCAAiC;AAAA,IAChD,CAAC,EACE,OAAO,EACP,MAAM;AAAA,EACX,CAAC;AACH;",
+  "sourcesContent": ["import { createAttachmentAccessContext } from './lib/access-runner'\nimport { asFunction, asValue } from 'awilix'\nimport type { AppContainer } from '@open-mercato/shared/lib/di/container'\nimport type { DataEngine } from '@open-mercato/shared/lib/data/engine'\nimport { StorageDriverFactory } from './lib/drivers/driverFactory'\nimport { DefaultAttachmentService } from './lib/attachment-service'\nimport { createAttachmentQuotaService, type AttachmentQuotaService } from './lib/quota-service'\nimport { scheduleAttachmentQuotaRecovery } from './lib/quota-recovery-queue'\nimport { AttachmentTargetAccessService } from './lib/target-access-service'\nimport { ScopedAttachmentUploadService } from './lib/scoped-upload-service'\n\nexport function register(container: AppContainer) {\n  const accessContext = () => createAttachmentAccessContext(container)\n  container.register({\n    attachmentQuotaRecoveryScheduler: asValue(scheduleAttachmentQuotaRecovery),\n    attachmentQuotaService: asFunction(({ em }: { em: ConstructorParameters<typeof StorageDriverFactory>[0] }) =>\n      createAttachmentQuotaService(em),\n    )\n      .scoped()\n      .proxy(),\n    attachmentTargetAccessService: asFunction(({ em }: { em: ConstructorParameters<typeof StorageDriverFactory>[0] }) =>\n      new AttachmentTargetAccessService(em, accessContext),\n    )\n      .scoped()\n      .proxy(),\n    attachmentScopedUploadService: asFunction(({\n      em,\n      dataEngine,\n      storageDriverFactory,\n      attachmentQuotaService,\n      attachmentQuotaRecoveryScheduler,\n    }: {\n      em: ConstructorParameters<typeof StorageDriverFactory>[0]\n      dataEngine: DataEngine\n      storageDriverFactory: StorageDriverFactory\n      attachmentQuotaService: AttachmentQuotaService\n      attachmentQuotaRecoveryScheduler: typeof scheduleAttachmentQuotaRecovery\n    }) => new ScopedAttachmentUploadService({\n      em,\n      dataEngine,\n      storageDriverFactory,\n      attachmentQuotaService,\n      attachmentQuotaRecoveryScheduler,\n    }))\n      .scoped()\n      .proxy(),\n    storageDriverFactory: asFunction(({ em }: { em: ConstructorParameters<typeof StorageDriverFactory>[0] }) =>\n      new StorageDriverFactory(em),\n    )\n      .singleton()\n      .proxy(),\n    // The scoped upload service is handed over as a lazy resolver so module\n    // uploads share the public attachment route's single fenced reservation\n    // ledger, without dragging that service's own dependencies into every\n    // container that merely constructs an `attachmentService`.\n    attachmentService: asFunction((cradle: {\n      em: ConstructorParameters<typeof DefaultAttachmentService>[0]\n      storageDriverFactory: ConstructorParameters<typeof DefaultAttachmentService>[1]\n      attachmentScopedUploadService: ScopedAttachmentUploadService\n    }) => new DefaultAttachmentService(\n      cradle.em,\n      cradle.storageDriverFactory,\n      () => cradle.attachmentScopedUploadService ?? null,\n      accessContext,\n    ))\n      .scoped()\n      .proxy(),\n  })\n}\n"],
+  "mappings": "AAAA,SAAS,qCAAqC;AAC9C,SAAS,YAAY,eAAe;AAGpC,SAAS,4BAA4B;AACrC,SAAS,gCAAgC;AACzC,SAAS,oCAAiE;AAC1E,SAAS,uCAAuC;AAChD,SAAS,qCAAqC;AAC9C,SAAS,qCAAqC;AAEvC,SAAS,SAAS,WAAyB;AAChD,QAAM,gBAAgB,MAAM,8BAA8B,SAAS;AACnE,YAAU,SAAS;AAAA,IACjB,kCAAkC,QAAQ,+BAA+B;AAAA,IACzE,wBAAwB;AAAA,MAAW,CAAC,EAAE,GAAG,MACvC,6BAA6B,EAAE;AAAA,IACjC,EACG,OAAO,EACP,MAAM;AAAA,IACT,+BAA+B;AAAA,MAAW,CAAC,EAAE,GAAG,MAC9C,IAAI,8BAA8B,IAAI,aAAa;AAAA,IACrD,EACG,OAAO,EACP,MAAM;AAAA,IACT,+BAA+B,WAAW,CAAC;AAAA,MACzC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,MAMM,IAAI,8BAA8B;AAAA,MACtC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC,CAAC,EACC,OAAO,EACP,MAAM;AAAA,IACT,sBAAsB;AAAA,MAAW,CAAC,EAAE,GAAG,MACrC,IAAI,qBAAqB,EAAE;AAAA,IAC7B,EACG,UAAU,EACV,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA,IAKT,mBAAmB,WAAW,CAAC,WAIzB,IAAI;AAAA,MACR,OAAO;AAAA,MACP,OAAO;AAAA,MACP,MAAM,OAAO,iCAAiC;AAAA,MAC9C;AAAA,IACF,CAAC,EACE,OAAO,EACP,MAAM;AAAA,EACX,CAAC;AACH;",
   "names": []
 }

package/dist/modules/attachments/generators.js

@@ -0,0 +1,29 @@
+const accessPlugin = {
+  id: "attachments.access-resolvers",
+  conventionFile: "data/attachment-access.ts",
+  importPrefix: "ATTACHMENT_ACCESS",
+  configExpr: (importName, moduleId) => `{ moduleId: '${moduleId}', resolvers: (${importName}.attachmentAccessResolvers ?? []), protectedTargets: (${importName}.protectedAttachmentTargets ?? []) }`,
+  outputFileName: "attachment-access.generated.ts",
+  buildOutput: ({ importSection, entriesLiteral }) => `// AUTO-GENERATED by mercato generate registry
+import type { AttachmentAccessResolverEntry } from '@open-mercato/core/modules/attachments'
+${importSection}
+
+export const attachmentAccessEntries: AttachmentAccessResolverEntry[] = [
+${entriesLiteral ? `  ${entriesLiteral}
+` : ""}]
+`,
+  bootstrapRegistration: {
+    entriesExportName: "attachmentAccessEntries",
+    registrationImports: [
+      "import { registerAttachmentAccessResolvers } from '@open-mercato/core/modules/attachments/lib/access-registry'"
+    ],
+    buildCall: (entries) => `registerAttachmentAccessResolvers(${entries})`
+  }
+};
+const generatorPlugins = [accessPlugin];
+var generators_default = generatorPlugins;
+export {
+  generators_default as default,
+  generatorPlugins
+};
+//# sourceMappingURL=generators.js.map

package/dist/modules/attachments/generators.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/modules/attachments/generators.ts"],
+  "sourcesContent": ["import type { GeneratorPlugin } from '@open-mercato/shared/modules/generators'\n\nconst accessPlugin: GeneratorPlugin = {\n  id: 'attachments.access-resolvers',\n  conventionFile: 'data/attachment-access.ts',\n  importPrefix: 'ATTACHMENT_ACCESS',\n  configExpr: (importName, moduleId) =>\n    `{ moduleId: '${moduleId}', resolvers: (${importName}.attachmentAccessResolvers ?? []), protectedTargets: (${importName}.protectedAttachmentTargets ?? []) }`,\n  outputFileName: 'attachment-access.generated.ts',\n  buildOutput: ({ importSection, entriesLiteral }) => `// AUTO-GENERATED by mercato generate registry\nimport type { AttachmentAccessResolverEntry } from '@open-mercato/core/modules/attachments'\n${importSection}\n\nexport const attachmentAccessEntries: AttachmentAccessResolverEntry[] = [\n${entriesLiteral ? `  ${entriesLiteral}\\n` : ''}]\n`,\n  bootstrapRegistration: {\n    entriesExportName: 'attachmentAccessEntries',\n    registrationImports: [\n      \"import { registerAttachmentAccessResolvers } from '@open-mercato/core/modules/attachments/lib/access-registry'\",\n    ],\n    buildCall: (entries) => `registerAttachmentAccessResolvers(${entries})`,\n  },\n}\n\nexport const generatorPlugins: GeneratorPlugin[] = [accessPlugin]\nexport default generatorPlugins\n"],
+  "mappings": "AAEA,MAAM,eAAgC;AAAA,EACpC,IAAI;AAAA,EACJ,gBAAgB;AAAA,EAChB,cAAc;AAAA,EACd,YAAY,CAAC,YAAY,aACvB,gBAAgB,QAAQ,kBAAkB,UAAU,yDAAyD,UAAU;AAAA,EACzH,gBAAgB;AAAA,EAChB,aAAa,CAAC,EAAE,eAAe,eAAe,MAAM;AAAA;AAAA,EAEpD,aAAa;AAAA;AAAA;AAAA,EAGb,iBAAiB,KAAK,cAAc;AAAA,IAAO,EAAE;AAAA;AAAA,EAE7C,uBAAuB;AAAA,IACrB,mBAAmB;AAAA,IACnB,qBAAqB;AAAA,MACnB;AAAA,IACF;AAAA,IACA,WAAW,CAAC,YAAY,qCAAqC,OAAO;AAAA,EACtE;AACF;AAEO,MAAM,mBAAsC,CAAC,YAAY;AAChE,IAAO,qBAAQ;",
+  "names": []
+}

package/dist/modules/attachments/index.js

@@ -6,7 +6,14 @@ const metadata = {
   author: "Open Mercato Team",
   license: "MIT"
 };
+import { registerAttachmentAccessResolvers } from "./lib/access-registry.js";
+import { syncAttachmentAccessProtection } from "./lib/access-protection.js";
+import { createAttachmentAccessContext, evaluateAttachmentAccess } from "./lib/access-runner.js";
 export {
-  metadata
+  createAttachmentAccessContext,
+  evaluateAttachmentAccess,
+  metadata,
+  registerAttachmentAccessResolvers,
+  syncAttachmentAccessProtection
 };
 //# sourceMappingURL=index.js.map

package/dist/modules/attachments/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/attachments/index.ts"],
-  "sourcesContent": ["import type { ModuleInfo } from '@open-mercato/shared/modules/registry'\n\nexport const metadata: ModuleInfo = {\n  name: 'attachments',\n  title: 'Attachments',\n  version: '0.1.0',\n  description: 'File attachments and media management.',\n  author: 'Open Mercato Team',\n  license: 'MIT',\n}\n\nexport {\n  type AttachmentOwner,\n  type AttachmentProviderCleanup,\n  type AttachmentService,\n  type CreatedScopedAttachment,\n  type CreateScopedAttachmentInput,\n  type ReadScopedAttachmentInput,\n  type ReadScopedAttachmentResult,\n  type ReleaseScopedAttachmentInput,\n} from './lib/attachment-service'\n"],
-  "mappings": "AAEO,MAAM,WAAuB;AAAA,EAClC,MAAM;AAAA,EACN,OAAO;AAAA,EACP,SAAS;AAAA,EACT,aAAa;AAAA,EACb,QAAQ;AAAA,EACR,SAAS;AACX;",
+  "sourcesContent": ["import type { ModuleInfo } from '@open-mercato/shared/modules/registry'\n\nexport const metadata: ModuleInfo = {\n  name: 'attachments',\n  title: 'Attachments',\n  version: '0.1.0',\n  description: 'File attachments and media management.',\n  author: 'Open Mercato Team',\n  license: 'MIT',\n}\n\nexport {\n  type AttachmentOwner,\n  type AttachmentProviderCleanup,\n  type AttachmentService,\n  type CreatedScopedAttachment,\n  type CreateScopedAttachmentInput,\n  type ReadScopedAttachmentInput,\n  type ReadScopedAttachmentResult,\n  type ReleaseScopedAttachmentInput,\n} from './lib/attachment-service'\n\nexport type {\n  AttachmentAccessAction,\n  AttachmentAccessDecision,\n  AttachmentAccessInput,\n  AttachmentAccessPartition,\n  AttachmentAccessRecord,\n  AttachmentAccessRequirement,\n  AttachmentAccessResolver,\n  AttachmentAccessResolverEntry,\n  AttachmentAccessSubject,\n  AttachmentAccessTarget,\n  ProtectedAttachmentTarget,\n} from './lib/access-types'\nexport { registerAttachmentAccessResolvers } from './lib/access-registry'\nexport { syncAttachmentAccessProtection } from './lib/access-protection'\nexport { createAttachmentAccessContext, evaluateAttachmentAccess } from './lib/access-runner'\nexport type { AttachmentAccessContext, AttachmentAccessResult } from './lib/access-runner'\n"],
+  "mappings": "AAEO,MAAM,WAAuB;AAAA,EAClC,MAAM;AAAA,EACN,OAAO;AAAA,EACP,SAAS;AAAA,EACT,aAAa;AAAA,EACb,QAAQ;AAAA,EACR,SAAS;AACX;AA0BA,SAAS,yCAAyC;AAClD,SAAS,sCAAsC;AAC/C,SAAS,+BAA+B,gCAAgC;",
   "names": []
 }

package/dist/modules/attachments/lib/access-errors.js

@@ -0,0 +1,35 @@
+import { CrudHttpError, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
+async function attachmentAccessErrorBody(status) {
+  const { t } = await resolveTranslations();
+  const key = status === 401 ? "unauthorized" : status === 404 ? "notFound" : status === 504 ? "timeout" : "forbidden";
+  return { error: t(`attachments.access.${key}`) };
+}
+async function attachmentAccessErrorResponse(decision) {
+  return Response.json(await attachmentAccessErrorBody(decision.status), {
+    status: decision.status,
+    headers: { "Cache-Control": "private, no-store" }
+  });
+}
+async function throwAttachmentAccessError(status) {
+  throw new CrudHttpError(status, await attachmentAccessErrorBody(status));
+}
+function withAttachmentAccessErrors(handler) {
+  return async (...args) => {
+    try {
+      return await handler(...args);
+    } catch (error) {
+      if (isCrudHttpError(error)) {
+        return Response.json(error.body, { status: error.status, headers: { "Cache-Control": "private, no-store" } });
+      }
+      throw error;
+    }
+  };
+}
+export {
+  attachmentAccessErrorBody,
+  attachmentAccessErrorResponse,
+  throwAttachmentAccessError,
+  withAttachmentAccessErrors
+};
+//# sourceMappingURL=access-errors.js.map

package/dist/modules/attachments/lib/access-errors.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/attachments/lib/access-errors.ts"],
+  "sourcesContent": ["import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport type { AttachmentAccessDecision } from './access-types'\n\nexport async function attachmentAccessErrorBody(status: number): Promise<{ error: string }> {\n  const { t } = await resolveTranslations()\n  const key = status === 401 ? 'unauthorized' : status === 404 ? 'notFound' : status === 504 ? 'timeout' : 'forbidden'\n  return { error: t(`attachments.access.${key}`) }\n}\n\nexport async function attachmentAccessErrorResponse(decision: Extract<AttachmentAccessDecision, { ok: false }>): Promise<Response> {\n  return Response.json(await attachmentAccessErrorBody(decision.status), {\n    status: decision.status, headers: { 'Cache-Control': 'private, no-store' },\n  })\n}\n\nexport async function throwAttachmentAccessError(status: number): Promise<never> {\n  throw new CrudHttpError(status, await attachmentAccessErrorBody(status))\n}\n\nexport function withAttachmentAccessErrors<Arguments extends unknown[]>(handler: (...args: Arguments) => Promise<Response>) {\n  return async (...args: Arguments): Promise<Response> => {\n    try {\n      return await handler(...args)\n    } catch (error) {\n      if (isCrudHttpError(error)) {\n        return Response.json(error.body, { status: error.status, headers: { 'Cache-Control': 'private, no-store' } })\n      }\n      throw error\n    }\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AAGpC,eAAsB,0BAA0B,QAA4C;AAC1F,QAAM,EAAE,EAAE,IAAI,MAAM,oBAAoB;AACxC,QAAM,MAAM,WAAW,MAAM,iBAAiB,WAAW,MAAM,aAAa,WAAW,MAAM,YAAY;AACzG,SAAO,EAAE,OAAO,EAAE,sBAAsB,GAAG,EAAE,EAAE;AACjD;AAEA,eAAsB,8BAA8B,UAA+E;AACjI,SAAO,SAAS,KAAK,MAAM,0BAA0B,SAAS,MAAM,GAAG;AAAA,IACrE,QAAQ,SAAS;AAAA,IAAQ,SAAS,EAAE,iBAAiB,oBAAoB;AAAA,EAC3E,CAAC;AACH;AAEA,eAAsB,2BAA2B,QAAgC;AAC/E,QAAM,IAAI,cAAc,QAAQ,MAAM,0BAA0B,MAAM,CAAC;AACzE;AAEO,SAAS,2BAAwD,SAAoD;AAC1H,SAAO,UAAU,SAAuC;AACtD,QAAI;AACF,aAAO,MAAM,QAAQ,GAAG,IAAI;AAAA,IAC9B,SAAS,OAAO;AACd,UAAI,gBAAgB,KAAK,GAAG;AAC1B,eAAO,SAAS,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,QAAQ,SAAS,EAAE,iBAAiB,oBAAoB,EAAE,CAAC;AAAA,MAC9G;AACA,YAAM;AAAA,IACR;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/attachments/lib/access-mutation.js

@@ -0,0 +1,23 @@
+import { throwAttachmentAccessError } from "./access-errors.js";
+import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { runRouteMutationGuards } from "@open-mercato/shared/lib/crud/route-mutation-guard";
+async function prepareAttachmentMutation(input) {
+  if (!input.auth.tenantId) return throwAttachmentAccessError(401);
+  const guard = await runRouteMutationGuards({
+    container: input.container,
+    req: input.req,
+    auth: { tenantId: input.auth.tenantId, organizationId: input.auth.orgId ?? null, userId: input.auth.sub },
+    input: {
+      resourceKind: "attachments:attachment",
+      resourceId: input.recordId,
+      operation: input.operation,
+      mutationPayload: input.payload
+    }
+  });
+  if (!guard.ok) throw new CrudHttpError(guard.errorStatus, guard.errorBody);
+  return guard;
+}
+export {
+  prepareAttachmentMutation
+};
+//# sourceMappingURL=access-mutation.js.map

package/dist/modules/attachments/lib/access-mutation.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/attachments/lib/access-mutation.ts"],
+  "sourcesContent": ["import type { AwilixContainer } from 'awilix'\nimport type { AuthContext } from '@open-mercato/shared/lib/auth/server'\nimport { throwAttachmentAccessError } from './access-errors'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'\n\nexport async function prepareAttachmentMutation(input: {\n  container: AwilixContainer\n  req: Request\n  auth: NonNullable<AuthContext>\n  recordId?: string\n  operation: 'update' | 'delete'\n  payload?: Record<string, unknown>\n}) {\n  if (!input.auth.tenantId) return throwAttachmentAccessError(401)\n  const guard = await runRouteMutationGuards({\n    container: input.container, req: input.req,\n    auth: { tenantId: input.auth.tenantId, organizationId: input.auth.orgId ?? null, userId: input.auth.sub },\n    input: {\n      resourceKind: 'attachments:attachment', resourceId: input.recordId,\n      operation: input.operation, mutationPayload: input.payload,\n    },\n  })\n  if (!guard.ok) throw new CrudHttpError(guard.errorStatus, guard.errorBody)\n  return guard\n}\n"],
+  "mappings": "AAEA,SAAS,kCAAkC;AAC3C,SAAS,qBAAqB;AAC9B,SAAS,8BAA8B;AAEvC,eAAsB,0BAA0B,OAO7C;AACD,MAAI,CAAC,MAAM,KAAK,SAAU,QAAO,2BAA2B,GAAG;AAC/D,QAAM,QAAQ,MAAM,uBAAuB;AAAA,IACzC,WAAW,MAAM;AAAA,IAAW,KAAK,MAAM;AAAA,IACvC,MAAM,EAAE,UAAU,MAAM,KAAK,UAAU,gBAAgB,MAAM,KAAK,SAAS,MAAM,QAAQ,MAAM,KAAK,IAAI;AAAA,IACxG,OAAO;AAAA,MACL,cAAc;AAAA,MAA0B,YAAY,MAAM;AAAA,MAC1D,WAAW,MAAM;AAAA,MAAW,iBAAiB,MAAM;AAAA,IACrD;AAAA,EACF,CAAC;AACD,MAAI,CAAC,MAAM,GAAI,OAAM,IAAI,cAAc,MAAM,aAAa,MAAM,SAAS;AACzE,SAAO;AACT;",
+  "names": []
+}

package/dist/modules/attachments/lib/access-protection.js

@@ -0,0 +1,73 @@
+import { LockMode } from "@mikro-orm/core";
+import { findOneWithDecryption, findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { AttachmentPartition } from "../data/entities.js";
+import { attachmentAccessRequirementsSchema } from "../data/validators.js";
+import { getAttachmentAccessRegistry, matchesAttachmentAccessSelector } from "./access-registry.js";
+function getDeclaredAttachmentAccessRequirements(partitionCode) {
+  const registry = getAttachmentAccessRegistry();
+  if (registry.invalid) throw new Error("[internal] Attachment access registry is invalid");
+  return registry.protectedTargets.filter((target) => matchesAttachmentAccessSelector(target.targetPartition, partitionCode)).map(({ resolverId, targetEntity }) => ({ resolverId, targetEntity }));
+}
+function mergeAttachmentAccessRequirements(current, required) {
+  const existing = attachmentAccessRequirementsSchema.parse(current ?? []);
+  const union = /* @__PURE__ */ new Map();
+  for (const requirement of [...existing, ...required]) {
+    union.set(JSON.stringify([requirement.resolverId, requirement.targetEntity]), { ...requirement });
+  }
+  return [...union.values()];
+}
+async function syncAttachmentAccessProtection(em, options = {}) {
+  const registry = getAttachmentAccessRegistry();
+  if (registry.invalid) throw new Error("[internal] Attachment access registry is invalid");
+  if (!registry.protectedTargets.length) return 0;
+  const isolated = em.fork({ clear: true, useContext: false });
+  const candidates = await findWithDecryption(
+    isolated,
+    AttachmentPartition,
+    options.partitionCode ? { code: options.partitionCode } : {},
+    { orderBy: { id: "asc" } },
+    { tenantId: null, organizationId: null }
+  );
+  if (options.partitionCode && getDeclaredAttachmentAccessRequirements(options.partitionCode).length && !candidates.length) {
+    throw new Error("[internal] Protected attachment partition is not durably configured");
+  }
+  const pending = candidates.filter((partition) => {
+    const required = getDeclaredAttachmentAccessRequirements(partition.code);
+    if (!required.length) return false;
+    const existing = attachmentAccessRequirementsSchema.parse(partition.accessResolverRequirements ?? []);
+    return JSON.stringify(mergeAttachmentAccessRequirements(existing, required)) !== JSON.stringify(existing);
+  });
+  if (!pending.length) return 0;
+  return isolated.transactional(async (transaction) => {
+    let changed = 0;
+    for (const candidate of pending) {
+      const partition = await findOneWithDecryption(transaction, AttachmentPartition, { id: candidate.id }, {
+        lockMode: LockMode.PESSIMISTIC_WRITE,
+        refresh: true
+      }, { tenantId: null, organizationId: null });
+      if (!partition) throw new Error("[internal] Attachment partition disappeared during access protection synchronization");
+      const existing = attachmentAccessRequirementsSchema.parse(partition.accessResolverRequirements ?? []);
+      const merged = mergeAttachmentAccessRequirements(existing, getDeclaredAttachmentAccessRequirements(partition.code));
+      if (JSON.stringify(merged) === JSON.stringify(existing)) continue;
+      partition.accessResolverRequirements = merged;
+      changed += 1;
+    }
+    if (changed) await transaction.flush();
+    return changed;
+  });
+}
+async function ensureAttachmentPartitionProtection(em, partition) {
+  const required = getDeclaredAttachmentAccessRequirements(partition.code);
+  if (!required.length) return;
+  const existing = attachmentAccessRequirementsSchema.parse(partition.accessResolverRequirements ?? []);
+  const merged = mergeAttachmentAccessRequirements(existing, required);
+  if (JSON.stringify(existing) === JSON.stringify(merged)) return;
+  await syncAttachmentAccessProtection(em, { partitionCode: partition.code });
+}
+export {
+  ensureAttachmentPartitionProtection,
+  getDeclaredAttachmentAccessRequirements,
+  mergeAttachmentAccessRequirements,
+  syncAttachmentAccessProtection
+};
+//# sourceMappingURL=access-protection.js.map