@open-mercato/core 0.6.8-develop.7015.1.af90a2ddc7 → 0.6.8-develop.7016.1.4ed7b1e49d

package/dist/modules/auth/services/principalService.js

@@ -0,0 +1,200 @@
+import { sql } from "kysely";
+import { escapeLikePattern } from "@open-mercato/shared/lib/db/escapeLikePattern";
+import { findOneWithDecryption, findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { Role, RoleAcl, User, UserRole } from "../data/entities.js";
+import { listSuperAdminUserIds } from "../lib/grantChecks.js";
+import { resolveRoleOrganizationScope, roleAclGrantsPrincipalOrganization } from "./roleOrganizationScope.js";
+const MAX_ROLE_PAGE_SIZE = 100;
+const MAX_ROLE_RESULTS = 1e3;
+function normalizeIds(ids) {
+  return Array.from(new Set(ids.map((id) => id.trim()).filter(Boolean)));
+}
+function relationId(value) {
+  if (typeof value === "string") return value.trim() || null;
+  if (!value || typeof value !== "object") return null;
+  const id = value.id;
+  return typeof id === "string" && id.trim().length > 0 ? id.trim() : null;
+}
+class DefaultAuthPrincipalService {
+  constructor(em, organizationHierarchyService) {
+    this.em = em;
+    this.organizationHierarchyService = organizationHierarchyService;
+  }
+  async principalExists(input) {
+    if (input.type === "role") {
+      return (await this.filterActiveRoleIds([input.id], input.scope)).includes(input.id);
+    }
+    return Boolean(await findOneWithDecryption(
+      this.em,
+      User,
+      {
+        id: input.id,
+        tenantId: input.scope.tenantId,
+        deletedAt: null,
+        $or: [{ organizationId: null }, { organizationId: input.scope.organizationId }]
+      },
+      { fields: ["id"] },
+      input.scope
+    ));
+  }
+  async resolveActiveUserRoleIds(userId, scope) {
+    const links = await findWithDecryption(
+      this.em,
+      UserRole,
+      {
+        user: userId,
+        deletedAt: null,
+        role: { tenantId: scope.tenantId, deletedAt: null }
+      },
+      { fields: ["role"] },
+      scope
+    );
+    return this.filterActiveRoleIds(
+      normalizeIds(links.flatMap((link) => {
+        const id = relationId(link.role);
+        return id ? [id] : [];
+      })),
+      scope
+    );
+  }
+  async filterActiveRoleIds(roleIds, scope) {
+    const ids = normalizeIds(roleIds);
+    if (ids.length === 0) return [];
+    const roles = await findWithDecryption(
+      this.em,
+      Role,
+      { id: { $in: ids }, tenantId: scope.tenantId, deletedAt: null },
+      { fields: ["id"] },
+      scope
+    );
+    const activeIds = normalizeIds(roles.map((role) => role.id));
+    if (activeIds.length === 0) return [];
+    const roleOrganizationScope = await resolveRoleOrganizationScope(
+      this.organizationHierarchyService,
+      scope.tenantId,
+      scope.organizationId
+    );
+    const acls = await findWithDecryption(
+      this.em,
+      RoleAcl,
+      {
+        tenantId: scope.tenantId,
+        role: { $in: activeIds },
+        deletedAt: null
+      },
+      { fields: ["role", "organizationsJson"] },
+      scope
+    );
+    const eligibilityById = /* @__PURE__ */ new Map();
+    for (const acl of acls) {
+      const id = relationId(acl.role);
+      if (!id) continue;
+      eligibilityById.set(
+        id,
+        eligibilityById.get(id) === true || roleAclGrantsPrincipalOrganization(acl, roleOrganizationScope)
+      );
+    }
+    return activeIds.filter((id) => eligibilityById.get(id) !== false);
+  }
+  async resolveLabels(input) {
+    const ids = normalizeIds(input.ids);
+    if (ids.length === 0) return [];
+    if (input.type === "role") {
+      const eligibleIds = await this.filterActiveRoleIds(ids, input.scope);
+      if (eligibleIds.length === 0) return [];
+      const roles = await findWithDecryption(
+        this.em,
+        Role,
+        { id: { $in: eligibleIds }, tenantId: input.scope.tenantId, deletedAt: null },
+        { fields: ["id", "name"] },
+        input.scope
+      );
+      return roles.map((role) => ({ id: role.id, label: role.name, secondary: null }));
+    }
+    const users = await findWithDecryption(
+      this.em,
+      User,
+      {
+        id: { $in: ids },
+        tenantId: input.scope.tenantId,
+        deletedAt: null,
+        $or: [{ organizationId: null }, { organizationId: input.scope.organizationId }]
+      },
+      { fields: ["id", "name", "email"] },
+      input.scope
+    );
+    return users.map((user) => ({
+      id: user.id,
+      label: user.name?.trim() || user.email,
+      secondary: user.name?.trim() && user.email !== user.name.trim() ? user.email : null
+    }));
+  }
+  async queryActiveRolePage(input) {
+    const page = Math.max(1, Math.floor(input.page));
+    const pageSize = Math.min(MAX_ROLE_PAGE_SIZE, Math.max(1, Math.floor(input.pageSize)));
+    const offset = (page - 1) * pageSize;
+    const excludedIds = normalizeIds(input.excludedIds ?? []);
+    const roleOrganizationScope = await resolveRoleOrganizationScope(
+      this.organizationHierarchyService,
+      input.scope.tenantId,
+      input.scope.organizationId
+    );
+    const db = this.em.getKysely();
+    let eligibleRoles = db.selectFrom("roles as r").where("r.tenant_id", "=", input.scope.tenantId).where("r.deleted_at", "is", null);
+    if (roleOrganizationScope) {
+      const allowedOrganizations = Array.from(roleOrganizationScope);
+      const organizationPredicates = [
+        sql`ra.organizations_json is null`,
+        sql`ra.organizations_json::jsonb @> ${JSON.stringify(["__all__"])}::jsonb`,
+        ...allowedOrganizations.map((organizationId) => sql`ra.organizations_json::jsonb @> ${JSON.stringify([organizationId])}::jsonb`)
+      ];
+      const organizationAllowed = sql`(${sql.join(organizationPredicates, sql` or `)})`;
+      eligibleRoles = eligibleRoles.where(sql`(
+        not exists (
+          select 1
+          from role_acls as ra_any
+          where ra_any.role_id = r.id
+            and ra_any.tenant_id = ${input.scope.tenantId}
+            and ra_any.deleted_at is null
+        )
+        or exists (
+          select 1
+          from role_acls as ra
+          where ra.role_id = r.id
+            and ra.tenant_id = ${input.scope.tenantId}
+            and ra.deleted_at is null
+            and ${organizationAllowed}
+        )
+      )`);
+    }
+    if (input.search?.trim()) {
+      const searchPattern = `%${escapeLikePattern(input.search.trim())}%`;
+      eligibleRoles = eligibleRoles.where(sql`r.name ilike ${searchPattern}`);
+    }
+    if (excludedIds.length > 0) {
+      eligibleRoles = eligibleRoles.where("r.id", "not in", excludedIds);
+    }
+    const boundedRoleIds = eligibleRoles.select("r.id").limit(MAX_ROLE_RESULTS).as("bounded_roles");
+    const countQuery = db.selectFrom(boundedRoleIds).select(sql`count(*)`.as("count"));
+    const pageQuery = eligibleRoles.select(["r.id", "r.name"]).orderBy("r.id", "asc").limit(offset < MAX_ROLE_RESULTS ? Math.min(pageSize, MAX_ROLE_RESULTS - offset) : 0).offset(Math.min(offset, MAX_ROLE_RESULTS));
+    const [rows, countRow] = await Promise.all([
+      pageQuery.execute(),
+      countQuery.executeTakeFirst()
+    ]);
+    const parsedTotal = Number(countRow?.count ?? 0);
+    const total = Number.isFinite(parsedTotal) ? Math.min(MAX_ROLE_RESULTS, Math.max(0, Math.floor(parsedTotal))) : 0;
+    return {
+      items: rows.map((role) => ({ id: role.id, label: role.name, secondary: null })),
+      page,
+      pageSize,
+      total
+    };
+  }
+  async listSuperAdminUserIds(tenantId) {
+    return Array.from(await listSuperAdminUserIds(this.em, tenantId));
+  }
+}
+export {
+  DefaultAuthPrincipalService
+};
+//# sourceMappingURL=principalService.js.map

package/dist/modules/auth/services/principalService.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/auth/services/principalService.ts"],
+  "sourcesContent": ["import type { FilterQuery } from '@mikro-orm/core'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { sql } from 'kysely'\nimport type {\n  AuthPrincipalLabel,\n  AuthPrincipalRolePage,\n  AuthPrincipalService,\n  OrganizationHierarchyService,\n  PrincipalScope,\n} from '@open-mercato/shared/lib/auth/principal-service'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { Role, RoleAcl, User, UserRole } from '../data/entities'\nimport { listSuperAdminUserIds } from '../lib/grantChecks'\nimport { resolveRoleOrganizationScope, roleAclGrantsPrincipalOrganization } from './roleOrganizationScope'\n\nconst MAX_ROLE_PAGE_SIZE = 100\nconst MAX_ROLE_RESULTS = 1_000\n\ntype AuthPrincipalDatabase = {\n  roles: {\n    id: string\n    tenant_id: string\n    name: string\n    deleted_at: Date | null\n  }\n  role_acls: {\n    role_id: string\n    tenant_id: string\n    organizations_json: string[] | null\n    deleted_at: Date | null\n  }\n}\n\nfunction normalizeIds(ids: string[]): string[] {\n  return Array.from(new Set(ids.map((id) => id.trim()).filter(Boolean)))\n}\n\nfunction relationId(value: unknown): string | null {\n  if (typeof value === 'string') return value.trim() || null\n  if (!value || typeof value !== 'object') return null\n  const id = (value as { id?: unknown }).id\n  return typeof id === 'string' && id.trim().length > 0 ? id.trim() : null\n}\n\nexport class DefaultAuthPrincipalService implements AuthPrincipalService {\n  constructor(\n    private readonly em: EntityManager,\n    private readonly organizationHierarchyService?: OrganizationHierarchyService,\n  ) {}\n\n  async principalExists(input: {\n    type: 'user' | 'role'\n    id: string\n    scope: PrincipalScope\n  }): Promise<boolean> {\n    if (input.type === 'role') {\n      return (await this.filterActiveRoleIds([input.id], input.scope)).includes(input.id)\n    }\n    return Boolean(await findOneWithDecryption(\n      this.em,\n      User,\n      {\n        id: input.id,\n        tenantId: input.scope.tenantId,\n        deletedAt: null,\n        $or: [{ organizationId: null }, { organizationId: input.scope.organizationId }],\n      } as FilterQuery<User>,\n      { fields: ['id'] as const },\n      input.scope,\n    ))\n  }\n\n  async resolveActiveUserRoleIds(userId: string, scope: PrincipalScope): Promise<string[]> {\n    const links = await findWithDecryption(\n      this.em,\n      UserRole,\n      {\n        user: userId,\n        deletedAt: null,\n        role: { tenantId: scope.tenantId, deletedAt: null },\n      } as FilterQuery<UserRole>,\n      { fields: ['role'] as const },\n      scope,\n    )\n    return this.filterActiveRoleIds(\n      normalizeIds(links.flatMap((link) => {\n        const id = relationId(link.role)\n        return id ? [id] : []\n      })),\n      scope,\n    )\n  }\n\n  async filterActiveRoleIds(roleIds: string[], scope: PrincipalScope): Promise<string[]> {\n    const ids = normalizeIds(roleIds)\n    if (ids.length === 0) return []\n    const roles = await findWithDecryption(\n      this.em,\n      Role,\n      { id: { $in: ids }, tenantId: scope.tenantId, deletedAt: null } as FilterQuery<Role>,\n      { fields: ['id'] as const },\n      scope,\n    )\n    const activeIds = normalizeIds(roles.map((role) => role.id))\n    if (activeIds.length === 0) return []\n    const roleOrganizationScope = await resolveRoleOrganizationScope(\n      this.organizationHierarchyService,\n      scope.tenantId,\n      scope.organizationId,\n    )\n    const acls = await findWithDecryption(\n      this.em,\n      RoleAcl,\n      {\n        tenantId: scope.tenantId,\n        role: { $in: activeIds },\n        deletedAt: null,\n      } as FilterQuery<RoleAcl>,\n      { fields: ['role', 'organizationsJson'] as const },\n      scope,\n    )\n    const eligibilityById = new Map<string, boolean>()\n    for (const acl of acls) {\n      const id = relationId(acl.role)\n      if (!id) continue\n      eligibilityById.set(\n        id,\n        eligibilityById.get(id) === true || roleAclGrantsPrincipalOrganization(acl, roleOrganizationScope),\n      )\n    }\n    // A tenant role without an ACL remains a valid explicit-share principal.\n    // Only an existing ACL can restrict that role away from this organization.\n    return activeIds.filter((id) => eligibilityById.get(id) !== false)\n  }\n\n  async resolveLabels(input: {\n    type: 'user' | 'role'\n    ids: string[]\n    scope: PrincipalScope\n  }): Promise<AuthPrincipalLabel[]> {\n    const ids = normalizeIds(input.ids)\n    if (ids.length === 0) return []\n    if (input.type === 'role') {\n      const eligibleIds = await this.filterActiveRoleIds(ids, input.scope)\n      if (eligibleIds.length === 0) return []\n      const roles = await findWithDecryption(\n        this.em,\n        Role,\n        { id: { $in: eligibleIds }, tenantId: input.scope.tenantId, deletedAt: null } as FilterQuery<Role>,\n        { fields: ['id', 'name'] as const },\n        input.scope,\n      )\n      return roles.map((role) => ({ id: role.id, label: role.name, secondary: null }))\n    }\n    const users = await findWithDecryption(\n      this.em,\n      User,\n      {\n        id: { $in: ids },\n        tenantId: input.scope.tenantId,\n        deletedAt: null,\n        $or: [{ organizationId: null }, { organizationId: input.scope.organizationId }],\n      } as FilterQuery<User>,\n      { fields: ['id', 'name', 'email'] as const },\n      input.scope,\n    )\n    return users.map((user) => ({\n      id: user.id,\n      label: user.name?.trim() || user.email,\n      secondary: user.name?.trim() && user.email !== user.name.trim() ? user.email : null,\n    }))\n  }\n\n  async queryActiveRolePage(input: {\n    scope: PrincipalScope\n    search?: string\n    excludedIds?: string[]\n    page: number\n    pageSize: number\n  }): Promise<AuthPrincipalRolePage> {\n    const page = Math.max(1, Math.floor(input.page))\n    const pageSize = Math.min(MAX_ROLE_PAGE_SIZE, Math.max(1, Math.floor(input.pageSize)))\n    const offset = (page - 1) * pageSize\n    const excludedIds = normalizeIds(input.excludedIds ?? [])\n    const roleOrganizationScope = await resolveRoleOrganizationScope(\n      this.organizationHierarchyService,\n      input.scope.tenantId,\n      input.scope.organizationId,\n    )\n    const db = this.em.getKysely<AuthPrincipalDatabase>()\n    let eligibleRoles = db\n      .selectFrom('roles as r')\n      .where('r.tenant_id', '=', input.scope.tenantId)\n      .where('r.deleted_at', 'is', null)\n\n    if (roleOrganizationScope) {\n      const allowedOrganizations = Array.from(roleOrganizationScope)\n      const organizationPredicates = [\n        sql<boolean>`ra.organizations_json is null`,\n        sql<boolean>`ra.organizations_json::jsonb @> ${JSON.stringify(['__all__'])}::jsonb`,\n        ...allowedOrganizations.map((organizationId) => (\n          sql<boolean>`ra.organizations_json::jsonb @> ${JSON.stringify([organizationId])}::jsonb`\n        )),\n      ]\n      const organizationAllowed = sql<boolean>`(${sql.join(organizationPredicates, sql` or `)})`\n      eligibleRoles = eligibleRoles.where(sql<boolean>`(\n        not exists (\n          select 1\n          from role_acls as ra_any\n          where ra_any.role_id = r.id\n            and ra_any.tenant_id = ${input.scope.tenantId}\n            and ra_any.deleted_at is null\n        )\n        or exists (\n          select 1\n          from role_acls as ra\n          where ra.role_id = r.id\n            and ra.tenant_id = ${input.scope.tenantId}\n            and ra.deleted_at is null\n            and ${organizationAllowed}\n        )\n      )`)\n    }\n    if (input.search?.trim()) {\n      const searchPattern = `%${escapeLikePattern(input.search.trim())}%`\n      eligibleRoles = eligibleRoles.where(sql<boolean>`r.name ilike ${searchPattern}`)\n    }\n    if (excludedIds.length > 0) {\n      eligibleRoles = eligibleRoles.where('r.id', 'not in', excludedIds)\n    }\n\n    const boundedRoleIds = eligibleRoles\n      .select('r.id')\n      .limit(MAX_ROLE_RESULTS)\n      .as('bounded_roles')\n    const countQuery = db\n      .selectFrom(boundedRoleIds)\n      .select(sql<string>`count(*)`.as('count'))\n    const pageQuery = eligibleRoles\n      .select(['r.id', 'r.name'])\n      .orderBy('r.id', 'asc')\n      .limit(offset < MAX_ROLE_RESULTS ? Math.min(pageSize, MAX_ROLE_RESULTS - offset) : 0)\n      .offset(Math.min(offset, MAX_ROLE_RESULTS))\n\n    const [rows, countRow] = await Promise.all([\n      pageQuery.execute() as Promise<Array<{ id: string; name: string }>>,\n      countQuery.executeTakeFirst() as Promise<{ count?: string | number } | undefined>,\n    ])\n    const parsedTotal = Number(countRow?.count ?? 0)\n    const total = Number.isFinite(parsedTotal)\n      ? Math.min(MAX_ROLE_RESULTS, Math.max(0, Math.floor(parsedTotal)))\n      : 0\n\n    return {\n      items: rows.map((role) => ({ id: role.id, label: role.name, secondary: null })),\n      page,\n      pageSize,\n      total,\n    }\n  }\n\n  async listSuperAdminUserIds(tenantId: string): Promise<string[]> {\n    return Array.from(await listSuperAdminUserIds(this.em, tenantId))\n  }\n}\n"],
+  "mappings": "AAEA,SAAS,WAAW;AAQpB,SAAS,yBAAyB;AAClC,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,MAAM,SAAS,MAAM,gBAAgB;AAC9C,SAAS,6BAA6B;AACtC,SAAS,8BAA8B,0CAA0C;AAEjF,MAAM,qBAAqB;AAC3B,MAAM,mBAAmB;AAiBzB,SAAS,aAAa,KAAyB;AAC7C,SAAO,MAAM,KAAK,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,EAAE,OAAO,OAAO,CAAC,CAAC;AACvE;AAEA,SAAS,WAAW,OAA+B;AACjD,MAAI,OAAO,UAAU,SAAU,QAAO,MAAM,KAAK,KAAK;AACtD,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,KAAM,MAA2B;AACvC,SAAO,OAAO,OAAO,YAAY,GAAG,KAAK,EAAE,SAAS,IAAI,GAAG,KAAK,IAAI;AACtE;AAEO,MAAM,4BAA4D;AAAA,EACvE,YACmB,IACA,8BACjB;AAFiB;AACA;AAAA,EAChB;AAAA,EAEH,MAAM,gBAAgB,OAID;AACnB,QAAI,MAAM,SAAS,QAAQ;AACzB,cAAQ,MAAM,KAAK,oBAAoB,CAAC,MAAM,EAAE,GAAG,MAAM,KAAK,GAAG,SAAS,MAAM,EAAE;AAAA,IACpF;AACA,WAAO,QAAQ,MAAM;AAAA,MACnB,KAAK;AAAA,MACL;AAAA,MACA;AAAA,QACE,IAAI,MAAM;AAAA,QACV,UAAU,MAAM,MAAM;AAAA,QACtB,WAAW;AAAA,QACX,KAAK,CAAC,EAAE,gBAAgB,KAAK,GAAG,EAAE,gBAAgB,MAAM,MAAM,eAAe,CAAC;AAAA,MAChF;AAAA,MACA,EAAE,QAAQ,CAAC,IAAI,EAAW;AAAA,MAC1B,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,yBAAyB,QAAgB,OAA0C;AACvF,UAAM,QAAQ,MAAM;AAAA,MAClB,KAAK;AAAA,MACL;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,WAAW;AAAA,QACX,MAAM,EAAE,UAAU,MAAM,UAAU,WAAW,KAAK;AAAA,MACpD;AAAA,MACA,EAAE,QAAQ,CAAC,MAAM,EAAW;AAAA,MAC5B;AAAA,IACF;AACA,WAAO,KAAK;AAAA,MACV,aAAa,MAAM,QAAQ,CAAC,SAAS;AACnC,cAAM,KAAK,WAAW,KAAK,IAAI;AAC/B,eAAO,KAAK,CAAC,EAAE,IAAI,CAAC;AAAA,MACtB,CAAC,CAAC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,oBAAoB,SAAmB,OAA0C;AACrF,UAAM,MAAM,aAAa,OAAO;AAChC,QAAI,IAAI,WAAW,EAAG,QAAO,CAAC;AAC9B,UAAM,QAAQ,MAAM;AAAA,MAClB,KAAK;AAAA,MACL;AAAA,MACA,EAAE,IAAI,EAAE,KAAK,IAAI,GAAG,UAAU,MAAM,UAAU,WAAW,KAAK;AAAA,MAC9D,EAAE,QAAQ,CAAC,IAAI,EAAW;AAAA,MAC1B;AAAA,IACF;AACA,UAAM,YAAY,aAAa,MAAM,IAAI,CAAC,SAAS,KAAK,EAAE,CAAC;AAC3D,QAAI,UAAU,WAAW,EAAG,QAAO,CAAC;AACpC,UAAM,wBAAwB,MAAM;AAAA,MAClC,KAAK;AAAA,MACL,MAAM;AAAA,MACN,MAAM;AAAA,IACR;AACA,UAAM,OAAO,MAAM;AAAA,MACjB,KAAK;AAAA,MACL;AAAA,MACA;AAAA,QACE,UAAU,MAAM;AAAA,QAChB,MAAM,EAAE,KAAK,UAAU;AAAA,QACvB,WAAW;AAAA,MACb;AAAA,MACA,EAAE,QAAQ,CAAC,QAAQ,mBAAmB,EAAW;AAAA,MACjD;AAAA,IACF;AACA,UAAM,kBAAkB,oBAAI,IAAqB;AACjD,eAAW,OAAO,MAAM;AACtB,YAAM,KAAK,WAAW,IAAI,IAAI;AAC9B,UAAI,CAAC,GAAI;AACT,sBAAgB;AAAA,QACd;AAAA,QACA,gBAAgB,IAAI,EAAE,MAAM,QAAQ,mCAAmC,KAAK,qBAAqB;AAAA,MACnG;AAAA,IACF;AAGA,WAAO,UAAU,OAAO,CAAC,OAAO,gBAAgB,IAAI,EAAE,MAAM,KAAK;AAAA,EACnE;AAAA,EAEA,MAAM,cAAc,OAIc;AAChC,UAAM,MAAM,aAAa,MAAM,GAAG;AAClC,QAAI,IAAI,WAAW,EAAG,QAAO,CAAC;AAC9B,QAAI,MAAM,SAAS,QAAQ;AACzB,YAAM,cAAc,MAAM,KAAK,oBAAoB,KAAK,MAAM,KAAK;AACnE,UAAI,YAAY,WAAW,EAAG,QAAO,CAAC;AACtC,YAAM,QAAQ,MAAM;AAAA,QAClB,KAAK;AAAA,QACL;AAAA,QACA,EAAE,IAAI,EAAE,KAAK,YAAY,GAAG,UAAU,MAAM,MAAM,UAAU,WAAW,KAAK;AAAA,QAC5E,EAAE,QAAQ,CAAC,MAAM,MAAM,EAAW;AAAA,QAClC,MAAM;AAAA,MACR;AACA,aAAO,MAAM,IAAI,CAAC,UAAU,EAAE,IAAI,KAAK,IAAI,OAAO,KAAK,MAAM,WAAW,KAAK,EAAE;AAAA,IACjF;AACA,UAAM,QAAQ,MAAM;AAAA,MAClB,KAAK;AAAA,MACL;AAAA,MACA;AAAA,QACE,IAAI,EAAE,KAAK,IAAI;AAAA,QACf,UAAU,MAAM,MAAM;AAAA,QACtB,WAAW;AAAA,QACX,KAAK,CAAC,EAAE,gBAAgB,KAAK,GAAG,EAAE,gBAAgB,MAAM,MAAM,eAAe,CAAC;AAAA,MAChF;AAAA,MACA,EAAE,QAAQ,CAAC,MAAM,QAAQ,OAAO,EAAW;AAAA,MAC3C,MAAM;AAAA,IACR;AACA,WAAO,MAAM,IAAI,CAAC,UAAU;AAAA,MAC1B,IAAI,KAAK;AAAA,MACT,OAAO,KAAK,MAAM,KAAK,KAAK,KAAK;AAAA,MACjC,WAAW,KAAK,MAAM,KAAK,KAAK,KAAK,UAAU,KAAK,KAAK,KAAK,IAAI,KAAK,QAAQ;AAAA,IACjF,EAAE;AAAA,EACJ;AAAA,EAEA,MAAM,oBAAoB,OAMS;AACjC,UAAM,OAAO,KAAK,IAAI,GAAG,KAAK,MAAM,MAAM,IAAI,CAAC;AAC/C,UAAM,WAAW,KAAK,IAAI,oBAAoB,KAAK,IAAI,GAAG,KAAK,MAAM,MAAM,QAAQ,CAAC,CAAC;AACrF,UAAM,UAAU,OAAO,KAAK;AAC5B,UAAM,cAAc,aAAa,MAAM,eAAe,CAAC,CAAC;AACxD,UAAM,wBAAwB,MAAM;AAAA,MAClC,KAAK;AAAA,MACL,MAAM,MAAM;AAAA,MACZ,MAAM,MAAM;AAAA,IACd;AACA,UAAM,KAAK,KAAK,GAAG,UAAiC;AACpD,QAAI,gBAAgB,GACjB,WAAW,YAAY,EACvB,MAAM,eAAe,KAAK,MAAM,MAAM,QAAQ,EAC9C,MAAM,gBAAgB,MAAM,IAAI;AAEnC,QAAI,uBAAuB;AACzB,YAAM,uBAAuB,MAAM,KAAK,qBAAqB;AAC7D,YAAM,yBAAyB;AAAA,QAC7B;AAAA,QACA,sCAA+C,KAAK,UAAU,CAAC,SAAS,CAAC,CAAC;AAAA,QAC1E,GAAG,qBAAqB,IAAI,CAAC,mBAC3B,sCAA+C,KAAK,UAAU,CAAC,cAAc,CAAC,CAAC,SAChF;AAAA,MACH;AACA,YAAM,sBAAsB,OAAgB,IAAI,KAAK,wBAAwB,SAAS,CAAC;AACvF,sBAAgB,cAAc,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA,qCAKL,MAAM,MAAM,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iCAOxB,MAAM,MAAM,QAAQ;AAAA;AAAA,kBAEnC,mBAAmB;AAAA;AAAA,QAE7B;AAAA,IACJ;AACA,QAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,YAAM,gBAAgB,IAAI,kBAAkB,MAAM,OAAO,KAAK,CAAC,CAAC;AAChE,sBAAgB,cAAc,MAAM,mBAA4B,aAAa,EAAE;AAAA,IACjF;AACA,QAAI,YAAY,SAAS,GAAG;AAC1B,sBAAgB,cAAc,MAAM,QAAQ,UAAU,WAAW;AAAA,IACnE;AAEA,UAAM,iBAAiB,cACpB,OAAO,MAAM,EACb,MAAM,gBAAgB,EACtB,GAAG,eAAe;AACrB,UAAM,aAAa,GAChB,WAAW,cAAc,EACzB,OAAO,cAAsB,GAAG,OAAO,CAAC;AAC3C,UAAM,YAAY,cACf,OAAO,CAAC,QAAQ,QAAQ,CAAC,EACzB,QAAQ,QAAQ,KAAK,EACrB,MAAM,SAAS,mBAAmB,KAAK,IAAI,UAAU,mBAAmB,MAAM,IAAI,CAAC,EACnF,OAAO,KAAK,IAAI,QAAQ,gBAAgB,CAAC;AAE5C,UAAM,CAAC,MAAM,QAAQ,IAAI,MAAM,QAAQ,IAAI;AAAA,MACzC,UAAU,QAAQ;AAAA,MAClB,WAAW,iBAAiB;AAAA,IAC9B,CAAC;AACD,UAAM,cAAc,OAAO,UAAU,SAAS,CAAC;AAC/C,UAAM,QAAQ,OAAO,SAAS,WAAW,IACrC,KAAK,IAAI,kBAAkB,KAAK,IAAI,GAAG,KAAK,MAAM,WAAW,CAAC,CAAC,IAC/D;AAEJ,WAAO;AAAA,MACL,OAAO,KAAK,IAAI,CAAC,UAAU,EAAE,IAAI,KAAK,IAAI,OAAO,KAAK,MAAM,WAAW,KAAK,EAAE;AAAA,MAC9E;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,sBAAsB,UAAqC;AAC/D,WAAO,MAAM,KAAK,MAAM,sBAAsB,KAAK,IAAI,QAAQ,CAAC;AAAA,EAClE;AACF;",
+  "names": []
+}

package/dist/modules/auth/services/rbacService.js

@@ -8,6 +8,7 @@ import {
   resolveEffectiveFeatures
 } from "@open-mercato/shared/security/featurePolicy";
 import { filterGrantsByEnabledModules } from "@open-mercato/shared/security/enabledModulesRegistry";
+import { resolveRoleOrganizationScope, roleAclAllowsOrganization } from "./roleOrganizationScope.js";
 function isAclData(value) {
   if (typeof value !== "object" || value === null) return false;
   const record = value;
@@ -19,9 +20,13 @@ function isAclData(value) {
   }
   return true;
 }
+function isRestrictedRoleAcl(acl) {
+  return Array.isArray(acl.organizationsJson) && acl.organizationsJson.length > 0 && !acl.organizationsJson.includes("__all__");
+}
 class RbacService {
-  constructor(em, cache) {
+  constructor(em, cache, organizationHierarchyService) {
     this.em = em;
+    this.organizationHierarchyService = organizationHierarchyService;
     this.cacheTtlMs = 5 * 60 * 1e3;
     // 5 minutes default
     this.cache = null;
@@ -39,12 +44,6 @@ class RbacService {
   hasAllFeatures(required, granted) {
     return authorizeFeatures(required, { grantedFeatures: granted });
   }
-  roleAclAllowsOrganization(acl, organizationId) {
-    if (!organizationId) return true;
-    const organizations = Array.isArray(acl.organizationsJson) ? acl.organizationsJson : null;
-    if (!organizations || !organizations.length || organizations.includes("__all__")) return true;
-    return organizations.includes(organizationId);
-  }
   getCacheKey(userId, scope) {
     return `rbac:${userId}:${scope.tenantId || "null"}:${scope.organizationId || "null"}`;
   }
@@ -71,6 +70,7 @@ class RbacService {
     ];
     if (scope.tenantId) {
       tags.push(this.getTenantTag(scope.tenantId));
+      tags.push(buildOrgScopeTenantCacheTag(scope.tenantId));
     }
     if (scope.organizationId) {
       tags.push(this.getOrganizationTag(scope.organizationId));
@@ -167,8 +167,8 @@ class RbacService {
       this.globalSuperAdminCache.set(userId, false);
       return false;
     }
-    const roleSuper = await em.findOne(RoleAcl, { isSuperAdmin: true, role: { $in: roleIds } });
-    const result = !!(roleSuper && roleSuper.isSuperAdmin);
+    const roleSupers = await em.find(RoleAcl, { isSuperAdmin: true, role: { $in: roleIds } });
+    const result = roleSupers.some((roleAcl) => !!roleAcl.isSuperAdmin && !isRestrictedRoleAcl(roleAcl));
     this.globalSuperAdminCache.set(userId, result);
     return result;
   }
@@ -215,28 +215,55 @@ class RbacService {
       }
       const tenantId2 = scope.tenantId || key.tenantId || null;
       const roleIds2 = Array.isArray(key.rolesJson) ? key.rolesJson.filter(Boolean) : [];
+      const keyOrganizationId = typeof key.organizationId === "string" && key.organizationId.trim().length > 0 ? key.organizationId.trim() : null;
+      const evaluatedOrganizationId = scope.organizationId || keyOrganizationId;
       let isSuper2 = false;
       const features2 = [];
-      let organizations2 = key.organizationId ? [key.organizationId] : null;
+      let roleOrganizations = [];
+      let hasApplicableRestrictedRole2 = false;
       if (tenantId2 && roleIds2.length) {
+        const roleOrganizationScope = await resolveRoleOrganizationScope(
+          this.organizationHierarchyService,
+          tenantId2,
+          evaluatedOrganizationId
+        );
         const racls = await em2.find(RoleAcl, { tenantId: tenantId2, role: { $in: roleIds2 } });
         for (const acl of racls) {
-          isSuper2 = isSuper2 || !!acl.isSuperAdmin;
-          if (Array.isArray(acl.featuresJson)) {
-            for (const f of acl.featuresJson) if (!features2.includes(f)) features2.push(f);
+          if (roleAclAllowsOrganization(acl, roleOrganizationScope)) {
+            isSuper2 = isSuper2 || !!acl.isSuperAdmin;
+            if (Array.isArray(acl.featuresJson)) {
+              for (const f of acl.featuresJson) if (!features2.includes(f)) features2.push(f);
+            }
+            if (isRestrictedRoleAcl(acl)) hasApplicableRestrictedRole2 = true;
           }
-          if (organizations2 !== null) {
-            if (acl.organizationsJson == null) {
-              organizations2 = null;
+          if (roleOrganizations !== null) {
+            if (acl.organizationsJson == null || Array.isArray(acl.organizationsJson) && acl.organizationsJson.length === 0) {
+              roleOrganizations = null;
             } else if (Array.isArray(acl.organizationsJson) && acl.organizationsJson.includes("__all__")) {
-              organizations2 = null;
+              roleOrganizations = null;
             } else {
-              organizations2 = Array.from(/* @__PURE__ */ new Set([...organizations2 || [], ...acl.organizationsJson]));
+              roleOrganizations = Array.from(/* @__PURE__ */ new Set([
+                ...roleOrganizations,
+                ...Array.isArray(acl.organizationsJson) ? acl.organizationsJson : []
+              ]));
             }
           }
         }
+        if (roleOrganizations !== null && evaluatedOrganizationId && roleOrganizationScope !== null && roleOrganizationScope.size > 0 && hasApplicableRestrictedRole2 && !roleOrganizations.includes(evaluatedOrganizationId)) {
+          roleOrganizations.push(evaluatedOrganizationId);
+        }
       }
-      const result2 = { isSuperAdmin: isSuper2, features: features2, organizations: organizations2 };
+      let organizations2 = roleOrganizations;
+      if (keyOrganizationId) {
+        const keyOrganizationScope = await resolveRoleOrganizationScope(
+          this.organizationHierarchyService,
+          tenantId2,
+          keyOrganizationId
+        );
+        organizations2 = roleOrganizations === null || roleOrganizations.some((organizationId) => keyOrganizationScope?.has(organizationId)) ? [keyOrganizationId] : [];
+      }
+      if (isSuper2 && organizations2 !== null && !features2.includes("*")) features2.push("*");
+      const result2 = { isSuperAdmin: isSuper2 && organizations2 === null, features: features2, organizations: organizations2 };
       await this.setCache(cacheKey, result2, userId, scope);
       return result2;
     }
@@ -276,13 +303,22 @@ class RbacService {
     let isSuper = false;
     const features = [];
     let organizations = [];
+    let hasApplicableRestrictedRole = false;
     if (roleIds.length) {
+      const roleOrganizationScope = await resolveRoleOrganizationScope(
+        this.organizationHierarchyService,
+        tenantId,
+        scope.organizationId
+      );
       const racls = await em.find(RoleAcl, { tenantId, role: { $in: roleIds } }, {});
       const roleAcls = Array.isArray(racls) ? racls : [];
       for (const r of roleAcls) {
-        isSuper = isSuper || !!r.isSuperAdmin;
-        if (Array.isArray(r.featuresJson)) {
-          for (const f of r.featuresJson) if (!features.includes(f)) features.push(f);
+        if (roleAclAllowsOrganization(r, roleOrganizationScope)) {
+          isSuper = isSuper || !!r.isSuperAdmin;
+          if (Array.isArray(r.featuresJson)) {
+            for (const f of r.featuresJson) if (!features.includes(f)) features.push(f);
+          }
+          if (isRestrictedRoleAcl(r)) hasApplicableRestrictedRole = true;
         }
         if (organizations !== null) {
           if (r.organizationsJson == null) organizations = null;
@@ -290,6 +326,9 @@ class RbacService {
           else organizations = Array.from(/* @__PURE__ */ new Set([...organizations || [], ...r.organizationsJson]));
         }
       }
+      if (organizations !== null && scope.organizationId && roleOrganizationScope !== null && roleOrganizationScope.size > 0 && hasApplicableRestrictedRole && !organizations.includes(scope.organizationId)) {
+        organizations.push(scope.organizationId);
+      }
     }
     if (organizations && orgId && !organizations.includes(orgId) && !organizations.includes("__all__")) {
     }
@@ -306,11 +345,15 @@ class RbacService {
   async tenantHasFeature(tenantId, feature, opts) {
     if (!tenantId || !feature) return false;
     const em = this.em.fork();
+    const roleOrganizationScope = await resolveRoleOrganizationScope(
+      this.organizationHierarchyService,
+      tenantId,
+      opts?.organizationId
+    );
     const roleAcls = await em.find(RoleAcl, { tenantId, deletedAt: null }, {});
     const list = Array.isArray(roleAcls) ? roleAcls : [];
-    const organizationId = opts?.organizationId ?? null;
     for (const acl of list) {
-      if (!this.roleAclAllowsOrganization(acl, organizationId)) continue;
+      if (!roleAclAllowsOrganization(acl, roleOrganizationScope)) continue;
       const grants = Array.isArray(acl.featuresJson) ? acl.featuresJson : [];
       if (authorizeFeatures([feature], {
         grantedFeatures: grants,

package/dist/modules/auth/services/rbacService.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/auth/services/rbacService.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CacheStrategy } from '@open-mercato/cache'\nimport { getCurrentCacheTenant, runWithCacheTenant } from '@open-mercato/cache'\nimport { UserAcl, RoleAcl, User, UserRole } from '@open-mercato/core/modules/auth/data/entities'\nimport { ApiKey } from '@open-mercato/core/modules/api_keys/data/entities'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { buildOrgScopeUserCacheTag, buildOrgScopeTenantCacheTag } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport {\n  authorizeFeatures,\n  resolveEffectiveFeatures,\n} from '@open-mercato/shared/security/featurePolicy'\nimport { filterGrantsByEnabledModules } from '@open-mercato/shared/security/enabledModulesRegistry'\n\ninterface AclData {\n  isSuperAdmin: boolean\n  features: string[]\n  organizations: string[] | null\n}\n\nfunction isAclData(value: unknown): value is AclData {\n  if (typeof value !== 'object' || value === null) return false\n  const record = value as Partial<AclData>\n  if (typeof record.isSuperAdmin !== 'boolean') return false\n  if (!Array.isArray(record.features) || record.features.some((feature) => typeof feature !== 'string')) return false\n  if (record.organizations !== null && record.organizations !== undefined) {\n    if (!Array.isArray(record.organizations)) return false\n    if (record.organizations.some((org) => typeof org !== 'string')) return false\n  }\n  return true\n}\n\nexport class RbacService {\n  private cacheTtlMs: number = 5 * 60 * 1000 // 5 minutes default\n  private cache: CacheStrategy | null = null\n  private globalSuperAdminCache = new Map<string, boolean>()\n\n  constructor(private em: EntityManager, cache?: CacheStrategy) {\n    this.cache = cache || null\n  }\n\n  /**\n   * Set cache TTL in milliseconds\n   * @param ttlMs - Time to live in milliseconds\n   */\n  setCacheTtl(ttlMs: number) {\n    this.cacheTtlMs = ttlMs\n  }\n\n  /** Compatibility wrapper for callers that already have both feature lists. */\n  public hasAllFeatures(required: string[], granted: string[]): boolean {\n    return authorizeFeatures(required, { grantedFeatures: granted })\n  }\n\n  private roleAclAllowsOrganization(acl: RoleAcl, organizationId: string | null | undefined): boolean {\n    if (!organizationId) return true\n    const organizations = Array.isArray(acl.organizationsJson) ? acl.organizationsJson : null\n    if (!organizations || !organizations.length || organizations.includes('__all__')) return true\n    return organizations.includes(organizationId)\n  }\n\n  private getCacheKey(userId: string, scope: { tenantId: string | null; organizationId: string | null }): string {\n    return `rbac:${userId}:${scope.tenantId || 'null'}:${scope.organizationId || 'null'}`\n  }\n\n  private getUserTag(userId: string): string {\n    return `rbac:user:${userId}`\n  }\n\n  private getTenantTag(tenantId: string): string {\n    return `rbac:tenant:${tenantId}`\n  }\n\n  private getOrganizationTag(organizationId: string): string {\n    return `rbac:org:${organizationId}`\n  }\n\n  private async getFromCache(cacheKey: string): Promise<AclData | null> {\n    if (!this.cache) return null\n    const cached = await this.cache.get(cacheKey)\n    if (!cached) return null\n    return isAclData(cached) ? cached : null\n  }\n\n  private async setCache(cacheKey: string, data: AclData, userId: string, scope: { tenantId: string | null; organizationId: string | null }): Promise<void> {\n    if (!this.cache) return\n\n    const tags = [\n      this.getUserTag(userId),\n      'rbac:all'\n    ]\n\n    if (scope.tenantId) {\n      tags.push(this.getTenantTag(scope.tenantId))\n    }\n\n    if (scope.organizationId) {\n      tags.push(this.getOrganizationTag(scope.organizationId))\n    }\n\n    await this.cache.set(cacheKey, data, {\n      ttl: this.cacheTtlMs,\n      tags\n    })\n  }\n\n  /**\n   * Invalidates cached ACL data for a specific user across all tenants and organizations.\n   * Call this when a user's roles or user-specific ACL is modified.\n   * \n   * @param userId - The ID of the user whose cache should be invalidated\n   */\n  async invalidateUserCache(userId: string): Promise<void> {\n    this.globalSuperAdminCache.delete(userId)\n    // Also drop the directory OrganizationScope cache for this user. That scope's\n    // accessible-org set is derived from this user's ACL/role grants, so any\n    // permission change that invalidates the RBAC cache must invalidate the\n    // resolved scope too. This is the missing `org-scope:user:*` caller required\n    // before the cross-request scope TTL can be safely enabled (issue #2259).\n    await this.deleteCacheByTags([this.getUserTag(userId), buildOrgScopeUserCacheTag(userId)])\n  }\n\n  /**\n   * Invalidates cached ACL data for all users within a specific tenant.\n   * Call this when a role's ACL is modified, since roles are tenant-scoped\n   * and affect all users in that tenant who have that role.\n   * \n   * @param tenantId - The ID of the tenant whose cache should be invalidated\n   */\n  async invalidateTenantCache(tenantId: string): Promise<void> {\n    this.globalSuperAdminCache.clear()\n    // Role ACL changes invalidate every user in the tenant; the resolved\n    // OrganizationScope for those users derives from the same grants, so drop\n    // the tenant-tagged scope entries alongside the RBAC ones (issue #2259).\n    await this.deleteCacheByTags([this.getTenantTag(tenantId), buildOrgScopeTenantCacheTag(tenantId)], [tenantId])\n  }\n\n  /**\n   * Invalidates cached ACL data for all users within a specific organization.\n   * Call this when organization-level permissions or visibility changes.\n   * \n   * @param organizationId - The ID of the organization whose cache should be invalidated\n   */\n  async invalidateOrganizationCache(organizationId: string): Promise<void> {\n    await this.deleteCacheByTags([this.getOrganizationTag(organizationId)])\n  }\n\n  /**\n   * Clears all cached ACL data.\n   * Use this for bulk operations or system-wide ACL changes.\n   */\n  async invalidateAllCache(): Promise<void> {\n    this.globalSuperAdminCache.clear()\n    await this.deleteCacheByTags(['rbac:all'])\n  }\n\n  private async deleteCacheByTags(tags: string[], tenantHints?: Array<string | null>): Promise<void> {\n    if (!this.cache) return\n    const contexts = new Set<string | null>()\n    const current = getCurrentCacheTenant()\n    contexts.add(current ?? null)\n    contexts.add(null)\n    if (Array.isArray(tenantHints)) {\n      for (const hint of tenantHints) {\n        contexts.add(hint ?? null)\n      }\n    }\n    for (const ctx of contexts) {\n      if (ctx === current) {\n        await this.cache.deleteByTags(tags)\n      } else {\n        await runWithCacheTenant(ctx, async () => {\n          await this.cache!.deleteByTags(tags)\n        })\n      }\n    }\n  }\n\n  private async isGlobalSuperAdmin(userId: string): Promise<boolean> {\n    if (this.globalSuperAdminCache.has(userId)) return this.globalSuperAdminCache.get(userId)!\n    const em = this.em.fork()\n    const userSuper = await em.findOne(UserAcl, { user: userId as any, isSuperAdmin: true })\n    if (userSuper && (userSuper as any).isSuperAdmin) {\n      this.globalSuperAdminCache.set(userId, true)\n      return true\n    }\n    const links = await findWithDecryption(\n      em,\n      UserRole,\n      { user: userId as any },\n      { populate: ['role'] },\n      { tenantId: null, organizationId: null },\n    )\n    const linkList = Array.isArray(links) ? links : []\n    if (!linkList.length) {\n      this.globalSuperAdminCache.set(userId, false)\n      return false\n    }\n    const roleIds = Array.from(new Set(linkList.map((link) => {\n      const role = link.role as any\n      return role?.id ? String(role.id) : null\n    }).filter((id): id is string => typeof id === 'string' && id.length > 0)))\n    if (!roleIds.length) {\n      this.globalSuperAdminCache.set(userId, false)\n      return false\n    }\n    const roleSuper = await em.findOne(RoleAcl, { isSuperAdmin: true, role: { $in: roleIds as any } } as any)\n    const result = !!(roleSuper && (roleSuper as any).isSuperAdmin)\n    this.globalSuperAdminCache.set(userId, result)\n    return result\n  }\n\n  /**\n   * Loads the Access Control List (ACL) for a user within a given scope.\n   * \n   * The ACL resolution follows this priority:\n   * 1. Per-user ACL (UserAcl) - if exists, use it exclusively\n   * 2. Aggregated role ACLs (RoleAcl) - combine permissions from all user's roles\n   * \n   * Results are cached for performance (default 5 minutes TTL).\n   * Cache is automatically invalidated when ACL-related data changes.\n   * \n   * @param userId - The ID of the user\n   * @param scope - The tenant and organization context for ACL evaluation\n   * @returns An object containing:\n   *   - isSuperAdmin: If true, user has unrestricted access to all features\n   *   - features: Array of feature strings (may include wildcards like 'entities.*')\n   *   - organizations: Array of organization IDs user can access, or null for all organizations\n   * \n   * @example\n   * const acl = await rbacService.loadAcl('user-123', { tenantId: 'tenant-1', organizationId: 'org-1' })\n   * // Returns: { isSuperAdmin: false, features: ['users.view', 'entities.*'], organizations: ['org-1', 'org-2'] }\n   */\n  async loadAcl(userId: string, scope: { tenantId: string | null; organizationId: string | null }): Promise<{\n    isSuperAdmin: boolean\n    features: string[]\n    organizations: string[] | null\n  }> {\n    const cacheKey = this.getCacheKey(userId, scope)\n    const cached = await this.getFromCache(cacheKey)\n    if (cached) return cached\n\n    if (!userId.startsWith('api_key:')) {\n      if (await this.isGlobalSuperAdmin(userId)) {\n        const result = { isSuperAdmin: true, features: ['*'], organizations: null }\n        await this.setCache(cacheKey, result, userId, scope)\n        return result\n      }\n    }\n\n    if (userId.startsWith('api_key:')) {\n      const apiKeyId = userId.slice('api_key:'.length)\n      const em = this.em.fork()\n      const key = await em.findOne(ApiKey, { id: apiKeyId, deletedAt: null })\n      if (!key || (key.expiresAt && key.expiresAt.getTime() < Date.now())) {\n        const result = { isSuperAdmin: false, features: [], organizations: null }\n        await this.setCache(cacheKey, result, userId, scope)\n        return result\n      }\n      const tenantId = scope.tenantId || key.tenantId || null\n      const roleIds = Array.isArray(key.rolesJson) ? key.rolesJson.filter(Boolean) : []\n      let isSuper = false\n      const features: string[] = []\n      let organizations: string[] | null = key.organizationId ? [key.organizationId] : null\n      if (tenantId && roleIds.length) {\n        const racls = await em.find(RoleAcl, { tenantId, role: { $in: roleIds as any } } as any)\n        for (const acl of racls) {\n          isSuper = isSuper || !!acl.isSuperAdmin\n          if (Array.isArray(acl.featuresJson)) {\n            for (const f of acl.featuresJson) if (!features.includes(f)) features.push(f)\n          }\n          if (organizations !== null) {\n            if (acl.organizationsJson == null) {\n              organizations = null\n            } else if (Array.isArray(acl.organizationsJson) && acl.organizationsJson.includes('__all__')) {\n              organizations = null\n            } else {\n              organizations = Array.from(new Set([...(organizations || []), ...acl.organizationsJson]))\n            }\n          }\n        }\n      }\n      const result = { isSuperAdmin: isSuper, features, organizations }\n      await this.setCache(cacheKey, result, userId, scope)\n      return result\n    }\n\n    // Use a forked EntityManager to avoid inheriting an aborted transaction from callers\n    const em = this.em.fork()\n    const user = await em.findOne(User, { id: userId })\n    if (!user) {\n      const result = { isSuperAdmin: false, features: [], organizations: null }\n      await this.setCache(cacheKey, result, userId, scope)\n      return result\n    }\n    const tenantId = scope.tenantId || user.tenantId || null\n    const orgId = scope.organizationId || user.organizationId || null\n\n    if (!tenantId) {\n      const result = { isSuperAdmin: false, features: [], organizations: null }\n      await this.setCache(cacheKey, result, userId, scope)\n      return result\n    }\n\n    // Per-user ACL first\n    const uacl = await em.findOne(UserAcl, { user: userId as any, tenantId })\n    if (uacl) {\n      const result = {\n        isSuperAdmin: !!uacl.isSuperAdmin,\n        features: Array.isArray(uacl.featuresJson) ? (uacl.featuresJson as string[]) : [],\n        organizations: Array.isArray(uacl.organizationsJson) ? (uacl.organizationsJson as string[]) : null,\n      }\n      await this.setCache(cacheKey, result, userId, scope)\n      return result\n    }\n\n    // Aggregate role ACLs\n    const links = await findWithDecryption(\n      em,\n      UserRole,\n      { user: userId as any, role: { tenantId } } as any,\n      { populate: ['role'] },\n      { tenantId, organizationId: orgId },\n    )\n    const linkList = Array.isArray(links) ? links : []\n    const roleIds = linkList.map((l) => (l.role as any)?.id).filter(Boolean)\n    let isSuper = false\n    const features: string[] = []\n    let organizations: string[] | null = []\n    if (roleIds.length) {\n      const racls = await em.find(RoleAcl, { tenantId, role: { $in: roleIds as any } } as any, {})\n      const roleAcls = Array.isArray(racls) ? racls : []\n      for (const r of roleAcls) {\n        isSuper = isSuper || !!r.isSuperAdmin\n        if (Array.isArray(r.featuresJson)) for (const f of r.featuresJson) if (!features.includes(f)) features.push(f)\n        if (organizations !== null) {\n          if (r.organizationsJson == null) organizations = null\n          else if (Array.isArray(r.organizationsJson) && r.organizationsJson.includes('__all__')) organizations = null\n          else organizations = Array.from(new Set([...(organizations || []), ...r.organizationsJson]))\n        }\n      }\n    }\n    if (organizations && orgId && !organizations.includes(orgId) && !organizations.includes('__all__')) {\n      // Out-of-scope org; caller will enforce\n    }\n    const result = { isSuperAdmin: isSuper, features, organizations }\n    await this.setCache(cacheKey, result, userId, scope)\n    return result\n  }\n\n  /**\n   * Checks whether any tenant role grants a feature.\n   *\n   * This supports non-user runtimes such as scheduler workers that execute with\n   * tenant scope but without an authenticated user.\n   */\n  async tenantHasFeature(\n    tenantId: string | null | undefined,\n    feature: string,\n    opts?: { organizationId?: string | null },\n  ): Promise<boolean> {\n    if (!tenantId || !feature) return false\n\n    const em = this.em.fork()\n    const roleAcls = await em.find(RoleAcl, { tenantId, deletedAt: null } as any, {})\n    const list = Array.isArray(roleAcls) ? roleAcls : []\n    const organizationId = opts?.organizationId ?? null\n\n    for (const acl of list) {\n      if (!this.roleAclAllowsOrganization(acl, organizationId)) continue\n      const grants = Array.isArray(acl.featuresJson) ? acl.featuresJson : []\n      if (authorizeFeatures([feature], {\n        grantedFeatures: grants,\n        unrestricted: acl.isSuperAdmin,\n      })) {\n        return true\n      }\n    }\n\n    return false\n  }\n\n  /**\n   * Checks if a user has all required features within a given scope.\n   *\n   * This is the primary authorization check method used throughout the application.\n   * It combines feature checking with organization visibility validation.\n   *\n   * Authorization logic:\n   * 1. No features required \u2192 always returns true\n   * 2. User is super admin \u2192 always returns true\n   * 3. Organization restriction check: If the user's ACL has a restricted organization list\n   *    and the requested organization is not in that list \u2192 returns false\n   * 4. Feature matching: User must have all required features (supports wildcards)\n   *\n   * @param userId - The ID of the user\n   * @param required - Array of feature strings to check (e.g., ['users.view', 'users.edit'])\n   * @param scope - The tenant and organization context for authorization\n   * @returns true if the user has all required features and organization access, false otherwise\n   *\n   * @example\n   * // Check if user can view and edit users\n   * const canManageUsers = await rbacService.userHasAllFeatures(\n   *   'user-123',\n   *   ['users.view', 'users.edit'],\n   *   { tenantId: 'tenant-1', organizationId: 'org-1' }\n   * )\n   *\n   * @example\n   * // Check with wildcard features\n   * const canAccessEntities = await rbacService.userHasAllFeatures(\n   *   'user-123',\n   *   ['entities.records.view'],\n   *   { tenantId: 'tenant-1', organizationId: 'org-1' }\n   * )\n   * // Returns true if user has 'entities.*', '*', or 'entities.records.view'\n   */\n  async userHasAllFeatures(userId: string, required: string[], scope: { tenantId: string | null; organizationId: string | null }): Promise<boolean> {\n    if (!required.length) return true\n    const acl = await this.loadAcl(userId, scope)\n    const organizationAllowed = acl.isSuperAdmin\n      || !acl.organizations\n      || !scope.organizationId\n      || acl.organizations.includes(scope.organizationId)\n      || acl.organizations.includes('__all__')\n    return authorizeFeatures(required, {\n      grantedFeatures: acl.features,\n      unrestricted: acl.isSuperAdmin,\n      scopeAllowed: organizationAllowed,\n    })\n  }\n\n  /**\n   * Returns the user's infrastructure grant list, filtered to enabled modules.\n   * The result may contain wildcards; authoritative checks must still go through\n   * `authorizeFeatures` or `userHasAllFeatures` so null overrides are enforced.\n   */\n  async getGrantedFeatures(\n    userId: string,\n    scope: { tenantId: string | null; organizationId: string | null },\n  ): Promise<string[]> {\n    const acl = await this.loadAcl(userId, scope)\n    if (acl.isSuperAdmin) return filterGrantsByEnabledModules(['*'])\n    if (\n      acl.organizations &&\n      scope.organizationId &&\n      !acl.organizations.includes(scope.organizationId) &&\n      !acl.organizations.includes('__all__')\n    ) {\n      return []\n    }\n    return filterGrantsByEnabledModules(acl.features)\n  }\n\n  /** Returns concrete active feature IDs for browser capability payloads. */\n  async getEffectiveFeatures(\n    userId: string,\n    scope: { tenantId: string | null; organizationId: string | null },\n  ): Promise<string[]> {\n    const acl = await this.loadAcl(userId, scope)\n    const organizationAllowed = acl.isSuperAdmin\n      || !acl.organizations\n      || !scope.organizationId\n      || acl.organizations.includes(scope.organizationId)\n      || acl.organizations.includes('__all__')\n    if (!organizationAllowed) return []\n    return resolveEffectiveFeatures(acl.isSuperAdmin ? ['*'] : acl.features)\n  }\n}\n"],
-  "mappings": "AAEA,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,SAAS,SAAS,MAAM,gBAAgB;AACjD,SAAS,cAAc;AACvB,SAAS,0BAA0B;AACnC,SAAS,2BAA2B,mCAAmC;AACvE;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,oCAAoC;AAQ7C,SAAS,UAAU,OAAkC;AACnD,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,SAAS;AACf,MAAI,OAAO,OAAO,iBAAiB,UAAW,QAAO;AACrD,MAAI,CAAC,MAAM,QAAQ,OAAO,QAAQ,KAAK,OAAO,SAAS,KAAK,CAAC,YAAY,OAAO,YAAY,QAAQ,EAAG,QAAO;AAC9G,MAAI,OAAO,kBAAkB,QAAQ,OAAO,kBAAkB,QAAW;AACvE,QAAI,CAAC,MAAM,QAAQ,OAAO,aAAa,EAAG,QAAO;AACjD,QAAI,OAAO,cAAc,KAAK,CAAC,QAAQ,OAAO,QAAQ,QAAQ,EAAG,QAAO;AAAA,EAC1E;AACA,SAAO;AACT;AAEO,MAAM,YAAY;AAAA,EAKvB,YAAoB,IAAmB,OAAuB;AAA1C;AAJpB,SAAQ,aAAqB,IAAI,KAAK;AACtC;AAAA,SAAQ,QAA8B;AACtC,SAAQ,wBAAwB,oBAAI,IAAqB;AAGvD,SAAK,QAAQ,SAAS;AAAA,EACxB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,YAAY,OAAe;AACzB,SAAK,aAAa;AAAA,EACpB;AAAA;AAAA,EAGO,eAAe,UAAoB,SAA4B;AACpE,WAAO,kBAAkB,UAAU,EAAE,iBAAiB,QAAQ,CAAC;AAAA,EACjE;AAAA,EAEQ,0BAA0B,KAAc,gBAAoD;AAClG,QAAI,CAAC,eAAgB,QAAO;AAC5B,UAAM,gBAAgB,MAAM,QAAQ,IAAI,iBAAiB,IAAI,IAAI,oBAAoB;AACrF,QAAI,CAAC,iBAAiB,CAAC,cAAc,UAAU,cAAc,SAAS,SAAS,EAAG,QAAO;AACzF,WAAO,cAAc,SAAS,cAAc;AAAA,EAC9C;AAAA,EAEQ,YAAY,QAAgB,OAA2E;AAC7G,WAAO,QAAQ,MAAM,IAAI,MAAM,YAAY,MAAM,IAAI,MAAM,kBAAkB,MAAM;AAAA,EACrF;AAAA,EAEQ,WAAW,QAAwB;AACzC,WAAO,aAAa,MAAM;AAAA,EAC5B;AAAA,EAEQ,aAAa,UAA0B;AAC7C,WAAO,eAAe,QAAQ;AAAA,EAChC;AAAA,EAEQ,mBAAmB,gBAAgC;AACzD,WAAO,YAAY,cAAc;AAAA,EACnC;AAAA,EAEA,MAAc,aAAa,UAA2C;AACpE,QAAI,CAAC,KAAK,MAAO,QAAO;AACxB,UAAM,SAAS,MAAM,KAAK,MAAM,IAAI,QAAQ;AAC5C,QAAI,CAAC,OAAQ,QAAO;AACpB,WAAO,UAAU,MAAM,IAAI,SAAS;AAAA,EACtC;AAAA,EAEA,MAAc,SAAS,UAAkB,MAAe,QAAgB,OAAkF;AACxJ,QAAI,CAAC,KAAK,MAAO;AAEjB,UAAM,OAAO;AAAA,MACX,KAAK,WAAW,MAAM;AAAA,MACtB;AAAA,IACF;AAEA,QAAI,MAAM,UAAU;AAClB,WAAK,KAAK,KAAK,aAAa,MAAM,QAAQ,CAAC;AAAA,IAC7C;AAEA,QAAI,MAAM,gBAAgB;AACxB,WAAK,KAAK,KAAK,mBAAmB,MAAM,cAAc,CAAC;AAAA,IACzD;AAEA,UAAM,KAAK,MAAM,IAAI,UAAU,MAAM;AAAA,MACnC,KAAK,KAAK;AAAA,MACV;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,oBAAoB,QAA+B;AACvD,SAAK,sBAAsB,OAAO,MAAM;AAMxC,UAAM,KAAK,kBAAkB,CAAC,KAAK,WAAW,MAAM,GAAG,0BAA0B,MAAM,CAAC,CAAC;AAAA,EAC3F;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,sBAAsB,UAAiC;AAC3D,SAAK,sBAAsB,MAAM;AAIjC,UAAM,KAAK,kBAAkB,CAAC,KAAK,aAAa,QAAQ,GAAG,4BAA4B,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;AAAA,EAC/G;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,4BAA4B,gBAAuC;AACvE,UAAM,KAAK,kBAAkB,CAAC,KAAK,mBAAmB,cAAc,CAAC,CAAC;AAAA,EACxE;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,qBAAoC;AACxC,SAAK,sBAAsB,MAAM;AACjC,UAAM,KAAK,kBAAkB,CAAC,UAAU,CAAC;AAAA,EAC3C;AAAA,EAEA,MAAc,kBAAkB,MAAgB,aAAmD;AACjG,QAAI,CAAC,KAAK,MAAO;AACjB,UAAM,WAAW,oBAAI,IAAmB;AACxC,UAAM,UAAU,sBAAsB;AACtC,aAAS,IAAI,WAAW,IAAI;AAC5B,aAAS,IAAI,IAAI;AACjB,QAAI,MAAM,QAAQ,WAAW,GAAG;AAC9B,iBAAW,QAAQ,aAAa;AAC9B,iBAAS,IAAI,QAAQ,IAAI;AAAA,MAC3B;AAAA,IACF;AACA,eAAW,OAAO,UAAU;AAC1B,UAAI,QAAQ,SAAS;AACnB,cAAM,KAAK,MAAM,aAAa,IAAI;AAAA,MACpC,OAAO;AACL,cAAM,mBAAmB,KAAK,YAAY;AACxC,gBAAM,KAAK,MAAO,aAAa,IAAI;AAAA,QACrC,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,mBAAmB,QAAkC;AACjE,QAAI,KAAK,sBAAsB,IAAI,MAAM,EAAG,QAAO,KAAK,sBAAsB,IAAI,MAAM;AACxF,UAAM,KAAK,KAAK,GAAG,KAAK;AACxB,UAAM,YAAY,MAAM,GAAG,QAAQ,SAAS,EAAE,MAAM,QAAe,cAAc,KAAK,CAAC;AACvF,QAAI,aAAc,UAAkB,cAAc;AAChD,WAAK,sBAAsB,IAAI,QAAQ,IAAI;AAC3C,aAAO;AAAA,IACT;AACA,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA,EAAE,MAAM,OAAc;AAAA,MACtB,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,MACrB,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,IACzC;AACA,UAAM,WAAW,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC;AACjD,QAAI,CAAC,SAAS,QAAQ;AACpB,WAAK,sBAAsB,IAAI,QAAQ,KAAK;AAC5C,aAAO;AAAA,IACT;AACA,UAAM,UAAU,MAAM,KAAK,IAAI,IAAI,SAAS,IAAI,CAAC,SAAS;AACxD,YAAM,OAAO,KAAK;AAClB,aAAO,MAAM,KAAK,OAAO,KAAK,EAAE,IAAI;AAAA,IACtC,CAAC,EAAE,OAAO,CAAC,OAAqB,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC,CAAC,CAAC;AACzE,QAAI,CAAC,QAAQ,QAAQ;AACnB,WAAK,sBAAsB,IAAI,QAAQ,KAAK;AAC5C,aAAO;AAAA,IACT;AACA,UAAM,YAAY,MAAM,GAAG,QAAQ,SAAS,EAAE,cAAc,MAAM,MAAM,EAAE,KAAK,QAAe,EAAE,CAAQ;AACxG,UAAM,SAAS,CAAC,EAAE,aAAc,UAAkB;AAClD,SAAK,sBAAsB,IAAI,QAAQ,MAAM;AAC7C,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,MAAM,QAAQ,QAAgB,OAI3B;AACD,UAAM,WAAW,KAAK,YAAY,QAAQ,KAAK;AAC/C,UAAM,SAAS,MAAM,KAAK,aAAa,QAAQ;AAC/C,QAAI,OAAQ,QAAO;AAEnB,QAAI,CAAC,OAAO,WAAW,UAAU,GAAG;AAClC,UAAI,MAAM,KAAK,mBAAmB,MAAM,GAAG;AACzC,cAAMA,UAAS,EAAE,cAAc,MAAM,UAAU,CAAC,GAAG,GAAG,eAAe,KAAK;AAC1E,cAAM,KAAK,SAAS,UAAUA,SAAQ,QAAQ,KAAK;AACnD,eAAOA;AAAA,MACT;AAAA,IACF;AAEA,QAAI,OAAO,WAAW,UAAU,GAAG;AACjC,YAAM,WAAW,OAAO,MAAM,WAAW,MAAM;AAC/C,YAAMC,MAAK,KAAK,GAAG,KAAK;AACxB,YAAM,MAAM,MAAMA,IAAG,QAAQ,QAAQ,EAAE,IAAI,UAAU,WAAW,KAAK,CAAC;AACtE,UAAI,CAAC,OAAQ,IAAI,aAAa,IAAI,UAAU,QAAQ,IAAI,KAAK,IAAI,GAAI;AACnE,cAAMD,UAAS,EAAE,cAAc,OAAO,UAAU,CAAC,GAAG,eAAe,KAAK;AACxE,cAAM,KAAK,SAAS,UAAUA,SAAQ,QAAQ,KAAK;AACnD,eAAOA;AAAA,MACT;AACA,YAAME,YAAW,MAAM,YAAY,IAAI,YAAY;AACnD,YAAMC,WAAU,MAAM,QAAQ,IAAI,SAAS,IAAI,IAAI,UAAU,OAAO,OAAO,IAAI,CAAC;AAChF,UAAIC,WAAU;AACd,YAAMC,YAAqB,CAAC;AAC5B,UAAIC,iBAAiC,IAAI,iBAAiB,CAAC,IAAI,cAAc,IAAI;AACjF,UAAIJ,aAAYC,SAAQ,QAAQ;AAC9B,cAAM,QAAQ,MAAMF,IAAG,KAAK,SAAS,EAAE,UAAAC,WAAU,MAAM,EAAE,KAAKC,SAAe,EAAE,CAAQ;AACvF,mBAAW,OAAO,OAAO;AACvB,UAAAC,WAAUA,YAAW,CAAC,CAAC,IAAI;AAC3B,cAAI,MAAM,QAAQ,IAAI,YAAY,GAAG;AACnC,uBAAW,KAAK,IAAI,aAAc,KAAI,CAACC,UAAS,SAAS,CAAC,EAAG,CAAAA,UAAS,KAAK,CAAC;AAAA,UAC9E;AACA,cAAIC,mBAAkB,MAAM;AAC1B,gBAAI,IAAI,qBAAqB,MAAM;AACjC,cAAAA,iBAAgB;AAAA,YAClB,WAAW,MAAM,QAAQ,IAAI,iBAAiB,KAAK,IAAI,kBAAkB,SAAS,SAAS,GAAG;AAC5F,cAAAA,iBAAgB;AAAA,YAClB,OAAO;AACL,cAAAA,iBAAgB,MAAM,KAAK,oBAAI,IAAI,CAAC,GAAIA,kBAAiB,CAAC,GAAI,GAAG,IAAI,iBAAiB,CAAC,CAAC;AAAA,YAC1F;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,YAAMN,UAAS,EAAE,cAAcI,UAAS,UAAAC,WAAU,eAAAC,eAAc;AAChE,YAAM,KAAK,SAAS,UAAUN,SAAQ,QAAQ,KAAK;AACnD,aAAOA;AAAA,IACT;AAGA,UAAM,KAAK,KAAK,GAAG,KAAK;AACxB,UAAM,OAAO,MAAM,GAAG,QAAQ,MAAM,EAAE,IAAI,OAAO,CAAC;AAClD,QAAI,CAAC,MAAM;AACT,YAAMA,UAAS,EAAE,cAAc,OAAO,UAAU,CAAC,GAAG,eAAe,KAAK;AACxE,YAAM,KAAK,SAAS,UAAUA,SAAQ,QAAQ,KAAK;AACnD,aAAOA;AAAA,IACT;AACA,UAAM,WAAW,MAAM,YAAY,KAAK,YAAY;AACpD,UAAM,QAAQ,MAAM,kBAAkB,KAAK,kBAAkB;AAE7D,QAAI,CAAC,UAAU;AACb,YAAMA,UAAS,EAAE,cAAc,OAAO,UAAU,CAAC,GAAG,eAAe,KAAK;AACxE,YAAM,KAAK,SAAS,UAAUA,SAAQ,QAAQ,KAAK;AACnD,aAAOA;AAAA,IACT;AAGA,UAAM,OAAO,MAAM,GAAG,QAAQ,SAAS,EAAE,MAAM,QAAe,SAAS,CAAC;AACxE,QAAI,MAAM;AACR,YAAMA,UAAS;AAAA,QACb,cAAc,CAAC,CAAC,KAAK;AAAA,QACrB,UAAU,MAAM,QAAQ,KAAK,YAAY,IAAK,KAAK,eAA4B,CAAC;AAAA,QAChF,eAAe,MAAM,QAAQ,KAAK,iBAAiB,IAAK,KAAK,oBAAiC;AAAA,MAChG;AACA,YAAM,KAAK,SAAS,UAAUA,SAAQ,QAAQ,KAAK;AACnD,aAAOA;AAAA,IACT;AAGA,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA,EAAE,MAAM,QAAe,MAAM,EAAE,SAAS,EAAE;AAAA,MAC1C,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,MACrB,EAAE,UAAU,gBAAgB,MAAM;AAAA,IACpC;AACA,UAAM,WAAW,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC;AACjD,UAAM,UAAU,SAAS,IAAI,CAAC,MAAO,EAAE,MAAc,EAAE,EAAE,OAAO,OAAO;AACvE,QAAI,UAAU;AACd,UAAM,WAAqB,CAAC;AAC5B,QAAI,gBAAiC,CAAC;AACtC,QAAI,QAAQ,QAAQ;AAClB,YAAM,QAAQ,MAAM,GAAG,KAAK,SAAS,EAAE,UAAU,MAAM,EAAE,KAAK,QAAe,EAAE,GAAU,CAAC,CAAC;AAC3F,YAAM,WAAW,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC;AACjD,iBAAW,KAAK,UAAU;AACxB,kBAAU,WAAW,CAAC,CAAC,EAAE;AACzB,YAAI,MAAM,QAAQ,EAAE,YAAY;AAAG,qBAAW,KAAK,EAAE,aAAc,KAAI,CAAC,SAAS,SAAS,CAAC,EAAG,UAAS,KAAK,CAAC;AAAA;AAC7G,YAAI,kBAAkB,MAAM;AAC1B,cAAI,EAAE,qBAAqB,KAAM,iBAAgB;AAAA,mBACxC,MAAM,QAAQ,EAAE,iBAAiB,KAAK,EAAE,kBAAkB,SAAS,SAAS,EAAG,iBAAgB;AAAA,cACnG,iBAAgB,MAAM,KAAK,oBAAI,IAAI,CAAC,GAAI,iBAAiB,CAAC,GAAI,GAAG,EAAE,iBAAiB,CAAC,CAAC;AAAA,QAC7F;AAAA,MACF;AAAA,IACF;AACA,QAAI,iBAAiB,SAAS,CAAC,cAAc,SAAS,KAAK,KAAK,CAAC,cAAc,SAAS,SAAS,GAAG;AAAA,IAEpG;AACA,UAAM,SAAS,EAAE,cAAc,SAAS,UAAU,cAAc;AAChE,UAAM,KAAK,SAAS,UAAU,QAAQ,QAAQ,KAAK;AACnD,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,iBACJ,UACA,SACA,MACkB;AAClB,QAAI,CAAC,YAAY,CAAC,QAAS,QAAO;AAElC,UAAM,KAAK,KAAK,GAAG,KAAK;AACxB,UAAM,WAAW,MAAM,GAAG,KAAK,SAAS,EAAE,UAAU,WAAW,KAAK,GAAU,CAAC,CAAC;AAChF,UAAM,OAAO,MAAM,QAAQ,QAAQ,IAAI,WAAW,CAAC;AACnD,UAAM,iBAAiB,MAAM,kBAAkB;AAE/C,eAAW,OAAO,MAAM;AACtB,UAAI,CAAC,KAAK,0BAA0B,KAAK,cAAc,EAAG;AAC1D,YAAM,SAAS,MAAM,QAAQ,IAAI,YAAY,IAAI,IAAI,eAAe,CAAC;AACrE,UAAI,kBAAkB,CAAC,OAAO,GAAG;AAAA,QAC/B,iBAAiB;AAAA,QACjB,cAAc,IAAI;AAAA,MACpB,CAAC,GAAG;AACF,eAAO;AAAA,MACT;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqCA,MAAM,mBAAmB,QAAgB,UAAoB,OAAqF;AAChJ,QAAI,CAAC,SAAS,OAAQ,QAAO;AAC7B,UAAM,MAAM,MAAM,KAAK,QAAQ,QAAQ,KAAK;AAC5C,UAAM,sBAAsB,IAAI,gBAC3B,CAAC,IAAI,iBACL,CAAC,MAAM,kBACP,IAAI,cAAc,SAAS,MAAM,cAAc,KAC/C,IAAI,cAAc,SAAS,SAAS;AACzC,WAAO,kBAAkB,UAAU;AAAA,MACjC,iBAAiB,IAAI;AAAA,MACrB,cAAc,IAAI;AAAA,MAClB,cAAc;AAAA,IAChB,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,mBACJ,QACA,OACmB;AACnB,UAAM,MAAM,MAAM,KAAK,QAAQ,QAAQ,KAAK;AAC5C,QAAI,IAAI,aAAc,QAAO,6BAA6B,CAAC,GAAG,CAAC;AAC/D,QACE,IAAI,iBACJ,MAAM,kBACN,CAAC,IAAI,cAAc,SAAS,MAAM,cAAc,KAChD,CAAC,IAAI,cAAc,SAAS,SAAS,GACrC;AACA,aAAO,CAAC;AAAA,IACV;AACA,WAAO,6BAA6B,IAAI,QAAQ;AAAA,EAClD;AAAA;AAAA,EAGA,MAAM,qBACJ,QACA,OACmB;AACnB,UAAM,MAAM,MAAM,KAAK,QAAQ,QAAQ,KAAK;AAC5C,UAAM,sBAAsB,IAAI,gBAC3B,CAAC,IAAI,iBACL,CAAC,MAAM,kBACP,IAAI,cAAc,SAAS,MAAM,cAAc,KAC/C,IAAI,cAAc,SAAS,SAAS;AACzC,QAAI,CAAC,oBAAqB,QAAO,CAAC;AAClC,WAAO,yBAAyB,IAAI,eAAe,CAAC,GAAG,IAAI,IAAI,QAAQ;AAAA,EACzE;AACF;",
-  "names": ["result", "em", "tenantId", "roleIds", "isSuper", "features", "organizations"]
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CacheStrategy } from '@open-mercato/cache'\nimport { getCurrentCacheTenant, runWithCacheTenant } from '@open-mercato/cache'\nimport { UserAcl, RoleAcl, User, UserRole } from '@open-mercato/core/modules/auth/data/entities'\nimport { ApiKey } from '@open-mercato/core/modules/api_keys/data/entities'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { OrganizationHierarchyService } from '@open-mercato/shared/lib/auth/principal-service'\nimport { buildOrgScopeUserCacheTag, buildOrgScopeTenantCacheTag } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport {\n  authorizeFeatures,\n  resolveEffectiveFeatures,\n} from '@open-mercato/shared/security/featurePolicy'\nimport { filterGrantsByEnabledModules } from '@open-mercato/shared/security/enabledModulesRegistry'\nimport { resolveRoleOrganizationScope, roleAclAllowsOrganization } from './roleOrganizationScope'\n\ninterface AclData {\n  isSuperAdmin: boolean\n  features: string[]\n  organizations: string[] | null\n}\n\nfunction isAclData(value: unknown): value is AclData {\n  if (typeof value !== 'object' || value === null) return false\n  const record = value as Partial<AclData>\n  if (typeof record.isSuperAdmin !== 'boolean') return false\n  if (!Array.isArray(record.features) || record.features.some((feature) => typeof feature !== 'string')) return false\n  if (record.organizations !== null && record.organizations !== undefined) {\n    if (!Array.isArray(record.organizations)) return false\n    if (record.organizations.some((org) => typeof org !== 'string')) return false\n  }\n  return true\n}\n\nfunction isRestrictedRoleAcl(acl: Pick<RoleAcl, 'organizationsJson'>): boolean {\n  return Array.isArray(acl.organizationsJson)\n    && acl.organizationsJson.length > 0\n    && !acl.organizationsJson.includes('__all__')\n}\n\nexport class RbacService {\n  private cacheTtlMs: number = 5 * 60 * 1000 // 5 minutes default\n  private cache: CacheStrategy | null = null\n  private globalSuperAdminCache = new Map<string, boolean>()\n\n  constructor(\n    private em: EntityManager,\n    cache?: CacheStrategy,\n    private readonly organizationHierarchyService?: OrganizationHierarchyService,\n  ) {\n    this.cache = cache || null\n  }\n\n  /**\n   * Set cache TTL in milliseconds\n   * @param ttlMs - Time to live in milliseconds\n   */\n  setCacheTtl(ttlMs: number) {\n    this.cacheTtlMs = ttlMs\n  }\n\n  /** Compatibility wrapper for callers that already have both feature lists. */\n  public hasAllFeatures(required: string[], granted: string[]): boolean {\n    return authorizeFeatures(required, { grantedFeatures: granted })\n  }\n\n  private getCacheKey(userId: string, scope: { tenantId: string | null; organizationId: string | null }): string {\n    return `rbac:${userId}:${scope.tenantId || 'null'}:${scope.organizationId || 'null'}`\n  }\n\n  private getUserTag(userId: string): string {\n    return `rbac:user:${userId}`\n  }\n\n  private getTenantTag(tenantId: string): string {\n    return `rbac:tenant:${tenantId}`\n  }\n\n  private getOrganizationTag(organizationId: string): string {\n    return `rbac:org:${organizationId}`\n  }\n\n  private async getFromCache(cacheKey: string): Promise<AclData | null> {\n    if (!this.cache) return null\n    const cached = await this.cache.get(cacheKey)\n    if (!cached) return null\n    return isAclData(cached) ? cached : null\n  }\n\n  private async setCache(cacheKey: string, data: AclData, userId: string, scope: { tenantId: string | null; organizationId: string | null }): Promise<void> {\n    if (!this.cache) return\n\n    const tags = [\n      this.getUserTag(userId),\n      'rbac:all'\n    ]\n\n    if (scope.tenantId) {\n      tags.push(this.getTenantTag(scope.tenantId))\n      // Scoped role projections depend on the selected organization's ancestor\n      // chain, so Directory hierarchy changes must evict them as well as the\n      // separately cached OrganizationScope entries.\n      tags.push(buildOrgScopeTenantCacheTag(scope.tenantId))\n    }\n\n    if (scope.organizationId) {\n      tags.push(this.getOrganizationTag(scope.organizationId))\n    }\n\n    await this.cache.set(cacheKey, data, {\n      ttl: this.cacheTtlMs,\n      tags\n    })\n  }\n\n  /**\n   * Invalidates cached ACL data for a specific user across all tenants and organizations.\n   * Call this when a user's roles or user-specific ACL is modified.\n   * \n   * @param userId - The ID of the user whose cache should be invalidated\n   */\n  async invalidateUserCache(userId: string): Promise<void> {\n    this.globalSuperAdminCache.delete(userId)\n    // Also drop the directory OrganizationScope cache for this user. That scope's\n    // accessible-org set is derived from this user's ACL/role grants, so any\n    // permission change that invalidates the RBAC cache must invalidate the\n    // resolved scope too. This is the missing `org-scope:user:*` caller required\n    // before the cross-request scope TTL can be safely enabled (issue #2259).\n    await this.deleteCacheByTags([this.getUserTag(userId), buildOrgScopeUserCacheTag(userId)])\n  }\n\n  /**\n   * Invalidates cached ACL data for all users within a specific tenant.\n   * Call this when a role's ACL is modified, since roles are tenant-scoped\n   * and affect all users in that tenant who have that role.\n   * \n   * @param tenantId - The ID of the tenant whose cache should be invalidated\n   */\n  async invalidateTenantCache(tenantId: string): Promise<void> {\n    this.globalSuperAdminCache.clear()\n    // Role ACL changes invalidate every user in the tenant; the resolved\n    // OrganizationScope for those users derives from the same grants, so drop\n    // the tenant-tagged scope entries alongside the RBAC ones (issue #2259).\n    await this.deleteCacheByTags([this.getTenantTag(tenantId), buildOrgScopeTenantCacheTag(tenantId)], [tenantId])\n  }\n\n  /**\n   * Invalidates cached ACL data for all users within a specific organization.\n   * Call this when organization-level permissions or visibility changes.\n   * \n   * @param organizationId - The ID of the organization whose cache should be invalidated\n   */\n  async invalidateOrganizationCache(organizationId: string): Promise<void> {\n    await this.deleteCacheByTags([this.getOrganizationTag(organizationId)])\n  }\n\n  /**\n   * Clears all cached ACL data.\n   * Use this for bulk operations or system-wide ACL changes.\n   */\n  async invalidateAllCache(): Promise<void> {\n    this.globalSuperAdminCache.clear()\n    await this.deleteCacheByTags(['rbac:all'])\n  }\n\n  private async deleteCacheByTags(tags: string[], tenantHints?: Array<string | null>): Promise<void> {\n    if (!this.cache) return\n    const contexts = new Set<string | null>()\n    const current = getCurrentCacheTenant()\n    contexts.add(current ?? null)\n    contexts.add(null)\n    if (Array.isArray(tenantHints)) {\n      for (const hint of tenantHints) {\n        contexts.add(hint ?? null)\n      }\n    }\n    for (const ctx of contexts) {\n      if (ctx === current) {\n        await this.cache.deleteByTags(tags)\n      } else {\n        await runWithCacheTenant(ctx, async () => {\n          await this.cache!.deleteByTags(tags)\n        })\n      }\n    }\n  }\n\n  private async isGlobalSuperAdmin(userId: string): Promise<boolean> {\n    if (this.globalSuperAdminCache.has(userId)) return this.globalSuperAdminCache.get(userId)!\n    const em = this.em.fork()\n    const userSuper = await em.findOne(UserAcl, { user: userId as any, isSuperAdmin: true })\n    if (userSuper && (userSuper as any).isSuperAdmin) {\n      this.globalSuperAdminCache.set(userId, true)\n      return true\n    }\n    const links = await findWithDecryption(\n      em,\n      UserRole,\n      { user: userId as any },\n      { populate: ['role'] },\n      { tenantId: null, organizationId: null },\n    )\n    const linkList = Array.isArray(links) ? links : []\n    if (!linkList.length) {\n      this.globalSuperAdminCache.set(userId, false)\n      return false\n    }\n    const roleIds = Array.from(new Set(linkList.map((link) => {\n      const role = link.role as any\n      return role?.id ? String(role.id) : null\n    }).filter((id): id is string => typeof id === 'string' && id.length > 0)))\n    if (!roleIds.length) {\n      this.globalSuperAdminCache.set(userId, false)\n      return false\n    }\n    const roleSupers = await em.find(RoleAcl, { isSuperAdmin: true, role: { $in: roleIds as any } } as any)\n    const result = roleSupers.some((roleAcl) => (\n      !!roleAcl.isSuperAdmin && !isRestrictedRoleAcl(roleAcl)\n    ))\n    this.globalSuperAdminCache.set(userId, result)\n    return result\n  }\n\n  /**\n   * Loads the Access Control List (ACL) for a user within a given scope.\n   * \n   * The ACL resolution follows this priority:\n   * 1. Per-user ACL (UserAcl) - if exists, use it exclusively\n   * 2. Aggregated role ACLs (RoleAcl) - combine permissions from all user's roles\n   * \n   * Results are cached for performance (default 5 minutes TTL).\n   * Cache is automatically invalidated when ACL-related data changes.\n   * \n   * @param userId - The ID of the user\n   * @param scope - The tenant and organization context for ACL evaluation\n   * @returns An object containing:\n   *   - isSuperAdmin: If true, user has unrestricted access to all features\n   *   - features: Array of feature strings (may include wildcards like 'entities.*')\n   *   - organizations: Array of organization IDs user can access, or null for all organizations\n   * \n   * @example\n   * const acl = await rbacService.loadAcl('user-123', { tenantId: 'tenant-1', organizationId: 'org-1' })\n   * // Returns: { isSuperAdmin: false, features: ['users.view', 'entities.*'], organizations: ['org-1', 'org-2'] }\n   */\n  async loadAcl(userId: string, scope: { tenantId: string | null; organizationId: string | null }): Promise<{\n    isSuperAdmin: boolean\n    features: string[]\n    organizations: string[] | null\n  }> {\n    const cacheKey = this.getCacheKey(userId, scope)\n    const cached = await this.getFromCache(cacheKey)\n    if (cached) return cached\n\n    // Direct user-level super-admin grants and unrestricted role-level\n    // super-admin grants are global. Organization-restricted role grants are\n    // deliberately excluded by isGlobalSuperAdmin and continue through the\n    // scoped ACL projection below.\n    if (!userId.startsWith('api_key:')) {\n      if (await this.isGlobalSuperAdmin(userId)) {\n        const result = { isSuperAdmin: true, features: ['*'], organizations: null }\n        await this.setCache(cacheKey, result, userId, scope)\n        return result\n      }\n    }\n\n    if (userId.startsWith('api_key:')) {\n      const apiKeyId = userId.slice('api_key:'.length)\n      const em = this.em.fork()\n      const key = await em.findOne(ApiKey, { id: apiKeyId, deletedAt: null })\n      if (!key || (key.expiresAt && key.expiresAt.getTime() < Date.now())) {\n        const result = { isSuperAdmin: false, features: [], organizations: null }\n        await this.setCache(cacheKey, result, userId, scope)\n        return result\n      }\n      const tenantId = scope.tenantId || key.tenantId || null\n      const roleIds = Array.isArray(key.rolesJson) ? key.rolesJson.filter(Boolean) : []\n      const keyOrganizationId = typeof key.organizationId === 'string' && key.organizationId.trim().length > 0\n        ? key.organizationId.trim()\n        : null\n      const evaluatedOrganizationId = scope.organizationId || keyOrganizationId\n      let isSuper = false\n      const features: string[] = []\n      let roleOrganizations: string[] | null = []\n      let hasApplicableRestrictedRole = false\n      if (tenantId && roleIds.length) {\n        const roleOrganizationScope = await resolveRoleOrganizationScope(\n          this.organizationHierarchyService,\n          tenantId,\n          evaluatedOrganizationId,\n        )\n        const racls = await em.find(RoleAcl, { tenantId, role: { $in: roleIds as any } } as any)\n        for (const acl of racls) {\n          if (roleAclAllowsOrganization(acl, roleOrganizationScope)) {\n            isSuper = isSuper || !!acl.isSuperAdmin\n            if (Array.isArray(acl.featuresJson)) {\n              for (const f of acl.featuresJson) if (!features.includes(f)) features.push(f)\n            }\n            if (isRestrictedRoleAcl(acl)) hasApplicableRestrictedRole = true\n          }\n          if (roleOrganizations !== null) {\n            if (acl.organizationsJson == null || (Array.isArray(acl.organizationsJson) && acl.organizationsJson.length === 0)) {\n              roleOrganizations = null\n            } else if (Array.isArray(acl.organizationsJson) && acl.organizationsJson.includes('__all__')) {\n              roleOrganizations = null\n            } else {\n              roleOrganizations = Array.from(new Set([\n                ...roleOrganizations,\n                ...(Array.isArray(acl.organizationsJson) ? acl.organizationsJson : []),\n              ]))\n            }\n          }\n        }\n        if (\n          roleOrganizations !== null\n          && evaluatedOrganizationId\n          && roleOrganizationScope !== null\n          && roleOrganizationScope.size > 0\n          && hasApplicableRestrictedRole\n          && !roleOrganizations.includes(evaluatedOrganizationId)\n        ) {\n          roleOrganizations.push(evaluatedOrganizationId)\n        }\n      }\n      let organizations = roleOrganizations\n      if (keyOrganizationId) {\n        const keyOrganizationScope = await resolveRoleOrganizationScope(\n          this.organizationHierarchyService,\n          tenantId,\n          keyOrganizationId,\n        )\n        organizations = roleOrganizations === null\n          || roleOrganizations.some((organizationId) => keyOrganizationScope?.has(organizationId))\n          ? [keyOrganizationId]\n          : []\n      }\n      // A role-level super-admin grant still respects the API key's effective\n      // organization allowlist. Represent it as a wildcard feature whenever\n      // the key is restricted so downstream super-admin shortcuts cannot\n      // bypass the key or role organization bounds.\n      if (isSuper && organizations !== null && !features.includes('*')) features.push('*')\n      const result = { isSuperAdmin: isSuper && organizations === null, features, organizations }\n      await this.setCache(cacheKey, result, userId, scope)\n      return result\n    }\n\n    // Use a forked EntityManager to avoid inheriting an aborted transaction from callers\n    const em = this.em.fork()\n    const user = await em.findOne(User, { id: userId })\n    if (!user) {\n      const result = { isSuperAdmin: false, features: [], organizations: null }\n      await this.setCache(cacheKey, result, userId, scope)\n      return result\n    }\n    const tenantId = scope.tenantId || user.tenantId || null\n    const orgId = scope.organizationId || user.organizationId || null\n\n    if (!tenantId) {\n      const result = { isSuperAdmin: false, features: [], organizations: null }\n      await this.setCache(cacheKey, result, userId, scope)\n      return result\n    }\n\n    // Per-user ACL first\n    const uacl = await em.findOne(UserAcl, { user: userId as any, tenantId })\n    if (uacl) {\n      const result = {\n        isSuperAdmin: !!uacl.isSuperAdmin,\n        features: Array.isArray(uacl.featuresJson) ? (uacl.featuresJson as string[]) : [],\n        organizations: Array.isArray(uacl.organizationsJson) ? (uacl.organizationsJson as string[]) : null,\n      }\n      await this.setCache(cacheKey, result, userId, scope)\n      return result\n    }\n\n    // Aggregate role ACLs\n    const links = await findWithDecryption(\n      em,\n      UserRole,\n      { user: userId as any, role: { tenantId } } as any,\n      { populate: ['role'] },\n      { tenantId, organizationId: orgId },\n    )\n    const linkList = Array.isArray(links) ? links : []\n    const roleIds = linkList.map((l) => (l.role as any)?.id).filter(Boolean)\n    let isSuper = false\n    const features: string[] = []\n    let organizations: string[] | null = []\n    let hasApplicableRestrictedRole = false\n    if (roleIds.length) {\n      const roleOrganizationScope = await resolveRoleOrganizationScope(\n        this.organizationHierarchyService,\n        tenantId,\n        scope.organizationId,\n      )\n      const racls = await em.find(RoleAcl, { tenantId, role: { $in: roleIds as any } } as any, {})\n      const roleAcls = Array.isArray(racls) ? racls : []\n      for (const r of roleAcls) {\n        if (roleAclAllowsOrganization(r, roleOrganizationScope)) {\n          isSuper = isSuper || !!r.isSuperAdmin\n          if (Array.isArray(r.featuresJson)) for (const f of r.featuresJson) if (!features.includes(f)) features.push(f)\n          if (isRestrictedRoleAcl(r)) hasApplicableRestrictedRole = true\n        }\n        if (organizations !== null) {\n          // For a user principal an empty allowlist is a deny-all scope (#4033), not\n          // \"unrestricted\": it must merge to an empty set so scoped reads and deletes\n          // fail closed. Only an absent allowlist or an explicit '__all__' widens to\n          // every organization. (The API-key branch above deliberately differs \u2014 an\n          // empty role list there means the key inherits the key's own scope.)\n          if (r.organizationsJson == null) organizations = null\n          else if (Array.isArray(r.organizationsJson) && r.organizationsJson.includes('__all__')) organizations = null\n          else organizations = Array.from(new Set([...(organizations || []), ...r.organizationsJson]))\n        }\n      }\n      if (\n        organizations !== null\n        && scope.organizationId\n        && roleOrganizationScope !== null\n        && roleOrganizationScope.size > 0\n        && hasApplicableRestrictedRole\n        && !organizations.includes(scope.organizationId)\n      ) {\n        organizations.push(scope.organizationId)\n      }\n    }\n    if (organizations && orgId && !organizations.includes(orgId) && !organizations.includes('__all__')) {\n      // Out-of-scope org; caller will enforce\n    }\n    const result = { isSuperAdmin: isSuper, features, organizations }\n    await this.setCache(cacheKey, result, userId, scope)\n    return result\n  }\n\n  /**\n   * Checks whether any tenant role grants a feature.\n   *\n   * This supports non-user runtimes such as scheduler workers that execute with\n   * tenant scope but without an authenticated user.\n   */\n  async tenantHasFeature(\n    tenantId: string | null | undefined,\n    feature: string,\n    opts?: { organizationId?: string | null },\n  ): Promise<boolean> {\n    if (!tenantId || !feature) return false\n\n    const em = this.em.fork()\n    const roleOrganizationScope = await resolveRoleOrganizationScope(\n      this.organizationHierarchyService,\n      tenantId,\n      opts?.organizationId,\n    )\n    const roleAcls = await em.find(RoleAcl, { tenantId, deletedAt: null } as any, {})\n    const list = Array.isArray(roleAcls) ? roleAcls : []\n\n    for (const acl of list) {\n      if (!roleAclAllowsOrganization(acl, roleOrganizationScope)) continue\n      const grants = Array.isArray(acl.featuresJson) ? acl.featuresJson : []\n      if (authorizeFeatures([feature], {\n        grantedFeatures: grants,\n        unrestricted: acl.isSuperAdmin,\n      })) {\n        return true\n      }\n    }\n\n    return false\n  }\n\n  /**\n   * Checks if a user has all required features within a given scope.\n   *\n   * This is the primary authorization check method used throughout the application.\n   * It combines feature checking with organization visibility validation.\n   *\n   * Authorization logic:\n   * 1. No features required \u2192 always returns true\n   * 2. User is super admin \u2192 always returns true\n   * 3. Organization restriction check: If the user's ACL has a restricted organization list\n   *    and the requested organization is not in that list \u2192 returns false\n   * 4. Feature matching: User must have all required features (supports wildcards)\n   *\n   * @param userId - The ID of the user\n   * @param required - Array of feature strings to check (e.g., ['users.view', 'users.edit'])\n   * @param scope - The tenant and organization context for authorization\n   * @returns true if the user has all required features and organization access, false otherwise\n   *\n   * @example\n   * // Check if user can view and edit users\n   * const canManageUsers = await rbacService.userHasAllFeatures(\n   *   'user-123',\n   *   ['users.view', 'users.edit'],\n   *   { tenantId: 'tenant-1', organizationId: 'org-1' }\n   * )\n   *\n   * @example\n   * // Check with wildcard features\n   * const canAccessEntities = await rbacService.userHasAllFeatures(\n   *   'user-123',\n   *   ['entities.records.view'],\n   *   { tenantId: 'tenant-1', organizationId: 'org-1' }\n   * )\n   * // Returns true if user has 'entities.*', '*', or 'entities.records.view'\n   */\n  async userHasAllFeatures(userId: string, required: string[], scope: { tenantId: string | null; organizationId: string | null }): Promise<boolean> {\n    if (!required.length) return true\n    const acl = await this.loadAcl(userId, scope)\n    const organizationAllowed = acl.isSuperAdmin\n      || !acl.organizations\n      || !scope.organizationId\n      || acl.organizations.includes(scope.organizationId)\n      || acl.organizations.includes('__all__')\n    return authorizeFeatures(required, {\n      grantedFeatures: acl.features,\n      unrestricted: acl.isSuperAdmin,\n      scopeAllowed: organizationAllowed,\n    })\n  }\n\n  /**\n   * Returns the user's infrastructure grant list, filtered to enabled modules.\n   * The result may contain wildcards; authoritative checks must still go through\n   * `authorizeFeatures` or `userHasAllFeatures` so null overrides are enforced.\n   */\n  async getGrantedFeatures(\n    userId: string,\n    scope: { tenantId: string | null; organizationId: string | null },\n  ): Promise<string[]> {\n    const acl = await this.loadAcl(userId, scope)\n    if (acl.isSuperAdmin) return filterGrantsByEnabledModules(['*'])\n    if (\n      acl.organizations &&\n      scope.organizationId &&\n      !acl.organizations.includes(scope.organizationId) &&\n      !acl.organizations.includes('__all__')\n    ) {\n      return []\n    }\n    return filterGrantsByEnabledModules(acl.features)\n  }\n\n  /** Returns concrete active feature IDs for browser capability payloads. */\n  async getEffectiveFeatures(\n    userId: string,\n    scope: { tenantId: string | null; organizationId: string | null },\n  ): Promise<string[]> {\n    const acl = await this.loadAcl(userId, scope)\n    const organizationAllowed = acl.isSuperAdmin\n      || !acl.organizations\n      || !scope.organizationId\n      || acl.organizations.includes(scope.organizationId)\n      || acl.organizations.includes('__all__')\n    if (!organizationAllowed) return []\n    return resolveEffectiveFeatures(acl.isSuperAdmin ? ['*'] : acl.features)\n  }\n}\n"],
+  "mappings": "AAEA,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,SAAS,SAAS,MAAM,gBAAgB;AACjD,SAAS,cAAc;AACvB,SAAS,0BAA0B;AAEnC,SAAS,2BAA2B,mCAAmC;AACvE;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,oCAAoC;AAC7C,SAAS,8BAA8B,iCAAiC;AAQxE,SAAS,UAAU,OAAkC;AACnD,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,SAAS;AACf,MAAI,OAAO,OAAO,iBAAiB,UAAW,QAAO;AACrD,MAAI,CAAC,MAAM,QAAQ,OAAO,QAAQ,KAAK,OAAO,SAAS,KAAK,CAAC,YAAY,OAAO,YAAY,QAAQ,EAAG,QAAO;AAC9G,MAAI,OAAO,kBAAkB,QAAQ,OAAO,kBAAkB,QAAW;AACvE,QAAI,CAAC,MAAM,QAAQ,OAAO,aAAa,EAAG,QAAO;AACjD,QAAI,OAAO,cAAc,KAAK,CAAC,QAAQ,OAAO,QAAQ,QAAQ,EAAG,QAAO;AAAA,EAC1E;AACA,SAAO;AACT;AAEA,SAAS,oBAAoB,KAAkD;AAC7E,SAAO,MAAM,QAAQ,IAAI,iBAAiB,KACrC,IAAI,kBAAkB,SAAS,KAC/B,CAAC,IAAI,kBAAkB,SAAS,SAAS;AAChD;AAEO,MAAM,YAAY;AAAA,EAKvB,YACU,IACR,OACiB,8BACjB;AAHQ;AAES;AAPnB,SAAQ,aAAqB,IAAI,KAAK;AACtC;AAAA,SAAQ,QAA8B;AACtC,SAAQ,wBAAwB,oBAAI,IAAqB;AAOvD,SAAK,QAAQ,SAAS;AAAA,EACxB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,YAAY,OAAe;AACzB,SAAK,aAAa;AAAA,EACpB;AAAA;AAAA,EAGO,eAAe,UAAoB,SAA4B;AACpE,WAAO,kBAAkB,UAAU,EAAE,iBAAiB,QAAQ,CAAC;AAAA,EACjE;AAAA,EAEQ,YAAY,QAAgB,OAA2E;AAC7G,WAAO,QAAQ,MAAM,IAAI,MAAM,YAAY,MAAM,IAAI,MAAM,kBAAkB,MAAM;AAAA,EACrF;AAAA,EAEQ,WAAW,QAAwB;AACzC,WAAO,aAAa,MAAM;AAAA,EAC5B;AAAA,EAEQ,aAAa,UAA0B;AAC7C,WAAO,eAAe,QAAQ;AAAA,EAChC;AAAA,EAEQ,mBAAmB,gBAAgC;AACzD,WAAO,YAAY,cAAc;AAAA,EACnC;AAAA,EAEA,MAAc,aAAa,UAA2C;AACpE,QAAI,CAAC,KAAK,MAAO,QAAO;AACxB,UAAM,SAAS,MAAM,KAAK,MAAM,IAAI,QAAQ;AAC5C,QAAI,CAAC,OAAQ,QAAO;AACpB,WAAO,UAAU,MAAM,IAAI,SAAS;AAAA,EACtC;AAAA,EAEA,MAAc,SAAS,UAAkB,MAAe,QAAgB,OAAkF;AACxJ,QAAI,CAAC,KAAK,MAAO;AAEjB,UAAM,OAAO;AAAA,MACX,KAAK,WAAW,MAAM;AAAA,MACtB;AAAA,IACF;AAEA,QAAI,MAAM,UAAU;AAClB,WAAK,KAAK,KAAK,aAAa,MAAM,QAAQ,CAAC;AAI3C,WAAK,KAAK,4BAA4B,MAAM,QAAQ,CAAC;AAAA,IACvD;AAEA,QAAI,MAAM,gBAAgB;AACxB,WAAK,KAAK,KAAK,mBAAmB,MAAM,cAAc,CAAC;AAAA,IACzD;AAEA,UAAM,KAAK,MAAM,IAAI,UAAU,MAAM;AAAA,MACnC,KAAK,KAAK;AAAA,MACV;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,oBAAoB,QAA+B;AACvD,SAAK,sBAAsB,OAAO,MAAM;AAMxC,UAAM,KAAK,kBAAkB,CAAC,KAAK,WAAW,MAAM,GAAG,0BAA0B,MAAM,CAAC,CAAC;AAAA,EAC3F;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,sBAAsB,UAAiC;AAC3D,SAAK,sBAAsB,MAAM;AAIjC,UAAM,KAAK,kBAAkB,CAAC,KAAK,aAAa,QAAQ,GAAG,4BAA4B,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;AAAA,EAC/G;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,4BAA4B,gBAAuC;AACvE,UAAM,KAAK,kBAAkB,CAAC,KAAK,mBAAmB,cAAc,CAAC,CAAC;AAAA,EACxE;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,qBAAoC;AACxC,SAAK,sBAAsB,MAAM;AACjC,UAAM,KAAK,kBAAkB,CAAC,UAAU,CAAC;AAAA,EAC3C;AAAA,EAEA,MAAc,kBAAkB,MAAgB,aAAmD;AACjG,QAAI,CAAC,KAAK,MAAO;AACjB,UAAM,WAAW,oBAAI,IAAmB;AACxC,UAAM,UAAU,sBAAsB;AACtC,aAAS,IAAI,WAAW,IAAI;AAC5B,aAAS,IAAI,IAAI;AACjB,QAAI,MAAM,QAAQ,WAAW,GAAG;AAC9B,iBAAW,QAAQ,aAAa;AAC9B,iBAAS,IAAI,QAAQ,IAAI;AAAA,MAC3B;AAAA,IACF;AACA,eAAW,OAAO,UAAU;AAC1B,UAAI,QAAQ,SAAS;AACnB,cAAM,KAAK,MAAM,aAAa,IAAI;AAAA,MACpC,OAAO;AACL,cAAM,mBAAmB,KAAK,YAAY;AACxC,gBAAM,KAAK,MAAO,aAAa,IAAI;AAAA,QACrC,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,mBAAmB,QAAkC;AACjE,QAAI,KAAK,sBAAsB,IAAI,MAAM,EAAG,QAAO,KAAK,sBAAsB,IAAI,MAAM;AACxF,UAAM,KAAK,KAAK,GAAG,KAAK;AACxB,UAAM,YAAY,MAAM,GAAG,QAAQ,SAAS,EAAE,MAAM,QAAe,cAAc,KAAK,CAAC;AACvF,QAAI,aAAc,UAAkB,cAAc;AAChD,WAAK,sBAAsB,IAAI,QAAQ,IAAI;AAC3C,aAAO;AAAA,IACT;AACA,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA,EAAE,MAAM,OAAc;AAAA,MACtB,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,MACrB,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,IACzC;AACA,UAAM,WAAW,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC;AACjD,QAAI,CAAC,SAAS,QAAQ;AACpB,WAAK,sBAAsB,IAAI,QAAQ,KAAK;AAC5C,aAAO;AAAA,IACT;AACA,UAAM,UAAU,MAAM,KAAK,IAAI,IAAI,SAAS,IAAI,CAAC,SAAS;AACxD,YAAM,OAAO,KAAK;AAClB,aAAO,MAAM,KAAK,OAAO,KAAK,EAAE,IAAI;AAAA,IACtC,CAAC,EAAE,OAAO,CAAC,OAAqB,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC,CAAC,CAAC;AACzE,QAAI,CAAC,QAAQ,QAAQ;AACnB,WAAK,sBAAsB,IAAI,QAAQ,KAAK;AAC5C,aAAO;AAAA,IACT;AACA,UAAM,aAAa,MAAM,GAAG,KAAK,SAAS,EAAE,cAAc,MAAM,MAAM,EAAE,KAAK,QAAe,EAAE,CAAQ;AACtG,UAAM,SAAS,WAAW,KAAK,CAAC,YAC9B,CAAC,CAAC,QAAQ,gBAAgB,CAAC,oBAAoB,OAAO,CACvD;AACD,SAAK,sBAAsB,IAAI,QAAQ,MAAM;AAC7C,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,MAAM,QAAQ,QAAgB,OAI3B;AACD,UAAM,WAAW,KAAK,YAAY,QAAQ,KAAK;AAC/C,UAAM,SAAS,MAAM,KAAK,aAAa,QAAQ;AAC/C,QAAI,OAAQ,QAAO;AAMnB,QAAI,CAAC,OAAO,WAAW,UAAU,GAAG;AAClC,UAAI,MAAM,KAAK,mBAAmB,MAAM,GAAG;AACzC,cAAMA,UAAS,EAAE,cAAc,MAAM,UAAU,CAAC,GAAG,GAAG,eAAe,KAAK;AAC1E,cAAM,KAAK,SAAS,UAAUA,SAAQ,QAAQ,KAAK;AACnD,eAAOA;AAAA,MACT;AAAA,IACF;AAEA,QAAI,OAAO,WAAW,UAAU,GAAG;AACjC,YAAM,WAAW,OAAO,MAAM,WAAW,MAAM;AAC/C,YAAMC,MAAK,KAAK,GAAG,KAAK;AACxB,YAAM,MAAM,MAAMA,IAAG,QAAQ,QAAQ,EAAE,IAAI,UAAU,WAAW,KAAK,CAAC;AACtE,UAAI,CAAC,OAAQ,IAAI,aAAa,IAAI,UAAU,QAAQ,IAAI,KAAK,IAAI,GAAI;AACnE,cAAMD,UAAS,EAAE,cAAc,OAAO,UAAU,CAAC,GAAG,eAAe,KAAK;AACxE,cAAM,KAAK,SAAS,UAAUA,SAAQ,QAAQ,KAAK;AACnD,eAAOA;AAAA,MACT;AACA,YAAME,YAAW,MAAM,YAAY,IAAI,YAAY;AACnD,YAAMC,WAAU,MAAM,QAAQ,IAAI,SAAS,IAAI,IAAI,UAAU,OAAO,OAAO,IAAI,CAAC;AAChF,YAAM,oBAAoB,OAAO,IAAI,mBAAmB,YAAY,IAAI,eAAe,KAAK,EAAE,SAAS,IACnG,IAAI,eAAe,KAAK,IACxB;AACJ,YAAM,0BAA0B,MAAM,kBAAkB;AACxD,UAAIC,WAAU;AACd,YAAMC,YAAqB,CAAC;AAC5B,UAAI,oBAAqC,CAAC;AAC1C,UAAIC,+BAA8B;AAClC,UAAIJ,aAAYC,SAAQ,QAAQ;AAC9B,cAAM,wBAAwB,MAAM;AAAA,UAClC,KAAK;AAAA,UACLD;AAAA,UACA;AAAA,QACF;AACA,cAAM,QAAQ,MAAMD,IAAG,KAAK,SAAS,EAAE,UAAAC,WAAU,MAAM,EAAE,KAAKC,SAAe,EAAE,CAAQ;AACvF,mBAAW,OAAO,OAAO;AACvB,cAAI,0BAA0B,KAAK,qBAAqB,GAAG;AACzD,YAAAC,WAAUA,YAAW,CAAC,CAAC,IAAI;AAC3B,gBAAI,MAAM,QAAQ,IAAI,YAAY,GAAG;AACnC,yBAAW,KAAK,IAAI,aAAc,KAAI,CAACC,UAAS,SAAS,CAAC,EAAG,CAAAA,UAAS,KAAK,CAAC;AAAA,YAC9E;AACA,gBAAI,oBAAoB,GAAG,EAAG,CAAAC,+BAA8B;AAAA,UAC9D;AACA,cAAI,sBAAsB,MAAM;AAC9B,gBAAI,IAAI,qBAAqB,QAAS,MAAM,QAAQ,IAAI,iBAAiB,KAAK,IAAI,kBAAkB,WAAW,GAAI;AACjH,kCAAoB;AAAA,YACtB,WAAW,MAAM,QAAQ,IAAI,iBAAiB,KAAK,IAAI,kBAAkB,SAAS,SAAS,GAAG;AAC5F,kCAAoB;AAAA,YACtB,OAAO;AACL,kCAAoB,MAAM,KAAK,oBAAI,IAAI;AAAA,gBACrC,GAAG;AAAA,gBACH,GAAI,MAAM,QAAQ,IAAI,iBAAiB,IAAI,IAAI,oBAAoB,CAAC;AAAA,cACtE,CAAC,CAAC;AAAA,YACJ;AAAA,UACF;AAAA,QACF;AACA,YACE,sBAAsB,QACnB,2BACA,0BAA0B,QAC1B,sBAAsB,OAAO,KAC7BA,gCACA,CAAC,kBAAkB,SAAS,uBAAuB,GACtD;AACA,4BAAkB,KAAK,uBAAuB;AAAA,QAChD;AAAA,MACF;AACA,UAAIC,iBAAgB;AACpB,UAAI,mBAAmB;AACrB,cAAM,uBAAuB,MAAM;AAAA,UACjC,KAAK;AAAA,UACLL;AAAA,UACA;AAAA,QACF;AACA,QAAAK,iBAAgB,sBAAsB,QACjC,kBAAkB,KAAK,CAAC,mBAAmB,sBAAsB,IAAI,cAAc,CAAC,IACrF,CAAC,iBAAiB,IAClB,CAAC;AAAA,MACP;AAKA,UAAIH,YAAWG,mBAAkB,QAAQ,CAACF,UAAS,SAAS,GAAG,EAAG,CAAAA,UAAS,KAAK,GAAG;AACnF,YAAML,UAAS,EAAE,cAAcI,YAAWG,mBAAkB,MAAM,UAAAF,WAAU,eAAAE,eAAc;AAC1F,YAAM,KAAK,SAAS,UAAUP,SAAQ,QAAQ,KAAK;AACnD,aAAOA;AAAA,IACT;AAGA,UAAM,KAAK,KAAK,GAAG,KAAK;AACxB,UAAM,OAAO,MAAM,GAAG,QAAQ,MAAM,EAAE,IAAI,OAAO,CAAC;AAClD,QAAI,CAAC,MAAM;AACT,YAAMA,UAAS,EAAE,cAAc,OAAO,UAAU,CAAC,GAAG,eAAe,KAAK;AACxE,YAAM,KAAK,SAAS,UAAUA,SAAQ,QAAQ,KAAK;AACnD,aAAOA;AAAA,IACT;AACA,UAAM,WAAW,MAAM,YAAY,KAAK,YAAY;AACpD,UAAM,QAAQ,MAAM,kBAAkB,KAAK,kBAAkB;AAE7D,QAAI,CAAC,UAAU;AACb,YAAMA,UAAS,EAAE,cAAc,OAAO,UAAU,CAAC,GAAG,eAAe,KAAK;AACxE,YAAM,KAAK,SAAS,UAAUA,SAAQ,QAAQ,KAAK;AACnD,aAAOA;AAAA,IACT;AAGA,UAAM,OAAO,MAAM,GAAG,QAAQ,SAAS,EAAE,MAAM,QAAe,SAAS,CAAC;AACxE,QAAI,MAAM;AACR,YAAMA,UAAS;AAAA,QACb,cAAc,CAAC,CAAC,KAAK;AAAA,QACrB,UAAU,MAAM,QAAQ,KAAK,YAAY,IAAK,KAAK,eAA4B,CAAC;AAAA,QAChF,eAAe,MAAM,QAAQ,KAAK,iBAAiB,IAAK,KAAK,oBAAiC;AAAA,MAChG;AACA,YAAM,KAAK,SAAS,UAAUA,SAAQ,QAAQ,KAAK;AACnD,aAAOA;AAAA,IACT;AAGA,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA,EAAE,MAAM,QAAe,MAAM,EAAE,SAAS,EAAE;AAAA,MAC1C,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,MACrB,EAAE,UAAU,gBAAgB,MAAM;AAAA,IACpC;AACA,UAAM,WAAW,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC;AACjD,UAAM,UAAU,SAAS,IAAI,CAAC,MAAO,EAAE,MAAc,EAAE,EAAE,OAAO,OAAO;AACvE,QAAI,UAAU;AACd,UAAM,WAAqB,CAAC;AAC5B,QAAI,gBAAiC,CAAC;AACtC,QAAI,8BAA8B;AAClC,QAAI,QAAQ,QAAQ;AAClB,YAAM,wBAAwB,MAAM;AAAA,QAClC,KAAK;AAAA,QACL;AAAA,QACA,MAAM;AAAA,MACR;AACA,YAAM,QAAQ,MAAM,GAAG,KAAK,SAAS,EAAE,UAAU,MAAM,EAAE,KAAK,QAAe,EAAE,GAAU,CAAC,CAAC;AAC3F,YAAM,WAAW,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC;AACjD,iBAAW,KAAK,UAAU;AACxB,YAAI,0BAA0B,GAAG,qBAAqB,GAAG;AACvD,oBAAU,WAAW,CAAC,CAAC,EAAE;AACzB,cAAI,MAAM,QAAQ,EAAE,YAAY;AAAG,uBAAW,KAAK,EAAE,aAAc,KAAI,CAAC,SAAS,SAAS,CAAC,EAAG,UAAS,KAAK,CAAC;AAAA;AAC7G,cAAI,oBAAoB,CAAC,EAAG,+BAA8B;AAAA,QAC5D;AACA,YAAI,kBAAkB,MAAM;AAM1B,cAAI,EAAE,qBAAqB,KAAM,iBAAgB;AAAA,mBACxC,MAAM,QAAQ,EAAE,iBAAiB,KAAK,EAAE,kBAAkB,SAAS,SAAS,EAAG,iBAAgB;AAAA,cACnG,iBAAgB,MAAM,KAAK,oBAAI,IAAI,CAAC,GAAI,iBAAiB,CAAC,GAAI,GAAG,EAAE,iBAAiB,CAAC,CAAC;AAAA,QAC7F;AAAA,MACF;AACA,UACE,kBAAkB,QACf,MAAM,kBACN,0BAA0B,QAC1B,sBAAsB,OAAO,KAC7B,+BACA,CAAC,cAAc,SAAS,MAAM,cAAc,GAC/C;AACA,sBAAc,KAAK,MAAM,cAAc;AAAA,MACzC;AAAA,IACF;AACA,QAAI,iBAAiB,SAAS,CAAC,cAAc,SAAS,KAAK,KAAK,CAAC,cAAc,SAAS,SAAS,GAAG;AAAA,IAEpG;AACA,UAAM,SAAS,EAAE,cAAc,SAAS,UAAU,cAAc;AAChE,UAAM,KAAK,SAAS,UAAU,QAAQ,QAAQ,KAAK;AACnD,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,iBACJ,UACA,SACA,MACkB;AAClB,QAAI,CAAC,YAAY,CAAC,QAAS,QAAO;AAElC,UAAM,KAAK,KAAK,GAAG,KAAK;AACxB,UAAM,wBAAwB,MAAM;AAAA,MAClC,KAAK;AAAA,MACL;AAAA,MACA,MAAM;AAAA,IACR;AACA,UAAM,WAAW,MAAM,GAAG,KAAK,SAAS,EAAE,UAAU,WAAW,KAAK,GAAU,CAAC,CAAC;AAChF,UAAM,OAAO,MAAM,QAAQ,QAAQ,IAAI,WAAW,CAAC;AAEnD,eAAW,OAAO,MAAM;AACtB,UAAI,CAAC,0BAA0B,KAAK,qBAAqB,EAAG;AAC5D,YAAM,SAAS,MAAM,QAAQ,IAAI,YAAY,IAAI,IAAI,eAAe,CAAC;AACrE,UAAI,kBAAkB,CAAC,OAAO,GAAG;AAAA,QAC/B,iBAAiB;AAAA,QACjB,cAAc,IAAI;AAAA,MACpB,CAAC,GAAG;AACF,eAAO;AAAA,MACT;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqCA,MAAM,mBAAmB,QAAgB,UAAoB,OAAqF;AAChJ,QAAI,CAAC,SAAS,OAAQ,QAAO;AAC7B,UAAM,MAAM,MAAM,KAAK,QAAQ,QAAQ,KAAK;AAC5C,UAAM,sBAAsB,IAAI,gBAC3B,CAAC,IAAI,iBACL,CAAC,MAAM,kBACP,IAAI,cAAc,SAAS,MAAM,cAAc,KAC/C,IAAI,cAAc,SAAS,SAAS;AACzC,WAAO,kBAAkB,UAAU;AAAA,MACjC,iBAAiB,IAAI;AAAA,MACrB,cAAc,IAAI;AAAA,MAClB,cAAc;AAAA,IAChB,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,mBACJ,QACA,OACmB;AACnB,UAAM,MAAM,MAAM,KAAK,QAAQ,QAAQ,KAAK;AAC5C,QAAI,IAAI,aAAc,QAAO,6BAA6B,CAAC,GAAG,CAAC;AAC/D,QACE,IAAI,iBACJ,MAAM,kBACN,CAAC,IAAI,cAAc,SAAS,MAAM,cAAc,KAChD,CAAC,IAAI,cAAc,SAAS,SAAS,GACrC;AACA,aAAO,CAAC;AAAA,IACV;AACA,WAAO,6BAA6B,IAAI,QAAQ;AAAA,EAClD;AAAA;AAAA,EAGA,MAAM,qBACJ,QACA,OACmB;AACnB,UAAM,MAAM,MAAM,KAAK,QAAQ,QAAQ,KAAK;AAC5C,UAAM,sBAAsB,IAAI,gBAC3B,CAAC,IAAI,iBACL,CAAC,MAAM,kBACP,IAAI,cAAc,SAAS,MAAM,cAAc,KAC/C,IAAI,cAAc,SAAS,SAAS;AACzC,QAAI,CAAC,oBAAqB,QAAO,CAAC;AAClC,WAAO,yBAAyB,IAAI,eAAe,CAAC,GAAG,IAAI,IAAI,QAAQ;AAAA,EACzE;AACF;",
+  "names": ["result", "em", "tenantId", "roleIds", "isSuper", "features", "hasApplicableRestrictedRole", "organizations"]
 }

package/dist/modules/auth/services/roleOrganizationScope.js

@@ -0,0 +1,41 @@
+function normalizeId(value) {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
+}
+async function resolveRoleOrganizationScope(hierarchyService, tenantId, organizationId) {
+  const selectedId = normalizeId(organizationId);
+  if (!selectedId) return null;
+  const normalizedTenantId = normalizeId(tenantId);
+  if (!normalizedTenantId) return /* @__PURE__ */ new Set();
+  const ids = /* @__PURE__ */ new Set([selectedId]);
+  if (!hierarchyService) return ids;
+  const ancestorIds = await hierarchyService.resolveAncestorIds({
+    tenantId: normalizedTenantId,
+    organizationId: selectedId
+  });
+  if (ancestorIds === null) return /* @__PURE__ */ new Set();
+  for (const ancestorId of ancestorIds) {
+    const normalized = normalizeId(ancestorId);
+    if (normalized) ids.add(normalized);
+  }
+  return ids;
+}
+function roleAclAllowsOrganization(acl, scope) {
+  if (!scope) return true;
+  const organizations = Array.isArray(acl.organizationsJson) ? acl.organizationsJson : null;
+  if (!organizations || organizations.length === 0 || organizations.includes("__all__")) return true;
+  return organizations.some((organizationId) => scope.has(organizationId));
+}
+function roleAclGrantsPrincipalOrganization(acl, scope) {
+  if (!scope) return true;
+  const organizations = Array.isArray(acl.organizationsJson) ? acl.organizationsJson : null;
+  if (!organizations) return true;
+  if (organizations.length === 0) return false;
+  if (organizations.includes("__all__")) return true;
+  return organizations.some((organizationId) => scope.has(organizationId));
+}
+export {
+  resolveRoleOrganizationScope,
+  roleAclAllowsOrganization,
+  roleAclGrantsPrincipalOrganization
+};
+//# sourceMappingURL=roleOrganizationScope.js.map

package/dist/modules/auth/services/roleOrganizationScope.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/auth/services/roleOrganizationScope.ts"],
+  "sourcesContent": ["import type { OrganizationHierarchyService } from '@open-mercato/shared/lib/auth/principal-service'\nimport type { RoleAcl } from '../data/entities'\n\nexport type RoleOrganizationScope = ReadonlySet<string> | null\n\nfunction normalizeId(value: unknown): string | null {\n  return typeof value === 'string' && value.trim().length > 0 ? value.trim() : null\n}\n\nexport async function resolveRoleOrganizationScope(\n  hierarchyService: OrganizationHierarchyService | null | undefined,\n  tenantId: string | null | undefined,\n  organizationId: string | null | undefined,\n): Promise<RoleOrganizationScope> {\n  const selectedId = normalizeId(organizationId)\n  if (!selectedId) return null\n  const normalizedTenantId = normalizeId(tenantId)\n  if (!normalizedTenantId) return new Set()\n\n  const ids = new Set<string>([selectedId])\n  // Auth remains independently usable when Directory is disabled: exact-org\n  // grants still apply, while parent-to-descendant expansion fails closed.\n  if (!hierarchyService) return ids\n\n  const ancestorIds = await hierarchyService.resolveAncestorIds({\n    tenantId: normalizedTenantId,\n    organizationId: selectedId,\n  })\n  // A registered Directory seam can prove an invalid/wrong-tenant selection.\n  // Fail closed for restricted roles in that case.\n  if (ancestorIds === null) return new Set()\n  for (const ancestorId of ancestorIds) {\n    const normalized = normalizeId(ancestorId)\n    if (normalized) ids.add(normalized)\n  }\n  return ids\n}\n\nexport function roleAclAllowsOrganization(\n  acl: Pick<RoleAcl, 'organizationsJson'>,\n  scope: RoleOrganizationScope,\n): boolean {\n  if (!scope) return true\n  const organizations = Array.isArray(acl.organizationsJson) ? acl.organizationsJson : null\n  if (!organizations || organizations.length === 0 || organizations.includes('__all__')) return true\n  return organizations.some((organizationId) => scope.has(organizationId))\n}\n\n/**\n * Principal eligibility \u2014 which roles may be selected as, or resolved into, an explicit share\n * target \u2014 follows the human-principal deny-all contract instead: an empty allowlist grants no\n * organization reach, so such a role must not become a share principal here (#4033).\n *\n * This deliberately differs from `roleAclAllowsOrganization` above, which governs *feature*\n * evaluation and keeps the wider \"an empty list applies everywhere\" meaning, and from the\n * API-key projection, where an empty list means \"inherit the key's own organization binding\".\n * Without this split a user who reaches an organization through a second role could inherit\n * viewer/editor access from a share assigned to a deny-all role.\n */\nexport function roleAclGrantsPrincipalOrganization(\n  acl: Pick<RoleAcl, 'organizationsJson'>,\n  scope: RoleOrganizationScope,\n): boolean {\n  if (!scope) return true\n  const organizations = Array.isArray(acl.organizationsJson) ? acl.organizationsJson : null\n  if (!organizations) return true\n  if (organizations.length === 0) return false\n  if (organizations.includes('__all__')) return true\n  return organizations.some((organizationId) => scope.has(organizationId))\n}\n"],
+  "mappings": "AAKA,SAAS,YAAY,OAA+B;AAClD,SAAO,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,IAAI,MAAM,KAAK,IAAI;AAC/E;AAEA,eAAsB,6BACpB,kBACA,UACA,gBACgC;AAChC,QAAM,aAAa,YAAY,cAAc;AAC7C,MAAI,CAAC,WAAY,QAAO;AACxB,QAAM,qBAAqB,YAAY,QAAQ;AAC/C,MAAI,CAAC,mBAAoB,QAAO,oBAAI,IAAI;AAExC,QAAM,MAAM,oBAAI,IAAY,CAAC,UAAU,CAAC;AAGxC,MAAI,CAAC,iBAAkB,QAAO;AAE9B,QAAM,cAAc,MAAM,iBAAiB,mBAAmB;AAAA,IAC5D,UAAU;AAAA,IACV,gBAAgB;AAAA,EAClB,CAAC;AAGD,MAAI,gBAAgB,KAAM,QAAO,oBAAI,IAAI;AACzC,aAAW,cAAc,aAAa;AACpC,UAAM,aAAa,YAAY,UAAU;AACzC,QAAI,WAAY,KAAI,IAAI,UAAU;AAAA,EACpC;AACA,SAAO;AACT;AAEO,SAAS,0BACd,KACA,OACS;AACT,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,gBAAgB,MAAM,QAAQ,IAAI,iBAAiB,IAAI,IAAI,oBAAoB;AACrF,MAAI,CAAC,iBAAiB,cAAc,WAAW,KAAK,cAAc,SAAS,SAAS,EAAG,QAAO;AAC9F,SAAO,cAAc,KAAK,CAAC,mBAAmB,MAAM,IAAI,cAAc,CAAC;AACzE;AAaO,SAAS,mCACd,KACA,OACS;AACT,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,gBAAgB,MAAM,QAAQ,IAAI,iBAAiB,IAAI,IAAI,oBAAoB;AACrF,MAAI,CAAC,cAAe,QAAO;AAC3B,MAAI,cAAc,WAAW,EAAG,QAAO;AACvC,MAAI,cAAc,SAAS,SAAS,EAAG,QAAO;AAC9C,SAAO,cAAc,KAAK,CAAC,mBAAmB,MAAM,IAAI,cAAc,CAAC;AACzE;",
+  "names": []
+}

package/dist/modules/directory/di.js

@@ -1,4 +1,13 @@
+import { asClass, asFunction } from "awilix";
+import { DefaultOrganizationScopeService } from "./services/organizationScopeService.js";
+import { DefaultOrganizationHierarchyService } from "./services/organizationHierarchyService.js";
 function register(container) {
+  container.register({
+    organizationHierarchyService: asClass(DefaultOrganizationHierarchyService).scoped(),
+    organizationScopeService: asFunction(
+      (cradle) => new DefaultOrganizationScopeService(cradle.em, cradle.rbacService, container)
+    ).scoped().proxy()
+  });
 }
 export {
   register