@open-mercato/core 0.6.8-develop.7100.1.fbf66fca35 → 0.7.0

package/dist/modules/auth/di.js

@@ -6,43 +6,17 @@ import {
   isRbacDefaultCacheEnabled,
   resetRbacFallbackCache
 } from "@open-mercato/core/modules/auth/services/rbacDefaultCache";
-import { DefaultAuthPrincipalService } from "./services/principalService.js";
-function resolveOptionalCache(container) {
-  try {
-    return container.hasRegistration("cache") ? container.resolve("cache") : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function resolveOptionalOrganizationHierarchyService(container) {
-  try {
-    if (!container.hasRegistration("organizationHierarchyService")) return void 0;
-    const candidate = container.resolve("organizationHierarchyService");
-    return typeof candidate?.resolveAncestorIds === "function" ? candidate : void 0;
-  } catch {
-    return void 0;
-  }
-}
 function register(container) {
   container.register({ authService: asClass(AuthService).scoped() });
-  container.register({
-    authPrincipalService: asFunction(function authPrincipalServiceFactory(em) {
-      return new DefaultAuthPrincipalService(
-        em,
-        resolveOptionalOrganizationHierarchyService(container)
-      );
-    }).scoped()
-  });
-  container.register({
-    rbacService: asFunction(function rbacServiceFactory(em) {
-      const configuredCache = resolveOptionalCache(container);
-      return new RbacService(
-        em,
-        configuredCache ?? (isRbacDefaultCacheEnabled() ? createRbacFallbackCache() : void 0),
-        resolveOptionalOrganizationHierarchyService(container)
-      );
-    }).scoped()
-  });
+  if (isRbacDefaultCacheEnabled()) {
+    container.register({
+      rbacService: asFunction((cradle) => {
+        return new RbacService(cradle.em, cradle.cache ?? createRbacFallbackCache());
+      }).scoped()
+    });
+  } else {
+    container.register({ rbacService: asClass(RbacService).scoped() });
+  }
 }
 export {
   register,

package/dist/modules/auth/di.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/auth/di.ts"],
-  "sourcesContent": ["import { asClass, asFunction } from 'awilix'\nimport type { AppContainer } from '@open-mercato/shared/lib/di/container'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CacheStrategy } from '@open-mercato/cache'\nimport type { OrganizationHierarchyService } from '@open-mercato/shared/lib/auth/principal-service'\nimport { AuthService } from '@open-mercato/core/modules/auth/services/authService'\nimport { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport {\n  createRbacFallbackCache,\n  isRbacDefaultCacheEnabled,\n  resetRbacFallbackCache,\n} from '@open-mercato/core/modules/auth/services/rbacDefaultCache'\nimport { DefaultAuthPrincipalService } from './services/principalService'\n\nexport { resetRbacFallbackCache }\n\nfunction resolveOptionalCache(container: AppContainer): CacheStrategy | undefined {\n  try {\n    return container.hasRegistration('cache')\n      ? container.resolve<CacheStrategy>('cache')\n      : undefined\n  } catch {\n    return undefined\n  }\n}\n\nfunction resolveOptionalOrganizationHierarchyService(\n  container: AppContainer,\n): OrganizationHierarchyService | undefined {\n  try {\n    if (!container.hasRegistration('organizationHierarchyService')) return undefined\n    const candidate = container.resolve<OrganizationHierarchyService>('organizationHierarchyService')\n    return typeof candidate?.resolveAncestorIds === 'function' ? candidate : undefined\n  } catch {\n    return undefined\n  }\n}\n\nexport function register(container: AppContainer) {\n  // Register or override core auth service\n  container.register({ authService: asClass(AuthService).scoped() })\n  container.register({\n    authPrincipalService: asFunction(function authPrincipalServiceFactory(em: EntityManager) {\n      return new DefaultAuthPrincipalService(\n        em,\n        resolveOptionalOrganizationHierarchyService(container),\n      )\n    }).scoped(),\n  })\n  // Resolve optional infrastructure lazily so Auth still works when Directory\n  // is disabled and in lean CLI/test containers without a CacheStrategy.\n  // Setting `OM_RBAC_DEFAULT_CACHE=on` opts into the in-process fallback;\n  // an explicitly registered cache always wins.\n  container.register({\n    rbacService: asFunction(function rbacServiceFactory(em: EntityManager) {\n      const configuredCache = resolveOptionalCache(container)\n      return new RbacService(\n        em,\n        configuredCache ?? (isRbacDefaultCacheEnabled() ? createRbacFallbackCache() : undefined),\n        resolveOptionalOrganizationHierarchyService(container),\n      )\n    }).scoped(),\n  })\n}\n"],
-  "mappings": "AAAA,SAAS,SAAS,kBAAkB;AAKpC,SAAS,mBAAmB;AAC5B,SAAS,mBAAmB;AAC5B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,mCAAmC;AAI5C,SAAS,qBAAqB,WAAoD;AAChF,MAAI;AACF,WAAO,UAAU,gBAAgB,OAAO,IACpC,UAAU,QAAuB,OAAO,IACxC;AAAA,EACN,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,4CACP,WAC0C;AAC1C,MAAI;AACF,QAAI,CAAC,UAAU,gBAAgB,8BAA8B,EAAG,QAAO;AACvE,UAAM,YAAY,UAAU,QAAsC,8BAA8B;AAChG,WAAO,OAAO,WAAW,uBAAuB,aAAa,YAAY;AAAA,EAC3E,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,SAAS,WAAyB;AAEhD,YAAU,SAAS,EAAE,aAAa,QAAQ,WAAW,EAAE,OAAO,EAAE,CAAC;AACjE,YAAU,SAAS;AAAA,IACjB,sBAAsB,WAAW,SAAS,4BAA4B,IAAmB;AACvF,aAAO,IAAI;AAAA,QACT;AAAA,QACA,4CAA4C,SAAS;AAAA,MACvD;AAAA,IACF,CAAC,EAAE,OAAO;AAAA,EACZ,CAAC;AAKD,YAAU,SAAS;AAAA,IACjB,aAAa,WAAW,SAAS,mBAAmB,IAAmB;AACrE,YAAM,kBAAkB,qBAAqB,SAAS;AACtD,aAAO,IAAI;AAAA,QACT;AAAA,QACA,oBAAoB,0BAA0B,IAAI,wBAAwB,IAAI;AAAA,QAC9E,4CAA4C,SAAS;AAAA,MACvD;AAAA,IACF,CAAC,EAAE,OAAO;AAAA,EACZ,CAAC;AACH;",
+  "sourcesContent": ["import { asClass, asFunction } from 'awilix'\nimport type { AppContainer } from '@open-mercato/shared/lib/di/container'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CacheStrategy } from '@open-mercato/cache'\nimport { AuthService } from '@open-mercato/core/modules/auth/services/authService'\nimport { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport {\n  createRbacFallbackCache,\n  isRbacDefaultCacheEnabled,\n  resetRbacFallbackCache,\n} from '@open-mercato/core/modules/auth/services/rbacDefaultCache'\n\nexport { resetRbacFallbackCache }\n\nexport function register(container: AppContainer) {\n  // Register or override core auth service\n  container.register({ authService: asClass(AuthService).scoped() })\n  // RBAC service. The bare `asClass(...).scoped()` registration matches\n  // develop and is the default. Setting `OM_RBAC_DEFAULT_CACHE=on` opts\n  // into the in-process LRU fallback for deployments that don't wire a\n  // shared CacheStrategy (CLI scripts, lean test bootstraps). Production\n  // bootstraps that already register `cache` via `@open-mercato/cache`\n  // preempt this fallback because the container's existing `cache`\n  // registration wins when `RbacService` reaches for it.\n  if (isRbacDefaultCacheEnabled()) {\n    container.register({\n      rbacService: asFunction((cradle: { em: EntityManager; cache?: CacheStrategy }) => {\n        return new RbacService(cradle.em, cradle.cache ?? createRbacFallbackCache())\n      }).scoped(),\n    })\n  } else {\n    container.register({ rbacService: asClass(RbacService).scoped() })\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,SAAS,kBAAkB;AAIpC,SAAS,mBAAmB;AAC5B,SAAS,mBAAmB;AAC5B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAIA,SAAS,SAAS,WAAyB;AAEhD,YAAU,SAAS,EAAE,aAAa,QAAQ,WAAW,EAAE,OAAO,EAAE,CAAC;AAQjE,MAAI,0BAA0B,GAAG;AAC/B,cAAU,SAAS;AAAA,MACjB,aAAa,WAAW,CAAC,WAAyD;AAChF,eAAO,IAAI,YAAY,OAAO,IAAI,OAAO,SAAS,wBAAwB,CAAC;AAAA,MAC7E,CAAC,EAAE,OAAO;AAAA,IACZ,CAAC;AAAA,EACH,OAAO;AACL,cAAU,SAAS,EAAE,aAAa,QAAQ,WAAW,EAAE,OAAO,EAAE,CAAC;AAAA,EACnE;AACF;",
   "names": []
 }

package/dist/modules/auth/frontend/reset/[token]/page.js

@@ -5,10 +5,8 @@ import { Button } from "@open-mercato/ui/primitives/button";
 import { PasswordInput } from "@open-mercato/ui/primitives/password-input";
 import { Label } from "@open-mercato/ui/primitives/label";
 import { useEffect, useState } from "react";
-import Link from "next/link";
 import { useRouter } from "next/navigation";
 import { apiCall } from "@open-mercato/ui/backend/utils/apiCall";
-import { Spinner } from "@open-mercato/ui/primitives/spinner";
 import { useT } from "@open-mercato/shared/lib/i18n/context";
 import { formatPasswordRequirements, getPasswordPolicy, validatePassword } from "@open-mercato/shared/lib/auth/passwordPolicy";
 function ResetWithTokenPage({ params }) {
@@ -17,35 +15,12 @@ function ResetWithTokenPage({ params }) {
   const [error, setError] = useState(null);
   const [submitting, setSubmitting] = useState(false);
   const [clientReady, setClientReady] = useState(false);
-  const [tokenState, setTokenState] = useState("checking");
   const passwordPolicy = getPasswordPolicy();
   const passwordRequirements = formatPasswordRequirements(passwordPolicy, t);
   const passwordDescription = passwordRequirements ? t("auth.password.requirements.help", "Password requirements: {requirements}", { requirements: passwordRequirements }) : "";
   useEffect(() => {
     setClientReady(true);
   }, []);
-  useEffect(() => {
-    let cancelled = false;
-    async function checkToken() {
-      const body = new FormData();
-      body.set("token", params.token);
-      try {
-        const { ok, result } = await apiCall(
-          "/api/auth/reset/validate",
-          { method: "POST", body }
-        );
-        if (cancelled) return;
-        setTokenState(ok && result?.valid === false ? "expired" : "usable");
-      } catch {
-        if (cancelled) return;
-        setTokenState("usable");
-      }
-    }
-    void checkToken();
-    return () => {
-      cancelled = true;
-    };
-  }, [params.token]);
   async function onSubmit(e) {
     e.preventDefault();
     setError(null);
@@ -84,27 +59,6 @@ function ResetWithTokenPage({ params }) {
       setSubmitting(false);
     }
   }
-  if (tokenState === "checking") {
-    return /* @__PURE__ */ jsx("div", { className: "min-h-svh flex items-center justify-center p-4", children: /* @__PURE__ */ jsxs(Card, { className: "w-full max-w-sm", children: [
-      /* @__PURE__ */ jsx(CardHeader, { children: /* @__PURE__ */ jsx(CardTitle, { children: t("auth.reset.title", "Set a new password") }) }),
-      /* @__PURE__ */ jsx(CardContent, { children: /* @__PURE__ */ jsxs("div", { className: "flex items-center gap-2 text-sm text-muted-foreground", "data-auth-token-state": "checking", children: [
-        /* @__PURE__ */ jsx(Spinner, { size: "sm" }),
-        /* @__PURE__ */ jsx("span", { children: t("auth.reset.token.checking", "Checking your reset link...") })
-      ] }) })
-    ] }) });
-  }
-  if (tokenState === "expired") {
-    return /* @__PURE__ */ jsx("div", { className: "min-h-svh flex items-center justify-center p-4", children: /* @__PURE__ */ jsxs(Card, { className: "w-full max-w-sm", children: [
-      /* @__PURE__ */ jsxs(CardHeader, { children: [
-        /* @__PURE__ */ jsx(CardTitle, { children: t("auth.reset.token.expiredTitle", "This reset link is no longer valid") }),
-        /* @__PURE__ */ jsx(CardDescription, { children: t("auth.reset.token.expiredSubtitle", "It has already been used or has expired. Request a new link to set your password.") })
-      ] }),
-      /* @__PURE__ */ jsx(CardContent, { children: /* @__PURE__ */ jsxs("div", { className: "grid gap-3", "data-auth-token-state": "expired", children: [
-        /* @__PURE__ */ jsx(Button, { asChild: true, className: "w-full", children: /* @__PURE__ */ jsx(Link, { href: "/reset", children: t("auth.reset.token.requestNew", "Request a new link") }) }),
-        /* @__PURE__ */ jsx("div", { className: "text-center", children: /* @__PURE__ */ jsx(Link, { href: "/login", className: "text-xs text-muted-foreground underline", children: t("auth.reset.backToLogin", "Back to login") }) })
-      ] }) })
-    ] }) });
-  }
   return /* @__PURE__ */ jsx("div", { className: "min-h-svh flex items-center justify-center p-4", children: /* @__PURE__ */ jsxs(Card, { className: "w-full max-w-sm", children: [
     /* @__PURE__ */ jsxs(CardHeader, { children: [
       /* @__PURE__ */ jsx(CardTitle, { children: t("auth.reset.title", "Set a new password") }),

package/dist/modules/auth/frontend/reset/[token]/page.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/auth/frontend/reset/%5Btoken%5D/page.tsx"],
-  "sourcesContent": ["\"use client\"\nimport { Card, CardContent, CardHeader, CardTitle, CardDescription } from '@open-mercato/ui/primitives/card'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { PasswordInput } from '@open-mercato/ui/primitives/password-input'\nimport { Label } from '@open-mercato/ui/primitives/label'\nimport { useEffect, useState } from 'react'\nimport Link from 'next/link'\nimport { useRouter } from 'next/navigation'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\nimport { Spinner } from '@open-mercato/ui/primitives/spinner'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { formatPasswordRequirements, getPasswordPolicy, validatePassword } from '@open-mercato/shared/lib/auth/passwordPolicy'\n\ntype TokenState = 'checking' | 'usable' | 'expired'\n\nexport default function ResetWithTokenPage({ params }: { params: { token: string } }) {\n  const router = useRouter()\n  const t = useT()\n  const [error, setError] = useState<string | null>(null)\n  const [submitting, setSubmitting] = useState(false)\n  const [clientReady, setClientReady] = useState(false)\n  const [tokenState, setTokenState] = useState<TokenState>('checking')\n  const passwordPolicy = getPasswordPolicy()\n  const passwordRequirements = formatPasswordRequirements(passwordPolicy, t)\n  const passwordDescription = passwordRequirements\n    ? t('auth.password.requirements.help', 'Password requirements: {requirements}', { requirements: passwordRequirements })\n    : ''\n\n  useEffect(() => {\n    setClientReady(true)\n  }, [])\n\n  useEffect(() => {\n    let cancelled = false\n    async function checkToken() {\n      const body = new FormData()\n      body.set('token', params.token)\n      // Fail open whenever the check cannot answer \u2014 an unreachable or failing\n      // endpoint must not strand a user holding a perfectly good link, and the\n      // confirm endpoint still rejects a dead token on submit.\n      try {\n        const { ok, result } = await apiCall<{ ok?: boolean; valid?: boolean }>(\n          '/api/auth/reset/validate',\n          { method: 'POST', body },\n        )\n        if (cancelled) return\n        setTokenState(ok && result?.valid === false ? 'expired' : 'usable')\n      } catch {\n        if (cancelled) return\n        setTokenState('usable')\n      }\n    }\n    void checkToken()\n    return () => { cancelled = true }\n  }, [params.token])\n\n  async function onSubmit(e: React.FormEvent<HTMLFormElement>) {\n    e.preventDefault()\n    setError(null)\n    const form = new FormData(e.currentTarget)\n    const password = String(form.get('password') ?? '')\n    const confirmPassword = String(form.get('confirmPassword') ?? '')\n\n    if (!password) {\n      setError(t('auth.profile.form.errors.newPasswordRequired', 'New password is required.'))\n      return\n    }\n    if (!confirmPassword) {\n      setError(t('auth.profile.form.errors.confirmPasswordRequired', 'Please confirm the new password.'))\n      return\n    }\n    if (password !== confirmPassword) {\n      setError(t('auth.profile.form.errors.passwordMismatch', 'Passwords do not match.'))\n      return\n    }\n    if (!validatePassword(password, passwordPolicy).ok) {\n      setError(t('auth.profile.form.errors.passwordRequirements', 'Password must meet the requirements.'))\n      return\n    }\n\n    setSubmitting(true)\n    try {\n      form.set('token', params.token)\n      const { ok, result } = await apiCall<{ ok?: boolean; error?: string; redirect?: string }>(\n        '/api/auth/reset/confirm',\n        { method: 'POST', body: form },\n      )\n      if (!ok || result?.ok === false) {\n        setError(result?.error || t('auth.reset.errors.failed', 'Unable to reset password'))\n        return\n      }\n      router.replace(result?.redirect || '/login')\n    } finally {\n      setSubmitting(false)\n    }\n  }\n\n  if (tokenState === 'checking') {\n    return (\n      <div className=\"min-h-svh flex items-center justify-center p-4\">\n        <Card className=\"w-full max-w-sm\">\n          <CardHeader>\n            <CardTitle>{t('auth.reset.title', 'Set a new password')}</CardTitle>\n          </CardHeader>\n          <CardContent>\n            <div className=\"flex items-center gap-2 text-sm text-muted-foreground\" data-auth-token-state=\"checking\">\n              <Spinner size=\"sm\" />\n              <span>{t('auth.reset.token.checking', 'Checking your reset link...')}</span>\n            </div>\n          </CardContent>\n        </Card>\n      </div>\n    )\n  }\n\n  if (tokenState === 'expired') {\n    return (\n      <div className=\"min-h-svh flex items-center justify-center p-4\">\n        <Card className=\"w-full max-w-sm\">\n          <CardHeader>\n            <CardTitle>{t('auth.reset.token.expiredTitle', 'This reset link is no longer valid')}</CardTitle>\n            <CardDescription>\n              {t('auth.reset.token.expiredSubtitle', 'It has already been used or has expired. Request a new link to set your password.')}\n            </CardDescription>\n          </CardHeader>\n          <CardContent>\n            <div className=\"grid gap-3\" data-auth-token-state=\"expired\">\n              <Button asChild className=\"w-full\">\n                <Link href=\"/reset\">{t('auth.reset.token.requestNew', 'Request a new link')}</Link>\n              </Button>\n              <div className=\"text-center\">\n                <Link href=\"/login\" className=\"text-xs text-muted-foreground underline\">\n                  {t('auth.reset.backToLogin', 'Back to login')}\n                </Link>\n              </div>\n            </div>\n          </CardContent>\n        </Card>\n      </div>\n    )\n  }\n\n  return (\n    <div className=\"min-h-svh flex items-center justify-center p-4\">\n      <Card className=\"w-full max-w-sm\">\n        <CardHeader>\n          <CardTitle>{t('auth.reset.title', 'Set a new password')}</CardTitle>\n          <CardDescription>{t('auth.reset.subtitle', 'Choose a strong password for your account.')}</CardDescription>\n        </CardHeader>\n        <CardContent>\n          <form className=\"grid gap-3\" onSubmit={onSubmit} data-auth-ready={clientReady ? '1' : '0'}>\n            {error && <div className=\"text-sm text-status-error-text\">{error}</div>}\n            <div className=\"grid gap-1\">\n              <Label htmlFor=\"password\">{t('auth.reset.form.password', 'New password')}</Label>\n              <PasswordInput id=\"password\" name=\"password\" required minLength={passwordPolicy.minLength} autoComplete=\"new-password\" />\n              {passwordDescription ? (\n                <p className=\"text-xs text-muted-foreground\">{passwordDescription}</p>\n              ) : null}\n            </div>\n            <div className=\"grid gap-1\">\n              <Label htmlFor=\"confirmPassword\">{t('auth.profile.form.confirmPassword', 'Confirm new password')}</Label>\n              <PasswordInput\n                id=\"confirmPassword\"\n                name=\"confirmPassword\"\n                required\n                minLength={passwordPolicy.minLength}\n                autoComplete=\"new-password\"\n              />\n            </div>\n            <Button type=\"submit\" className=\"mt-2 w-full\" disabled={submitting}>\n              {submitting ? t('auth.reset.form.loading', '...') : t('auth.reset.form.submit', 'Update password')}\n            </Button>\n          </form>\n        </CardContent>\n      </Card>\n    </div>\n  )\n}\n"],
-  "mappings": ";AAsGY,cAGA,YAHA;AArGZ,SAAS,MAAM,aAAa,YAAY,WAAW,uBAAuB;AAC1E,SAAS,cAAc;AACvB,SAAS,qBAAqB;AAC9B,SAAS,aAAa;AACtB,SAAS,WAAW,gBAAgB;AACpC,OAAO,UAAU;AACjB,SAAS,iBAAiB;AAC1B,SAAS,eAAe;AACxB,SAAS,eAAe;AACxB,SAAS,YAAY;AACrB,SAAS,4BAA4B,mBAAmB,wBAAwB;AAIjE,SAAR,mBAAoC,EAAE,OAAO,GAAkC;AACpF,QAAM,SAAS,UAAU;AACzB,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAwB,IAAI;AACtD,QAAM,CAAC,YAAY,aAAa,IAAI,SAAS,KAAK;AAClD,QAAM,CAAC,aAAa,cAAc,IAAI,SAAS,KAAK;AACpD,QAAM,CAAC,YAAY,aAAa,IAAI,SAAqB,UAAU;AACnE,QAAM,iBAAiB,kBAAkB;AACzC,QAAM,uBAAuB,2BAA2B,gBAAgB,CAAC;AACzE,QAAM,sBAAsB,uBACxB,EAAE,mCAAmC,yCAAyC,EAAE,cAAc,qBAAqB,CAAC,IACpH;AAEJ,YAAU,MAAM;AACd,mBAAe,IAAI;AAAA,EACrB,GAAG,CAAC,CAAC;AAEL,YAAU,MAAM;AACd,QAAI,YAAY;AAChB,mBAAe,aAAa;AAC1B,YAAM,OAAO,IAAI,SAAS;AAC1B,WAAK,IAAI,SAAS,OAAO,KAAK;AAI9B,UAAI;AACF,cAAM,EAAE,IAAI,OAAO,IAAI,MAAM;AAAA,UAC3B;AAAA,UACA,EAAE,QAAQ,QAAQ,KAAK;AAAA,QACzB;AACA,YAAI,UAAW;AACf,sBAAc,MAAM,QAAQ,UAAU,QAAQ,YAAY,QAAQ;AAAA,MACpE,QAAQ;AACN,YAAI,UAAW;AACf,sBAAc,QAAQ;AAAA,MACxB;AAAA,IACF;AACA,SAAK,WAAW;AAChB,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,OAAO,KAAK,CAAC;AAEjB,iBAAe,SAAS,GAAqC;AAC3D,MAAE,eAAe;AACjB,aAAS,IAAI;AACb,UAAM,OAAO,IAAI,SAAS,EAAE,aAAa;AACzC,UAAM,WAAW,OAAO,KAAK,IAAI,UAAU,KAAK,EAAE;AAClD,UAAM,kBAAkB,OAAO,KAAK,IAAI,iBAAiB,KAAK,EAAE;AAEhE,QAAI,CAAC,UAAU;AACb,eAAS,EAAE,gDAAgD,2BAA2B,CAAC;AACvF;AAAA,IACF;AACA,QAAI,CAAC,iBAAiB;AACpB,eAAS,EAAE,oDAAoD,kCAAkC,CAAC;AAClG;AAAA,IACF;AACA,QAAI,aAAa,iBAAiB;AAChC,eAAS,EAAE,6CAA6C,yBAAyB,CAAC;AAClF;AAAA,IACF;AACA,QAAI,CAAC,iBAAiB,UAAU,cAAc,EAAE,IAAI;AAClD,eAAS,EAAE,iDAAiD,sCAAsC,CAAC;AACnG;AAAA,IACF;AAEA,kBAAc,IAAI;AAClB,QAAI;AACF,WAAK,IAAI,SAAS,OAAO,KAAK;AAC9B,YAAM,EAAE,IAAI,OAAO,IAAI,MAAM;AAAA,QAC3B;AAAA,QACA,EAAE,QAAQ,QAAQ,MAAM,KAAK;AAAA,MAC/B;AACA,UAAI,CAAC,MAAM,QAAQ,OAAO,OAAO;AAC/B,iBAAS,QAAQ,SAAS,EAAE,4BAA4B,0BAA0B,CAAC;AACnF;AAAA,MACF;AACA,aAAO,QAAQ,QAAQ,YAAY,QAAQ;AAAA,IAC7C,UAAE;AACA,oBAAc,KAAK;AAAA,IACrB;AAAA,EACF;AAEA,MAAI,eAAe,YAAY;AAC7B,WACE,oBAAC,SAAI,WAAU,kDACb,+BAAC,QAAK,WAAU,mBACd;AAAA,0BAAC,cACC,8BAAC,aAAW,YAAE,oBAAoB,oBAAoB,GAAE,GAC1D;AAAA,MACA,oBAAC,eACC,+BAAC,SAAI,WAAU,yDAAwD,yBAAsB,YAC3F;AAAA,4BAAC,WAAQ,MAAK,MAAK;AAAA,QACnB,oBAAC,UAAM,YAAE,6BAA6B,6BAA6B,GAAE;AAAA,SACvE,GACF;AAAA,OACF,GACF;AAAA,EAEJ;AAEA,MAAI,eAAe,WAAW;AAC5B,WACE,oBAAC,SAAI,WAAU,kDACb,+BAAC,QAAK,WAAU,mBACd;AAAA,2BAAC,cACC;AAAA,4BAAC,aAAW,YAAE,iCAAiC,oCAAoC,GAAE;AAAA,QACrF,oBAAC,mBACE,YAAE,oCAAoC,mFAAmF,GAC5H;AAAA,SACF;AAAA,MACA,oBAAC,eACC,+BAAC,SAAI,WAAU,cAAa,yBAAsB,WAChD;AAAA,4BAAC,UAAO,SAAO,MAAC,WAAU,UACxB,8BAAC,QAAK,MAAK,UAAU,YAAE,+BAA+B,oBAAoB,GAAE,GAC9E;AAAA,QACA,oBAAC,SAAI,WAAU,eACb,8BAAC,QAAK,MAAK,UAAS,WAAU,2CAC3B,YAAE,0BAA0B,eAAe,GAC9C,GACF;AAAA,SACF,GACF;AAAA,OACF,GACF;AAAA,EAEJ;AAEA,SACE,oBAAC,SAAI,WAAU,kDACb,+BAAC,QAAK,WAAU,mBACd;AAAA,yBAAC,cACC;AAAA,0BAAC,aAAW,YAAE,oBAAoB,oBAAoB,GAAE;AAAA,MACxD,oBAAC,mBAAiB,YAAE,uBAAuB,4CAA4C,GAAE;AAAA,OAC3F;AAAA,IACA,oBAAC,eACC,+BAAC,UAAK,WAAU,cAAa,UAAoB,mBAAiB,cAAc,MAAM,KACnF;AAAA,eAAS,oBAAC,SAAI,WAAU,kCAAkC,iBAAM;AAAA,MACjE,qBAAC,SAAI,WAAU,cACb;AAAA,4BAAC,SAAM,SAAQ,YAAY,YAAE,4BAA4B,cAAc,GAAE;AAAA,QACzE,oBAAC,iBAAc,IAAG,YAAW,MAAK,YAAW,UAAQ,MAAC,WAAW,eAAe,WAAW,cAAa,gBAAe;AAAA,QACtH,sBACC,oBAAC,OAAE,WAAU,iCAAiC,+BAAoB,IAChE;AAAA,SACN;AAAA,MACA,qBAAC,SAAI,WAAU,cACb;AAAA,4BAAC,SAAM,SAAQ,mBAAmB,YAAE,qCAAqC,sBAAsB,GAAE;AAAA,QACjG;AAAA,UAAC;AAAA;AAAA,YACC,IAAG;AAAA,YACH,MAAK;AAAA,YACL,UAAQ;AAAA,YACR,WAAW,eAAe;AAAA,YAC1B,cAAa;AAAA;AAAA,QACf;AAAA,SACF;AAAA,MACA,oBAAC,UAAO,MAAK,UAAS,WAAU,eAAc,UAAU,YACrD,uBAAa,EAAE,2BAA2B,KAAK,IAAI,EAAE,0BAA0B,iBAAiB,GACnG;AAAA,OACF,GACF;AAAA,KACF,GACF;AAEJ;",
+  "sourcesContent": ["\"use client\"\nimport { Card, CardContent, CardHeader, CardTitle, CardDescription } from '@open-mercato/ui/primitives/card'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { PasswordInput } from '@open-mercato/ui/primitives/password-input'\nimport { Label } from '@open-mercato/ui/primitives/label'\nimport { useEffect, useState } from 'react'\nimport { useRouter } from 'next/navigation'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { formatPasswordRequirements, getPasswordPolicy, validatePassword } from '@open-mercato/shared/lib/auth/passwordPolicy'\n\nexport default function ResetWithTokenPage({ params }: { params: { token: string } }) {\n  const router = useRouter()\n  const t = useT()\n  const [error, setError] = useState<string | null>(null)\n  const [submitting, setSubmitting] = useState(false)\n  const [clientReady, setClientReady] = useState(false)\n  const passwordPolicy = getPasswordPolicy()\n  const passwordRequirements = formatPasswordRequirements(passwordPolicy, t)\n  const passwordDescription = passwordRequirements\n    ? t('auth.password.requirements.help', 'Password requirements: {requirements}', { requirements: passwordRequirements })\n    : ''\n\n  useEffect(() => {\n    setClientReady(true)\n  }, [])\n\n  async function onSubmit(e: React.FormEvent<HTMLFormElement>) {\n    e.preventDefault()\n    setError(null)\n    const form = new FormData(e.currentTarget)\n    const password = String(form.get('password') ?? '')\n    const confirmPassword = String(form.get('confirmPassword') ?? '')\n\n    if (!password) {\n      setError(t('auth.profile.form.errors.newPasswordRequired', 'New password is required.'))\n      return\n    }\n    if (!confirmPassword) {\n      setError(t('auth.profile.form.errors.confirmPasswordRequired', 'Please confirm the new password.'))\n      return\n    }\n    if (password !== confirmPassword) {\n      setError(t('auth.profile.form.errors.passwordMismatch', 'Passwords do not match.'))\n      return\n    }\n    if (!validatePassword(password, passwordPolicy).ok) {\n      setError(t('auth.profile.form.errors.passwordRequirements', 'Password must meet the requirements.'))\n      return\n    }\n\n    setSubmitting(true)\n    try {\n      form.set('token', params.token)\n      const { ok, result } = await apiCall<{ ok?: boolean; error?: string; redirect?: string }>(\n        '/api/auth/reset/confirm',\n        { method: 'POST', body: form },\n      )\n      if (!ok || result?.ok === false) {\n        setError(result?.error || t('auth.reset.errors.failed', 'Unable to reset password'))\n        return\n      }\n      router.replace(result?.redirect || '/login')\n    } finally {\n      setSubmitting(false)\n    }\n  }\n\n  return (\n    <div className=\"min-h-svh flex items-center justify-center p-4\">\n      <Card className=\"w-full max-w-sm\">\n        <CardHeader>\n          <CardTitle>{t('auth.reset.title', 'Set a new password')}</CardTitle>\n          <CardDescription>{t('auth.reset.subtitle', 'Choose a strong password for your account.')}</CardDescription>\n        </CardHeader>\n        <CardContent>\n          <form className=\"grid gap-3\" onSubmit={onSubmit} data-auth-ready={clientReady ? '1' : '0'}>\n            {error && <div className=\"text-sm text-status-error-text\">{error}</div>}\n            <div className=\"grid gap-1\">\n              <Label htmlFor=\"password\">{t('auth.reset.form.password', 'New password')}</Label>\n              <PasswordInput id=\"password\" name=\"password\" required minLength={passwordPolicy.minLength} autoComplete=\"new-password\" />\n              {passwordDescription ? (\n                <p className=\"text-xs text-muted-foreground\">{passwordDescription}</p>\n              ) : null}\n            </div>\n            <div className=\"grid gap-1\">\n              <Label htmlFor=\"confirmPassword\">{t('auth.profile.form.confirmPassword', 'Confirm new password')}</Label>\n              <PasswordInput\n                id=\"confirmPassword\"\n                name=\"confirmPassword\"\n                required\n                minLength={passwordPolicy.minLength}\n                autoComplete=\"new-password\"\n              />\n            </div>\n            <Button type=\"submit\" className=\"mt-2 w-full\" disabled={submitting}>\n              {submitting ? t('auth.reset.form.loading', '...') : t('auth.reset.form.submit', 'Update password')}\n            </Button>\n          </form>\n        </CardContent>\n      </Card>\n    </div>\n  )\n}\n"],
+  "mappings": ";AAuEQ,SACE,KADF;AAtER,SAAS,MAAM,aAAa,YAAY,WAAW,uBAAuB;AAC1E,SAAS,cAAc;AACvB,SAAS,qBAAqB;AAC9B,SAAS,aAAa;AACtB,SAAS,WAAW,gBAAgB;AACpC,SAAS,iBAAiB;AAC1B,SAAS,eAAe;AACxB,SAAS,YAAY;AACrB,SAAS,4BAA4B,mBAAmB,wBAAwB;AAEjE,SAAR,mBAAoC,EAAE,OAAO,GAAkC;AACpF,QAAM,SAAS,UAAU;AACzB,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAwB,IAAI;AACtD,QAAM,CAAC,YAAY,aAAa,IAAI,SAAS,KAAK;AAClD,QAAM,CAAC,aAAa,cAAc,IAAI,SAAS,KAAK;AACpD,QAAM,iBAAiB,kBAAkB;AACzC,QAAM,uBAAuB,2BAA2B,gBAAgB,CAAC;AACzE,QAAM,sBAAsB,uBACxB,EAAE,mCAAmC,yCAAyC,EAAE,cAAc,qBAAqB,CAAC,IACpH;AAEJ,YAAU,MAAM;AACd,mBAAe,IAAI;AAAA,EACrB,GAAG,CAAC,CAAC;AAEL,iBAAe,SAAS,GAAqC;AAC3D,MAAE,eAAe;AACjB,aAAS,IAAI;AACb,UAAM,OAAO,IAAI,SAAS,EAAE,aAAa;AACzC,UAAM,WAAW,OAAO,KAAK,IAAI,UAAU,KAAK,EAAE;AAClD,UAAM,kBAAkB,OAAO,KAAK,IAAI,iBAAiB,KAAK,EAAE;AAEhE,QAAI,CAAC,UAAU;AACb,eAAS,EAAE,gDAAgD,2BAA2B,CAAC;AACvF;AAAA,IACF;AACA,QAAI,CAAC,iBAAiB;AACpB,eAAS,EAAE,oDAAoD,kCAAkC,CAAC;AAClG;AAAA,IACF;AACA,QAAI,aAAa,iBAAiB;AAChC,eAAS,EAAE,6CAA6C,yBAAyB,CAAC;AAClF;AAAA,IACF;AACA,QAAI,CAAC,iBAAiB,UAAU,cAAc,EAAE,IAAI;AAClD,eAAS,EAAE,iDAAiD,sCAAsC,CAAC;AACnG;AAAA,IACF;AAEA,kBAAc,IAAI;AAClB,QAAI;AACF,WAAK,IAAI,SAAS,OAAO,KAAK;AAC9B,YAAM,EAAE,IAAI,OAAO,IAAI,MAAM;AAAA,QAC3B;AAAA,QACA,EAAE,QAAQ,QAAQ,MAAM,KAAK;AAAA,MAC/B;AACA,UAAI,CAAC,MAAM,QAAQ,OAAO,OAAO;AAC/B,iBAAS,QAAQ,SAAS,EAAE,4BAA4B,0BAA0B,CAAC;AACnF;AAAA,MACF;AACA,aAAO,QAAQ,QAAQ,YAAY,QAAQ;AAAA,IAC7C,UAAE;AACA,oBAAc,KAAK;AAAA,IACrB;AAAA,EACF;AAEA,SACE,oBAAC,SAAI,WAAU,kDACb,+BAAC,QAAK,WAAU,mBACd;AAAA,yBAAC,cACC;AAAA,0BAAC,aAAW,YAAE,oBAAoB,oBAAoB,GAAE;AAAA,MACxD,oBAAC,mBAAiB,YAAE,uBAAuB,4CAA4C,GAAE;AAAA,OAC3F;AAAA,IACA,oBAAC,eACC,+BAAC,UAAK,WAAU,cAAa,UAAoB,mBAAiB,cAAc,MAAM,KACnF;AAAA,eAAS,oBAAC,SAAI,WAAU,kCAAkC,iBAAM;AAAA,MACjE,qBAAC,SAAI,WAAU,cACb;AAAA,4BAAC,SAAM,SAAQ,YAAY,YAAE,4BAA4B,cAAc,GAAE;AAAA,QACzE,oBAAC,iBAAc,IAAG,YAAW,MAAK,YAAW,UAAQ,MAAC,WAAW,eAAe,WAAW,cAAa,gBAAe;AAAA,QACtH,sBACC,oBAAC,OAAE,WAAU,iCAAiC,+BAAoB,IAChE;AAAA,SACN;AAAA,MACA,qBAAC,SAAI,WAAU,cACb;AAAA,4BAAC,SAAM,SAAQ,mBAAmB,YAAE,qCAAqC,sBAAsB,GAAE;AAAA,QACjG;AAAA,UAAC;AAAA;AAAA,YACC,IAAG;AAAA,YACH,MAAK;AAAA,YACL,UAAQ;AAAA,YACR,WAAW,eAAe;AAAA,YAC1B,cAAa;AAAA;AAAA,QACf;AAAA,SACF;AAAA,MACA,oBAAC,UAAO,MAAK,UAAS,WAAU,eAAc,UAAU,YACrD,uBAAa,EAAE,2BAA2B,KAAK,IAAI,EAAE,0BAA0B,iBAAiB,GACnG;AAAA,OACF,GACF;AAAA,KACF,GACF;AAEJ;",
   "names": []
 }

package/dist/modules/auth/lib/grantChecks.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/auth/lib/grantChecks.ts"],
-  "sourcesContent": ["import type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'\nimport { badRequest, CrudHttpError, forbidden } from '@open-mercato/shared/lib/crud/errors'\nimport { hasFeature } from '@open-mercato/shared/security/features'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { Role, RoleAcl, User, UserAcl, UserRole } from '@open-mercato/core/modules/auth/data/entities'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport type { OrganizationScope } from '@open-mercato/core/modules/directory/utils/organizationScope'\n\ntype ActorAcl = {\n  isSuperAdmin: boolean\n  features: string[]\n  organizations: string[] | null\n}\n\ntype GrantCheckContext = {\n  em: EntityManager\n  rbacService: RbacService\n  actorUserId: string | null | undefined\n  tenantId: string | null | undefined\n  organizationId?: string | null | undefined\n}\n\ntype RoleGrantCheckInput = GrantCheckContext & {\n  roles: Role[]\n}\n\ntype RoleTokenGrantCheckInput = GrantCheckContext & {\n  roleTokens: unknown\n}\n\ntype UserDestinationRolesInput = {\n  em: EntityManager\n  targetUserId: string\n  destinationTenantId: string | null | undefined\n  roleTokens: unknown\n}\n\ntype UserDestinationScopeCheckInput = GrantCheckContext & {\n  actorIsSuperAdmin?: boolean\n  allowedOrganizationIds?: string[] | null\n  destinationTenantId: string | null | undefined\n  destinationOrganizationId: string | null | undefined\n  roles: Role[]\n}\n\ntype FeatureGrantCheckInput = GrantCheckContext & {\n  features: unknown\n  isSuperAdmin?: boolean\n  organizations?: string[] | null\n}\n\ntype SuperAdminUserTargetInput = GrantCheckContext & {\n  targetUserId: string\n  actorIsSuperAdmin?: boolean\n}\n\ntype UserTargetAccessInput = SuperAdminUserTargetInput & {\n  organizationScope: Pick<OrganizationScope, 'allowedIds'>\n}\n\ntype SuperAdminRoleTargetInput = GrantCheckContext & {\n  targetRoleId: string\n  actorIsSuperAdmin?: boolean\n}\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i\n\nexport async function assertActorCanGrantRoleTokens(input: RoleTokenGrantCheckInput): Promise<Role[]> {\n  const tokens = normalizeStringList(input.roleTokens)\n  if (!tokens.length) return []\n\n  const tenantId = normalizeNullableString(input.tenantId)\n  const roles = await resolveRolesForGrant(input.em, tokens, tenantId)\n  await assertActorCanGrantRoles({ ...input, tenantId, roles })\n  return roles\n}\n\nexport async function resolveUserDestinationRoles(input: UserDestinationRolesInput): Promise<Role[]> {\n  const destinationTenantId = normalizeNullableString(input.destinationTenantId)\n  if (Array.isArray(input.roleTokens)) {\n    return resolveRolesForGrant(input.em, normalizeStringList(input.roleTokens), destinationTenantId)\n  }\n\n  const links = await findWithDecryption(\n    input.em,\n    UserRole,\n    { user: input.targetUserId as unknown as User } as FilterQuery<UserRole>,\n    { populate: ['role'] },\n    { tenantId: null, organizationId: null },\n  )\n  const roles: Role[] = []\n  for (const link of links) {\n    const linkedRole = (link as { role?: Role | string | null }).role\n    if (linkedRole && typeof linkedRole === 'object') {\n      roles.push(linkedRole)\n      continue\n    }\n    if (typeof linkedRole === 'string') {\n      const resolvedRole = await resolveRoleForGrant(input.em, linkedRole, null)\n      if (resolvedRole) {\n        roles.push(resolvedRole)\n        continue\n      }\n    }\n    throw badRequest(await translateAuthError(\n      'auth.users.errors.invalidRoleAssignment',\n      'User has an invalid role assignment',\n    ))\n  }\n  return roles\n}\n\nexport async function assertActorCanAssignUserDestination(\n  input: UserDestinationScopeCheckInput,\n): Promise<void> {\n  const destinationTenantId = normalizeNullableString(input.destinationTenantId)\n  const destinationOrganizationId = normalizeNullableString(input.destinationOrganizationId)\n  if (!destinationTenantId || !destinationOrganizationId) {\n    return throwUserDestinationOrganizationNotFound(400)\n  }\n\n  for (const role of input.roles) {\n    if (normalizeNullableString(role.tenantId) !== destinationTenantId) {\n      throw forbidden(await translateAuthError(\n        'auth.users.errors.roleOutsideDestinationTenant',\n        'Cannot retain or assign a role outside the destination tenant.',\n      ))\n    }\n  }\n\n  if (await resolveActorIsSuperAdmin(input)) return\n\n  const actorTenantId = normalizeNullableString(input.tenantId)\n  if (!actorTenantId || actorTenantId !== destinationTenantId) {\n    return throwUserDestinationOrganizationNotFound(404)\n  }\n\n  const actorAcl = await loadActorAcl(input)\n  const allowedOrganizationIds = input.allowedOrganizationIds === undefined\n    ? actorAcl.organizations\n    : input.allowedOrganizationIds\n  if (\n    allowedOrganizationIds !== null\n    && !allowedOrganizationIds.includes('__all__')\n    && !allowedOrganizationIds.includes(destinationOrganizationId)\n  ) {\n    throw forbidden(await translateAuthError(\n      'auth.users.errors.destinationOrganizationOutsideScope',\n      'Cannot assign user to a destination organization outside actor scope.',\n    ))\n  }\n\n  await assertActorCanGrantRoles({\n    ...input,\n    tenantId: destinationTenantId,\n    roles: input.roles,\n  })\n}\n\nexport async function throwUserDestinationOrganizationNotFound(status: 400 | 404): Promise<never> {\n  throw new CrudHttpError(status, {\n    error: await translateAuthError(\n      'auth.users.errors.organizationNotFound',\n      'Organization not found',\n    ),\n  })\n}\n\nexport async function assertActorCanGrantRoles(input: RoleGrantCheckInput): Promise<void> {\n  if (!input.roles.length) return\n\n  const tenantId = normalizeNullableString(input.tenantId)\n  const actorAcl = await loadActorAcl({ ...input, tenantId })\n  if (actorAcl.isSuperAdmin) return\n\n  if (!tenantId) {\n    throw forbidden('Tenant context is required to grant roles.')\n  }\n\n  for (const role of input.roles) {\n    const roleTenantId = normalizeNullableString(role.tenantId)\n    if (roleTenantId !== tenantId) {\n      throw forbidden('Cannot grant a role outside the target tenant.')\n    }\n\n    const acl = await findOneWithDecryption(\n      input.em,\n      RoleAcl,\n      { role, tenantId } as FilterQuery<RoleAcl>,\n      {},\n      { tenantId, organizationId: null },\n    )\n    if (!acl) continue\n\n    assertActorCanGrantAclSnapshot(actorAcl, {\n      isSuperAdmin: !!acl.isSuperAdmin,\n      features: normalizeStringList(acl.featuresJson),\n      organizations: normalizeOrganizationList(acl.organizationsJson),\n    })\n  }\n}\n\nexport async function assertActorCanGrantAcl(input: FeatureGrantCheckInput): Promise<void> {\n  const actorAcl = await loadActorAcl(input)\n  if (actorAcl.isSuperAdmin) return\n\n  const tenantId = normalizeNullableString(input.tenantId)\n  if (!tenantId) {\n    throw forbidden('Tenant context is required to grant ACL features.')\n  }\n\n  assertActorCanGrantAclSnapshot(actorAcl, {\n    isSuperAdmin: !!input.isSuperAdmin,\n    features: normalizeStringList(input.features),\n    organizations: input.organizations === undefined ? undefined : normalizeOrganizationList(input.organizations),\n  })\n}\n\nexport function normalizeGrantFeatureList(features: unknown): string[] {\n  return normalizeStringList(features)\n}\n\nexport async function assertActorCanModifySuperAdminUserTarget(input: SuperAdminUserTargetInput): Promise<void> {\n  const actorIsSuperAdmin = await resolveActorIsSuperAdmin(input)\n  if (actorIsSuperAdmin) return\n  const targetIsSuperAdmin = await isUserEffectivelySuperAdmin(input.em, input.targetUserId)\n  if (targetIsSuperAdmin) {\n    throw forbidden('Only super administrators can modify super administrator accounts.')\n  }\n}\n\nexport async function assertActorCanModifySuperAdminRoleTarget(input: SuperAdminRoleTargetInput): Promise<void> {\n  const actorIsSuperAdmin = await resolveActorIsSuperAdmin(input)\n  if (actorIsSuperAdmin) return\n  const targetIsSuperAdmin = await isRoleEffectivelySuperAdmin(input.em, input.targetRoleId)\n  if (targetIsSuperAdmin) {\n    throw forbidden('Only super administrators can modify super administrator roles.')\n  }\n}\n\n/**\n * `input.tenantId` is the ACTOR's scope, not the target's: the check below is a\n * comparison between the two, so passing a tenant derived from the target turns\n * it into a tautology. Callers that resolve a record scope separately MUST still\n * hand this guard `auth.tenantId`.\n */\nexport async function assertActorCanAccessUserTarget(input: UserTargetAccessInput): Promise<void> {\n  const isSuperAdmin = await resolveActorIsSuperAdmin(input)\n  if (isSuperAdmin) return\n\n  const target = await findOneWithDecryption(\n    input.em,\n    User,\n    { id: input.targetUserId } as FilterQuery<User>,\n    {},\n    { tenantId: null, organizationId: null },\n  )\n  // Not found (incl. soft-deleted, which MikroORM's soft-delete filter hides):\n  // delegate to the caller. Every wired call site is itself tenant-scoped \u2014 the\n  // ACL/consents reads filter by auth.tenantId and the user commands re-load by\n  // id within tenant \u2014 so a missing target yields a safe empty/404 there. The\n  // guard's job is to block a foreign *existing* target, below.\n  if (!target) return\n\n  const actorTenantId = normalizeNullableString(input.tenantId)\n  const targetTenantId = normalizeNullableString((target as { tenantId?: string | null }).tenantId)\n  if (!targetTenantId || targetTenantId !== actorTenantId) {\n    throw new CrudHttpError(404, { error: 'User not found' })\n  }\n\n  if (input.organizationScope.allowedIds !== null) {\n    const targetOrganizationId = normalizeNullableString((target as { organizationId?: string | null }).organizationId)\n    if (!targetOrganizationId || !input.organizationScope.allowedIds.includes(targetOrganizationId)) {\n      throw forbidden('Not authorized to access this user.')\n    }\n  }\n}\n\nexport async function assertActorCanAccessRoleTarget(input: SuperAdminRoleTargetInput): Promise<void> {\n  const isSuperAdmin = await resolveActorIsSuperAdmin(input)\n  if (isSuperAdmin) return\n\n  const target = await findOneWithDecryption(\n    input.em,\n    Role,\n    { id: input.targetRoleId } as FilterQuery<Role>,\n    {},\n    { tenantId: null, organizationId: null },\n  )\n  // Not found (incl. soft-deleted): delegate (see assertActorCanAccessUserTarget).\n  if (!target) return\n\n  const actorTenantId = normalizeNullableString(input.tenantId)\n  const targetTenantId = normalizeNullableString((target as { tenantId?: string | null }).tenantId)\n  if (!targetTenantId || targetTenantId !== actorTenantId) {\n    throw new CrudHttpError(404, { error: 'Role not found' })\n  }\n}\n\nasync function resolveActorIsSuperAdmin(input: GrantCheckContext & { actorIsSuperAdmin?: boolean }): Promise<boolean> {\n  if (typeof input.actorIsSuperAdmin === 'boolean') return input.actorIsSuperAdmin\n  const acl = await loadActorAcl(input)\n  return acl.isSuperAdmin\n}\n\nexport async function isUserEffectivelySuperAdmin(em: EntityManager, userId: string): Promise<boolean> {\n  const directGrant = await em.findOne(\n    UserAcl,\n    { user: userId as unknown, isSuperAdmin: true } as FilterQuery<UserAcl>,\n  )\n  if (directGrant && (directGrant as { isSuperAdmin?: boolean }).isSuperAdmin === true) return true\n  const links = await findWithDecryption(\n    em,\n    UserRole,\n    { user: userId as unknown } as FilterQuery<UserRole>,\n    { populate: ['role'] },\n    { tenantId: null, organizationId: null },\n  )\n  const roleIds = (Array.isArray(links) ? links : [])\n    .map((link) => {\n      const role = (link as { role?: { id?: unknown } | string | null }).role\n      if (!role) return null\n      if (typeof role === 'string') return role\n      return role.id ? String(role.id) : null\n    })\n    .filter((id): id is string => typeof id === 'string' && id.length > 0)\n  if (!roleIds.length) return false\n  const roleGrant = await em.findOne(\n    RoleAcl,\n    { role: { $in: roleIds } as unknown, isSuperAdmin: true } as FilterQuery<RoleAcl>,\n  )\n  return !!roleGrant && (roleGrant as { isSuperAdmin?: boolean }).isSuperAdmin === true\n}\n\nexport async function isRoleEffectivelySuperAdmin(em: EntityManager, roleId: string): Promise<boolean> {\n  const grant = await em.findOne(\n    RoleAcl,\n    { role: roleId as unknown, isSuperAdmin: true } as FilterQuery<RoleAcl>,\n  )\n  return !!grant && (grant as { isSuperAdmin?: boolean }).isSuperAdmin === true\n}\n\nexport async function listSuperAdminUserIds(em: EntityManager, tenantId: string | null): Promise<Set<string>> {\n  const ids = new Set<string>()\n  const userAclFilter: Record<string, unknown> = { isSuperAdmin: true }\n  if (tenantId) userAclFilter.tenantId = tenantId\n  const userAcls = await em.find(UserAcl, userAclFilter as FilterQuery<UserAcl>)\n  for (const acl of userAcls) {\n    const userRef = (acl as { user?: { id?: unknown } | string | null }).user\n    const userId = userRef && typeof userRef === 'object'\n      ? userRef.id\n      : userRef\n    if (userId) ids.add(String(userId))\n  }\n  const roleAcls = await em.find(\n    RoleAcl,\n    { isSuperAdmin: true } as FilterQuery<RoleAcl>,\n  )\n  const roleIds = roleAcls\n    .map((acl) => {\n      const roleRef = (acl as { role?: { id?: unknown } | string | null }).role\n      if (!roleRef) return null\n      if (typeof roleRef === 'string') return roleRef\n      return roleRef.id ? String(roleRef.id) : null\n    })\n    .filter((id): id is string => typeof id === 'string' && id.length > 0)\n  if (roleIds.length) {\n    const links = await findWithDecryption(\n      em,\n      UserRole,\n      { role: { $in: roleIds } as unknown } as FilterQuery<UserRole>,\n      {},\n      { tenantId: null, organizationId: null },\n    )\n    for (const link of Array.isArray(links) ? links : []) {\n      const userRef = (link as { user?: { id?: unknown } | string | null }).user\n      const userId = userRef && typeof userRef === 'object'\n        ? userRef.id\n        : userRef\n      if (userId) ids.add(String(userId))\n    }\n  }\n  return ids\n}\n\nasync function loadActorAcl(input: GrantCheckContext): Promise<ActorAcl> {\n  const actorUserId = normalizeNullableString(input.actorUserId)\n  if (!actorUserId) throw forbidden('Not authorized to grant ACL privileges.')\n\n  const acl = await input.rbacService.loadAcl(actorUserId, {\n    tenantId: normalizeNullableString(input.tenantId),\n    organizationId: normalizeNullableString(input.organizationId),\n  })\n\n  return {\n    isSuperAdmin: !!acl?.isSuperAdmin,\n    features: normalizeStringList(acl?.features),\n    organizations: normalizeOrganizationList(acl?.organizations),\n  }\n}\n\nasync function resolveRolesForGrant(\n  em: EntityManager,\n  roleTokens: string[],\n  tenantId: string | null,\n): Promise<Role[]> {\n  const roles: Role[] = []\n  const missingRoles: string[] = []\n\n  for (const token of roleTokens) {\n    const role = await resolveRoleForGrant(em, token, tenantId)\n    if (!role) {\n      missingRoles.push(token)\n    } else {\n      roles.push(role)\n    }\n  }\n\n  if (missingRoles.length) {\n    const labels = missingRoles.map((role) => `\"${role}\"`).join(', ')\n    throw new CrudHttpError(400, { error: `Role(s) not found: ${labels}` })\n  }\n\n  return roles\n}\n\nasync function resolveRoleForGrant(\n  em: EntityManager,\n  token: string,\n  tenantId: string | null,\n): Promise<Role | null> {\n  const where: Record<string, unknown> = UUID_RE.test(token)\n    ? { id: token, deletedAt: null }\n    : { name: token, deletedAt: null }\n  if (tenantId) where.tenantId = tenantId\n  return findOneWithDecryption(\n    em,\n    Role,\n    where as FilterQuery<Role>,\n    {},\n    { tenantId, organizationId: null },\n  )\n}\n\nfunction assertActorCanGrantAclSnapshot(\n  actorAcl: ActorAcl,\n  requested: {\n    isSuperAdmin: boolean\n    features: string[]\n    organizations?: string[] | null\n  },\n): void {\n  if (requested.isSuperAdmin) {\n    throw forbidden('Only super administrators can grant super admin access.')\n  }\n\n  const actorGrantableFeatures = actorAcl.features.filter((grant) => grant !== '*')\n  for (const feature of requested.features) {\n    if (feature === '*') {\n      throw forbidden('Only super administrators can grant global wildcard access.')\n    }\n    if (isWildcardFeature(feature)) {\n      if (!hasFeature(actorGrantableFeatures, feature)) {\n        throw forbidden(`Cannot grant feature wildcard ${feature}.`)\n      }\n      continue\n    }\n    if (!hasFeature(actorGrantableFeatures, feature)) {\n      throw forbidden(`Cannot grant feature ${feature}.`)\n    }\n  }\n\n  if (requested.organizations !== undefined) {\n    assertActorCanGrantOrganizations(actorAcl.organizations, requested.organizations)\n  }\n}\n\nfunction assertActorCanGrantOrganizations(\n  actorOrganizations: string[] | null,\n  requestedOrganizations: string[] | null,\n): void {\n  if (actorOrganizations === null || actorOrganizations.includes('__all__')) return\n\n  if (requestedOrganizations === null || requestedOrganizations.includes('__all__')) {\n    throw forbidden('Cannot grant unrestricted organization access.')\n  }\n\n  for (const organizationId of requestedOrganizations) {\n    if (!actorOrganizations.includes(organizationId)) {\n      throw forbidden('Cannot grant organization access outside actor scope.')\n    }\n  }\n}\n\nfunction normalizeStringList(values: unknown): string[] {\n  if (!Array.isArray(values)) return []\n  const dedup = new Set<string>()\n  for (const value of values) {\n    if (typeof value !== 'string') continue\n    const trimmed = value.trim()\n    if (!trimmed) continue\n    dedup.add(trimmed)\n  }\n  return Array.from(dedup)\n}\n\nfunction normalizeOrganizationList(values: unknown): string[] | null {\n  if (values === null || values === undefined) return null\n  return normalizeStringList(values)\n}\n\nfunction normalizeNullableString(value: unknown): string | null {\n  return typeof value === 'string' && value.trim().length > 0 ? value.trim() : null\n}\n\nfunction isWildcardFeature(feature: string): boolean {\n  return feature.endsWith('.*')\n}\n\nasync function translateAuthError(key: string, fallback: string): Promise<string> {\n  const { translate } = await resolveTranslations()\n  return translate(key, fallback)\n}\n"],
-  "mappings": "AACA,SAAS,YAAY,eAAe,iBAAiB;AACrD,SAAS,kBAAkB;AAC3B,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,2BAA2B;AACpC,SAAS,MAAM,SAAS,MAAM,SAAS,gBAAgB;AA6DvD,MAAM,UAAU;AAEhB,eAAsB,8BAA8B,OAAkD;AACpG,QAAM,SAAS,oBAAoB,MAAM,UAAU;AACnD,MAAI,CAAC,OAAO,OAAQ,QAAO,CAAC;AAE5B,QAAM,WAAW,wBAAwB,MAAM,QAAQ;AACvD,QAAM,QAAQ,MAAM,qBAAqB,MAAM,IAAI,QAAQ,QAAQ;AACnE,QAAM,yBAAyB,EAAE,GAAG,OAAO,UAAU,MAAM,CAAC;AAC5D,SAAO;AACT;AAEA,eAAsB,4BAA4B,OAAmD;AACnG,QAAM,sBAAsB,wBAAwB,MAAM,mBAAmB;AAC7E,MAAI,MAAM,QAAQ,MAAM,UAAU,GAAG;AACnC,WAAO,qBAAqB,MAAM,IAAI,oBAAoB,MAAM,UAAU,GAAG,mBAAmB;AAAA,EAClG;AAEA,QAAM,QAAQ,MAAM;AAAA,IAClB,MAAM;AAAA,IACN;AAAA,IACA,EAAE,MAAM,MAAM,aAAgC;AAAA,IAC9C,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,IACrB,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,EACzC;AACA,QAAM,QAAgB,CAAC;AACvB,aAAW,QAAQ,OAAO;AACxB,UAAM,aAAc,KAAyC;AAC7D,QAAI,cAAc,OAAO,eAAe,UAAU;AAChD,YAAM,KAAK,UAAU;AACrB;AAAA,IACF;AACA,QAAI,OAAO,eAAe,UAAU;AAClC,YAAM,eAAe,MAAM,oBAAoB,MAAM,IAAI,YAAY,IAAI;AACzE,UAAI,cAAc;AAChB,cAAM,KAAK,YAAY;AACvB;AAAA,MACF;AAAA,IACF;AACA,UAAM,WAAW,MAAM;AAAA,MACrB;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,eAAsB,oCACpB,OACe;AACf,QAAM,sBAAsB,wBAAwB,MAAM,mBAAmB;AAC7E,QAAM,4BAA4B,wBAAwB,MAAM,yBAAyB;AACzF,MAAI,CAAC,uBAAuB,CAAC,2BAA2B;AACtD,WAAO,yCAAyC,GAAG;AAAA,EACrD;AAEA,aAAW,QAAQ,MAAM,OAAO;AAC9B,QAAI,wBAAwB,KAAK,QAAQ,MAAM,qBAAqB;AAClE,YAAM,UAAU,MAAM;AAAA,QACpB;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,MAAI,MAAM,yBAAyB,KAAK,EAAG;AAE3C,QAAM,gBAAgB,wBAAwB,MAAM,QAAQ;AAC5D,MAAI,CAAC,iBAAiB,kBAAkB,qBAAqB;AAC3D,WAAO,yCAAyC,GAAG;AAAA,EACrD;AAEA,QAAM,WAAW,MAAM,aAAa,KAAK;AACzC,QAAM,yBAAyB,MAAM,2BAA2B,SAC5D,SAAS,gBACT,MAAM;AACV,MACE,2BAA2B,QACxB,CAAC,uBAAuB,SAAS,SAAS,KAC1C,CAAC,uBAAuB,SAAS,yBAAyB,GAC7D;AACA,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAEA,QAAM,yBAAyB;AAAA,IAC7B,GAAG;AAAA,IACH,UAAU;AAAA,IACV,OAAO,MAAM;AAAA,EACf,CAAC;AACH;AAEA,eAAsB,yCAAyC,QAAmC;AAChG,QAAM,IAAI,cAAc,QAAQ;AAAA,IAC9B,OAAO,MAAM;AAAA,MACX;AAAA,MACA;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,yBAAyB,OAA2C;AACxF,MAAI,CAAC,MAAM,MAAM,OAAQ;AAEzB,QAAM,WAAW,wBAAwB,MAAM,QAAQ;AACvD,QAAM,WAAW,MAAM,aAAa,EAAE,GAAG,OAAO,SAAS,CAAC;AAC1D,MAAI,SAAS,aAAc;AAE3B,MAAI,CAAC,UAAU;AACb,UAAM,UAAU,4CAA4C;AAAA,EAC9D;AAEA,aAAW,QAAQ,MAAM,OAAO;AAC9B,UAAM,eAAe,wBAAwB,KAAK,QAAQ;AAC1D,QAAI,iBAAiB,UAAU;AAC7B,YAAM,UAAU,gDAAgD;AAAA,IAClE;AAEA,UAAM,MAAM,MAAM;AAAA,MAChB,MAAM;AAAA,MACN;AAAA,MACA,EAAE,MAAM,SAAS;AAAA,MACjB,CAAC;AAAA,MACD,EAAE,UAAU,gBAAgB,KAAK;AAAA,IACnC;AACA,QAAI,CAAC,IAAK;AAEV,mCAA+B,UAAU;AAAA,MACvC,cAAc,CAAC,CAAC,IAAI;AAAA,MACpB,UAAU,oBAAoB,IAAI,YAAY;AAAA,MAC9C,eAAe,0BAA0B,IAAI,iBAAiB;AAAA,IAChE,CAAC;AAAA,EACH;AACF;AAEA,eAAsB,uBAAuB,OAA8C;AACzF,QAAM,WAAW,MAAM,aAAa,KAAK;AACzC,MAAI,SAAS,aAAc;AAE3B,QAAM,WAAW,wBAAwB,MAAM,QAAQ;AACvD,MAAI,CAAC,UAAU;AACb,UAAM,UAAU,mDAAmD;AAAA,EACrE;AAEA,iCAA+B,UAAU;AAAA,IACvC,cAAc,CAAC,CAAC,MAAM;AAAA,IACtB,UAAU,oBAAoB,MAAM,QAAQ;AAAA,IAC5C,eAAe,MAAM,kBAAkB,SAAY,SAAY,0BAA0B,MAAM,aAAa;AAAA,EAC9G,CAAC;AACH;AAEO,SAAS,0BAA0B,UAA6B;AACrE,SAAO,oBAAoB,QAAQ;AACrC;AAEA,eAAsB,yCAAyC,OAAiD;AAC9G,QAAM,oBAAoB,MAAM,yBAAyB,KAAK;AAC9D,MAAI,kBAAmB;AACvB,QAAM,qBAAqB,MAAM,4BAA4B,MAAM,IAAI,MAAM,YAAY;AACzF,MAAI,oBAAoB;AACtB,UAAM,UAAU,oEAAoE;AAAA,EACtF;AACF;AAEA,eAAsB,yCAAyC,OAAiD;AAC9G,QAAM,oBAAoB,MAAM,yBAAyB,KAAK;AAC9D,MAAI,kBAAmB;AACvB,QAAM,qBAAqB,MAAM,4BAA4B,MAAM,IAAI,MAAM,YAAY;AACzF,MAAI,oBAAoB;AACtB,UAAM,UAAU,iEAAiE;AAAA,EACnF;AACF;AAQA,eAAsB,+BAA+B,OAA6C;AAChG,QAAM,eAAe,MAAM,yBAAyB,KAAK;AACzD,MAAI,aAAc;AAElB,QAAM,SAAS,MAAM;AAAA,IACnB,MAAM;AAAA,IACN;AAAA,IACA,EAAE,IAAI,MAAM,aAAa;AAAA,IACzB,CAAC;AAAA,IACD,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,EACzC;AAMA,MAAI,CAAC,OAAQ;AAEb,QAAM,gBAAgB,wBAAwB,MAAM,QAAQ;AAC5D,QAAM,iBAAiB,wBAAyB,OAAwC,QAAQ;AAChG,MAAI,CAAC,kBAAkB,mBAAmB,eAAe;AACvD,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,iBAAiB,CAAC;AAAA,EAC1D;AAEA,MAAI,MAAM,kBAAkB,eAAe,MAAM;AAC/C,UAAM,uBAAuB,wBAAyB,OAA8C,cAAc;AAClH,QAAI,CAAC,wBAAwB,CAAC,MAAM,kBAAkB,WAAW,SAAS,oBAAoB,GAAG;AAC/F,YAAM,UAAU,qCAAqC;AAAA,IACvD;AAAA,EACF;AACF;AAEA,eAAsB,+BAA+B,OAAiD;AACpG,QAAM,eAAe,MAAM,yBAAyB,KAAK;AACzD,MAAI,aAAc;AAElB,QAAM,SAAS,MAAM;AAAA,IACnB,MAAM;AAAA,IACN;AAAA,IACA,EAAE,IAAI,MAAM,aAAa;AAAA,IACzB,CAAC;AAAA,IACD,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,EACzC;AAEA,MAAI,CAAC,OAAQ;AAEb,QAAM,gBAAgB,wBAAwB,MAAM,QAAQ;AAC5D,QAAM,iBAAiB,wBAAyB,OAAwC,QAAQ;AAChG,MAAI,CAAC,kBAAkB,mBAAmB,eAAe;AACvD,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,iBAAiB,CAAC;AAAA,EAC1D;AACF;AAEA,eAAe,yBAAyB,OAA8E;AACpH,MAAI,OAAO,MAAM,sBAAsB,UAAW,QAAO,MAAM;AAC/D,QAAM,MAAM,MAAM,aAAa,KAAK;AACpC,SAAO,IAAI;AACb;AAEA,eAAsB,4BAA4B,IAAmB,QAAkC;AACrG,QAAM,cAAc,MAAM,GAAG;AAAA,IAC3B;AAAA,IACA,EAAE,MAAM,QAAmB,cAAc,KAAK;AAAA,EAChD;AACA,MAAI,eAAgB,YAA2C,iBAAiB,KAAM,QAAO;AAC7F,QAAM,QAAQ,MAAM;AAAA,IAClB;AAAA,IACA;AAAA,IACA,EAAE,MAAM,OAAkB;AAAA,IAC1B,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,IACrB,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,EACzC;AACA,QAAM,WAAW,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,GAC9C,IAAI,CAAC,SAAS;AACb,UAAM,OAAQ,KAAqD;AACnE,QAAI,CAAC,KAAM,QAAO;AAClB,QAAI,OAAO,SAAS,SAAU,QAAO;AACrC,WAAO,KAAK,KAAK,OAAO,KAAK,EAAE,IAAI;AAAA,EACrC,CAAC,EACA,OAAO,CAAC,OAAqB,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC;AACvE,MAAI,CAAC,QAAQ,OAAQ,QAAO;AAC5B,QAAM,YAAY,MAAM,GAAG;AAAA,IACzB;AAAA,IACA,EAAE,MAAM,EAAE,KAAK,QAAQ,GAAc,cAAc,KAAK;AAAA,EAC1D;AACA,SAAO,CAAC,CAAC,aAAc,UAAyC,iBAAiB;AACnF;AAEA,eAAsB,4BAA4B,IAAmB,QAAkC;AACrG,QAAM,QAAQ,MAAM,GAAG;AAAA,IACrB;AAAA,IACA,EAAE,MAAM,QAAmB,cAAc,KAAK;AAAA,EAChD;AACA,SAAO,CAAC,CAAC,SAAU,MAAqC,iBAAiB;AAC3E;AAEA,eAAsB,sBAAsB,IAAmB,UAA+C;AAC5G,QAAM,MAAM,oBAAI,IAAY;AAC5B,QAAM,gBAAyC,EAAE,cAAc,KAAK;AACpE,MAAI,SAAU,eAAc,WAAW;AACvC,QAAM,WAAW,MAAM,GAAG,KAAK,SAAS,aAAqC;AAC7E,aAAW,OAAO,UAAU;AAC1B,UAAM,UAAW,IAAoD;AACrE,UAAM,SAAS,WAAW,OAAO,YAAY,WACzC,QAAQ,KACR;AACJ,QAAI,OAAQ,KAAI,IAAI,OAAO,MAAM,CAAC;AAAA,EACpC;AACA,QAAM,WAAW,MAAM,GAAG;AAAA,IACxB;AAAA,IACA,EAAE,cAAc,KAAK;AAAA,EACvB;AACA,QAAM,UAAU,SACb,IAAI,CAAC,QAAQ;AACZ,UAAM,UAAW,IAAoD;AACrE,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,OAAO,YAAY,SAAU,QAAO;AACxC,WAAO,QAAQ,KAAK,OAAO,QAAQ,EAAE,IAAI;AAAA,EAC3C,CAAC,EACA,OAAO,CAAC,OAAqB,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC;AACvE,MAAI,QAAQ,QAAQ;AAClB,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA,EAAE,MAAM,EAAE,KAAK,QAAQ,EAAa;AAAA,MACpC,CAAC;AAAA,MACD,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,IACzC;AACA,eAAW,QAAQ,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,GAAG;AACpD,YAAM,UAAW,KAAqD;AACtE,YAAM,SAAS,WAAW,OAAO,YAAY,WACzC,QAAQ,KACR;AACJ,UAAI,OAAQ,KAAI,IAAI,OAAO,MAAM,CAAC;AAAA,IACpC;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAe,aAAa,OAA6C;AACvE,QAAM,cAAc,wBAAwB,MAAM,WAAW;AAC7D,MAAI,CAAC,YAAa,OAAM,UAAU,yCAAyC;AAE3E,QAAM,MAAM,MAAM,MAAM,YAAY,QAAQ,aAAa;AAAA,IACvD,UAAU,wBAAwB,MAAM,QAAQ;AAAA,IAChD,gBAAgB,wBAAwB,MAAM,cAAc;AAAA,EAC9D,CAAC;AAED,SAAO;AAAA,IACL,cAAc,CAAC,CAAC,KAAK;AAAA,IACrB,UAAU,oBAAoB,KAAK,QAAQ;AAAA,IAC3C,eAAe,0BAA0B,KAAK,aAAa;AAAA,EAC7D;AACF;AAEA,eAAe,qBACb,IACA,YACA,UACiB;AACjB,QAAM,QAAgB,CAAC;AACvB,QAAM,eAAyB,CAAC;AAEhC,aAAW,SAAS,YAAY;AAC9B,UAAM,OAAO,MAAM,oBAAoB,IAAI,OAAO,QAAQ;AAC1D,QAAI,CAAC,MAAM;AACT,mBAAa,KAAK,KAAK;AAAA,IACzB,OAAO;AACL,YAAM,KAAK,IAAI;AAAA,IACjB;AAAA,EACF;AAEA,MAAI,aAAa,QAAQ;AACvB,UAAM,SAAS,aAAa,IAAI,CAAC,SAAS,IAAI,IAAI,GAAG,EAAE,KAAK,IAAI;AAChE,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,sBAAsB,MAAM,GAAG,CAAC;AAAA,EACxE;AAEA,SAAO;AACT;AAEA,eAAe,oBACb,IACA,OACA,UACsB;AACtB,QAAM,QAAiC,QAAQ,KAAK,KAAK,IACrD,EAAE,IAAI,OAAO,WAAW,KAAK,IAC7B,EAAE,MAAM,OAAO,WAAW,KAAK;AACnC,MAAI,SAAU,OAAM,WAAW;AAC/B,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,CAAC;AAAA,IACD,EAAE,UAAU,gBAAgB,KAAK;AAAA,EACnC;AACF;AAEA,SAAS,+BACP,UACA,WAKM;AACN,MAAI,UAAU,cAAc;AAC1B,UAAM,UAAU,yDAAyD;AAAA,EAC3E;AAEA,QAAM,yBAAyB,SAAS,SAAS,OAAO,CAAC,UAAU,UAAU,GAAG;AAChF,aAAW,WAAW,UAAU,UAAU;AACxC,QAAI,YAAY,KAAK;AACnB,YAAM,UAAU,6DAA6D;AAAA,IAC/E;AACA,QAAI,kBAAkB,OAAO,GAAG;AAC9B,UAAI,CAAC,WAAW,wBAAwB,OAAO,GAAG;AAChD,cAAM,UAAU,iCAAiC,OAAO,GAAG;AAAA,MAC7D;AACA;AAAA,IACF;AACA,QAAI,CAAC,WAAW,wBAAwB,OAAO,GAAG;AAChD,YAAM,UAAU,wBAAwB,OAAO,GAAG;AAAA,IACpD;AAAA,EACF;AAEA,MAAI,UAAU,kBAAkB,QAAW;AACzC,qCAAiC,SAAS,eAAe,UAAU,aAAa;AAAA,EAClF;AACF;AAEA,SAAS,iCACP,oBACA,wBACM;AACN,MAAI,uBAAuB,QAAQ,mBAAmB,SAAS,SAAS,EAAG;AAE3E,MAAI,2BAA2B,QAAQ,uBAAuB,SAAS,SAAS,GAAG;AACjF,UAAM,UAAU,gDAAgD;AAAA,EAClE;AAEA,aAAW,kBAAkB,wBAAwB;AACnD,QAAI,CAAC,mBAAmB,SAAS,cAAc,GAAG;AAChD,YAAM,UAAU,uDAAuD;AAAA,IACzE;AAAA,EACF;AACF;AAEA,SAAS,oBAAoB,QAA2B;AACtD,MAAI,CAAC,MAAM,QAAQ,MAAM,EAAG,QAAO,CAAC;AACpC,QAAM,QAAQ,oBAAI,IAAY;AAC9B,aAAW,SAAS,QAAQ;AAC1B,QAAI,OAAO,UAAU,SAAU;AAC/B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,QAAS;AACd,UAAM,IAAI,OAAO;AAAA,EACnB;AACA,SAAO,MAAM,KAAK,KAAK;AACzB;AAEA,SAAS,0BAA0B,QAAkC;AACnE,MAAI,WAAW,QAAQ,WAAW,OAAW,QAAO;AACpD,SAAO,oBAAoB,MAAM;AACnC;AAEA,SAAS,wBAAwB,OAA+B;AAC9D,SAAO,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,IAAI,MAAM,KAAK,IAAI;AAC/E;AAEA,SAAS,kBAAkB,SAA0B;AACnD,SAAO,QAAQ,SAAS,IAAI;AAC9B;AAEA,eAAe,mBAAmB,KAAa,UAAmC;AAChF,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,SAAO,UAAU,KAAK,QAAQ;AAChC;",
+  "sourcesContent": ["import type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'\nimport { badRequest, CrudHttpError, forbidden } from '@open-mercato/shared/lib/crud/errors'\nimport { hasFeature } from '@open-mercato/shared/security/features'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { Role, RoleAcl, User, UserAcl, UserRole } from '@open-mercato/core/modules/auth/data/entities'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport type { OrganizationScope } from '@open-mercato/core/modules/directory/utils/organizationScope'\n\ntype ActorAcl = {\n  isSuperAdmin: boolean\n  features: string[]\n  organizations: string[] | null\n}\n\ntype GrantCheckContext = {\n  em: EntityManager\n  rbacService: RbacService\n  actorUserId: string | null | undefined\n  tenantId: string | null | undefined\n  organizationId?: string | null | undefined\n}\n\ntype RoleGrantCheckInput = GrantCheckContext & {\n  roles: Role[]\n}\n\ntype RoleTokenGrantCheckInput = GrantCheckContext & {\n  roleTokens: unknown\n}\n\ntype UserDestinationRolesInput = {\n  em: EntityManager\n  targetUserId: string\n  destinationTenantId: string | null | undefined\n  roleTokens: unknown\n}\n\ntype UserDestinationScopeCheckInput = GrantCheckContext & {\n  actorIsSuperAdmin?: boolean\n  allowedOrganizationIds?: string[] | null\n  destinationTenantId: string | null | undefined\n  destinationOrganizationId: string | null | undefined\n  roles: Role[]\n}\n\ntype FeatureGrantCheckInput = GrantCheckContext & {\n  features: unknown\n  isSuperAdmin?: boolean\n  organizations?: string[] | null\n}\n\ntype SuperAdminUserTargetInput = GrantCheckContext & {\n  targetUserId: string\n  actorIsSuperAdmin?: boolean\n}\n\ntype UserTargetAccessInput = SuperAdminUserTargetInput & {\n  organizationScope: Pick<OrganizationScope, 'allowedIds'>\n}\n\ntype SuperAdminRoleTargetInput = GrantCheckContext & {\n  targetRoleId: string\n  actorIsSuperAdmin?: boolean\n}\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i\n\nexport async function assertActorCanGrantRoleTokens(input: RoleTokenGrantCheckInput): Promise<Role[]> {\n  const tokens = normalizeStringList(input.roleTokens)\n  if (!tokens.length) return []\n\n  const tenantId = normalizeNullableString(input.tenantId)\n  const roles = await resolveRolesForGrant(input.em, tokens, tenantId)\n  await assertActorCanGrantRoles({ ...input, tenantId, roles })\n  return roles\n}\n\nexport async function resolveUserDestinationRoles(input: UserDestinationRolesInput): Promise<Role[]> {\n  const destinationTenantId = normalizeNullableString(input.destinationTenantId)\n  if (Array.isArray(input.roleTokens)) {\n    return resolveRolesForGrant(input.em, normalizeStringList(input.roleTokens), destinationTenantId)\n  }\n\n  const links = await findWithDecryption(\n    input.em,\n    UserRole,\n    { user: input.targetUserId as unknown as User } as FilterQuery<UserRole>,\n    { populate: ['role'] },\n    { tenantId: null, organizationId: null },\n  )\n  const roles: Role[] = []\n  for (const link of links) {\n    const linkedRole = (link as { role?: Role | string | null }).role\n    if (linkedRole && typeof linkedRole === 'object') {\n      roles.push(linkedRole)\n      continue\n    }\n    if (typeof linkedRole === 'string') {\n      const resolvedRole = await resolveRoleForGrant(input.em, linkedRole, null)\n      if (resolvedRole) {\n        roles.push(resolvedRole)\n        continue\n      }\n    }\n    throw badRequest(await translateAuthError(\n      'auth.users.errors.invalidRoleAssignment',\n      'User has an invalid role assignment',\n    ))\n  }\n  return roles\n}\n\nexport async function assertActorCanAssignUserDestination(\n  input: UserDestinationScopeCheckInput,\n): Promise<void> {\n  const destinationTenantId = normalizeNullableString(input.destinationTenantId)\n  const destinationOrganizationId = normalizeNullableString(input.destinationOrganizationId)\n  if (!destinationTenantId || !destinationOrganizationId) {\n    return throwUserDestinationOrganizationNotFound(400)\n  }\n\n  for (const role of input.roles) {\n    if (normalizeNullableString(role.tenantId) !== destinationTenantId) {\n      throw forbidden(await translateAuthError(\n        'auth.users.errors.roleOutsideDestinationTenant',\n        'Cannot retain or assign a role outside the destination tenant.',\n      ))\n    }\n  }\n\n  if (await resolveActorIsSuperAdmin(input)) return\n\n  const actorTenantId = normalizeNullableString(input.tenantId)\n  if (!actorTenantId || actorTenantId !== destinationTenantId) {\n    return throwUserDestinationOrganizationNotFound(404)\n  }\n\n  const actorAcl = await loadActorAcl(input)\n  const allowedOrganizationIds = input.allowedOrganizationIds === undefined\n    ? actorAcl.organizations\n    : input.allowedOrganizationIds\n  if (\n    allowedOrganizationIds !== null\n    && !allowedOrganizationIds.includes('__all__')\n    && !allowedOrganizationIds.includes(destinationOrganizationId)\n  ) {\n    throw forbidden(await translateAuthError(\n      'auth.users.errors.destinationOrganizationOutsideScope',\n      'Cannot assign user to a destination organization outside actor scope.',\n    ))\n  }\n\n  await assertActorCanGrantRoles({\n    ...input,\n    tenantId: destinationTenantId,\n    roles: input.roles,\n  })\n}\n\nexport async function throwUserDestinationOrganizationNotFound(status: 400 | 404): Promise<never> {\n  throw new CrudHttpError(status, {\n    error: await translateAuthError(\n      'auth.users.errors.organizationNotFound',\n      'Organization not found',\n    ),\n  })\n}\n\nexport async function assertActorCanGrantRoles(input: RoleGrantCheckInput): Promise<void> {\n  if (!input.roles.length) return\n\n  const tenantId = normalizeNullableString(input.tenantId)\n  const actorAcl = await loadActorAcl({ ...input, tenantId })\n  if (actorAcl.isSuperAdmin) return\n\n  if (!tenantId) {\n    throw forbidden('Tenant context is required to grant roles.')\n  }\n\n  for (const role of input.roles) {\n    const roleTenantId = normalizeNullableString(role.tenantId)\n    if (roleTenantId !== tenantId) {\n      throw forbidden('Cannot grant a role outside the target tenant.')\n    }\n\n    const acl = await findOneWithDecryption(\n      input.em,\n      RoleAcl,\n      { role, tenantId } as FilterQuery<RoleAcl>,\n      {},\n      { tenantId, organizationId: null },\n    )\n    if (!acl) continue\n\n    assertActorCanGrantAclSnapshot(actorAcl, {\n      isSuperAdmin: !!acl.isSuperAdmin,\n      features: normalizeStringList(acl.featuresJson),\n      organizations: normalizeOrganizationList(acl.organizationsJson),\n    })\n  }\n}\n\nexport async function assertActorCanGrantAcl(input: FeatureGrantCheckInput): Promise<void> {\n  const actorAcl = await loadActorAcl(input)\n  if (actorAcl.isSuperAdmin) return\n\n  const tenantId = normalizeNullableString(input.tenantId)\n  if (!tenantId) {\n    throw forbidden('Tenant context is required to grant ACL features.')\n  }\n\n  assertActorCanGrantAclSnapshot(actorAcl, {\n    isSuperAdmin: !!input.isSuperAdmin,\n    features: normalizeStringList(input.features),\n    organizations: input.organizations === undefined ? undefined : normalizeOrganizationList(input.organizations),\n  })\n}\n\nexport function normalizeGrantFeatureList(features: unknown): string[] {\n  return normalizeStringList(features)\n}\n\nexport async function assertActorCanModifySuperAdminUserTarget(input: SuperAdminUserTargetInput): Promise<void> {\n  const actorIsSuperAdmin = await resolveActorIsSuperAdmin(input)\n  if (actorIsSuperAdmin) return\n  const targetIsSuperAdmin = await isUserEffectivelySuperAdmin(input.em, input.targetUserId)\n  if (targetIsSuperAdmin) {\n    throw forbidden('Only super administrators can modify super administrator accounts.')\n  }\n}\n\nexport async function assertActorCanModifySuperAdminRoleTarget(input: SuperAdminRoleTargetInput): Promise<void> {\n  const actorIsSuperAdmin = await resolveActorIsSuperAdmin(input)\n  if (actorIsSuperAdmin) return\n  const targetIsSuperAdmin = await isRoleEffectivelySuperAdmin(input.em, input.targetRoleId)\n  if (targetIsSuperAdmin) {\n    throw forbidden('Only super administrators can modify super administrator roles.')\n  }\n}\n\nexport async function assertActorCanAccessUserTarget(input: UserTargetAccessInput): Promise<void> {\n  const isSuperAdmin = await resolveActorIsSuperAdmin(input)\n  if (isSuperAdmin) return\n\n  const target = await findOneWithDecryption(\n    input.em,\n    User,\n    { id: input.targetUserId } as FilterQuery<User>,\n    {},\n    { tenantId: null, organizationId: null },\n  )\n  // Not found (incl. soft-deleted, which MikroORM's soft-delete filter hides):\n  // delegate to the caller. Every wired call site is itself tenant-scoped \u2014 the\n  // ACL/consents reads filter by auth.tenantId and the user commands re-load by\n  // id within tenant \u2014 so a missing target yields a safe empty/404 there. The\n  // guard's job is to block a foreign *existing* target, below.\n  if (!target) return\n\n  const actorTenantId = normalizeNullableString(input.tenantId)\n  const targetTenantId = normalizeNullableString((target as { tenantId?: string | null }).tenantId)\n  if (!targetTenantId || targetTenantId !== actorTenantId) {\n    throw new CrudHttpError(404, { error: 'User not found' })\n  }\n\n  if (input.organizationScope.allowedIds !== null) {\n    const targetOrganizationId = normalizeNullableString((target as { organizationId?: string | null }).organizationId)\n    if (!targetOrganizationId || !input.organizationScope.allowedIds.includes(targetOrganizationId)) {\n      throw forbidden('Not authorized to access this user.')\n    }\n  }\n}\n\nexport async function assertActorCanAccessRoleTarget(input: SuperAdminRoleTargetInput): Promise<void> {\n  const isSuperAdmin = await resolveActorIsSuperAdmin(input)\n  if (isSuperAdmin) return\n\n  const target = await findOneWithDecryption(\n    input.em,\n    Role,\n    { id: input.targetRoleId } as FilterQuery<Role>,\n    {},\n    { tenantId: null, organizationId: null },\n  )\n  // Not found (incl. soft-deleted): delegate (see assertActorCanAccessUserTarget).\n  if (!target) return\n\n  const actorTenantId = normalizeNullableString(input.tenantId)\n  const targetTenantId = normalizeNullableString((target as { tenantId?: string | null }).tenantId)\n  if (!targetTenantId || targetTenantId !== actorTenantId) {\n    throw new CrudHttpError(404, { error: 'Role not found' })\n  }\n}\n\nasync function resolveActorIsSuperAdmin(input: GrantCheckContext & { actorIsSuperAdmin?: boolean }): Promise<boolean> {\n  if (typeof input.actorIsSuperAdmin === 'boolean') return input.actorIsSuperAdmin\n  const acl = await loadActorAcl(input)\n  return acl.isSuperAdmin\n}\n\nexport async function isUserEffectivelySuperAdmin(em: EntityManager, userId: string): Promise<boolean> {\n  const directGrant = await em.findOne(\n    UserAcl,\n    { user: userId as unknown, isSuperAdmin: true } as FilterQuery<UserAcl>,\n  )\n  if (directGrant && (directGrant as { isSuperAdmin?: boolean }).isSuperAdmin === true) return true\n  const links = await findWithDecryption(\n    em,\n    UserRole,\n    { user: userId as unknown } as FilterQuery<UserRole>,\n    { populate: ['role'] },\n    { tenantId: null, organizationId: null },\n  )\n  const roleIds = (Array.isArray(links) ? links : [])\n    .map((link) => {\n      const role = (link as { role?: { id?: unknown } | string | null }).role\n      if (!role) return null\n      if (typeof role === 'string') return role\n      return role.id ? String(role.id) : null\n    })\n    .filter((id): id is string => typeof id === 'string' && id.length > 0)\n  if (!roleIds.length) return false\n  const roleGrant = await em.findOne(\n    RoleAcl,\n    { role: { $in: roleIds } as unknown, isSuperAdmin: true } as FilterQuery<RoleAcl>,\n  )\n  return !!roleGrant && (roleGrant as { isSuperAdmin?: boolean }).isSuperAdmin === true\n}\n\nexport async function isRoleEffectivelySuperAdmin(em: EntityManager, roleId: string): Promise<boolean> {\n  const grant = await em.findOne(\n    RoleAcl,\n    { role: roleId as unknown, isSuperAdmin: true } as FilterQuery<RoleAcl>,\n  )\n  return !!grant && (grant as { isSuperAdmin?: boolean }).isSuperAdmin === true\n}\n\nexport async function listSuperAdminUserIds(em: EntityManager, tenantId: string | null): Promise<Set<string>> {\n  const ids = new Set<string>()\n  const userAclFilter: Record<string, unknown> = { isSuperAdmin: true }\n  if (tenantId) userAclFilter.tenantId = tenantId\n  const userAcls = await em.find(UserAcl, userAclFilter as FilterQuery<UserAcl>)\n  for (const acl of userAcls) {\n    const userRef = (acl as { user?: { id?: unknown } | string | null }).user\n    const userId = userRef && typeof userRef === 'object'\n      ? userRef.id\n      : userRef\n    if (userId) ids.add(String(userId))\n  }\n  const roleAcls = await em.find(\n    RoleAcl,\n    { isSuperAdmin: true } as FilterQuery<RoleAcl>,\n  )\n  const roleIds = roleAcls\n    .map((acl) => {\n      const roleRef = (acl as { role?: { id?: unknown } | string | null }).role\n      if (!roleRef) return null\n      if (typeof roleRef === 'string') return roleRef\n      return roleRef.id ? String(roleRef.id) : null\n    })\n    .filter((id): id is string => typeof id === 'string' && id.length > 0)\n  if (roleIds.length) {\n    const links = await findWithDecryption(\n      em,\n      UserRole,\n      { role: { $in: roleIds } as unknown } as FilterQuery<UserRole>,\n      {},\n      { tenantId: null, organizationId: null },\n    )\n    for (const link of Array.isArray(links) ? links : []) {\n      const userRef = (link as { user?: { id?: unknown } | string | null }).user\n      const userId = userRef && typeof userRef === 'object'\n        ? userRef.id\n        : userRef\n      if (userId) ids.add(String(userId))\n    }\n  }\n  return ids\n}\n\nasync function loadActorAcl(input: GrantCheckContext): Promise<ActorAcl> {\n  const actorUserId = normalizeNullableString(input.actorUserId)\n  if (!actorUserId) throw forbidden('Not authorized to grant ACL privileges.')\n\n  const acl = await input.rbacService.loadAcl(actorUserId, {\n    tenantId: normalizeNullableString(input.tenantId),\n    organizationId: normalizeNullableString(input.organizationId),\n  })\n\n  return {\n    isSuperAdmin: !!acl?.isSuperAdmin,\n    features: normalizeStringList(acl?.features),\n    organizations: normalizeOrganizationList(acl?.organizations),\n  }\n}\n\nasync function resolveRolesForGrant(\n  em: EntityManager,\n  roleTokens: string[],\n  tenantId: string | null,\n): Promise<Role[]> {\n  const roles: Role[] = []\n  const missingRoles: string[] = []\n\n  for (const token of roleTokens) {\n    const role = await resolveRoleForGrant(em, token, tenantId)\n    if (!role) {\n      missingRoles.push(token)\n    } else {\n      roles.push(role)\n    }\n  }\n\n  if (missingRoles.length) {\n    const labels = missingRoles.map((role) => `\"${role}\"`).join(', ')\n    throw new CrudHttpError(400, { error: `Role(s) not found: ${labels}` })\n  }\n\n  return roles\n}\n\nasync function resolveRoleForGrant(\n  em: EntityManager,\n  token: string,\n  tenantId: string | null,\n): Promise<Role | null> {\n  const where: Record<string, unknown> = UUID_RE.test(token)\n    ? { id: token, deletedAt: null }\n    : { name: token, deletedAt: null }\n  if (tenantId) where.tenantId = tenantId\n  return findOneWithDecryption(\n    em,\n    Role,\n    where as FilterQuery<Role>,\n    {},\n    { tenantId, organizationId: null },\n  )\n}\n\nfunction assertActorCanGrantAclSnapshot(\n  actorAcl: ActorAcl,\n  requested: {\n    isSuperAdmin: boolean\n    features: string[]\n    organizations?: string[] | null\n  },\n): void {\n  if (requested.isSuperAdmin) {\n    throw forbidden('Only super administrators can grant super admin access.')\n  }\n\n  const actorGrantableFeatures = actorAcl.features.filter((grant) => grant !== '*')\n  for (const feature of requested.features) {\n    if (feature === '*') {\n      throw forbidden('Only super administrators can grant global wildcard access.')\n    }\n    if (isWildcardFeature(feature)) {\n      if (!hasFeature(actorGrantableFeatures, feature)) {\n        throw forbidden(`Cannot grant feature wildcard ${feature}.`)\n      }\n      continue\n    }\n    if (!hasFeature(actorGrantableFeatures, feature)) {\n      throw forbidden(`Cannot grant feature ${feature}.`)\n    }\n  }\n\n  if (requested.organizations !== undefined) {\n    assertActorCanGrantOrganizations(actorAcl.organizations, requested.organizations)\n  }\n}\n\nfunction assertActorCanGrantOrganizations(\n  actorOrganizations: string[] | null,\n  requestedOrganizations: string[] | null,\n): void {\n  if (actorOrganizations === null || actorOrganizations.includes('__all__')) return\n\n  if (requestedOrganizations === null || requestedOrganizations.includes('__all__')) {\n    throw forbidden('Cannot grant unrestricted organization access.')\n  }\n\n  for (const organizationId of requestedOrganizations) {\n    if (!actorOrganizations.includes(organizationId)) {\n      throw forbidden('Cannot grant organization access outside actor scope.')\n    }\n  }\n}\n\nfunction normalizeStringList(values: unknown): string[] {\n  if (!Array.isArray(values)) return []\n  const dedup = new Set<string>()\n  for (const value of values) {\n    if (typeof value !== 'string') continue\n    const trimmed = value.trim()\n    if (!trimmed) continue\n    dedup.add(trimmed)\n  }\n  return Array.from(dedup)\n}\n\nfunction normalizeOrganizationList(values: unknown): string[] | null {\n  if (values === null || values === undefined) return null\n  return normalizeStringList(values)\n}\n\nfunction normalizeNullableString(value: unknown): string | null {\n  return typeof value === 'string' && value.trim().length > 0 ? value.trim() : null\n}\n\nfunction isWildcardFeature(feature: string): boolean {\n  return feature.endsWith('.*')\n}\n\nasync function translateAuthError(key: string, fallback: string): Promise<string> {\n  const { translate } = await resolveTranslations()\n  return translate(key, fallback)\n}\n"],
+  "mappings": "AACA,SAAS,YAAY,eAAe,iBAAiB;AACrD,SAAS,kBAAkB;AAC3B,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,2BAA2B;AACpC,SAAS,MAAM,SAAS,MAAM,SAAS,gBAAgB;AA6DvD,MAAM,UAAU;AAEhB,eAAsB,8BAA8B,OAAkD;AACpG,QAAM,SAAS,oBAAoB,MAAM,UAAU;AACnD,MAAI,CAAC,OAAO,OAAQ,QAAO,CAAC;AAE5B,QAAM,WAAW,wBAAwB,MAAM,QAAQ;AACvD,QAAM,QAAQ,MAAM,qBAAqB,MAAM,IAAI,QAAQ,QAAQ;AACnE,QAAM,yBAAyB,EAAE,GAAG,OAAO,UAAU,MAAM,CAAC;AAC5D,SAAO;AACT;AAEA,eAAsB,4BAA4B,OAAmD;AACnG,QAAM,sBAAsB,wBAAwB,MAAM,mBAAmB;AAC7E,MAAI,MAAM,QAAQ,MAAM,UAAU,GAAG;AACnC,WAAO,qBAAqB,MAAM,IAAI,oBAAoB,MAAM,UAAU,GAAG,mBAAmB;AAAA,EAClG;AAEA,QAAM,QAAQ,MAAM;AAAA,IAClB,MAAM;AAAA,IACN;AAAA,IACA,EAAE,MAAM,MAAM,aAAgC;AAAA,IAC9C,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,IACrB,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,EACzC;AACA,QAAM,QAAgB,CAAC;AACvB,aAAW,QAAQ,OAAO;AACxB,UAAM,aAAc,KAAyC;AAC7D,QAAI,cAAc,OAAO,eAAe,UAAU;AAChD,YAAM,KAAK,UAAU;AACrB;AAAA,IACF;AACA,QAAI,OAAO,eAAe,UAAU;AAClC,YAAM,eAAe,MAAM,oBAAoB,MAAM,IAAI,YAAY,IAAI;AACzE,UAAI,cAAc;AAChB,cAAM,KAAK,YAAY;AACvB;AAAA,MACF;AAAA,IACF;AACA,UAAM,WAAW,MAAM;AAAA,MACrB;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,eAAsB,oCACpB,OACe;AACf,QAAM,sBAAsB,wBAAwB,MAAM,mBAAmB;AAC7E,QAAM,4BAA4B,wBAAwB,MAAM,yBAAyB;AACzF,MAAI,CAAC,uBAAuB,CAAC,2BAA2B;AACtD,WAAO,yCAAyC,GAAG;AAAA,EACrD;AAEA,aAAW,QAAQ,MAAM,OAAO;AAC9B,QAAI,wBAAwB,KAAK,QAAQ,MAAM,qBAAqB;AAClE,YAAM,UAAU,MAAM;AAAA,QACpB;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,MAAI,MAAM,yBAAyB,KAAK,EAAG;AAE3C,QAAM,gBAAgB,wBAAwB,MAAM,QAAQ;AAC5D,MAAI,CAAC,iBAAiB,kBAAkB,qBAAqB;AAC3D,WAAO,yCAAyC,GAAG;AAAA,EACrD;AAEA,QAAM,WAAW,MAAM,aAAa,KAAK;AACzC,QAAM,yBAAyB,MAAM,2BAA2B,SAC5D,SAAS,gBACT,MAAM;AACV,MACE,2BAA2B,QACxB,CAAC,uBAAuB,SAAS,SAAS,KAC1C,CAAC,uBAAuB,SAAS,yBAAyB,GAC7D;AACA,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAEA,QAAM,yBAAyB;AAAA,IAC7B,GAAG;AAAA,IACH,UAAU;AAAA,IACV,OAAO,MAAM;AAAA,EACf,CAAC;AACH;AAEA,eAAsB,yCAAyC,QAAmC;AAChG,QAAM,IAAI,cAAc,QAAQ;AAAA,IAC9B,OAAO,MAAM;AAAA,MACX;AAAA,MACA;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,yBAAyB,OAA2C;AACxF,MAAI,CAAC,MAAM,MAAM,OAAQ;AAEzB,QAAM,WAAW,wBAAwB,MAAM,QAAQ;AACvD,QAAM,WAAW,MAAM,aAAa,EAAE,GAAG,OAAO,SAAS,CAAC;AAC1D,MAAI,SAAS,aAAc;AAE3B,MAAI,CAAC,UAAU;AACb,UAAM,UAAU,4CAA4C;AAAA,EAC9D;AAEA,aAAW,QAAQ,MAAM,OAAO;AAC9B,UAAM,eAAe,wBAAwB,KAAK,QAAQ;AAC1D,QAAI,iBAAiB,UAAU;AAC7B,YAAM,UAAU,gDAAgD;AAAA,IAClE;AAEA,UAAM,MAAM,MAAM;AAAA,MAChB,MAAM;AAAA,MACN;AAAA,MACA,EAAE,MAAM,SAAS;AAAA,MACjB,CAAC;AAAA,MACD,EAAE,UAAU,gBAAgB,KAAK;AAAA,IACnC;AACA,QAAI,CAAC,IAAK;AAEV,mCAA+B,UAAU;AAAA,MACvC,cAAc,CAAC,CAAC,IAAI;AAAA,MACpB,UAAU,oBAAoB,IAAI,YAAY;AAAA,MAC9C,eAAe,0BAA0B,IAAI,iBAAiB;AAAA,IAChE,CAAC;AAAA,EACH;AACF;AAEA,eAAsB,uBAAuB,OAA8C;AACzF,QAAM,WAAW,MAAM,aAAa,KAAK;AACzC,MAAI,SAAS,aAAc;AAE3B,QAAM,WAAW,wBAAwB,MAAM,QAAQ;AACvD,MAAI,CAAC,UAAU;AACb,UAAM,UAAU,mDAAmD;AAAA,EACrE;AAEA,iCAA+B,UAAU;AAAA,IACvC,cAAc,CAAC,CAAC,MAAM;AAAA,IACtB,UAAU,oBAAoB,MAAM,QAAQ;AAAA,IAC5C,eAAe,MAAM,kBAAkB,SAAY,SAAY,0BAA0B,MAAM,aAAa;AAAA,EAC9G,CAAC;AACH;AAEO,SAAS,0BAA0B,UAA6B;AACrE,SAAO,oBAAoB,QAAQ;AACrC;AAEA,eAAsB,yCAAyC,OAAiD;AAC9G,QAAM,oBAAoB,MAAM,yBAAyB,KAAK;AAC9D,MAAI,kBAAmB;AACvB,QAAM,qBAAqB,MAAM,4BAA4B,MAAM,IAAI,MAAM,YAAY;AACzF,MAAI,oBAAoB;AACtB,UAAM,UAAU,oEAAoE;AAAA,EACtF;AACF;AAEA,eAAsB,yCAAyC,OAAiD;AAC9G,QAAM,oBAAoB,MAAM,yBAAyB,KAAK;AAC9D,MAAI,kBAAmB;AACvB,QAAM,qBAAqB,MAAM,4BAA4B,MAAM,IAAI,MAAM,YAAY;AACzF,MAAI,oBAAoB;AACtB,UAAM,UAAU,iEAAiE;AAAA,EACnF;AACF;AAEA,eAAsB,+BAA+B,OAA6C;AAChG,QAAM,eAAe,MAAM,yBAAyB,KAAK;AACzD,MAAI,aAAc;AAElB,QAAM,SAAS,MAAM;AAAA,IACnB,MAAM;AAAA,IACN;AAAA,IACA,EAAE,IAAI,MAAM,aAAa;AAAA,IACzB,CAAC;AAAA,IACD,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,EACzC;AAMA,MAAI,CAAC,OAAQ;AAEb,QAAM,gBAAgB,wBAAwB,MAAM,QAAQ;AAC5D,QAAM,iBAAiB,wBAAyB,OAAwC,QAAQ;AAChG,MAAI,CAAC,kBAAkB,mBAAmB,eAAe;AACvD,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,iBAAiB,CAAC;AAAA,EAC1D;AAEA,MAAI,MAAM,kBAAkB,eAAe,MAAM;AAC/C,UAAM,uBAAuB,wBAAyB,OAA8C,cAAc;AAClH,QAAI,CAAC,wBAAwB,CAAC,MAAM,kBAAkB,WAAW,SAAS,oBAAoB,GAAG;AAC/F,YAAM,UAAU,qCAAqC;AAAA,IACvD;AAAA,EACF;AACF;AAEA,eAAsB,+BAA+B,OAAiD;AACpG,QAAM,eAAe,MAAM,yBAAyB,KAAK;AACzD,MAAI,aAAc;AAElB,QAAM,SAAS,MAAM;AAAA,IACnB,MAAM;AAAA,IACN;AAAA,IACA,EAAE,IAAI,MAAM,aAAa;AAAA,IACzB,CAAC;AAAA,IACD,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,EACzC;AAEA,MAAI,CAAC,OAAQ;AAEb,QAAM,gBAAgB,wBAAwB,MAAM,QAAQ;AAC5D,QAAM,iBAAiB,wBAAyB,OAAwC,QAAQ;AAChG,MAAI,CAAC,kBAAkB,mBAAmB,eAAe;AACvD,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,iBAAiB,CAAC;AAAA,EAC1D;AACF;AAEA,eAAe,yBAAyB,OAA8E;AACpH,MAAI,OAAO,MAAM,sBAAsB,UAAW,QAAO,MAAM;AAC/D,QAAM,MAAM,MAAM,aAAa,KAAK;AACpC,SAAO,IAAI;AACb;AAEA,eAAsB,4BAA4B,IAAmB,QAAkC;AACrG,QAAM,cAAc,MAAM,GAAG;AAAA,IAC3B;AAAA,IACA,EAAE,MAAM,QAAmB,cAAc,KAAK;AAAA,EAChD;AACA,MAAI,eAAgB,YAA2C,iBAAiB,KAAM,QAAO;AAC7F,QAAM,QAAQ,MAAM;AAAA,IAClB;AAAA,IACA;AAAA,IACA,EAAE,MAAM,OAAkB;AAAA,IAC1B,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,IACrB,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,EACzC;AACA,QAAM,WAAW,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,GAC9C,IAAI,CAAC,SAAS;AACb,UAAM,OAAQ,KAAqD;AACnE,QAAI,CAAC,KAAM,QAAO;AAClB,QAAI,OAAO,SAAS,SAAU,QAAO;AACrC,WAAO,KAAK,KAAK,OAAO,KAAK,EAAE,IAAI;AAAA,EACrC,CAAC,EACA,OAAO,CAAC,OAAqB,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC;AACvE,MAAI,CAAC,QAAQ,OAAQ,QAAO;AAC5B,QAAM,YAAY,MAAM,GAAG;AAAA,IACzB;AAAA,IACA,EAAE,MAAM,EAAE,KAAK,QAAQ,GAAc,cAAc,KAAK;AAAA,EAC1D;AACA,SAAO,CAAC,CAAC,aAAc,UAAyC,iBAAiB;AACnF;AAEA,eAAsB,4BAA4B,IAAmB,QAAkC;AACrG,QAAM,QAAQ,MAAM,GAAG;AAAA,IACrB;AAAA,IACA,EAAE,MAAM,QAAmB,cAAc,KAAK;AAAA,EAChD;AACA,SAAO,CAAC,CAAC,SAAU,MAAqC,iBAAiB;AAC3E;AAEA,eAAsB,sBAAsB,IAAmB,UAA+C;AAC5G,QAAM,MAAM,oBAAI,IAAY;AAC5B,QAAM,gBAAyC,EAAE,cAAc,KAAK;AACpE,MAAI,SAAU,eAAc,WAAW;AACvC,QAAM,WAAW,MAAM,GAAG,KAAK,SAAS,aAAqC;AAC7E,aAAW,OAAO,UAAU;AAC1B,UAAM,UAAW,IAAoD;AACrE,UAAM,SAAS,WAAW,OAAO,YAAY,WACzC,QAAQ,KACR;AACJ,QAAI,OAAQ,KAAI,IAAI,OAAO,MAAM,CAAC;AAAA,EACpC;AACA,QAAM,WAAW,MAAM,GAAG;AAAA,IACxB;AAAA,IACA,EAAE,cAAc,KAAK;AAAA,EACvB;AACA,QAAM,UAAU,SACb,IAAI,CAAC,QAAQ;AACZ,UAAM,UAAW,IAAoD;AACrE,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,OAAO,YAAY,SAAU,QAAO;AACxC,WAAO,QAAQ,KAAK,OAAO,QAAQ,EAAE,IAAI;AAAA,EAC3C,CAAC,EACA,OAAO,CAAC,OAAqB,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC;AACvE,MAAI,QAAQ,QAAQ;AAClB,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA,EAAE,MAAM,EAAE,KAAK,QAAQ,EAAa;AAAA,MACpC,CAAC;AAAA,MACD,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,IACzC;AACA,eAAW,QAAQ,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,GAAG;AACpD,YAAM,UAAW,KAAqD;AACtE,YAAM,SAAS,WAAW,OAAO,YAAY,WACzC,QAAQ,KACR;AACJ,UAAI,OAAQ,KAAI,IAAI,OAAO,MAAM,CAAC;AAAA,IACpC;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAe,aAAa,OAA6C;AACvE,QAAM,cAAc,wBAAwB,MAAM,WAAW;AAC7D,MAAI,CAAC,YAAa,OAAM,UAAU,yCAAyC;AAE3E,QAAM,MAAM,MAAM,MAAM,YAAY,QAAQ,aAAa;AAAA,IACvD,UAAU,wBAAwB,MAAM,QAAQ;AAAA,IAChD,gBAAgB,wBAAwB,MAAM,cAAc;AAAA,EAC9D,CAAC;AAED,SAAO;AAAA,IACL,cAAc,CAAC,CAAC,KAAK;AAAA,IACrB,UAAU,oBAAoB,KAAK,QAAQ;AAAA,IAC3C,eAAe,0BAA0B,KAAK,aAAa;AAAA,EAC7D;AACF;AAEA,eAAe,qBACb,IACA,YACA,UACiB;AACjB,QAAM,QAAgB,CAAC;AACvB,QAAM,eAAyB,CAAC;AAEhC,aAAW,SAAS,YAAY;AAC9B,UAAM,OAAO,MAAM,oBAAoB,IAAI,OAAO,QAAQ;AAC1D,QAAI,CAAC,MAAM;AACT,mBAAa,KAAK,KAAK;AAAA,IACzB,OAAO;AACL,YAAM,KAAK,IAAI;AAAA,IACjB;AAAA,EACF;AAEA,MAAI,aAAa,QAAQ;AACvB,UAAM,SAAS,aAAa,IAAI,CAAC,SAAS,IAAI,IAAI,GAAG,EAAE,KAAK,IAAI;AAChE,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,sBAAsB,MAAM,GAAG,CAAC;AAAA,EACxE;AAEA,SAAO;AACT;AAEA,eAAe,oBACb,IACA,OACA,UACsB;AACtB,QAAM,QAAiC,QAAQ,KAAK,KAAK,IACrD,EAAE,IAAI,OAAO,WAAW,KAAK,IAC7B,EAAE,MAAM,OAAO,WAAW,KAAK;AACnC,MAAI,SAAU,OAAM,WAAW;AAC/B,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,CAAC;AAAA,IACD,EAAE,UAAU,gBAAgB,KAAK;AAAA,EACnC;AACF;AAEA,SAAS,+BACP,UACA,WAKM;AACN,MAAI,UAAU,cAAc;AAC1B,UAAM,UAAU,yDAAyD;AAAA,EAC3E;AAEA,QAAM,yBAAyB,SAAS,SAAS,OAAO,CAAC,UAAU,UAAU,GAAG;AAChF,aAAW,WAAW,UAAU,UAAU;AACxC,QAAI,YAAY,KAAK;AACnB,YAAM,UAAU,6DAA6D;AAAA,IAC/E;AACA,QAAI,kBAAkB,OAAO,GAAG;AAC9B,UAAI,CAAC,WAAW,wBAAwB,OAAO,GAAG;AAChD,cAAM,UAAU,iCAAiC,OAAO,GAAG;AAAA,MAC7D;AACA;AAAA,IACF;AACA,QAAI,CAAC,WAAW,wBAAwB,OAAO,GAAG;AAChD,YAAM,UAAU,wBAAwB,OAAO,GAAG;AAAA,IACpD;AAAA,EACF;AAEA,MAAI,UAAU,kBAAkB,QAAW;AACzC,qCAAiC,SAAS,eAAe,UAAU,aAAa;AAAA,EAClF;AACF;AAEA,SAAS,iCACP,oBACA,wBACM;AACN,MAAI,uBAAuB,QAAQ,mBAAmB,SAAS,SAAS,EAAG;AAE3E,MAAI,2BAA2B,QAAQ,uBAAuB,SAAS,SAAS,GAAG;AACjF,UAAM,UAAU,gDAAgD;AAAA,EAClE;AAEA,aAAW,kBAAkB,wBAAwB;AACnD,QAAI,CAAC,mBAAmB,SAAS,cAAc,GAAG;AAChD,YAAM,UAAU,uDAAuD;AAAA,IACzE;AAAA,EACF;AACF;AAEA,SAAS,oBAAoB,QAA2B;AACtD,MAAI,CAAC,MAAM,QAAQ,MAAM,EAAG,QAAO,CAAC;AACpC,QAAM,QAAQ,oBAAI,IAAY;AAC9B,aAAW,SAAS,QAAQ;AAC1B,QAAI,OAAO,UAAU,SAAU;AAC/B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,QAAS;AACd,UAAM,IAAI,OAAO;AAAA,EACnB;AACA,SAAO,MAAM,KAAK,KAAK;AACzB;AAEA,SAAS,0BAA0B,QAAkC;AACnE,MAAI,WAAW,QAAQ,WAAW,OAAW,QAAO;AACpD,SAAO,oBAAoB,MAAM;AACnC;AAEA,SAAS,wBAAwB,OAA+B;AAC9D,SAAO,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,IAAI,MAAM,KAAK,IAAI;AAC/E;AAEA,SAAS,kBAAkB,SAA0B;AACnD,SAAO,QAAQ,SAAS,IAAI;AAC9B;AAEA,eAAe,mBAAmB,KAAa,UAAmC;AAChF,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,SAAO,UAAU,KAAK,QAAQ;AAChC;",
   "names": []
 }

package/dist/modules/auth/services/authService.js

@@ -110,25 +110,11 @@ class AuthService {
     await this.em.persist(row).flush();
     return { user, token: rawToken };
   }
-  async findUnconsumedPasswordReset(token) {
+  async confirmPasswordReset(token, newPassword) {
     const now = /* @__PURE__ */ new Date();
     const hashedToken = hashAuthToken(token);
     const row = await this.em.findOne(PasswordReset, { token: hashedToken });
-    if (!row) return null;
-    if (row.usedAt && row.usedAt <= now) return null;
-    if (row.expiresAt <= now) return null;
-    return row;
-  }
-  async isPasswordResetTokenValid(token) {
-    const row = await this.findUnconsumedPasswordReset(token);
-    if (!row) return false;
-    const user = await findOneWithDecryption(this.em, User, { id: row.user.id, deletedAt: null });
-    return user != null;
-  }
-  async confirmPasswordReset(token, newPassword) {
-    const now = /* @__PURE__ */ new Date();
-    const row = await this.findUnconsumedPasswordReset(token);
-    if (!row) return null;
+    if (!row || row.usedAt && row.usedAt <= now || row.expiresAt <= now) return null;
     const affected = await this.em.nativeUpdate(
       PasswordReset,
       { id: row.id, usedAt: null },

package/dist/modules/auth/services/authService.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/auth/services/authService.ts"],
-  "sourcesContent": ["import { EntityManager } from '@mikro-orm/postgresql'\nimport { compare, hash } from 'bcryptjs'\nimport { User, Role, UserRole, Session, PasswordReset } from '@open-mercato/core/modules/auth/data/entities'\nimport { emailHashLookupValues } from '@open-mercato/core/modules/auth/lib/emailHash'\nimport { generateAuthToken, hashAuthToken } from '@open-mercato/core/modules/auth/lib/tokenHash'\nimport { findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\n// A fixed, valid bcrypt hash (cost 10) of a throwaway value no real password\n// can match. verifyPassword compares against it whenever the user is missing or\n// has no password hash, so a failed login spends the same bcrypt CPU time\n// regardless of whether the account exists \u2014 closing the timing side channel\n// for account enumeration (issue #2242).\nconst TIMING_EQUALIZER_PASSWORD_HASH = '$2b$10$OcZrhmZpIzJOjkfwUrk7d.Nl0eHNzOvalBcBlt5Ran.4lj8R3HZg6'\n\nexport class AuthService {\n  constructor(private em: EntityManager) {}\n\n  async findUserByEmail(email: string) {\n    const emailHashes = emailHashLookupValues(email)\n    return findOneWithDecryption(this.em, User, {\n      deletedAt: null,\n      $or: [\n        { email },\n        { emailHash: { $in: emailHashes } },\n      ],\n    } as any)\n  }\n\n  async findUsersByEmail(email: string) {\n    const emailHashes = emailHashLookupValues(email)\n    return findWithDecryption(this.em, User, {\n      deletedAt: null,\n      $or: [\n        { email },\n        { emailHash: { $in: emailHashes } },\n      ],\n    } as any)\n  }\n\n  async findUserByEmailAndTenant(email: string, tenantId: string) {\n    const emailHashes = emailHashLookupValues(email)\n    return findOneWithDecryption(\n      this.em,\n      User,\n      {\n        tenantId,\n        deletedAt: null,\n        $or: [\n          { email },\n          { emailHash: { $in: emailHashes } },\n        ],\n      } as any,\n      undefined,\n      { tenantId },\n    )\n  }\n\n  async verifyPassword(user: User | null, password: string) {\n    const storedHash = user?.passwordHash ?? null\n    // Always run a bcrypt comparison \u2014 against a fixed dummy hash when the user\n    // is absent or has no password \u2014 so login latency does not reveal whether\n    // the account exists (timing-based enumeration, issue #2242).\n    const matched = await compare(password, storedHash ?? TIMING_EQUALIZER_PASSWORD_HASH)\n    return storedHash !== null && matched\n  }\n\n  async updateLastLoginAt(user: User) {\n    const now = new Date()\n    // Use native update to avoid flushing unrelated entities that might be pending in this EM\n    await this.em.nativeUpdate(User, { id: user.id }, { lastLoginAt: now })\n    user.lastLoginAt = now\n  }\n\n  async getUserRoles(user: User, tenantId?: string | null): Promise<string[]> {\n    const resolvedTenantId = tenantId ?? user.tenantId ?? null\n    if (!resolvedTenantId) return []\n    const links = await findWithDecryption(\n      this.em,\n      UserRole,\n      { user, deletedAt: null, role: { tenantId: resolvedTenantId, deletedAt: null } as any },\n      { populate: ['role'] },\n      { tenantId: resolvedTenantId, organizationId: user.organizationId ?? null },\n    )\n    // A populated `role` can still be null when the link points at a soft-deleted\n    // role (the Role soft-delete filter suppresses hydration), e.g. an admin link\n    // orphaned by a re-seed during interrupted-provisioning recovery. Dropping such\n    // links keeps role resolution from throwing on the login / session-refresh hot\n    // path, mirroring resolveCanonicalStaffAuthContext in lib/sessionIntegrity.ts.\n    return links\n      .map((l) => l.role)\n      .filter((role): role is Role => !!role)\n      .map((role) => role.name)\n      .filter((name): name is string => typeof name === 'string' && name.trim().length > 0)\n  }\n\n\n  async createSession(user: User, expiresAt: Date): Promise<{ session: Session; token: string }> {\n    const rawToken = generateAuthToken()\n    const tokenHash = hashAuthToken(rawToken)\n    const sess = this.em.create(Session as any, { user, token: tokenHash, expiresAt, createdAt: new Date() } as any)\n    await this.em.persist(sess).flush()\n    return { session: sess as Session, token: rawToken }\n  }\n\n  async deleteSessionByToken(token: string) {\n    const hashedToken = hashAuthToken(token)\n    await this.em.nativeDelete(Session, { token: hashedToken })\n  }\n\n  async deleteSessionById(sessionId: string) {\n    await this.em.nativeDelete(Session, { id: sessionId })\n  }\n\n  async findActiveSessionById(sessionId: string): Promise<Session | null> {\n    const session = await this.em.findOne(Session, { id: sessionId, deletedAt: null })\n    if (!session) return null\n    if (session.expiresAt.getTime() < Date.now()) return null\n    return session\n  }\n\n  async deleteAllUserSessions(userId: string) {\n    await this.em.nativeDelete(Session, { user: userId })\n  }\n\n  async refreshFromSessionToken(token: string) {\n    const now = new Date()\n    const hashedToken = hashAuthToken(token)\n    const sess = await this.em.findOne(Session, { token: hashedToken })\n    if (!sess || sess.expiresAt <= now) return null\n    const user = await findOneWithDecryption(this.em, User, { id: sess.user.id, deletedAt: null })\n    if (!user) return null\n    const roles = await this.getUserRoles(user, user.tenantId ?? null)\n    return { user, roles, session: sess }\n  }\n\n  async requestPasswordReset(email: string) {\n    const user = await this.findUserByEmail(email)\n    if (!user) return null\n    const rawToken = generateAuthToken()\n    const tokenHash = hashAuthToken(rawToken)\n    const expiresAt = new Date(Date.now() + 60 * 60 * 1000)\n    const row = this.em.create(PasswordReset as any, { user, token: tokenHash, expiresAt, createdAt: new Date() } as any)\n    await this.em.persist(row).flush()\n    return { user, token: rawToken }\n  }\n\n  private async findUnconsumedPasswordReset(token: string): Promise<PasswordReset | null> {\n    const now = new Date()\n    const hashedToken = hashAuthToken(token)\n    const row = await this.em.findOne(PasswordReset, { token: hashedToken })\n    if (!row) return null\n    if (row.usedAt && row.usedAt <= now) return null\n    if (row.expiresAt <= now) return null\n    return row\n  }\n\n  async isPasswordResetTokenValid(token: string): Promise<boolean> {\n    const row = await this.findUnconsumedPasswordReset(token)\n    if (!row) return false\n    const user = await findOneWithDecryption(this.em, User, { id: row.user.id, deletedAt: null })\n    return user != null\n  }\n\n  async confirmPasswordReset(token: string, newPassword: string): Promise<User | null> {\n    const now = new Date()\n    const row = await this.findUnconsumedPasswordReset(token)\n    if (!row) return null\n\n    // Atomic compare-and-set: only mark used if still unused \u2014 prevents token replay under concurrency\n    const affected = await this.em.nativeUpdate(\n      PasswordReset,\n      { id: row.id, usedAt: null },\n      { usedAt: now },\n    )\n    if (affected === 0) return null\n\n    const user = await findOneWithDecryption(this.em, User, { id: row.user.id, deletedAt: null })\n    if (!user) return null\n    user.passwordHash = await hash(newPassword, 10)\n    await this.em.flush()\n    await this.deleteAllUserSessions(String(user.id))\n    return user\n  }\n}\n"],
-  "mappings": "AACA,SAAS,SAAS,YAAY;AAC9B,SAAS,MAAY,UAAU,SAAS,qBAAqB;AAC7D,SAAS,6BAA6B;AACtC,SAAS,mBAAmB,qBAAqB;AACjD,SAAS,oBAAoB,6BAA6B;AAO1D,MAAM,iCAAiC;AAEhC,MAAM,YAAY;AAAA,EACvB,YAAoB,IAAmB;AAAnB;AAAA,EAAoB;AAAA,EAExC,MAAM,gBAAgB,OAAe;AACnC,UAAM,cAAc,sBAAsB,KAAK;AAC/C,WAAO,sBAAsB,KAAK,IAAI,MAAM;AAAA,MAC1C,WAAW;AAAA,MACX,KAAK;AAAA,QACH,EAAE,MAAM;AAAA,QACR,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE;AAAA,MACpC;AAAA,IACF,CAAQ;AAAA,EACV;AAAA,EAEA,MAAM,iBAAiB,OAAe;AACpC,UAAM,cAAc,sBAAsB,KAAK;AAC/C,WAAO,mBAAmB,KAAK,IAAI,MAAM;AAAA,MACvC,WAAW;AAAA,MACX,KAAK;AAAA,QACH,EAAE,MAAM;AAAA,QACR,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE;AAAA,MACpC;AAAA,IACF,CAAQ;AAAA,EACV;AAAA,EAEA,MAAM,yBAAyB,OAAe,UAAkB;AAC9D,UAAM,cAAc,sBAAsB,KAAK;AAC/C,WAAO;AAAA,MACL,KAAK;AAAA,MACL;AAAA,MACA;AAAA,QACE;AAAA,QACA,WAAW;AAAA,QACX,KAAK;AAAA,UACH,EAAE,MAAM;AAAA,UACR,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE;AAAA,QACpC;AAAA,MACF;AAAA,MACA;AAAA,MACA,EAAE,SAAS;AAAA,IACb;AAAA,EACF;AAAA,EAEA,MAAM,eAAe,MAAmB,UAAkB;AACxD,UAAM,aAAa,MAAM,gBAAgB;AAIzC,UAAM,UAAU,MAAM,QAAQ,UAAU,cAAc,8BAA8B;AACpF,WAAO,eAAe,QAAQ;AAAA,EAChC;AAAA,EAEA,MAAM,kBAAkB,MAAY;AAClC,UAAM,MAAM,oBAAI,KAAK;AAErB,UAAM,KAAK,GAAG,aAAa,MAAM,EAAE,IAAI,KAAK,GAAG,GAAG,EAAE,aAAa,IAAI,CAAC;AACtE,SAAK,cAAc;AAAA,EACrB;AAAA,EAEA,MAAM,aAAa,MAAY,UAA6C;AAC1E,UAAM,mBAAmB,YAAY,KAAK,YAAY;AACtD,QAAI,CAAC,iBAAkB,QAAO,CAAC;AAC/B,UAAM,QAAQ,MAAM;AAAA,MAClB,KAAK;AAAA,MACL;AAAA,MACA,EAAE,MAAM,WAAW,MAAM,MAAM,EAAE,UAAU,kBAAkB,WAAW,KAAK,EAAS;AAAA,MACtF,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,MACrB,EAAE,UAAU,kBAAkB,gBAAgB,KAAK,kBAAkB,KAAK;AAAA,IAC5E;AAMA,WAAO,MACJ,IAAI,CAAC,MAAM,EAAE,IAAI,EACjB,OAAO,CAAC,SAAuB,CAAC,CAAC,IAAI,EACrC,IAAI,CAAC,SAAS,KAAK,IAAI,EACvB,OAAO,CAAC,SAAyB,OAAO,SAAS,YAAY,KAAK,KAAK,EAAE,SAAS,CAAC;AAAA,EACxF;AAAA,EAGA,MAAM,cAAc,MAAY,WAA+D;AAC7F,UAAM,WAAW,kBAAkB;AACnC,UAAM,YAAY,cAAc,QAAQ;AACxC,UAAM,OAAO,KAAK,GAAG,OAAO,SAAgB,EAAE,MAAM,OAAO,WAAW,WAAW,WAAW,oBAAI,KAAK,EAAE,CAAQ;AAC/G,UAAM,KAAK,GAAG,QAAQ,IAAI,EAAE,MAAM;AAClC,WAAO,EAAE,SAAS,MAAiB,OAAO,SAAS;AAAA,EACrD;AAAA,EAEA,MAAM,qBAAqB,OAAe;AACxC,UAAM,cAAc,cAAc,KAAK;AACvC,UAAM,KAAK,GAAG,aAAa,SAAS,EAAE,OAAO,YAAY,CAAC;AAAA,EAC5D;AAAA,EAEA,MAAM,kBAAkB,WAAmB;AACzC,UAAM,KAAK,GAAG,aAAa,SAAS,EAAE,IAAI,UAAU,CAAC;AAAA,EACvD;AAAA,EAEA,MAAM,sBAAsB,WAA4C;AACtE,UAAM,UAAU,MAAM,KAAK,GAAG,QAAQ,SAAS,EAAE,IAAI,WAAW,WAAW,KAAK,CAAC;AACjF,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,QAAQ,UAAU,QAAQ,IAAI,KAAK,IAAI,EAAG,QAAO;AACrD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,sBAAsB,QAAgB;AAC1C,UAAM,KAAK,GAAG,aAAa,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,EACtD;AAAA,EAEA,MAAM,wBAAwB,OAAe;AAC3C,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,cAAc,cAAc,KAAK;AACvC,UAAM,OAAO,MAAM,KAAK,GAAG,QAAQ,SAAS,EAAE,OAAO,YAAY,CAAC;AAClE,QAAI,CAAC,QAAQ,KAAK,aAAa,IAAK,QAAO;AAC3C,UAAM,OAAO,MAAM,sBAAsB,KAAK,IAAI,MAAM,EAAE,IAAI,KAAK,KAAK,IAAI,WAAW,KAAK,CAAC;AAC7F,QAAI,CAAC,KAAM,QAAO;AAClB,UAAM,QAAQ,MAAM,KAAK,aAAa,MAAM,KAAK,YAAY,IAAI;AACjE,WAAO,EAAE,MAAM,OAAO,SAAS,KAAK;AAAA,EACtC;AAAA,EAEA,MAAM,qBAAqB,OAAe;AACxC,UAAM,OAAO,MAAM,KAAK,gBAAgB,KAAK;AAC7C,QAAI,CAAC,KAAM,QAAO;AAClB,UAAM,WAAW,kBAAkB;AACnC,UAAM,YAAY,cAAc,QAAQ;AACxC,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,GAAI;AACtD,UAAM,MAAM,KAAK,GAAG,OAAO,eAAsB,EAAE,MAAM,OAAO,WAAW,WAAW,WAAW,oBAAI,KAAK,EAAE,CAAQ;AACpH,UAAM,KAAK,GAAG,QAAQ,GAAG,EAAE,MAAM;AACjC,WAAO,EAAE,MAAM,OAAO,SAAS;AAAA,EACjC;AAAA,EAEA,MAAc,4BAA4B,OAA8C;AACtF,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,cAAc,cAAc,KAAK;AACvC,UAAM,MAAM,MAAM,KAAK,GAAG,QAAQ,eAAe,EAAE,OAAO,YAAY,CAAC;AACvE,QAAI,CAAC,IAAK,QAAO;AACjB,QAAI,IAAI,UAAU,IAAI,UAAU,IAAK,QAAO;AAC5C,QAAI,IAAI,aAAa,IAAK,QAAO;AACjC,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,0BAA0B,OAAiC;AAC/D,UAAM,MAAM,MAAM,KAAK,4BAA4B,KAAK;AACxD,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,OAAO,MAAM,sBAAsB,KAAK,IAAI,MAAM,EAAE,IAAI,IAAI,KAAK,IAAI,WAAW,KAAK,CAAC;AAC5F,WAAO,QAAQ;AAAA,EACjB;AAAA,EAEA,MAAM,qBAAqB,OAAe,aAA2C;AACnF,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,MAAM,MAAM,KAAK,4BAA4B,KAAK;AACxD,QAAI,CAAC,IAAK,QAAO;AAGjB,UAAM,WAAW,MAAM,KAAK,GAAG;AAAA,MAC7B;AAAA,MACA,EAAE,IAAI,IAAI,IAAI,QAAQ,KAAK;AAAA,MAC3B,EAAE,QAAQ,IAAI;AAAA,IAChB;AACA,QAAI,aAAa,EAAG,QAAO;AAE3B,UAAM,OAAO,MAAM,sBAAsB,KAAK,IAAI,MAAM,EAAE,IAAI,IAAI,KAAK,IAAI,WAAW,KAAK,CAAC;AAC5F,QAAI,CAAC,KAAM,QAAO;AAClB,SAAK,eAAe,MAAM,KAAK,aAAa,EAAE;AAC9C,UAAM,KAAK,GAAG,MAAM;AACpB,UAAM,KAAK,sBAAsB,OAAO,KAAK,EAAE,CAAC;AAChD,WAAO;AAAA,EACT;AACF;",
+  "sourcesContent": ["import { EntityManager } from '@mikro-orm/postgresql'\nimport { compare, hash } from 'bcryptjs'\nimport { User, Role, UserRole, Session, PasswordReset } from '@open-mercato/core/modules/auth/data/entities'\nimport { emailHashLookupValues } from '@open-mercato/core/modules/auth/lib/emailHash'\nimport { generateAuthToken, hashAuthToken } from '@open-mercato/core/modules/auth/lib/tokenHash'\nimport { findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\n// A fixed, valid bcrypt hash (cost 10) of a throwaway value no real password\n// can match. verifyPassword compares against it whenever the user is missing or\n// has no password hash, so a failed login spends the same bcrypt CPU time\n// regardless of whether the account exists \u2014 closing the timing side channel\n// for account enumeration (issue #2242).\nconst TIMING_EQUALIZER_PASSWORD_HASH = '$2b$10$OcZrhmZpIzJOjkfwUrk7d.Nl0eHNzOvalBcBlt5Ran.4lj8R3HZg6'\n\nexport class AuthService {\n  constructor(private em: EntityManager) {}\n\n  async findUserByEmail(email: string) {\n    const emailHashes = emailHashLookupValues(email)\n    return findOneWithDecryption(this.em, User, {\n      deletedAt: null,\n      $or: [\n        { email },\n        { emailHash: { $in: emailHashes } },\n      ],\n    } as any)\n  }\n\n  async findUsersByEmail(email: string) {\n    const emailHashes = emailHashLookupValues(email)\n    return findWithDecryption(this.em, User, {\n      deletedAt: null,\n      $or: [\n        { email },\n        { emailHash: { $in: emailHashes } },\n      ],\n    } as any)\n  }\n\n  async findUserByEmailAndTenant(email: string, tenantId: string) {\n    const emailHashes = emailHashLookupValues(email)\n    return findOneWithDecryption(\n      this.em,\n      User,\n      {\n        tenantId,\n        deletedAt: null,\n        $or: [\n          { email },\n          { emailHash: { $in: emailHashes } },\n        ],\n      } as any,\n      undefined,\n      { tenantId },\n    )\n  }\n\n  async verifyPassword(user: User | null, password: string) {\n    const storedHash = user?.passwordHash ?? null\n    // Always run a bcrypt comparison \u2014 against a fixed dummy hash when the user\n    // is absent or has no password \u2014 so login latency does not reveal whether\n    // the account exists (timing-based enumeration, issue #2242).\n    const matched = await compare(password, storedHash ?? TIMING_EQUALIZER_PASSWORD_HASH)\n    return storedHash !== null && matched\n  }\n\n  async updateLastLoginAt(user: User) {\n    const now = new Date()\n    // Use native update to avoid flushing unrelated entities that might be pending in this EM\n    await this.em.nativeUpdate(User, { id: user.id }, { lastLoginAt: now })\n    user.lastLoginAt = now\n  }\n\n  async getUserRoles(user: User, tenantId?: string | null): Promise<string[]> {\n    const resolvedTenantId = tenantId ?? user.tenantId ?? null\n    if (!resolvedTenantId) return []\n    const links = await findWithDecryption(\n      this.em,\n      UserRole,\n      { user, deletedAt: null, role: { tenantId: resolvedTenantId, deletedAt: null } as any },\n      { populate: ['role'] },\n      { tenantId: resolvedTenantId, organizationId: user.organizationId ?? null },\n    )\n    // A populated `role` can still be null when the link points at a soft-deleted\n    // role (the Role soft-delete filter suppresses hydration), e.g. an admin link\n    // orphaned by a re-seed during interrupted-provisioning recovery. Dropping such\n    // links keeps role resolution from throwing on the login / session-refresh hot\n    // path, mirroring resolveCanonicalStaffAuthContext in lib/sessionIntegrity.ts.\n    return links\n      .map((l) => l.role)\n      .filter((role): role is Role => !!role)\n      .map((role) => role.name)\n      .filter((name): name is string => typeof name === 'string' && name.trim().length > 0)\n  }\n\n\n  async createSession(user: User, expiresAt: Date): Promise<{ session: Session; token: string }> {\n    const rawToken = generateAuthToken()\n    const tokenHash = hashAuthToken(rawToken)\n    const sess = this.em.create(Session as any, { user, token: tokenHash, expiresAt, createdAt: new Date() } as any)\n    await this.em.persist(sess).flush()\n    return { session: sess as Session, token: rawToken }\n  }\n\n  async deleteSessionByToken(token: string) {\n    const hashedToken = hashAuthToken(token)\n    await this.em.nativeDelete(Session, { token: hashedToken })\n  }\n\n  async deleteSessionById(sessionId: string) {\n    await this.em.nativeDelete(Session, { id: sessionId })\n  }\n\n  async findActiveSessionById(sessionId: string): Promise<Session | null> {\n    const session = await this.em.findOne(Session, { id: sessionId, deletedAt: null })\n    if (!session) return null\n    if (session.expiresAt.getTime() < Date.now()) return null\n    return session\n  }\n\n  async deleteAllUserSessions(userId: string) {\n    await this.em.nativeDelete(Session, { user: userId })\n  }\n\n  async refreshFromSessionToken(token: string) {\n    const now = new Date()\n    const hashedToken = hashAuthToken(token)\n    const sess = await this.em.findOne(Session, { token: hashedToken })\n    if (!sess || sess.expiresAt <= now) return null\n    const user = await findOneWithDecryption(this.em, User, { id: sess.user.id, deletedAt: null })\n    if (!user) return null\n    const roles = await this.getUserRoles(user, user.tenantId ?? null)\n    return { user, roles, session: sess }\n  }\n\n  async requestPasswordReset(email: string) {\n    const user = await this.findUserByEmail(email)\n    if (!user) return null\n    const rawToken = generateAuthToken()\n    const tokenHash = hashAuthToken(rawToken)\n    const expiresAt = new Date(Date.now() + 60 * 60 * 1000)\n    const row = this.em.create(PasswordReset as any, { user, token: tokenHash, expiresAt, createdAt: new Date() } as any)\n    await this.em.persist(row).flush()\n    return { user, token: rawToken }\n  }\n\n  async confirmPasswordReset(token: string, newPassword: string): Promise<User | null> {\n    const now = new Date()\n    const hashedToken = hashAuthToken(token)\n    const row = await this.em.findOne(PasswordReset, { token: hashedToken })\n    if (!row || (row.usedAt && row.usedAt <= now) || row.expiresAt <= now) return null\n\n    // Atomic compare-and-set: only mark used if still unused \u2014 prevents token replay under concurrency\n    const affected = await this.em.nativeUpdate(\n      PasswordReset,\n      { id: row.id, usedAt: null },\n      { usedAt: now },\n    )\n    if (affected === 0) return null\n\n    const user = await findOneWithDecryption(this.em, User, { id: row.user.id, deletedAt: null })\n    if (!user) return null\n    user.passwordHash = await hash(newPassword, 10)\n    await this.em.flush()\n    await this.deleteAllUserSessions(String(user.id))\n    return user\n  }\n}\n"],
+  "mappings": "AACA,SAAS,SAAS,YAAY;AAC9B,SAAS,MAAY,UAAU,SAAS,qBAAqB;AAC7D,SAAS,6BAA6B;AACtC,SAAS,mBAAmB,qBAAqB;AACjD,SAAS,oBAAoB,6BAA6B;AAO1D,MAAM,iCAAiC;AAEhC,MAAM,YAAY;AAAA,EACvB,YAAoB,IAAmB;AAAnB;AAAA,EAAoB;AAAA,EAExC,MAAM,gBAAgB,OAAe;AACnC,UAAM,cAAc,sBAAsB,KAAK;AAC/C,WAAO,sBAAsB,KAAK,IAAI,MAAM;AAAA,MAC1C,WAAW;AAAA,MACX,KAAK;AAAA,QACH,EAAE,MAAM;AAAA,QACR,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE;AAAA,MACpC;AAAA,IACF,CAAQ;AAAA,EACV;AAAA,EAEA,MAAM,iBAAiB,OAAe;AACpC,UAAM,cAAc,sBAAsB,KAAK;AAC/C,WAAO,mBAAmB,KAAK,IAAI,MAAM;AAAA,MACvC,WAAW;AAAA,MACX,KAAK;AAAA,QACH,EAAE,MAAM;AAAA,QACR,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE;AAAA,MACpC;AAAA,IACF,CAAQ;AAAA,EACV;AAAA,EAEA,MAAM,yBAAyB,OAAe,UAAkB;AAC9D,UAAM,cAAc,sBAAsB,KAAK;AAC/C,WAAO;AAAA,MACL,KAAK;AAAA,MACL;AAAA,MACA;AAAA,QACE;AAAA,QACA,WAAW;AAAA,QACX,KAAK;AAAA,UACH,EAAE,MAAM;AAAA,UACR,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE;AAAA,QACpC;AAAA,MACF;AAAA,MACA;AAAA,MACA,EAAE,SAAS;AAAA,IACb;AAAA,EACF;AAAA,EAEA,MAAM,eAAe,MAAmB,UAAkB;AACxD,UAAM,aAAa,MAAM,gBAAgB;AAIzC,UAAM,UAAU,MAAM,QAAQ,UAAU,cAAc,8BAA8B;AACpF,WAAO,eAAe,QAAQ;AAAA,EAChC;AAAA,EAEA,MAAM,kBAAkB,MAAY;AAClC,UAAM,MAAM,oBAAI,KAAK;AAErB,UAAM,KAAK,GAAG,aAAa,MAAM,EAAE,IAAI,KAAK,GAAG,GAAG,EAAE,aAAa,IAAI,CAAC;AACtE,SAAK,cAAc;AAAA,EACrB;AAAA,EAEA,MAAM,aAAa,MAAY,UAA6C;AAC1E,UAAM,mBAAmB,YAAY,KAAK,YAAY;AACtD,QAAI,CAAC,iBAAkB,QAAO,CAAC;AAC/B,UAAM,QAAQ,MAAM;AAAA,MAClB,KAAK;AAAA,MACL;AAAA,MACA,EAAE,MAAM,WAAW,MAAM,MAAM,EAAE,UAAU,kBAAkB,WAAW,KAAK,EAAS;AAAA,MACtF,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,MACrB,EAAE,UAAU,kBAAkB,gBAAgB,KAAK,kBAAkB,KAAK;AAAA,IAC5E;AAMA,WAAO,MACJ,IAAI,CAAC,MAAM,EAAE,IAAI,EACjB,OAAO,CAAC,SAAuB,CAAC,CAAC,IAAI,EACrC,IAAI,CAAC,SAAS,KAAK,IAAI,EACvB,OAAO,CAAC,SAAyB,OAAO,SAAS,YAAY,KAAK,KAAK,EAAE,SAAS,CAAC;AAAA,EACxF;AAAA,EAGA,MAAM,cAAc,MAAY,WAA+D;AAC7F,UAAM,WAAW,kBAAkB;AACnC,UAAM,YAAY,cAAc,QAAQ;AACxC,UAAM,OAAO,KAAK,GAAG,OAAO,SAAgB,EAAE,MAAM,OAAO,WAAW,WAAW,WAAW,oBAAI,KAAK,EAAE,CAAQ;AAC/G,UAAM,KAAK,GAAG,QAAQ,IAAI,EAAE,MAAM;AAClC,WAAO,EAAE,SAAS,MAAiB,OAAO,SAAS;AAAA,EACrD;AAAA,EAEA,MAAM,qBAAqB,OAAe;AACxC,UAAM,cAAc,cAAc,KAAK;AACvC,UAAM,KAAK,GAAG,aAAa,SAAS,EAAE,OAAO,YAAY,CAAC;AAAA,EAC5D;AAAA,EAEA,MAAM,kBAAkB,WAAmB;AACzC,UAAM,KAAK,GAAG,aAAa,SAAS,EAAE,IAAI,UAAU,CAAC;AAAA,EACvD;AAAA,EAEA,MAAM,sBAAsB,WAA4C;AACtE,UAAM,UAAU,MAAM,KAAK,GAAG,QAAQ,SAAS,EAAE,IAAI,WAAW,WAAW,KAAK,CAAC;AACjF,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,QAAQ,UAAU,QAAQ,IAAI,KAAK,IAAI,EAAG,QAAO;AACrD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,sBAAsB,QAAgB;AAC1C,UAAM,KAAK,GAAG,aAAa,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,EACtD;AAAA,EAEA,MAAM,wBAAwB,OAAe;AAC3C,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,cAAc,cAAc,KAAK;AACvC,UAAM,OAAO,MAAM,KAAK,GAAG,QAAQ,SAAS,EAAE,OAAO,YAAY,CAAC;AAClE,QAAI,CAAC,QAAQ,KAAK,aAAa,IAAK,QAAO;AAC3C,UAAM,OAAO,MAAM,sBAAsB,KAAK,IAAI,MAAM,EAAE,IAAI,KAAK,KAAK,IAAI,WAAW,KAAK,CAAC;AAC7F,QAAI,CAAC,KAAM,QAAO;AAClB,UAAM,QAAQ,MAAM,KAAK,aAAa,MAAM,KAAK,YAAY,IAAI;AACjE,WAAO,EAAE,MAAM,OAAO,SAAS,KAAK;AAAA,EACtC;AAAA,EAEA,MAAM,qBAAqB,OAAe;AACxC,UAAM,OAAO,MAAM,KAAK,gBAAgB,KAAK;AAC7C,QAAI,CAAC,KAAM,QAAO;AAClB,UAAM,WAAW,kBAAkB;AACnC,UAAM,YAAY,cAAc,QAAQ;AACxC,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,GAAI;AACtD,UAAM,MAAM,KAAK,GAAG,OAAO,eAAsB,EAAE,MAAM,OAAO,WAAW,WAAW,WAAW,oBAAI,KAAK,EAAE,CAAQ;AACpH,UAAM,KAAK,GAAG,QAAQ,GAAG,EAAE,MAAM;AACjC,WAAO,EAAE,MAAM,OAAO,SAAS;AAAA,EACjC;AAAA,EAEA,MAAM,qBAAqB,OAAe,aAA2C;AACnF,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,cAAc,cAAc,KAAK;AACvC,UAAM,MAAM,MAAM,KAAK,GAAG,QAAQ,eAAe,EAAE,OAAO,YAAY,CAAC;AACvE,QAAI,CAAC,OAAQ,IAAI,UAAU,IAAI,UAAU,OAAQ,IAAI,aAAa,IAAK,QAAO;AAG9E,UAAM,WAAW,MAAM,KAAK,GAAG;AAAA,MAC7B;AAAA,MACA,EAAE,IAAI,IAAI,IAAI,QAAQ,KAAK;AAAA,MAC3B,EAAE,QAAQ,IAAI;AAAA,IAChB;AACA,QAAI,aAAa,EAAG,QAAO;AAE3B,UAAM,OAAO,MAAM,sBAAsB,KAAK,IAAI,MAAM,EAAE,IAAI,IAAI,KAAK,IAAI,WAAW,KAAK,CAAC;AAC5F,QAAI,CAAC,KAAM,QAAO;AAClB,SAAK,eAAe,MAAM,KAAK,aAAa,EAAE;AAC9C,UAAM,KAAK,GAAG,MAAM;AACpB,UAAM,KAAK,sBAAsB,OAAO,KAAK,EAAE,CAAC;AAChD,WAAO;AAAA,EACT;AACF;",
   "names": []
 }

package/dist/modules/auth/services/rbacService.js

@@ -8,7 +8,6 @@ import {
   resolveEffectiveFeatures
 } from "@open-mercato/shared/security/featurePolicy";
 import { filterGrantsByEnabledModules } from "@open-mercato/shared/security/enabledModulesRegistry";
-import { resolveRoleOrganizationScope, roleAclAllowsOrganization } from "./roleOrganizationScope.js";
 function isAclData(value) {
   if (typeof value !== "object" || value === null) return false;
   const record = value;
@@ -20,13 +19,9 @@ function isAclData(value) {
   }
   return true;
 }
-function isRestrictedRoleAcl(acl) {
-  return Array.isArray(acl.organizationsJson) && acl.organizationsJson.length > 0 && !acl.organizationsJson.includes("__all__");
-}
 class RbacService {
-  constructor(em, cache, organizationHierarchyService) {
+  constructor(em, cache) {
     this.em = em;
-    this.organizationHierarchyService = organizationHierarchyService;
     this.cacheTtlMs = 5 * 60 * 1e3;
     // 5 minutes default
     this.cache = null;
@@ -44,6 +39,12 @@ class RbacService {
   hasAllFeatures(required, granted) {
     return authorizeFeatures(required, { grantedFeatures: granted });
   }
+  roleAclAllowsOrganization(acl, organizationId) {
+    if (!organizationId) return true;
+    const organizations = Array.isArray(acl.organizationsJson) ? acl.organizationsJson : null;
+    if (!organizations || !organizations.length || organizations.includes("__all__")) return true;
+    return organizations.includes(organizationId);
+  }
   getCacheKey(userId, scope) {
     return `rbac:${userId}:${scope.tenantId || "null"}:${scope.organizationId || "null"}`;
   }
@@ -70,7 +71,6 @@ class RbacService {
     ];
     if (scope.tenantId) {
       tags.push(this.getTenantTag(scope.tenantId));
-      tags.push(buildOrgScopeTenantCacheTag(scope.tenantId));
     }
     if (scope.organizationId) {
       tags.push(this.getOrganizationTag(scope.organizationId));
@@ -167,8 +167,8 @@ class RbacService {
       this.globalSuperAdminCache.set(userId, false);
       return false;
     }
-    const roleSupers = await em.find(RoleAcl, { isSuperAdmin: true, role: { $in: roleIds } });
-    const result = roleSupers.some((roleAcl) => !!roleAcl.isSuperAdmin && !isRestrictedRoleAcl(roleAcl));
+    const roleSuper = await em.findOne(RoleAcl, { isSuperAdmin: true, role: { $in: roleIds } });
+    const result = !!(roleSuper && roleSuper.isSuperAdmin);
     this.globalSuperAdminCache.set(userId, result);
     return result;
   }
@@ -215,55 +215,28 @@ class RbacService {
       }
       const tenantId2 = scope.tenantId || key.tenantId || null;
       const roleIds2 = Array.isArray(key.rolesJson) ? key.rolesJson.filter(Boolean) : [];
-      const keyOrganizationId = typeof key.organizationId === "string" && key.organizationId.trim().length > 0 ? key.organizationId.trim() : null;
-      const evaluatedOrganizationId = scope.organizationId || keyOrganizationId;
       let isSuper2 = false;
       const features2 = [];
-      let roleOrganizations = [];
-      let hasApplicableRestrictedRole2 = false;
+      let organizations2 = key.organizationId ? [key.organizationId] : null;
       if (tenantId2 && roleIds2.length) {
-        const roleOrganizationScope = await resolveRoleOrganizationScope(
-          this.organizationHierarchyService,
-          tenantId2,
-          evaluatedOrganizationId
-        );
         const racls = await em2.find(RoleAcl, { tenantId: tenantId2, role: { $in: roleIds2 } });
         for (const acl of racls) {
-          if (roleAclAllowsOrganization(acl, roleOrganizationScope)) {
-            isSuper2 = isSuper2 || !!acl.isSuperAdmin;
-            if (Array.isArray(acl.featuresJson)) {
-              for (const f of acl.featuresJson) if (!features2.includes(f)) features2.push(f);
-            }
-            if (isRestrictedRoleAcl(acl)) hasApplicableRestrictedRole2 = true;
+          isSuper2 = isSuper2 || !!acl.isSuperAdmin;
+          if (Array.isArray(acl.featuresJson)) {
+            for (const f of acl.featuresJson) if (!features2.includes(f)) features2.push(f);
           }
-          if (roleOrganizations !== null) {
-            if (acl.organizationsJson == null || Array.isArray(acl.organizationsJson) && acl.organizationsJson.length === 0) {
-              roleOrganizations = null;
+          if (organizations2 !== null) {
+            if (acl.organizationsJson == null) {
+              organizations2 = null;
             } else if (Array.isArray(acl.organizationsJson) && acl.organizationsJson.includes("__all__")) {
-              roleOrganizations = null;
+              organizations2 = null;
             } else {
-              roleOrganizations = Array.from(/* @__PURE__ */ new Set([
-                ...roleOrganizations,
-                ...Array.isArray(acl.organizationsJson) ? acl.organizationsJson : []
-              ]));
+              organizations2 = Array.from(/* @__PURE__ */ new Set([...organizations2 || [], ...acl.organizationsJson]));
             }
           }
         }
-        if (roleOrganizations !== null && evaluatedOrganizationId && roleOrganizationScope !== null && roleOrganizationScope.size > 0 && hasApplicableRestrictedRole2 && !roleOrganizations.includes(evaluatedOrganizationId)) {
-          roleOrganizations.push(evaluatedOrganizationId);
-        }
       }
-      let organizations2 = roleOrganizations;
-      if (keyOrganizationId) {
-        const keyOrganizationScope = await resolveRoleOrganizationScope(
-          this.organizationHierarchyService,
-          tenantId2,
-          keyOrganizationId
-        );
-        organizations2 = roleOrganizations === null || roleOrganizations.some((organizationId) => keyOrganizationScope?.has(organizationId)) ? [keyOrganizationId] : [];
-      }
-      if (isSuper2 && organizations2 !== null && !features2.includes("*")) features2.push("*");
-      const result2 = { isSuperAdmin: isSuper2 && organizations2 === null, features: features2, organizations: organizations2 };
+      const result2 = { isSuperAdmin: isSuper2, features: features2, organizations: organizations2 };
       await this.setCache(cacheKey, result2, userId, scope);
       return result2;
     }
@@ -303,22 +276,13 @@ class RbacService {
     let isSuper = false;
     const features = [];
     let organizations = [];
-    let hasApplicableRestrictedRole = false;
     if (roleIds.length) {
-      const roleOrganizationScope = await resolveRoleOrganizationScope(
-        this.organizationHierarchyService,
-        tenantId,
-        scope.organizationId
-      );
       const racls = await em.find(RoleAcl, { tenantId, role: { $in: roleIds } }, {});
       const roleAcls = Array.isArray(racls) ? racls : [];
       for (const r of roleAcls) {
-        if (roleAclAllowsOrganization(r, roleOrganizationScope)) {
-          isSuper = isSuper || !!r.isSuperAdmin;
-          if (Array.isArray(r.featuresJson)) {
-            for (const f of r.featuresJson) if (!features.includes(f)) features.push(f);
-          }
-          if (isRestrictedRoleAcl(r)) hasApplicableRestrictedRole = true;
+        isSuper = isSuper || !!r.isSuperAdmin;
+        if (Array.isArray(r.featuresJson)) {
+          for (const f of r.featuresJson) if (!features.includes(f)) features.push(f);
         }
         if (organizations !== null) {
           if (r.organizationsJson == null) organizations = null;
@@ -326,9 +290,6 @@ class RbacService {
           else organizations = Array.from(/* @__PURE__ */ new Set([...organizations || [], ...r.organizationsJson]));
         }
       }
-      if (organizations !== null && scope.organizationId && roleOrganizationScope !== null && roleOrganizationScope.size > 0 && hasApplicableRestrictedRole && !organizations.includes(scope.organizationId)) {
-        organizations.push(scope.organizationId);
-      }
     }
     if (organizations && orgId && !organizations.includes(orgId) && !organizations.includes("__all__")) {
     }
@@ -345,15 +306,11 @@ class RbacService {
   async tenantHasFeature(tenantId, feature, opts) {
     if (!tenantId || !feature) return false;
     const em = this.em.fork();
-    const roleOrganizationScope = await resolveRoleOrganizationScope(
-      this.organizationHierarchyService,
-      tenantId,
-      opts?.organizationId
-    );
     const roleAcls = await em.find(RoleAcl, { tenantId, deletedAt: null }, {});
     const list = Array.isArray(roleAcls) ? roleAcls : [];
+    const organizationId = opts?.organizationId ?? null;
     for (const acl of list) {
-      if (!roleAclAllowsOrganization(acl, roleOrganizationScope)) continue;
+      if (!this.roleAclAllowsOrganization(acl, organizationId)) continue;
       const grants = Array.isArray(acl.featuresJson) ? acl.featuresJson : [];
       if (authorizeFeatures([feature], {
         grantedFeatures: grants,