@open-mercato/core 0.10.1-develop.7741.1.61a2652671 → 0.10.1-develop.7749.1.ea3edf75e3

package/dist/modules/attachments/lib/access-protection.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/attachments/lib/access-protection.ts"],
+  "sourcesContent": ["import { LockMode } from '@mikro-orm/core'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { AttachmentPartition } from '../data/entities'\nimport { attachmentAccessRequirementsSchema } from '../data/validators'\nimport { getAttachmentAccessRegistry, matchesAttachmentAccessSelector } from './access-registry'\nimport type { AttachmentAccessRequirement } from './access-types'\n\nexport function getDeclaredAttachmentAccessRequirements(partitionCode: string): AttachmentAccessRequirement[] {\n  const registry = getAttachmentAccessRegistry()\n  if (registry.invalid) throw new Error('[internal] Attachment access registry is invalid')\n  return registry.protectedTargets\n    .filter((target) => matchesAttachmentAccessSelector(target.targetPartition, partitionCode))\n    .map(({ resolverId, targetEntity }) => ({ resolverId, targetEntity }))\n}\n\nexport function mergeAttachmentAccessRequirements(\n  current: unknown,\n  required: readonly AttachmentAccessRequirement[],\n): AttachmentAccessRequirement[] {\n  const existing = attachmentAccessRequirementsSchema.parse(current ?? [])\n  const union = new Map<string, AttachmentAccessRequirement>()\n  for (const requirement of [...existing, ...required]) {\n    union.set(JSON.stringify([requirement.resolverId, requirement.targetEntity]), { ...requirement })\n  }\n  return [...union.values()]\n}\n\nexport async function syncAttachmentAccessProtection(\n  em: EntityManager,\n  options: { partitionCode?: string } = {},\n): Promise<number> {\n  const registry = getAttachmentAccessRegistry()\n  if (registry.invalid) throw new Error('[internal] Attachment access registry is invalid')\n  if (!registry.protectedTargets.length) return 0\n  const isolated = em.fork({ clear: true, useContext: false })\n  const candidates = await findWithDecryption(\n    isolated,\n    AttachmentPartition,\n    options.partitionCode ? { code: options.partitionCode } : {},\n    { orderBy: { id: 'asc' } },\n    { tenantId: null, organizationId: null },\n  )\n  if (options.partitionCode && getDeclaredAttachmentAccessRequirements(options.partitionCode).length && !candidates.length) {\n    throw new Error('[internal] Protected attachment partition is not durably configured')\n  }\n  const pending = candidates.filter((partition) => {\n    const required = getDeclaredAttachmentAccessRequirements(partition.code)\n    if (!required.length) return false\n    const existing = attachmentAccessRequirementsSchema.parse(partition.accessResolverRequirements ?? [])\n    return JSON.stringify(mergeAttachmentAccessRequirements(existing, required)) !== JSON.stringify(existing)\n  })\n  if (!pending.length) return 0\n  return isolated.transactional(async (transaction) => {\n    let changed = 0\n    for (const candidate of pending) {\n      const partition = await findOneWithDecryption(transaction, AttachmentPartition, { id: candidate.id }, {\n        lockMode: LockMode.PESSIMISTIC_WRITE,\n        refresh: true,\n      }, { tenantId: null, organizationId: null })\n      if (!partition) throw new Error('[internal] Attachment partition disappeared during access protection synchronization')\n      const existing = attachmentAccessRequirementsSchema.parse(partition.accessResolverRequirements ?? [])\n      const merged = mergeAttachmentAccessRequirements(existing, getDeclaredAttachmentAccessRequirements(partition.code))\n      if (JSON.stringify(merged) === JSON.stringify(existing)) continue\n      partition.accessResolverRequirements = merged\n      changed += 1\n    }\n    if (changed) await transaction.flush()\n    return changed\n  })\n}\n\nexport async function ensureAttachmentPartitionProtection(\n  em: EntityManager,\n  partition: AttachmentPartition,\n): Promise<void> {\n  const required = getDeclaredAttachmentAccessRequirements(partition.code)\n  if (!required.length) return\n  const existing = attachmentAccessRequirementsSchema.parse(partition.accessResolverRequirements ?? [])\n  const merged = mergeAttachmentAccessRequirements(existing, required)\n  if (JSON.stringify(existing) === JSON.stringify(merged)) return\n  await syncAttachmentAccessProtection(em, { partitionCode: partition.code })\n}\n"],
+  "mappings": "AAAA,SAAS,gBAAgB;AAEzB,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,2BAA2B;AACpC,SAAS,0CAA0C;AACnD,SAAS,6BAA6B,uCAAuC;AAGtE,SAAS,wCAAwC,eAAsD;AAC5G,QAAM,WAAW,4BAA4B;AAC7C,MAAI,SAAS,QAAS,OAAM,IAAI,MAAM,kDAAkD;AACxF,SAAO,SAAS,iBACb,OAAO,CAAC,WAAW,gCAAgC,OAAO,iBAAiB,aAAa,CAAC,EACzF,IAAI,CAAC,EAAE,YAAY,aAAa,OAAO,EAAE,YAAY,aAAa,EAAE;AACzE;AAEO,SAAS,kCACd,SACA,UAC+B;AAC/B,QAAM,WAAW,mCAAmC,MAAM,WAAW,CAAC,CAAC;AACvE,QAAM,QAAQ,oBAAI,IAAyC;AAC3D,aAAW,eAAe,CAAC,GAAG,UAAU,GAAG,QAAQ,GAAG;AACpD,UAAM,IAAI,KAAK,UAAU,CAAC,YAAY,YAAY,YAAY,YAAY,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC;AAAA,EAClG;AACA,SAAO,CAAC,GAAG,MAAM,OAAO,CAAC;AAC3B;AAEA,eAAsB,+BACpB,IACA,UAAsC,CAAC,GACtB;AACjB,QAAM,WAAW,4BAA4B;AAC7C,MAAI,SAAS,QAAS,OAAM,IAAI,MAAM,kDAAkD;AACxF,MAAI,CAAC,SAAS,iBAAiB,OAAQ,QAAO;AAC9C,QAAM,WAAW,GAAG,KAAK,EAAE,OAAO,MAAM,YAAY,MAAM,CAAC;AAC3D,QAAM,aAAa,MAAM;AAAA,IACvB;AAAA,IACA;AAAA,IACA,QAAQ,gBAAgB,EAAE,MAAM,QAAQ,cAAc,IAAI,CAAC;AAAA,IAC3D,EAAE,SAAS,EAAE,IAAI,MAAM,EAAE;AAAA,IACzB,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,EACzC;AACA,MAAI,QAAQ,iBAAiB,wCAAwC,QAAQ,aAAa,EAAE,UAAU,CAAC,WAAW,QAAQ;AACxH,UAAM,IAAI,MAAM,qEAAqE;AAAA,EACvF;AACA,QAAM,UAAU,WAAW,OAAO,CAAC,cAAc;AAC/C,UAAM,WAAW,wCAAwC,UAAU,IAAI;AACvE,QAAI,CAAC,SAAS,OAAQ,QAAO;AAC7B,UAAM,WAAW,mCAAmC,MAAM,UAAU,8BAA8B,CAAC,CAAC;AACpG,WAAO,KAAK,UAAU,kCAAkC,UAAU,QAAQ,CAAC,MAAM,KAAK,UAAU,QAAQ;AAAA,EAC1G,CAAC;AACD,MAAI,CAAC,QAAQ,OAAQ,QAAO;AAC5B,SAAO,SAAS,cAAc,OAAO,gBAAgB;AACnD,QAAI,UAAU;AACd,eAAW,aAAa,SAAS;AAC/B,YAAM,YAAY,MAAM,sBAAsB,aAAa,qBAAqB,EAAE,IAAI,UAAU,GAAG,GAAG;AAAA,QACpG,UAAU,SAAS;AAAA,QACnB,SAAS;AAAA,MACX,GAAG,EAAE,UAAU,MAAM,gBAAgB,KAAK,CAAC;AAC3C,UAAI,CAAC,UAAW,OAAM,IAAI,MAAM,sFAAsF;AACtH,YAAM,WAAW,mCAAmC,MAAM,UAAU,8BAA8B,CAAC,CAAC;AACpG,YAAM,SAAS,kCAAkC,UAAU,wCAAwC,UAAU,IAAI,CAAC;AAClH,UAAI,KAAK,UAAU,MAAM,MAAM,KAAK,UAAU,QAAQ,EAAG;AACzD,gBAAU,6BAA6B;AACvC,iBAAW;AAAA,IACb;AACA,QAAI,QAAS,OAAM,YAAY,MAAM;AACrC,WAAO;AAAA,EACT,CAAC;AACH;AAEA,eAAsB,oCACpB,IACA,WACe;AACf,QAAM,WAAW,wCAAwC,UAAU,IAAI;AACvE,MAAI,CAAC,SAAS,OAAQ;AACtB,QAAM,WAAW,mCAAmC,MAAM,UAAU,8BAA8B,CAAC,CAAC;AACpG,QAAM,SAAS,kCAAkC,UAAU,QAAQ;AACnE,MAAI,KAAK,UAAU,QAAQ,MAAM,KAAK,UAAU,MAAM,EAAG;AACzD,QAAM,+BAA+B,IAAI,EAAE,eAAe,UAAU,KAAK,CAAC;AAC5E;",
+  "names": []
+}

package/dist/modules/attachments/lib/access-query.js

@@ -0,0 +1,74 @@
+import { ensureAttachmentPartitionProtection } from "./access-protection.js";
+import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { AttachmentPartition } from "../data/entities.js";
+import { attachmentAccessRequirementsSchema } from "../data/validators.js";
+import { getAttachmentAccessRegistry } from "./access-registry.js";
+import { evaluateAttachmentAccess } from "./access-runner.js";
+import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { attachmentAccessErrorBody, throwAttachmentAccessError } from "./access-errors.js";
+import { readAttachmentMetadata } from "./metadata.js";
+function requiresAttachmentAccessScan(partitions) {
+  const registry = getAttachmentAccessRegistry();
+  return registry.invalid || registry.resolvers.length > 0 || registry.protectedTargets.length > 0 || partitions.some((partition) => {
+    const parsed = attachmentAccessRequirementsSchema.safeParse(partition.accessResolverRequirements ?? []);
+    return !parsed.success || parsed.data.length > 0;
+  });
+}
+async function assertAttachmentOwnerAccess(input) {
+  const partition = await findOneWithDecryption(input.em, AttachmentPartition, { code: input.attachment.partitionCode }, void 0, {
+    tenantId: input.attachment.tenantId,
+    organizationId: input.attachment.organizationId
+  });
+  if (!partition) await throwAttachmentAccessError(404);
+  if (input.persistProtection) await ensureAttachmentPartitionProtection(input.em, partition);
+  const result = await evaluateAttachmentAccess({ ...input, partition, requireAuthForPublic: true });
+  if (!result.ok) await throwAttachmentAccessError(result.status);
+}
+async function scanAuthorizedAttachments(input) {
+  const deadline = input.deadline ?? Date.now() + 15e3;
+  const timeoutBody = await attachmentAccessErrorBody(504);
+  let timer;
+  const scan = async () => {
+    const partitions = new Map(input.partitions.map((partition) => [partition.code, partition]));
+    const records = [];
+    const tags = /* @__PURE__ */ new Set();
+    let total = 0;
+    for (let batchOffset = 0; ; batchOffset += 100) {
+      if (Date.now() >= deadline) await throwAttachmentAccessError(504);
+      const batch = await input.loadBatch(batchOffset, 100);
+      for (const attachment of batch) {
+        if (Date.now() >= deadline) await throwAttachmentAccessError(504);
+        const partition = partitions.get(attachment.partitionCode);
+        if (!partition) continue;
+        const access = await evaluateAttachmentAccess({
+          auth: input.auth,
+          attachment,
+          partition,
+          action: "metadata",
+          context: input.context,
+          requireAuthForPublic: true
+        });
+        if (Date.now() >= deadline || !access.ok && access.status === 504) await throwAttachmentAccessError(504);
+        if (!access.ok) continue;
+        if (input.collectTags) for (const tag of readAttachmentMetadata(attachment.storageMetadata).tags ?? []) tags.add(tag);
+        if (total >= (input.offset ?? 0) && (input.limit === void 0 || records.length < input.limit)) records.push(attachment);
+        total += 1;
+      }
+      if (batch.length < 100) break;
+    }
+    return { records, total, tags: [...tags].sort((left, right) => left < right ? -1 : left > right ? 1 : 0) };
+  };
+  try {
+    return await Promise.race([scan(), new Promise((_resolve, reject) => {
+      timer = setTimeout(() => reject(new CrudHttpError(504, timeoutBody)), Math.max(1, deadline - Date.now()));
+    })]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+export {
+  assertAttachmentOwnerAccess,
+  requiresAttachmentAccessScan,
+  scanAuthorizedAttachments
+};
+//# sourceMappingURL=access-query.js.map

package/dist/modules/attachments/lib/access-query.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/attachments/lib/access-query.ts"],
+  "sourcesContent": ["import { ensureAttachmentPartitionProtection } from './access-protection'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { AuthContext } from '@open-mercato/shared/lib/auth/server'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { AttachmentPartition, type Attachment } from '../data/entities'\nimport { attachmentAccessRequirementsSchema } from '../data/validators'\nimport { getAttachmentAccessRegistry } from './access-registry'\nimport { evaluateAttachmentAccess, type AttachmentAccessContext } from './access-runner'\nimport type { AttachmentAccessAction, AttachmentAccessRecord } from './access-types'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { attachmentAccessErrorBody, throwAttachmentAccessError } from './access-errors'\nimport { readAttachmentMetadata } from './metadata'\n\nexport function requiresAttachmentAccessScan(partitions: readonly AttachmentPartition[]): boolean {\n  const registry = getAttachmentAccessRegistry()\n  return registry.invalid || registry.resolvers.length > 0 || registry.protectedTargets.length > 0\n    || partitions.some((partition) => {\n      const parsed = attachmentAccessRequirementsSchema.safeParse(partition.accessResolverRequirements ?? [])\n      return !parsed.success || parsed.data.length > 0\n    })\n}\n\nexport async function assertAttachmentOwnerAccess(input: {\n  em: EntityManager\n  context: AttachmentAccessContext\n  auth: NonNullable<AuthContext>\n  attachment: AttachmentAccessRecord\n  action: AttachmentAccessAction\n  persistProtection?: boolean\n}): Promise<void> {\n  const partition = await findOneWithDecryption(input.em, AttachmentPartition, { code: input.attachment.partitionCode }, undefined, {\n    tenantId: input.attachment.tenantId, organizationId: input.attachment.organizationId,\n  })\n  if (!partition) await throwAttachmentAccessError(404)\n  if (input.persistProtection) await ensureAttachmentPartitionProtection(input.em, partition!)\n  const result = await evaluateAttachmentAccess({ ...input, partition: partition!, requireAuthForPublic: true })\n  if (!result.ok) await throwAttachmentAccessError(result.status)\n}\n\nexport async function scanAuthorizedAttachments(input: {\n  auth: NonNullable<AuthContext>\n  context: AttachmentAccessContext\n  partitions: readonly AttachmentPartition[]\n  loadBatch(offset: number, limit: number): Promise<Attachment[]>\n  offset?: number\n  limit?: number\n  collectTags?: boolean\n  deadline?: number\n}): Promise<{ records: Attachment[]; total: number; tags: string[] }> {\n  const deadline = input.deadline ?? Date.now() + 15_000\n  const timeoutBody = await attachmentAccessErrorBody(504)\n  let timer: ReturnType<typeof setTimeout> | undefined\n  const scan = async () => {\n    const partitions = new Map(input.partitions.map((partition) => [partition.code, partition]))\n    const records: Attachment[] = []\n    const tags = new Set<string>()\n    let total = 0\n    for (let batchOffset = 0; ; batchOffset += 100) {\n      if (Date.now() >= deadline) await throwAttachmentAccessError(504)\n      const batch = await input.loadBatch(batchOffset, 100)\n      for (const attachment of batch) {\n        if (Date.now() >= deadline) await throwAttachmentAccessError(504)\n        const partition = partitions.get(attachment.partitionCode)\n        if (!partition) continue\n        const access = await evaluateAttachmentAccess({\n          auth: input.auth, attachment, partition, action: 'metadata', context: input.context,\n          requireAuthForPublic: true,\n        })\n        if (Date.now() >= deadline || (!access.ok && access.status === 504)) await throwAttachmentAccessError(504)\n        if (!access.ok) continue\n        if (input.collectTags) for (const tag of readAttachmentMetadata(attachment.storageMetadata).tags ?? []) tags.add(tag)\n        if (total >= (input.offset ?? 0) && (input.limit === undefined || records.length < input.limit)) records.push(attachment)\n        total += 1\n      }\n      if (batch.length < 100) break\n    }\n    return { records, total, tags: [...tags].sort((left, right) => left < right ? -1 : left > right ? 1 : 0) }\n  }\n  try {\n    return await Promise.race([scan(), new Promise<never>((_resolve, reject) => {\n      timer = setTimeout(() => reject(new CrudHttpError(504, timeoutBody)), Math.max(1, deadline - Date.now()))\n    })])\n  } finally {\n    if (timer) clearTimeout(timer)\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,2CAA2C;AAGpD,SAAS,6BAA6B;AACtC,SAAS,2BAA4C;AACrD,SAAS,0CAA0C;AACnD,SAAS,mCAAmC;AAC5C,SAAS,gCAA8D;AAEvE,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B,kCAAkC;AACtE,SAAS,8BAA8B;AAEhC,SAAS,6BAA6B,YAAqD;AAChG,QAAM,WAAW,4BAA4B;AAC7C,SAAO,SAAS,WAAW,SAAS,UAAU,SAAS,KAAK,SAAS,iBAAiB,SAAS,KAC1F,WAAW,KAAK,CAAC,cAAc;AAChC,UAAM,SAAS,mCAAmC,UAAU,UAAU,8BAA8B,CAAC,CAAC;AACtG,WAAO,CAAC,OAAO,WAAW,OAAO,KAAK,SAAS;AAAA,EACjD,CAAC;AACL;AAEA,eAAsB,4BAA4B,OAOhC;AAChB,QAAM,YAAY,MAAM,sBAAsB,MAAM,IAAI,qBAAqB,EAAE,MAAM,MAAM,WAAW,cAAc,GAAG,QAAW;AAAA,IAChI,UAAU,MAAM,WAAW;AAAA,IAAU,gBAAgB,MAAM,WAAW;AAAA,EACxE,CAAC;AACD,MAAI,CAAC,UAAW,OAAM,2BAA2B,GAAG;AACpD,MAAI,MAAM,kBAAmB,OAAM,oCAAoC,MAAM,IAAI,SAAU;AAC3F,QAAM,SAAS,MAAM,yBAAyB,EAAE,GAAG,OAAO,WAAuB,sBAAsB,KAAK,CAAC;AAC7G,MAAI,CAAC,OAAO,GAAI,OAAM,2BAA2B,OAAO,MAAM;AAChE;AAEA,eAAsB,0BAA0B,OASsB;AACpE,QAAM,WAAW,MAAM,YAAY,KAAK,IAAI,IAAI;AAChD,QAAM,cAAc,MAAM,0BAA0B,GAAG;AACvD,MAAI;AACJ,QAAM,OAAO,YAAY;AACvB,UAAM,aAAa,IAAI,IAAI,MAAM,WAAW,IAAI,CAAC,cAAc,CAAC,UAAU,MAAM,SAAS,CAAC,CAAC;AAC3F,UAAM,UAAwB,CAAC;AAC/B,UAAM,OAAO,oBAAI,IAAY;AAC7B,QAAI,QAAQ;AACZ,aAAS,cAAc,KAAK,eAAe,KAAK;AAC9C,UAAI,KAAK,IAAI,KAAK,SAAU,OAAM,2BAA2B,GAAG;AAChE,YAAM,QAAQ,MAAM,MAAM,UAAU,aAAa,GAAG;AACpD,iBAAW,cAAc,OAAO;AAC9B,YAAI,KAAK,IAAI,KAAK,SAAU,OAAM,2BAA2B,GAAG;AAChE,cAAM,YAAY,WAAW,IAAI,WAAW,aAAa;AACzD,YAAI,CAAC,UAAW;AAChB,cAAM,SAAS,MAAM,yBAAyB;AAAA,UAC5C,MAAM,MAAM;AAAA,UAAM;AAAA,UAAY;AAAA,UAAW,QAAQ;AAAA,UAAY,SAAS,MAAM;AAAA,UAC5E,sBAAsB;AAAA,QACxB,CAAC;AACD,YAAI,KAAK,IAAI,KAAK,YAAa,CAAC,OAAO,MAAM,OAAO,WAAW,IAAM,OAAM,2BAA2B,GAAG;AACzG,YAAI,CAAC,OAAO,GAAI;AAChB,YAAI,MAAM,YAAa,YAAW,OAAO,uBAAuB,WAAW,eAAe,EAAE,QAAQ,CAAC,EAAG,MAAK,IAAI,GAAG;AACpH,YAAI,UAAU,MAAM,UAAU,OAAO,MAAM,UAAU,UAAa,QAAQ,SAAS,MAAM,OAAQ,SAAQ,KAAK,UAAU;AACxH,iBAAS;AAAA,MACX;AACA,UAAI,MAAM,SAAS,IAAK;AAAA,IAC1B;AACA,WAAO,EAAE,SAAS,OAAO,MAAM,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,MAAM,UAAU,OAAO,QAAQ,KAAK,OAAO,QAAQ,IAAI,CAAC,EAAE;AAAA,EAC3G;AACA,MAAI;AACF,WAAO,MAAM,QAAQ,KAAK,CAAC,KAAK,GAAG,IAAI,QAAe,CAAC,UAAU,WAAW;AAC1E,cAAQ,WAAW,MAAM,OAAO,IAAI,cAAc,KAAK,WAAW,CAAC,GAAG,KAAK,IAAI,GAAG,WAAW,KAAK,IAAI,CAAC,CAAC;AAAA,IAC1G,CAAC,CAAC,CAAC;AAAA,EACL,UAAE;AACA,QAAI,MAAO,cAAa,KAAK;AAAA,EAC/B;AACF;",
+  "names": []
+}

package/dist/modules/attachments/lib/access-registry.js

@@ -0,0 +1,87 @@
+import { matchesEntity } from "@open-mercato/shared/lib/crud/mutation-guard-registry";
+import { attachmentAccessResolverSchema, protectedAttachmentTargetSchema } from "../data/validators.js";
+const GLOBAL_KEY = "__openMercatoAttachmentAccessRegistry__";
+const emptyRegistry = Object.freeze({ invalid: false, resolvers: [], protectedTargets: [] });
+function getAttachmentAccessRegistry() {
+  return globalThis[GLOBAL_KEY] ?? emptyRegistry;
+}
+function registerAttachmentAccessResolvers(entries) {
+  const globalState = globalThis;
+  globalState[GLOBAL_KEY] = { invalid: true, resolvers: [], protectedTargets: [] };
+  const resolvers = [];
+  const protectedTargets = [];
+  const ids = /* @__PURE__ */ new Set();
+  for (const [moduleOrder, entry] of entries.entries()) {
+    if (typeof entry.moduleId !== "string" || !entry.moduleId || !Array.isArray(entry.resolvers)) {
+      throw new Error("[internal] Invalid attachment access registry entry");
+    }
+    for (const [declarationOrder, raw] of entry.resolvers.entries()) {
+      const resolver = attachmentAccessResolverSchema.parse(raw);
+      if (!resolver.id.startsWith(`${entry.moduleId}.`) || ids.has(resolver.id)) {
+        throw new Error("[internal] Attachment access resolver IDs must be unique and owned by their module");
+      }
+      ids.add(resolver.id);
+      resolvers.push(Object.freeze({
+        ...resolver,
+        actions: resolver.actions ? Object.freeze([...resolver.actions]) : void 0,
+        moduleOrder,
+        declarationOrder
+      }));
+    }
+    for (const raw of entry.protectedTargets ?? []) {
+      const target = protectedAttachmentTargetSchema.parse(raw);
+      if (!target.resolverId.startsWith(`${entry.moduleId}.`)) {
+        throw new Error("[internal] Attachment access requirements must name their module resolver");
+      }
+      protectedTargets.push(Object.freeze(target));
+    }
+  }
+  resolvers.sort((left, right) => (left.priority ?? 50) - (right.priority ?? 50) || left.moduleOrder - right.moduleOrder || left.declarationOrder - right.declarationOrder);
+  globalState[GLOBAL_KEY] = Object.freeze({
+    invalid: false,
+    resolvers: Object.freeze(resolvers),
+    protectedTargets: Object.freeze(protectedTargets)
+  });
+}
+function matchesAttachmentAccessSelector(selector, value) {
+  return matchesEntity(selector, value);
+}
+function matchesAttachmentAccessTargets(selector, targets) {
+  return selector === "*" || targets.some((target) => matchesAttachmentAccessSelector(selector, target.entityId));
+}
+function matchesAttachmentAccessResolver(resolver, partitionCode, targets, action) {
+  return matchesAttachmentAccessSelector(resolver.targetPartition, partitionCode) && matchesAttachmentAccessTargets(resolver.targetEntity ?? "*", targets) && (!resolver.actions || resolver.actions.includes(action));
+}
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function collectAttachmentAccessTargets(attachment) {
+  const targets = [];
+  function append(entityId, recordId, origin) {
+    if (typeof entityId !== "string" || !entityId.trim()) return;
+    const target = Object.freeze({
+      entityId: entityId.trim(),
+      recordId: typeof recordId === "string" ? recordId.trim() : "",
+      origin
+    });
+    if (!targets.some((candidate) => candidate.entityId === target.entityId && candidate.recordId === target.recordId)) {
+      targets.push(target);
+    }
+  }
+  append(attachment.entityId, attachment.recordId, "primary");
+  const assignments = isRecord(attachment.storageMetadata) ? attachment.storageMetadata.assignments : void 0;
+  const entries = Array.isArray(assignments) ? assignments : isRecord(assignments) ? [assignments] : [];
+  for (const assignment of entries) {
+    if (isRecord(assignment)) append(assignment.type, assignment.id, "assignment");
+  }
+  return Object.freeze(targets);
+}
+export {
+  collectAttachmentAccessTargets,
+  getAttachmentAccessRegistry,
+  matchesAttachmentAccessResolver,
+  matchesAttachmentAccessSelector,
+  matchesAttachmentAccessTargets,
+  registerAttachmentAccessResolvers
+};
+//# sourceMappingURL=access-registry.js.map

package/dist/modules/attachments/lib/access-registry.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/attachments/lib/access-registry.ts"],
+  "sourcesContent": ["import { matchesEntity } from '@open-mercato/shared/lib/crud/mutation-guard-registry'\nimport { attachmentAccessResolverSchema, protectedAttachmentTargetSchema } from '../data/validators'\nimport type {\n  AttachmentAccessAction,\n  AttachmentAccessRecord,\n  AttachmentAccessResolver,\n  AttachmentAccessResolverEntry,\n  AttachmentAccessTarget,\n  ProtectedAttachmentTarget,\n} from './access-types'\n\nconst GLOBAL_KEY = '__openMercatoAttachmentAccessRegistry__'\n\ntype RegisteredResolver = AttachmentAccessResolver & {\n  moduleOrder: number\n  declarationOrder: number\n}\n\ntype Registry = {\n  invalid: boolean\n  resolvers: readonly RegisteredResolver[]\n  protectedTargets: readonly ProtectedAttachmentTarget[]\n}\n\nconst emptyRegistry: Registry = Object.freeze({ invalid: false, resolvers: [], protectedTargets: [] })\n\nexport function getAttachmentAccessRegistry(): Registry {\n  return (globalThis as Record<string, unknown>)[GLOBAL_KEY] as Registry | undefined ?? emptyRegistry\n}\n\nexport function registerAttachmentAccessResolvers(entries: readonly AttachmentAccessResolverEntry[]): void {\n  const globalState = globalThis as Record<string, unknown>\n  globalState[GLOBAL_KEY] = { invalid: true, resolvers: [], protectedTargets: [] } satisfies Registry\n  const resolvers: RegisteredResolver[] = []\n  const protectedTargets: ProtectedAttachmentTarget[] = []\n  const ids = new Set<string>()\n  for (const [moduleOrder, entry] of entries.entries()) {\n    if (typeof entry.moduleId !== 'string' || !entry.moduleId || !Array.isArray(entry.resolvers)) {\n      throw new Error('[internal] Invalid attachment access registry entry')\n    }\n    for (const [declarationOrder, raw] of entry.resolvers.entries()) {\n      const resolver = attachmentAccessResolverSchema.parse(raw)\n      if (!resolver.id.startsWith(`${entry.moduleId}.`) || ids.has(resolver.id)) {\n        throw new Error('[internal] Attachment access resolver IDs must be unique and owned by their module')\n      }\n      ids.add(resolver.id)\n      resolvers.push(Object.freeze({\n        ...resolver,\n        actions: resolver.actions ? Object.freeze([...resolver.actions]) : undefined,\n        moduleOrder,\n        declarationOrder,\n      }))\n    }\n    for (const raw of entry.protectedTargets ?? []) {\n      const target = protectedAttachmentTargetSchema.parse(raw)\n      if (!target.resolverId.startsWith(`${entry.moduleId}.`)) {\n        throw new Error('[internal] Attachment access requirements must name their module resolver')\n      }\n      protectedTargets.push(Object.freeze(target))\n    }\n  }\n  resolvers.sort((left, right) => (\n    (left.priority ?? 50) - (right.priority ?? 50)\n    || left.moduleOrder - right.moduleOrder\n    || left.declarationOrder - right.declarationOrder\n  ))\n  globalState[GLOBAL_KEY] = Object.freeze({\n    invalid: false,\n    resolvers: Object.freeze(resolvers),\n    protectedTargets: Object.freeze(protectedTargets),\n  }) satisfies Registry\n}\n\nexport function matchesAttachmentAccessSelector(selector: string, value: string): boolean {\n  return matchesEntity(selector, value)\n}\n\nexport function matchesAttachmentAccessTargets(selector: string, targets: readonly AttachmentAccessTarget[]): boolean {\n  return selector === '*' || targets.some((target) => matchesAttachmentAccessSelector(selector, target.entityId))\n}\n\nexport function matchesAttachmentAccessResolver(\n  resolver: AttachmentAccessResolver,\n  partitionCode: string,\n  targets: readonly AttachmentAccessTarget[],\n  action: AttachmentAccessAction,\n): boolean {\n  return matchesAttachmentAccessSelector(resolver.targetPartition, partitionCode)\n    && matchesAttachmentAccessTargets(resolver.targetEntity ?? '*', targets)\n    && (!resolver.actions || resolver.actions.includes(action))\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === 'object' && !Array.isArray(value)\n}\n\nexport function collectAttachmentAccessTargets(attachment: AttachmentAccessRecord): readonly AttachmentAccessTarget[] {\n  const targets: AttachmentAccessTarget[] = []\n  function append(entityId: unknown, recordId: unknown, origin: AttachmentAccessTarget['origin']) {\n    if (typeof entityId !== 'string' || !entityId.trim()) return\n    const target = Object.freeze({\n      entityId: entityId.trim(),\n      recordId: typeof recordId === 'string' ? recordId.trim() : '',\n      origin,\n    })\n    if (!targets.some((candidate) => candidate.entityId === target.entityId && candidate.recordId === target.recordId)) {\n      targets.push(target)\n    }\n  }\n  append(attachment.entityId, attachment.recordId, 'primary')\n  const assignments = isRecord(attachment.storageMetadata) ? attachment.storageMetadata.assignments : undefined\n  const entries = Array.isArray(assignments) ? assignments : isRecord(assignments) ? [assignments] : []\n  for (const assignment of entries) {\n    if (isRecord(assignment)) append(assignment.type, assignment.id, 'assignment')\n  }\n  return Object.freeze(targets)\n}\n"],
+  "mappings": "AAAA,SAAS,qBAAqB;AAC9B,SAAS,gCAAgC,uCAAuC;AAUhF,MAAM,aAAa;AAanB,MAAM,gBAA0B,OAAO,OAAO,EAAE,SAAS,OAAO,WAAW,CAAC,GAAG,kBAAkB,CAAC,EAAE,CAAC;AAE9F,SAAS,8BAAwC;AACtD,SAAQ,WAAuC,UAAU,KAA6B;AACxF;AAEO,SAAS,kCAAkC,SAAyD;AACzG,QAAM,cAAc;AACpB,cAAY,UAAU,IAAI,EAAE,SAAS,MAAM,WAAW,CAAC,GAAG,kBAAkB,CAAC,EAAE;AAC/E,QAAM,YAAkC,CAAC;AACzC,QAAM,mBAAgD,CAAC;AACvD,QAAM,MAAM,oBAAI,IAAY;AAC5B,aAAW,CAAC,aAAa,KAAK,KAAK,QAAQ,QAAQ,GAAG;AACpD,QAAI,OAAO,MAAM,aAAa,YAAY,CAAC,MAAM,YAAY,CAAC,MAAM,QAAQ,MAAM,SAAS,GAAG;AAC5F,YAAM,IAAI,MAAM,qDAAqD;AAAA,IACvE;AACA,eAAW,CAAC,kBAAkB,GAAG,KAAK,MAAM,UAAU,QAAQ,GAAG;AAC/D,YAAM,WAAW,+BAA+B,MAAM,GAAG;AACzD,UAAI,CAAC,SAAS,GAAG,WAAW,GAAG,MAAM,QAAQ,GAAG,KAAK,IAAI,IAAI,SAAS,EAAE,GAAG;AACzE,cAAM,IAAI,MAAM,oFAAoF;AAAA,MACtG;AACA,UAAI,IAAI,SAAS,EAAE;AACnB,gBAAU,KAAK,OAAO,OAAO;AAAA,QAC3B,GAAG;AAAA,QACH,SAAS,SAAS,UAAU,OAAO,OAAO,CAAC,GAAG,SAAS,OAAO,CAAC,IAAI;AAAA,QACnE;AAAA,QACA;AAAA,MACF,CAAC,CAAC;AAAA,IACJ;AACA,eAAW,OAAO,MAAM,oBAAoB,CAAC,GAAG;AAC9C,YAAM,SAAS,gCAAgC,MAAM,GAAG;AACxD,UAAI,CAAC,OAAO,WAAW,WAAW,GAAG,MAAM,QAAQ,GAAG,GAAG;AACvD,cAAM,IAAI,MAAM,2EAA2E;AAAA,MAC7F;AACA,uBAAiB,KAAK,OAAO,OAAO,MAAM,CAAC;AAAA,IAC7C;AAAA,EACF;AACA,YAAU,KAAK,CAAC,MAAM,WACnB,KAAK,YAAY,OAAO,MAAM,YAAY,OACxC,KAAK,cAAc,MAAM,eACzB,KAAK,mBAAmB,MAAM,gBAClC;AACD,cAAY,UAAU,IAAI,OAAO,OAAO;AAAA,IACtC,SAAS;AAAA,IACT,WAAW,OAAO,OAAO,SAAS;AAAA,IAClC,kBAAkB,OAAO,OAAO,gBAAgB;AAAA,EAClD,CAAC;AACH;AAEO,SAAS,gCAAgC,UAAkB,OAAwB;AACxF,SAAO,cAAc,UAAU,KAAK;AACtC;AAEO,SAAS,+BAA+B,UAAkB,SAAqD;AACpH,SAAO,aAAa,OAAO,QAAQ,KAAK,CAAC,WAAW,gCAAgC,UAAU,OAAO,QAAQ,CAAC;AAChH;AAEO,SAAS,gCACd,UACA,eACA,SACA,QACS;AACT,SAAO,gCAAgC,SAAS,iBAAiB,aAAa,KACzE,+BAA+B,SAAS,gBAAgB,KAAK,OAAO,MACnE,CAAC,SAAS,WAAW,SAAS,QAAQ,SAAS,MAAM;AAC7D;AAEA,SAAS,SAAS,OAAkD;AAClE,SAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEO,SAAS,+BAA+B,YAAuE;AACpH,QAAM,UAAoC,CAAC;AAC3C,WAAS,OAAO,UAAmB,UAAmB,QAA0C;AAC9F,QAAI,OAAO,aAAa,YAAY,CAAC,SAAS,KAAK,EAAG;AACtD,UAAM,SAAS,OAAO,OAAO;AAAA,MAC3B,UAAU,SAAS,KAAK;AAAA,MACxB,UAAU,OAAO,aAAa,WAAW,SAAS,KAAK,IAAI;AAAA,MAC3D;AAAA,IACF,CAAC;AACD,QAAI,CAAC,QAAQ,KAAK,CAAC,cAAc,UAAU,aAAa,OAAO,YAAY,UAAU,aAAa,OAAO,QAAQ,GAAG;AAClH,cAAQ,KAAK,MAAM;AAAA,IACrB;AAAA,EACF;AACA,SAAO,WAAW,UAAU,WAAW,UAAU,SAAS;AAC1D,QAAM,cAAc,SAAS,WAAW,eAAe,IAAI,WAAW,gBAAgB,cAAc;AACpG,QAAM,UAAU,MAAM,QAAQ,WAAW,IAAI,cAAc,SAAS,WAAW,IAAI,CAAC,WAAW,IAAI,CAAC;AACpG,aAAW,cAAc,SAAS;AAChC,QAAI,SAAS,UAAU,EAAG,QAAO,WAAW,MAAM,WAAW,IAAI,YAAY;AAAA,EAC/E;AACA,SAAO,OAAO,OAAO,OAAO;AAC9B;",
+  "names": []
+}

package/dist/modules/attachments/lib/access-runner.js

@@ -0,0 +1,161 @@
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import { getTelemetryRuntime } from "@open-mercato/shared/lib/telemetry/runtime";
+import { attachmentAccessDecisionSchema, attachmentAccessRequirementsSchema, attachmentAccessSubjectFeaturesSchema } from "../data/validators.js";
+import { checkAttachmentAccess } from "./access.js";
+import {
+  collectAttachmentAccessTargets,
+  getAttachmentAccessRegistry,
+  matchesAttachmentAccessResolver,
+  matchesAttachmentAccessSelector,
+  matchesAttachmentAccessTargets
+} from "./access-registry.js";
+const logger = createLogger("attachments").child({ component: "access" });
+const DEFAULT_TIMEOUT_MS = 1500;
+function createAttachmentAccessContext(container) {
+  return { container, subjects: /* @__PURE__ */ new Map(), resolverCaches: /* @__PURE__ */ new Map() };
+}
+class AccessTimeout extends Error {
+}
+async function withinBudget(work, timeoutMs, controller) {
+  let timer;
+  try {
+    return await Promise.race([
+      Promise.resolve().then(work),
+      new Promise((_resolve, reject) => {
+        timer = setTimeout(() => {
+          controller.abort();
+          reject(new AccessTimeout("[internal] Attachment access evaluation timed out"));
+        }, timeoutMs);
+      })
+    ]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+async function projectSubject(context, auth, attachment) {
+  const scope = {
+    tenantId: attachment.tenantId ?? auth.tenantId ?? null,
+    organizationId: attachment.organizationId ?? auth.orgId ?? null
+  };
+  const key = JSON.stringify([auth.sub, scope.tenantId, scope.organizationId]);
+  let pending = context.subjects.get(key);
+  if (!pending) {
+    pending = (async () => {
+      const rbac = context.container.resolve("rbacService");
+      const acl = await rbac.loadAcl(auth.sub, scope);
+      const userFeatures = attachmentAccessSubjectFeaturesSchema.parse(await rbac.getEffectiveFeatures(auth.sub, scope));
+      if (typeof acl.isSuperAdmin !== "boolean") {
+        throw new Error("[internal] Invalid attachment subject projection");
+      }
+      if (!acl.isSuperAdmin && acl.organizations && scope.organizationId && !acl.organizations.includes(scope.organizationId) && !acl.organizations.includes("__all__")) {
+        throw new Error("[internal] Attachment subject is outside its current organization grants");
+      }
+      return Object.freeze({
+        auth: Object.freeze({
+          sub: auth.sub,
+          tenantId: scope.tenantId,
+          orgId: scope.organizationId,
+          isApiKey: auth.isApiKey === true,
+          userId: auth.userId,
+          keyId: auth.keyId,
+          isSuperAdmin: acl.isSuperAdmin
+        }),
+        ...scope,
+        userFeatures: Object.freeze([...userFeatures]),
+        isSuperAdmin: acl.isSuperAdmin
+      });
+    })();
+    context.subjects.set(key, pending);
+  }
+  return pending;
+}
+async function evaluateAttachmentAccess(input) {
+  const { auth, attachment, partition, action, context } = input;
+  const baseline = checkAttachmentAccess(auth, attachment, partition, { requireAuthForPublic: input.requireAuthForPublic });
+  if (!baseline.ok) return { ok: false, status: baseline.status === 401 ? 401 : 403, reason: "scope", protected: false };
+  const deny = (status, reason, resolverId) => {
+    logger.info("Attachment owner access denied", { resolverId, action, attachmentId: attachment.id, reason });
+    return { ok: false, status, reason, protected: true };
+  };
+  const registry = getAttachmentAccessRegistry();
+  if (registry.invalid) return deny(403, "invalid_registry");
+  const parsedRequirements = attachmentAccessRequirementsSchema.safeParse(partition.accessResolverRequirements ?? []);
+  if (!parsedRequirements.success) return deny(403, "invalid_requirements");
+  const targets = collectAttachmentAccessTargets(attachment);
+  const requirements = [...parsedRequirements.data, ...registry.protectedTargets.filter((target) => matchesAttachmentAccessSelector(target.targetPartition, partition.code))].filter((requirement) => matchesAttachmentAccessTargets(requirement.targetEntity, targets));
+  const resolvers = registry.resolvers.filter((resolver) => matchesAttachmentAccessResolver(resolver, partition.code, targets, action));
+  if (!requirements.length && !resolvers.length) return { ok: true, protected: false };
+  if (!auth) return deny(401, "authentication_required");
+  for (const requirement of requirements) {
+    const requiredTargets = targets.filter((target) => matchesAttachmentAccessSelector(requirement.targetEntity, target.entityId));
+    const provider = resolvers.find((resolver) => resolver.id === requirement.resolverId);
+    if (!provider || (requiredTargets.length ? requiredTargets.some((target) => !matchesAttachmentAccessSelector(provider.targetEntity ?? "*", target.entityId)) : (provider.targetEntity ?? "*") !== "*")) return deny(403, "required_resolver_missing", requirement.resolverId);
+    if (targets.some((target) => matchesAttachmentAccessSelector(requirement.targetEntity, target.entityId) && !target.recordId)) {
+      return deny(403, "invalid_owner", requirement.resolverId);
+    }
+  }
+  if (!context) return deny(403, "policy_context_missing");
+  let subject;
+  try {
+    subject = await withinBudget(() => projectSubject(context, auth, attachment), DEFAULT_TIMEOUT_MS, new AbortController());
+  } catch (error) {
+    getTelemetryRuntime()?.reportError(new Error("[internal] Attachment subject projection failed"), {
+      module: "attachments",
+      code: "attachments.subject_projection_failed",
+      attributes: { attachmentId: attachment.id, action }
+    });
+    return deny(error instanceof AccessTimeout ? 504 : 403, "subject_projection_failed");
+  }
+  const liveBaseline = checkAttachmentAccess({ ...auth, roles: [], isSuperAdmin: subject.isSuperAdmin }, attachment, partition, { requireAuthForPublic: input.requireAuthForPublic });
+  if (!liveBaseline.ok) return deny(403, "current_scope");
+  for (const resolver of resolvers) {
+    const controller = new AbortController();
+    let cache = context.resolverCaches.get(resolver.id);
+    if (!cache) {
+      cache = /* @__PURE__ */ new Map();
+      context.resolverCaches.set(resolver.id, cache);
+    }
+    try {
+      const raw = await withinBudget(() => resolver.resolve(Object.freeze({
+        action,
+        subject,
+        attachment: Object.freeze({
+          id: attachment.id,
+          entityId: attachment.entityId,
+          recordId: attachment.recordId,
+          partitionCode: attachment.partitionCode,
+          tenantId: attachment.tenantId,
+          organizationId: attachment.organizationId,
+          fileName: attachment.fileName,
+          mimeType: attachment.mimeType
+        }),
+        partition: Object.freeze({
+          code: partition.code,
+          isPublic: partition.isPublic,
+          tenantId: partition.tenantId,
+          organizationId: partition.organizationId
+        }),
+        targets,
+        container: context.container,
+        cache,
+        signal: controller.signal
+      })), resolver.timeoutMs ?? DEFAULT_TIMEOUT_MS, controller);
+      const decision = attachmentAccessDecisionSchema.parse(raw);
+      if (!decision.ok) return deny(decision.status, decision.reason, resolver.id);
+    } catch (error) {
+      controller.abort();
+      getTelemetryRuntime()?.reportError(new Error(error instanceof AccessTimeout ? "[internal] Attachment resolver exceeded its time budget" : "[internal] Attachment resolver failed or returned an invalid decision"), {
+        module: "attachments",
+        code: "attachments.resolver_failed",
+        attributes: { resolverId: resolver.id, attachmentId: attachment.id, action }
+      });
+      return deny(error instanceof AccessTimeout ? 504 : 403, error instanceof AccessTimeout ? "resolver_timeout" : "resolver_failed", resolver.id);
+    }
+  }
+  return { ok: true, protected: true };
+}
+export {
+  createAttachmentAccessContext,
+  evaluateAttachmentAccess
+};
+//# sourceMappingURL=access-runner.js.map

package/dist/modules/attachments/lib/access-runner.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/attachments/lib/access-runner.ts"],
+  "sourcesContent": ["import type { AwilixContainer } from 'awilix'\nimport type { AuthContext } from '@open-mercato/shared/lib/auth/server'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { getTelemetryRuntime } from '@open-mercato/shared/lib/telemetry/runtime'\nimport type { Attachment, AttachmentPartition } from '../data/entities'\nimport { attachmentAccessDecisionSchema, attachmentAccessRequirementsSchema, attachmentAccessSubjectFeaturesSchema } from '../data/validators'\nimport { checkAttachmentAccess } from './access'\nimport {\n  collectAttachmentAccessTargets,\n  getAttachmentAccessRegistry,\n  matchesAttachmentAccessResolver,\n  matchesAttachmentAccessSelector,\n  matchesAttachmentAccessTargets,\n} from './access-registry'\nimport type {\n  AttachmentAccessAction, AttachmentAccessDecision, AttachmentAccessPartition,\n  AttachmentAccessRecord, AttachmentAccessSubject,\n} from './access-types'\n\nconst logger = createLogger('attachments').child({ component: 'access' })\nconst DEFAULT_TIMEOUT_MS = 1500\n\ntype RbacProjectionService = {\n  loadAcl(subject: string, scope: { tenantId: string | null; organizationId: string | null }): Promise<{\n    isSuperAdmin: boolean; organizations: string[] | null\n  }>\n  getEffectiveFeatures(subject: string, scope: { tenantId: string | null; organizationId: string | null }): Promise<string[]>\n}\n\nexport type AttachmentAccessContext = {\n  container: AwilixContainer\n  subjects: Map<string, Promise<AttachmentAccessSubject>>\n  resolverCaches: Map<string, Map<string, unknown>>\n}\n\nexport function createAttachmentAccessContext(container: AwilixContainer): AttachmentAccessContext {\n  return { container, subjects: new Map(), resolverCaches: new Map() }\n}\n\nexport type AttachmentAccessResult = AttachmentAccessDecision & { protected: boolean }\n\nclass AccessTimeout extends Error {}\n\nasync function withinBudget<Result>(work: () => Promise<Result>, timeoutMs: number, controller: AbortController): Promise<Result> {\n  let timer: ReturnType<typeof setTimeout> | undefined\n  try {\n    return await Promise.race([\n      Promise.resolve().then(work),\n      new Promise<never>((_resolve, reject) => {\n        timer = setTimeout(() => {\n          controller.abort()\n          reject(new AccessTimeout('[internal] Attachment access evaluation timed out'))\n        }, timeoutMs)\n      }),\n    ])\n  } finally {\n    if (timer) clearTimeout(timer)\n  }\n}\n\nasync function projectSubject(\n  context: AttachmentAccessContext,\n  auth: NonNullable<AuthContext>,\n  attachment: AttachmentAccessRecord,\n): Promise<AttachmentAccessSubject> {\n  const scope = {\n    tenantId: attachment.tenantId ?? auth.tenantId ?? null,\n    organizationId: attachment.organizationId ?? auth.orgId ?? null,\n  }\n  const key = JSON.stringify([auth.sub, scope.tenantId, scope.organizationId])\n  let pending = context.subjects.get(key)\n  if (!pending) {\n    pending = (async () => {\n      const rbac = context.container.resolve<RbacProjectionService>('rbacService')\n      const acl = await rbac.loadAcl(auth.sub, scope)\n      const userFeatures = attachmentAccessSubjectFeaturesSchema.parse(await rbac.getEffectiveFeatures(auth.sub, scope))\n      if (typeof acl.isSuperAdmin !== 'boolean') {\n        throw new Error('[internal] Invalid attachment subject projection')\n      }\n      if (!acl.isSuperAdmin && acl.organizations && scope.organizationId\n        && !acl.organizations.includes(scope.organizationId) && !acl.organizations.includes('__all__')) {\n        throw new Error('[internal] Attachment subject is outside its current organization grants')\n      }\n      return Object.freeze({\n        auth: Object.freeze({\n          sub: auth.sub, tenantId: scope.tenantId, orgId: scope.organizationId,\n          isApiKey: auth.isApiKey === true, userId: auth.userId, keyId: auth.keyId,\n          isSuperAdmin: acl.isSuperAdmin,\n        }),\n        ...scope,\n        userFeatures: Object.freeze([...userFeatures]),\n        isSuperAdmin: acl.isSuperAdmin,\n      })\n    })()\n    context.subjects.set(key, pending)\n  }\n  return pending\n}\n\nexport async function evaluateAttachmentAccess(input: {\n  auth: AuthContext | undefined\n  attachment: AttachmentAccessRecord\n  partition: AttachmentAccessPartition\n  action: AttachmentAccessAction\n  context?: AttachmentAccessContext | null\n  requireAuthForPublic?: boolean\n}): Promise<AttachmentAccessResult> {\n  const { auth, attachment, partition, action, context } = input\n  const baseline = checkAttachmentAccess(auth, attachment as Attachment, partition as AttachmentPartition, { requireAuthForPublic: input.requireAuthForPublic })\n  if (!baseline.ok) return { ok: false, status: baseline.status === 401 ? 401 : 403, reason: 'scope', protected: false }\n  const deny = (status: 401 | 403 | 404 | 504, reason: string, resolverId?: string): AttachmentAccessResult => {\n    logger.info('Attachment owner access denied', { resolverId, action, attachmentId: attachment.id, reason })\n    return { ok: false, status, reason, protected: true }\n  }\n  const registry = getAttachmentAccessRegistry()\n  if (registry.invalid) return deny(403, 'invalid_registry')\n  const parsedRequirements = attachmentAccessRequirementsSchema.safeParse(partition.accessResolverRequirements ?? [])\n  if (!parsedRequirements.success) return deny(403, 'invalid_requirements')\n  const targets = collectAttachmentAccessTargets(attachment)\n  const requirements = [...parsedRequirements.data, ...registry.protectedTargets.filter((target) => (\n    matchesAttachmentAccessSelector(target.targetPartition, partition.code)\n  ))].filter((requirement) => matchesAttachmentAccessTargets(requirement.targetEntity, targets))\n  const resolvers = registry.resolvers.filter((resolver) => matchesAttachmentAccessResolver(resolver, partition.code, targets, action))\n  if (!requirements.length && !resolvers.length) return { ok: true, protected: false }\n  if (!auth) return deny(401, 'authentication_required')\n  for (const requirement of requirements) {\n    const requiredTargets = targets.filter((target) => matchesAttachmentAccessSelector(requirement.targetEntity, target.entityId))\n    const provider = resolvers.find((resolver) => resolver.id === requirement.resolverId)\n    if (!provider || (requiredTargets.length\n      ? requiredTargets.some((target) => !matchesAttachmentAccessSelector(provider.targetEntity ?? '*', target.entityId))\n      : (provider.targetEntity ?? '*') !== '*')) return deny(403, 'required_resolver_missing', requirement.resolverId)\n    if (targets.some((target) => matchesAttachmentAccessSelector(requirement.targetEntity, target.entityId) && !target.recordId)) {\n      return deny(403, 'invalid_owner', requirement.resolverId)\n    }\n  }\n  if (!context) return deny(403, 'policy_context_missing')\n  let subject: AttachmentAccessSubject\n  try {\n    subject = await withinBudget(() => projectSubject(context, auth, attachment), DEFAULT_TIMEOUT_MS, new AbortController())\n  } catch (error) {\n    getTelemetryRuntime()?.reportError(new Error('[internal] Attachment subject projection failed'), {\n      module: 'attachments', code: 'attachments.subject_projection_failed', attributes: { attachmentId: attachment.id, action },\n    })\n    return deny(error instanceof AccessTimeout ? 504 : 403, 'subject_projection_failed')\n  }\n  const liveBaseline = checkAttachmentAccess({ ...auth, roles: [], isSuperAdmin: subject.isSuperAdmin }, attachment as Attachment, partition as AttachmentPartition, { requireAuthForPublic: input.requireAuthForPublic })\n  if (!liveBaseline.ok) return deny(403, 'current_scope')\n  for (const resolver of resolvers) {\n    const controller = new AbortController()\n    let cache = context.resolverCaches.get(resolver.id)\n    if (!cache) {\n      cache = new Map()\n      context.resolverCaches.set(resolver.id, cache)\n    }\n    try {\n      const raw = await withinBudget(() => resolver.resolve(Object.freeze({\n        action, subject,\n        attachment: Object.freeze({\n          id: attachment.id, entityId: attachment.entityId, recordId: attachment.recordId,\n          partitionCode: attachment.partitionCode, tenantId: attachment.tenantId,\n          organizationId: attachment.organizationId, fileName: attachment.fileName, mimeType: attachment.mimeType,\n        }),\n        partition: Object.freeze({\n          code: partition.code, isPublic: partition.isPublic,\n          tenantId: partition.tenantId, organizationId: partition.organizationId,\n        }),\n        targets, container: context.container, cache, signal: controller.signal,\n      })), resolver.timeoutMs ?? DEFAULT_TIMEOUT_MS, controller)\n      const decision = attachmentAccessDecisionSchema.parse(raw)\n      if (!decision.ok) return deny(decision.status, decision.reason, resolver.id)\n    } catch (error) {\n      controller.abort()\n      getTelemetryRuntime()?.reportError(new Error(error instanceof AccessTimeout\n        ? '[internal] Attachment resolver exceeded its time budget'\n        : '[internal] Attachment resolver failed or returned an invalid decision'), {\n        module: 'attachments', code: 'attachments.resolver_failed',\n        attributes: { resolverId: resolver.id, attachmentId: attachment.id, action },\n      })\n      return deny(error instanceof AccessTimeout ? 504 : 403, error instanceof AccessTimeout ? 'resolver_timeout' : 'resolver_failed', resolver.id)\n    }\n  }\n  return { ok: true, protected: true }\n}\n"],
+  "mappings": "AAEA,SAAS,oBAAoB;AAC7B,SAAS,2BAA2B;AAEpC,SAAS,gCAAgC,oCAAoC,6CAA6C;AAC1H,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAMP,MAAM,SAAS,aAAa,aAAa,EAAE,MAAM,EAAE,WAAW,SAAS,CAAC;AACxE,MAAM,qBAAqB;AAepB,SAAS,8BAA8B,WAAqD;AACjG,SAAO,EAAE,WAAW,UAAU,oBAAI,IAAI,GAAG,gBAAgB,oBAAI,IAAI,EAAE;AACrE;AAIA,MAAM,sBAAsB,MAAM;AAAC;AAEnC,eAAe,aAAqB,MAA6B,WAAmB,YAA8C;AAChI,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,QAAQ,KAAK;AAAA,MACxB,QAAQ,QAAQ,EAAE,KAAK,IAAI;AAAA,MAC3B,IAAI,QAAe,CAAC,UAAU,WAAW;AACvC,gBAAQ,WAAW,MAAM;AACvB,qBAAW,MAAM;AACjB,iBAAO,IAAI,cAAc,mDAAmD,CAAC;AAAA,QAC/E,GAAG,SAAS;AAAA,MACd,CAAC;AAAA,IACH,CAAC;AAAA,EACH,UAAE;AACA,QAAI,MAAO,cAAa,KAAK;AAAA,EAC/B;AACF;AAEA,eAAe,eACb,SACA,MACA,YACkC;AAClC,QAAM,QAAQ;AAAA,IACZ,UAAU,WAAW,YAAY,KAAK,YAAY;AAAA,IAClD,gBAAgB,WAAW,kBAAkB,KAAK,SAAS;AAAA,EAC7D;AACA,QAAM,MAAM,KAAK,UAAU,CAAC,KAAK,KAAK,MAAM,UAAU,MAAM,cAAc,CAAC;AAC3E,MAAI,UAAU,QAAQ,SAAS,IAAI,GAAG;AACtC,MAAI,CAAC,SAAS;AACZ,eAAW,YAAY;AACrB,YAAM,OAAO,QAAQ,UAAU,QAA+B,aAAa;AAC3E,YAAM,MAAM,MAAM,KAAK,QAAQ,KAAK,KAAK,KAAK;AAC9C,YAAM,eAAe,sCAAsC,MAAM,MAAM,KAAK,qBAAqB,KAAK,KAAK,KAAK,CAAC;AACjH,UAAI,OAAO,IAAI,iBAAiB,WAAW;AACzC,cAAM,IAAI,MAAM,kDAAkD;AAAA,MACpE;AACA,UAAI,CAAC,IAAI,gBAAgB,IAAI,iBAAiB,MAAM,kBAC/C,CAAC,IAAI,cAAc,SAAS,MAAM,cAAc,KAAK,CAAC,IAAI,cAAc,SAAS,SAAS,GAAG;AAChG,cAAM,IAAI,MAAM,0EAA0E;AAAA,MAC5F;AACA,aAAO,OAAO,OAAO;AAAA,QACnB,MAAM,OAAO,OAAO;AAAA,UAClB,KAAK,KAAK;AAAA,UAAK,UAAU,MAAM;AAAA,UAAU,OAAO,MAAM;AAAA,UACtD,UAAU,KAAK,aAAa;AAAA,UAAM,QAAQ,KAAK;AAAA,UAAQ,OAAO,KAAK;AAAA,UACnE,cAAc,IAAI;AAAA,QACpB,CAAC;AAAA,QACD,GAAG;AAAA,QACH,cAAc,OAAO,OAAO,CAAC,GAAG,YAAY,CAAC;AAAA,QAC7C,cAAc,IAAI;AAAA,MACpB,CAAC;AAAA,IACH,GAAG;AACH,YAAQ,SAAS,IAAI,KAAK,OAAO;AAAA,EACnC;AACA,SAAO;AACT;AAEA,eAAsB,yBAAyB,OAOX;AAClC,QAAM,EAAE,MAAM,YAAY,WAAW,QAAQ,QAAQ,IAAI;AACzD,QAAM,WAAW,sBAAsB,MAAM,YAA0B,WAAkC,EAAE,sBAAsB,MAAM,qBAAqB,CAAC;AAC7J,MAAI,CAAC,SAAS,GAAI,QAAO,EAAE,IAAI,OAAO,QAAQ,SAAS,WAAW,MAAM,MAAM,KAAK,QAAQ,SAAS,WAAW,MAAM;AACrH,QAAM,OAAO,CAAC,QAA+B,QAAgB,eAAgD;AAC3G,WAAO,KAAK,kCAAkC,EAAE,YAAY,QAAQ,cAAc,WAAW,IAAI,OAAO,CAAC;AACzG,WAAO,EAAE,IAAI,OAAO,QAAQ,QAAQ,WAAW,KAAK;AAAA,EACtD;AACA,QAAM,WAAW,4BAA4B;AAC7C,MAAI,SAAS,QAAS,QAAO,KAAK,KAAK,kBAAkB;AACzD,QAAM,qBAAqB,mCAAmC,UAAU,UAAU,8BAA8B,CAAC,CAAC;AAClH,MAAI,CAAC,mBAAmB,QAAS,QAAO,KAAK,KAAK,sBAAsB;AACxE,QAAM,UAAU,+BAA+B,UAAU;AACzD,QAAM,eAAe,CAAC,GAAG,mBAAmB,MAAM,GAAG,SAAS,iBAAiB,OAAO,CAAC,WACrF,gCAAgC,OAAO,iBAAiB,UAAU,IAAI,CACvE,CAAC,EAAE,OAAO,CAAC,gBAAgB,+BAA+B,YAAY,cAAc,OAAO,CAAC;AAC7F,QAAM,YAAY,SAAS,UAAU,OAAO,CAAC,aAAa,gCAAgC,UAAU,UAAU,MAAM,SAAS,MAAM,CAAC;AACpI,MAAI,CAAC,aAAa,UAAU,CAAC,UAAU,OAAQ,QAAO,EAAE,IAAI,MAAM,WAAW,MAAM;AACnF,MAAI,CAAC,KAAM,QAAO,KAAK,KAAK,yBAAyB;AACrD,aAAW,eAAe,cAAc;AACtC,UAAM,kBAAkB,QAAQ,OAAO,CAAC,WAAW,gCAAgC,YAAY,cAAc,OAAO,QAAQ,CAAC;AAC7H,UAAM,WAAW,UAAU,KAAK,CAAC,aAAa,SAAS,OAAO,YAAY,UAAU;AACpF,QAAI,CAAC,aAAa,gBAAgB,SAC9B,gBAAgB,KAAK,CAAC,WAAW,CAAC,gCAAgC,SAAS,gBAAgB,KAAK,OAAO,QAAQ,CAAC,KAC/G,SAAS,gBAAgB,SAAS,KAAM,QAAO,KAAK,KAAK,6BAA6B,YAAY,UAAU;AACjH,QAAI,QAAQ,KAAK,CAAC,WAAW,gCAAgC,YAAY,cAAc,OAAO,QAAQ,KAAK,CAAC,OAAO,QAAQ,GAAG;AAC5H,aAAO,KAAK,KAAK,iBAAiB,YAAY,UAAU;AAAA,IAC1D;AAAA,EACF;AACA,MAAI,CAAC,QAAS,QAAO,KAAK,KAAK,wBAAwB;AACvD,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,aAAa,MAAM,eAAe,SAAS,MAAM,UAAU,GAAG,oBAAoB,IAAI,gBAAgB,CAAC;AAAA,EACzH,SAAS,OAAO;AACd,wBAAoB,GAAG,YAAY,IAAI,MAAM,iDAAiD,GAAG;AAAA,MAC/F,QAAQ;AAAA,MAAe,MAAM;AAAA,MAAyC,YAAY,EAAE,cAAc,WAAW,IAAI,OAAO;AAAA,IAC1H,CAAC;AACD,WAAO,KAAK,iBAAiB,gBAAgB,MAAM,KAAK,2BAA2B;AAAA,EACrF;AACA,QAAM,eAAe,sBAAsB,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,cAAc,QAAQ,aAAa,GAAG,YAA0B,WAAkC,EAAE,sBAAsB,MAAM,qBAAqB,CAAC;AACvN,MAAI,CAAC,aAAa,GAAI,QAAO,KAAK,KAAK,eAAe;AACtD,aAAW,YAAY,WAAW;AAChC,UAAM,aAAa,IAAI,gBAAgB;AACvC,QAAI,QAAQ,QAAQ,eAAe,IAAI,SAAS,EAAE;AAClD,QAAI,CAAC,OAAO;AACV,cAAQ,oBAAI,IAAI;AAChB,cAAQ,eAAe,IAAI,SAAS,IAAI,KAAK;AAAA,IAC/C;AACA,QAAI;AACF,YAAM,MAAM,MAAM,aAAa,MAAM,SAAS,QAAQ,OAAO,OAAO;AAAA,QAClE;AAAA,QAAQ;AAAA,QACR,YAAY,OAAO,OAAO;AAAA,UACxB,IAAI,WAAW;AAAA,UAAI,UAAU,WAAW;AAAA,UAAU,UAAU,WAAW;AAAA,UACvE,eAAe,WAAW;AAAA,UAAe,UAAU,WAAW;AAAA,UAC9D,gBAAgB,WAAW;AAAA,UAAgB,UAAU,WAAW;AAAA,UAAU,UAAU,WAAW;AAAA,QACjG,CAAC;AAAA,QACD,WAAW,OAAO,OAAO;AAAA,UACvB,MAAM,UAAU;AAAA,UAAM,UAAU,UAAU;AAAA,UAC1C,UAAU,UAAU;AAAA,UAAU,gBAAgB,UAAU;AAAA,QAC1D,CAAC;AAAA,QACD;AAAA,QAAS,WAAW,QAAQ;AAAA,QAAW;AAAA,QAAO,QAAQ,WAAW;AAAA,MACnE,CAAC,CAAC,GAAG,SAAS,aAAa,oBAAoB,UAAU;AACzD,YAAM,WAAW,+BAA+B,MAAM,GAAG;AACzD,UAAI,CAAC,SAAS,GAAI,QAAO,KAAK,SAAS,QAAQ,SAAS,QAAQ,SAAS,EAAE;AAAA,IAC7E,SAAS,OAAO;AACd,iBAAW,MAAM;AACjB,0BAAoB,GAAG,YAAY,IAAI,MAAM,iBAAiB,gBAC1D,4DACA,uEAAuE,GAAG;AAAA,QAC5E,QAAQ;AAAA,QAAe,MAAM;AAAA,QAC7B,YAAY,EAAE,YAAY,SAAS,IAAI,cAAc,WAAW,IAAI,OAAO;AAAA,MAC7E,CAAC;AACD,aAAO,KAAK,iBAAiB,gBAAgB,MAAM,KAAK,iBAAiB,gBAAgB,qBAAqB,mBAAmB,SAAS,EAAE;AAAA,IAC9I;AAAA,EACF;AACA,SAAO,EAAE,IAAI,MAAM,WAAW,KAAK;AACrC;",
+  "names": []
+}

package/dist/modules/attachments/lib/access-types.js

@@ -0,0 +1 @@
+//# sourceMappingURL=access-types.js.map

package/dist/modules/attachments/lib/access-types.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": [],
+  "sourcesContent": [],
+  "mappings": "",
+  "names": []
+}

package/dist/modules/attachments/lib/attachment-service.js

@@ -1,9 +1,11 @@
+import { evaluateAttachmentAccess } from "./access-runner.js";
+import { throwAttachmentAccessError } from "./access-errors.js";
 import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { createLogger } from "@open-mercato/shared/lib/logger";
 import { Attachment, AttachmentPartition } from "../data/entities.js";
-import { assertAttachmentScopeInvariant, checkAttachmentAccess } from "./access.js";
+import { assertAttachmentScopeInvariant } from "./access.js";
 import { buildAttachmentFileUrl } from "./imageUrls.js";
 import {
   isScopedAttachmentUploadError
@@ -126,10 +128,11 @@ class DefaultAttachmentService {
    * share the one reservation ledger rather than run a parallel quota
    * mechanism — so its absence surfaces there, at the call that needs it.
    */
-  constructor(em, storageDriverFactory, resolveScopedUploadService) {
+  constructor(em, storageDriverFactory, resolveScopedUploadService, resolveAccessContext) {
     this.em = em;
     this.storageDriverFactory = storageDriverFactory;
     this.resolveScopedUploadService = resolveScopedUploadService;
+    this.resolveAccessContext = resolveAccessContext;
   }
   validateUpload(input) {
     if (!isMultipartRequestWithinUploadLimit(input.contentLength ?? null)) {
@@ -221,10 +224,15 @@ class DefaultAttachmentService {
       { tenantId: input.auth.tenantId, organizationId: input.auth.orgId }
     );
     if (!partition) throw new CrudHttpError(500, { error: "Attachment partition is not configured" });
-    const access = checkAttachmentAccess(input.auth, attachment, partition, { requireAuthForPublic: true });
-    if (!access.ok) {
-      throw new CrudHttpError(access.status, { error: access.status === 401 ? "Unauthorized" : "Forbidden" });
-    }
+    const access = await evaluateAttachmentAccess({
+      auth: input.auth,
+      attachment,
+      partition,
+      action: "read",
+      context: this.resolveAccessContext?.(),
+      requireAuthForPublic: true
+    });
+    if (!access.ok) await throwAttachmentAccessError(access.status);
     if (!partitionMatchesScope(partition, input.auth.tenantId, input.auth.orgId)) {
       throw new CrudHttpError(403, { error: "Attachment partition is not accessible for this scope" });
     }