@open-mercato/core 0.6.8-develop.7100.1.fbf66fca35 → 0.7.0

package/dist/modules/auth/commands/acl.js

@@ -1,254 +0,0 @@
-import { registerCommand } from "@open-mercato/shared/lib/commands";
-import { snapshotsEqual } from "@open-mercato/shared/lib/commands/helpers";
-import { withAtomicFlush } from "@open-mercato/shared/lib/commands/flush";
-import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
-import { createLogger } from "@open-mercato/shared/lib/logger";
-import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
-import { Role, RoleAcl, User, UserAcl } from "@open-mercato/core/modules/auth/data/entities";
-const logger = createLogger("auth").child({ component: "acl-commands" });
-const EMPTY_ACL_SNAPSHOT = {
-  isSuperAdmin: false,
-  features: [],
-  organizations: null
-};
-function compareIdentifiers(left, right) {
-  if (left === right) return 0;
-  return left < right ? -1 : 1;
-}
-function toSortedList(values) {
-  if (!Array.isArray(values)) return [];
-  return [...values].filter((value) => typeof value === "string").sort(compareIdentifiers);
-}
-function captureAclSnapshot(acl) {
-  if (!acl) return { ...EMPTY_ACL_SNAPSHOT };
-  return {
-    isSuperAdmin: Boolean(acl.isSuperAdmin),
-    features: toSortedList(acl.featuresJson),
-    organizations: Array.isArray(acl.organizationsJson) ? toSortedList(acl.organizationsJson) : null
-  };
-}
-function holdsGrants(snapshot) {
-  return snapshot.isSuperAdmin || snapshot.features.length > 0;
-}
-function resolveEffect(before, after) {
-  if (!holdsGrants(before) && holdsGrants(after)) return "granted";
-  if (holdsGrants(before) && !holdsGrants(after)) return "revoked";
-  return "changed";
-}
-function resolveEm(ctx) {
-  return ctx.container.resolve("em");
-}
-function resolveOrganizationId(ctx, tenantId) {
-  if ((ctx.auth?.tenantId ?? null) !== tenantId) return null;
-  return ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null;
-}
-async function deleteCacheTags(ctx, tags) {
-  let cache;
-  try {
-    cache = ctx.container.resolve("cache");
-  } catch (err) {
-    logger.debug("No cache registered for ACL tag invalidation", { err, tags });
-    return;
-  }
-  if (!cache?.deleteByTags) return;
-  await cache.deleteByTags(tags);
-}
-const AUTH_ROLE_ACL_UPDATE_COMMAND_ID = "auth.role-acl.update";
-const AUTH_USER_ACL_UPDATE_COMMAND_ID = "auth.user-acl.update";
-async function loadTargetSafely(config, input, ctx) {
-  try {
-    return await config.loadTarget(resolveEm(ctx).fork(), input, ctx);
-  } catch (err) {
-    logger.warn("Could not resolve the ACL target for the audit entry", {
-      err,
-      commandId: config.id,
-      resourceId: config.resourceId(input),
-      tenantId: input.tenantId
-    });
-    return null;
-  }
-}
-function buildAuditContext(params) {
-  const context = {};
-  if (params.target) context.target = params.target;
-  if (params.effect) context.effect = params.effect;
-  if (params.sanitizedRequest) context.sanitizedRequest = params.sanitizedRequest;
-  return Object.keys(context).length ? context : null;
-}
-function createAclUpdateCommand(config) {
-  return {
-    id: config.id,
-    // See "Auth ACL Commands — Undo Policy" at top of file.
-    isUndoable: false,
-    async prepare(input, ctx) {
-      const existing = await config.loadAcl(resolveEm(ctx).fork(), input);
-      return { before: captureAclSnapshot(existing) };
-    },
-    async execute(input, ctx) {
-      const em = resolveEm(ctx);
-      const existing = await config.loadAcl(em, input);
-      await config.persist({ em, input, existing });
-      try {
-        await config.invalidate({ ctx, input });
-      } catch (err) {
-        logger.error("ACL cache invalidation failed after a committed permission change", {
-          err,
-          commandId: config.id,
-          resourceId: config.resourceId(input),
-          tenantId: input.tenantId
-        });
-      }
-      return {
-        resourceId: config.resourceId(input),
-        tenantId: input.tenantId,
-        organizationId: resolveOrganizationId(ctx, input.tenantId)
-      };
-    },
-    captureAfter: async (input, _result, ctx) => {
-      const persisted = await config.loadAcl(resolveEm(ctx).fork(), input);
-      if (persisted) return captureAclSnapshot(persisted);
-      return config.snapshotWhenAbsent(input);
-    },
-    buildLog: async ({ input, result, ctx, snapshots }) => {
-      const before = snapshots.before ?? null;
-      const after = snapshots.after ?? null;
-      const changed = !before || !after || !snapshotsEqual(before, after);
-      const sanitizedRequest = config.sanitizedRequest?.(input) ?? null;
-      if (!changed && !sanitizedRequest) return { skipLog: true };
-      const { translate } = await resolveTranslations();
-      const target = await loadTargetSafely(config, input, ctx);
-      return {
-        actionLabel: translate(config.labelKey, config.labelFallback),
-        resourceKind: config.resourceKind,
-        resourceId: result.resourceId,
-        tenantId: result.tenantId,
-        organizationId: result.organizationId,
-        snapshotBefore: before,
-        snapshotAfter: after,
-        context: buildAuditContext({
-          target,
-          // A sanitized-only entry is written *because* nothing changed, so
-          // labelling it would have the trail assert a permission change that
-          // never happened.
-          effect: changed && before && after ? resolveEffect(before, after) : null,
-          sanitizedRequest
-        })
-      };
-    }
-  };
-}
-const updateRoleAclCommand = createAclUpdateCommand({
-  id: AUTH_ROLE_ACL_UPDATE_COMMAND_ID,
-  resourceKind: "auth.role_acl",
-  labelKey: "auth.audit.roleAcl.update",
-  labelFallback: "Change role permissions",
-  resourceId: (input) => input.roleId,
-  loadAcl: (em, input) => em.findOne(RoleAcl, { role: input.roleId, tenantId: input.tenantId }),
-  persist: async ({ em, input, existing }) => {
-    const acl = existing ?? em.create(RoleAcl, {
-      role: em.getReference(Role, input.roleId),
-      tenantId: input.tenantId,
-      createdAt: /* @__PURE__ */ new Date(),
-      isSuperAdmin: false
-    });
-    await withAtomicFlush(
-      em,
-      [
-        () => {
-          acl.organizationsJson = input.organizations;
-          acl.isSuperAdmin = input.isSuperAdmin;
-          acl.featuresJson = input.features;
-          em.persist(acl);
-        }
-      ],
-      { transaction: true, label: AUTH_ROLE_ACL_UPDATE_COMMAND_ID }
-    );
-  },
-  invalidate: async ({ ctx, input }) => {
-    const rbacService = ctx.container.resolve("rbacService");
-    await rbacService.invalidateTenantCache(input.tenantId);
-    await deleteCacheTags(ctx, [`rbac:tenant:${input.tenantId}`]);
-  },
-  snapshotWhenAbsent: () => null,
-  // Looked up by id alone: the entry already names this role through
-  // `resource_id`, and a tenant predicate would only blank the label when a
-  // super admin edits a role from outside the tenant scope they are writing in.
-  loadTarget: async (em, input) => {
-    const role = await em.findOne(Role, { id: input.roleId });
-    if (!role) return null;
-    return { kind: "role", id: input.roleId, name: role.name ?? null };
-  }
-});
-const updateUserAclCommand = createAclUpdateCommand({
-  id: AUTH_USER_ACL_UPDATE_COMMAND_ID,
-  resourceKind: "auth.user_acl",
-  labelKey: "auth.audit.userAcl.update",
-  labelFallback: "Change user permissions",
-  resourceId: (input) => input.userId,
-  loadAcl: (em, input) => em.findOne(UserAcl, { user: input.userId, tenantId: input.tenantId }),
-  persist: async ({ em, input, existing }) => {
-    if (input.clear) {
-      if (!existing) return;
-      const aclToRemove = existing;
-      await withAtomicFlush(
-        em,
-        [
-          () => {
-            em.remove(aclToRemove);
-          }
-        ],
-        { transaction: true, label: AUTH_USER_ACL_UPDATE_COMMAND_ID }
-      );
-      return;
-    }
-    const acl = existing ?? em.create(UserAcl, {
-      user: em.getReference(User, input.userId),
-      tenantId: input.tenantId,
-      createdAt: /* @__PURE__ */ new Date(),
-      isSuperAdmin: false
-    });
-    await withAtomicFlush(
-      em,
-      [
-        () => {
-          acl.isSuperAdmin = input.isSuperAdmin;
-          acl.featuresJson = input.features;
-          acl.organizationsJson = input.organizations;
-          em.persist(acl);
-        }
-      ],
-      { transaction: true, label: AUTH_USER_ACL_UPDATE_COMMAND_ID }
-    );
-  },
-  invalidate: async ({ ctx, input }) => {
-    const rbacService = ctx.container.resolve("rbacService");
-    await rbacService.invalidateUserCache(input.userId);
-    await deleteCacheTags(ctx, [`rbac:user:${input.userId}`]);
-  },
-  // Clearing removes the row, so an absent row is the real post-state here.
-  snapshotWhenAbsent: (input) => input.clear ? { ...EMPTY_ACL_SNAPSHOT } : null,
-  // `userId` arrives in the request body and `auth:user` carries encrypted
-  // personal data, so the lookup is tenant-scoped: an id belonging to another
-  // tenant must not be decrypted under this scope and stamped into this
-  // tenant's trail. A global account (`users.tenant_id` is nullable) still
-  // resolves, mirroring how the role route widens its own lookup.
-  loadTarget: async (em, input, ctx) => {
-    const user = await findOneWithDecryption(
-      em,
-      User,
-      { id: input.userId, $or: [{ tenantId: input.tenantId }, { tenantId: null }] },
-      {},
-      { tenantId: input.tenantId, organizationId: ctx.auth?.orgId ?? null }
-    );
-    if (!user) return null;
-    return { kind: "user", id: input.userId, email: user.email ?? null, name: user.name ?? null };
-  },
-  sanitizedRequest: (input) => input.requested ?? null
-});
-registerCommand(updateRoleAclCommand);
-registerCommand(updateUserAclCommand);
-export {
-  AUTH_ROLE_ACL_UPDATE_COMMAND_ID,
-  AUTH_USER_ACL_UPDATE_COMMAND_ID
-};
-//# sourceMappingURL=acl.js.map

package/dist/modules/auth/commands/acl.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../src/modules/auth/commands/acl.ts"],
-  "sourcesContent": ["// =============================================================================\n// Auth ACL Commands \u2014 Undo Policy\n// =============================================================================\n//\n// Neither command in this file defines `undo` or `redo`, so the command bus\n// never mints an undo token for them: `CommandBus.isUndoable()` requires a\n// handler-provided `undo`. The explicit `isUndoable: false` below is executable\n// documentation of that intent, not the mechanism \u2014 the guarantee comes from\n// the absence of the handlers, and the unit tests pin both.\n//\n// The policy is deliberate even though an ACL grant is trivially reversible.\n// The undo and redo endpoints are gated on `audit_logs.undo_self` /\n// `audit_logs.undo_tenant` (and their redo counterparts), not on\n// `auth.acl.manage`. `audit_logs.undo_self` is a default `employee` grant and\n// `audit_logs.undo_tenant` reaches every `admin` through `audit_logs.*`, so an\n// undoable ACL command would let a caller revert or replay someone else's\n// permission change without ever holding the feature that authorizes editing\n// permissions.\n//\n// Reversal stays available to the callers who are actually authorized for it:\n// re-submitting the ACL form, gated on `auth.acl.manage` and guarded by\n// `assertActorCanGrantAcl`. The audit log still captures the full before/after\n// via `buildLog`, so any such correction is itself fully traceable.\n// =============================================================================\nimport type { CommandHandler, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { registerCommand } from '@open-mercato/shared/lib/commands'\nimport { snapshotsEqual } from '@open-mercato/shared/lib/commands/helpers'\nimport { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'\nimport { Role, RoleAcl, User, UserAcl } from '@open-mercato/core/modules/auth/data/entities'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\n\nconst logger = createLogger('auth').child({ component: 'acl-commands' })\n\ntype TaggableCache = { deleteByTags?: (tags: string[]) => Promise<void> | void }\n\n/** Structural view of the fields both `RoleAcl` and `UserAcl` expose. */\ntype AclRecord = {\n  isSuperAdmin: boolean\n  featuresJson?: string[] | null\n  organizationsJson?: string[] | null\n}\n\n/**\n * Audit snapshot of a single ACL row.\n *\n * `features` and `organizations` are grant *sets*, but `features_json` /\n * `organizations_json` preserve the client's insertion order. The command bus\n * derives `changes` from these snapshots with a deep equality check that is\n * order-sensitive for arrays, so an unsorted snapshot would report a spurious\n * `features` change every time an admin re-saves an unmodified form. Sorting\n * here makes the derived diff reflect real grant changes only.\n *\n * `organizations: null` (visible in every organization) is deliberately\n * distinct from `[]` (visible in none).\n */\ntype AclSnapshot = {\n  isSuperAdmin: boolean\n  features: string[]\n  organizations: string[] | null\n}\n\nconst EMPTY_ACL_SNAPSHOT: AclSnapshot = {\n  isSuperAdmin: false,\n  features: [],\n  organizations: null,\n}\n\n/**\n * Identity of the role or user an entry is about.\n *\n * `action_logs` keeps only `resource_id`, so an entry degrades to a bare UUID\n * the moment the role or account is deleted \u2014 exactly when the trail matters\n * most. This rides in `context` rather than in the snapshots because the\n * command bus derives `changes` from the two snapshots with a deep comparison:\n * a target renamed between two ACL edits would otherwise be reported as a\n * permission change, and the no-op guard below would stop recognising an\n * unchanged ACL.\n */\ntype AclTarget =\n  | { kind: 'user'; id: string; email: string | null; name: string | null }\n  | { kind: 'role'; id: string; name: string | null }\n\n/**\n * What the caller asked for when the route trimmed the request instead of\n * refusing it.\n *\n * `sanitizeTenantFeatures` drops restricted grants silently, so such a request\n * leaves `before` and `after` identical and is indistinguishable from a no-op \u2014\n * which `buildLog` skips. Recording the original request both keeps the attempt\n * visible and exempts the entry from that guard.\n *\n * Features are the only axis carried, because they are the only one the route\n * can trim: a super-admin request is honoured or refused outright, and\n * organizations are never sanitized. Recording either would put a value next to\n * the snapshots that always matches them, inviting a reader to diff the two and\n * conclude a grant was refused.\n */\ntype SanitizedAclRequest = {\n  features: string[]\n}\n\n/** How the change reads at a glance, without diffing two grant lists. */\ntype AclChangeEffect = 'granted' | 'changed' | 'revoked'\n\n/**\n * Codepoint ordering rather than `localeCompare`: these snapshots are persisted\n * audit records, so the ordering must not shift with the runtime's default\n * locale. Feature and organization ids are opaque ASCII identifiers that are\n * never shown in this order to a user.\n *\n * The default comparator would coerce and compare the same way today, but\n * omitting one is banned repo-wide (`explicit-sort-comparators.test.ts`,\n * #3620): the ordering must be stated rather than inherited, so it cannot\n * silently change meaning if a call site ever drifts to non-strings. This is\n * the canonical-key form that audit prescribes.\n */\nfunction compareIdentifiers(left: string, right: string): number {\n  if (left === right) return 0\n  return left < right ? -1 : 1\n}\n\nfunction toSortedList(values: unknown): string[] {\n  if (!Array.isArray(values)) return []\n  return [...values].filter((value): value is string => typeof value === 'string').sort(compareIdentifiers)\n}\n\nfunction captureAclSnapshot(acl: AclRecord | null | undefined): AclSnapshot {\n  if (!acl) return { ...EMPTY_ACL_SNAPSHOT }\n  return {\n    isSuperAdmin: Boolean(acl.isSuperAdmin),\n    features: toSortedList(acl.featuresJson),\n    organizations: Array.isArray(acl.organizationsJson) ? toSortedList(acl.organizationsJson) : null,\n  }\n}\n\nfunction holdsGrants(snapshot: AclSnapshot): boolean {\n  return snapshot.isSuperAdmin || snapshot.features.length > 0\n}\n\nfunction resolveEffect(before: AclSnapshot, after: AclSnapshot): AclChangeEffect {\n  if (!holdsGrants(before) && holdsGrants(after)) return 'granted'\n  if (holdsGrants(before) && !holdsGrants(after)) return 'revoked'\n  return 'changed'\n}\n\nfunction resolveEm(ctx: CommandRuntimeContext): EntityManager {\n  return ctx.container.resolve('em') as EntityManager\n}\n\n/**\n * The log row's organization must belong to the same tenant as the row itself.\n *\n * A super admin may edit a role in a tenant other than their own, and\n * `ActionLogService.buildListQuery` filters with strict equality\n * (`organization_id = ?`, applied only when the reader supplies one). Stamping\n * the actor's organization onto a row scoped to a different tenant produces a\n * (tenant B, organization from tenant A) pair that no reader can ever match, so\n * the cross-tenant permission change \u2014 exactly the record worth keeping \u2014\n * becomes invisible. `null` is the honest value there: it still reaches\n * tenant-scoped readers whose organization filter is unset.\n */\nfunction resolveOrganizationId(ctx: CommandRuntimeContext, tenantId: string): string | null {\n  if ((ctx.auth?.tenantId ?? null) !== tenantId) return null\n  return ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null\n}\n\n/**\n * A runtime with no cache registered (CLI, workers, tests) is a configuration,\n * not a failure, so resolution is guarded here. An adapter that *is* wired and\n * then throws is a failure, and it propagates to the single error-level guard\n * in `execute` \u2014 the same one that covers the `rbacService` half of this\n * invalidation. Reporting one half at `debug` and the other at `error` would\n * hide a nav cache still serving revoked grants.\n */\nasync function deleteCacheTags(ctx: CommandRuntimeContext, tags: string[]): Promise<void> {\n  let cache: TaggableCache | undefined\n  try {\n    cache = ctx.container.resolve('cache') as TaggableCache | undefined\n  } catch (err) {\n    logger.debug('No cache registered for ACL tag invalidation', { err, tags })\n    return\n  }\n  if (!cache?.deleteByTags) return\n  await cache.deleteByTags(tags)\n}\n\ntype AclCommandValues = {\n  isSuperAdmin: boolean\n  features: string[]\n  organizations: string[] | null\n}\n\ntype AclCommandInput = AclCommandValues & { tenantId: string }\n\nexport type RoleAclUpdateInput = AclCommandInput & {\n  roleId: string\n}\n\nexport type UserAclUpdateInput = AclCommandInput & {\n  userId: string\n  /** Mirrors the route's `!hasCustomAcl`: drop the override row instead of upserting it. */\n  clear: boolean\n  /** Set by the route only when it wrote less than the caller asked for. */\n  requested?: SanitizedAclRequest | null\n}\n\nexport type AclUpdateResult = {\n  resourceId: string\n  tenantId: string\n  organizationId: string | null\n}\n\nexport const AUTH_ROLE_ACL_UPDATE_COMMAND_ID = 'auth.role-acl.update'\nexport const AUTH_USER_ACL_UPDATE_COMMAND_ID = 'auth.user-acl.update'\n\ntype AclCommandConfig<TInput extends AclCommandInput> = {\n  id: string\n  resourceKind: string\n  labelKey: string\n  labelFallback: string\n  resourceId: (input: TInput) => string\n  loadAcl: (em: EntityManager, input: TInput) => Promise<AclRecord | null>\n  persist: (params: { em: EntityManager; input: TInput; existing: AclRecord | null }) => Promise<void>\n  invalidate: (params: { ctx: CommandRuntimeContext; input: TInput }) => Promise<void>\n  /**\n   * Post-state when the row is absent after the write. Only the user command's\n   * clear path legitimately removes the row; anywhere else a missing row means\n   * the re-read failed, which must be logged as \"unknown\" rather than guessed.\n   */\n  snapshotWhenAbsent: (input: TInput) => AclSnapshot | null\n  /** Human-readable identity of the target; `null` when it cannot be resolved. */\n  loadTarget: (em: EntityManager, input: TInput, ctx: CommandRuntimeContext) => Promise<AclTarget | null>\n  /** Only the user route sanitizes, so only it can report a trimmed request. */\n  sanitizedRequest?: (input: TInput) => SanitizedAclRequest | null\n}\n\n/**\n * Enrichment must never cost the entry.\n *\n * The bus persists the log after `execute` has already committed the permission\n * change, so a throw from the target lookup would leave the write recorded\n * nowhere \u2014 the same \"committed but unaudited\" hole the cache-invalidation\n * guard in `execute` closes. A missing label is a far smaller loss.\n */\nasync function loadTargetSafely<TInput extends AclCommandInput>(\n  config: AclCommandConfig<TInput>,\n  input: TInput,\n  ctx: CommandRuntimeContext,\n): Promise<AclTarget | null> {\n  try {\n    return await config.loadTarget(resolveEm(ctx).fork(), input, ctx)\n  } catch (err) {\n    logger.warn('Could not resolve the ACL target for the audit entry', {\n      err,\n      commandId: config.id,\n      resourceId: config.resourceId(input),\n      tenantId: input.tenantId,\n    })\n    return null\n  }\n}\n\nfunction buildAuditContext(params: {\n  target: AclTarget | null\n  effect: AclChangeEffect | null\n  sanitizedRequest: SanitizedAclRequest | null\n}): Record<string, unknown> | null {\n  const context: Record<string, unknown> = {}\n  if (params.target) context.target = params.target\n  if (params.effect) context.effect = params.effect\n  if (params.sanitizedRequest) context.sanitizedRequest = params.sanitizedRequest\n  return Object.keys(context).length ? context : null\n}\n\n/**\n * Both ACL commands differ only in entity, lookup key, cache invalidation and\n * labels \u2014 `prepare`, `captureAfter` and `buildLog` are otherwise identical.\n * Sharing them here keeps the two audit-entry shapes from drifting apart.\n */\nfunction createAclUpdateCommand<TInput extends AclCommandInput>(\n  config: AclCommandConfig<TInput>,\n): CommandHandler<TInput, AclUpdateResult> {\n  return {\n    id: config.id,\n    // See \"Auth ACL Commands \u2014 Undo Policy\" at top of file.\n    isUndoable: false,\n    async prepare(input, ctx) {\n      const existing = await config.loadAcl(resolveEm(ctx).fork(), input)\n      return { before: captureAclSnapshot(existing) }\n    },\n    async execute(input, ctx) {\n      const em = resolveEm(ctx)\n      const existing = await config.loadAcl(em, input)\n      await config.persist({ em, input, existing })\n      // Cache invalidation runs only after the write commits, never inside the\n      // atomic flush \u2014 and must never propagate. The command bus persists the\n      // action log *after* `execute` returns, so a throw here would commit the\n      // permission change and then suppress its audit entry: precisely the\n      // \"committed but unaudited\" hole these commands exist to close, and it\n      // would open exactly when infrastructure is already degraded.\n      // `RbacService.deleteCacheByTags` awaits the cache adapter without a\n      // guard of its own, so an outage does reach us here.\n      //\n      // The resulting staleness (a revoked grant served from cache until its\n      // TTL) is not introduced by swallowing \u2014 it happens either way once the\n      // adapter is down. Logging at error level keeps it alarmable instead of\n      // trading a recorded change for an HTTP 500 that misreports a write which\n      // did commit.\n      try {\n        await config.invalidate({ ctx, input })\n      } catch (err) {\n        logger.error('ACL cache invalidation failed after a committed permission change', {\n          err,\n          commandId: config.id,\n          resourceId: config.resourceId(input),\n          tenantId: input.tenantId,\n        })\n      }\n      return {\n        resourceId: config.resourceId(input),\n        tenantId: input.tenantId,\n        organizationId: resolveOrganizationId(ctx, input.tenantId),\n      }\n    },\n    captureAfter: async (input, _result, ctx) => {\n      // Read the committed row back rather than echoing the request, so a grant\n      // the route sanitized away can never be logged as if it had been applied.\n      const persisted = await config.loadAcl(resolveEm(ctx).fork(), input)\n      if (persisted) return captureAclSnapshot(persisted)\n      return config.snapshotWhenAbsent(input)\n    },\n    buildLog: async ({ input, result, ctx, snapshots }) => {\n      const before = (snapshots.before as AclSnapshot | undefined) ?? null\n      const after = (snapshots.after as AclSnapshot | undefined) ?? null\n      // An unknown post-state (`after: null`, the failed re-read) counts as a\n      // change: it is the one case where the entry is the only evidence left.\n      // Both snapshots leave `captureAclSnapshot` with their grant lists sorted,\n      // so the shared order-sensitive comparison is a set comparison here.\n      const changed = !before || !after || !snapshotsEqual(before, after)\n      const sanitizedRequest = config.sanitizedRequest?.(input) ?? null\n      // The admin user-edit page PUTs the ACL on every save, even when only the\n      // name or the roles changed, and most accounts carry no per-user override\n      // at all \u2014 so recording an unchanged ACL faithfully buries the real\n      // permission changes under identical empty entries. A request the route\n      // trimmed rather than refused also arrives with `before == after`; that\n      // one is an escalation attempt and must survive this guard.\n      if (!changed && !sanitizedRequest) return { skipLog: true }\n      const { translate } = await resolveTranslations()\n      const target = await loadTargetSafely(config, input, ctx)\n      return {\n        actionLabel: translate(config.labelKey, config.labelFallback),\n        resourceKind: config.resourceKind,\n        resourceId: result.resourceId,\n        tenantId: result.tenantId,\n        organizationId: result.organizationId,\n        snapshotBefore: before,\n        snapshotAfter: after,\n        context: buildAuditContext({\n          target,\n          // A sanitized-only entry is written *because* nothing changed, so\n          // labelling it would have the trail assert a permission change that\n          // never happened.\n          effect: changed && before && after ? resolveEffect(before, after) : null,\n          sanitizedRequest,\n        }),\n      }\n    },\n  }\n}\n\nconst updateRoleAclCommand = createAclUpdateCommand<RoleAclUpdateInput>({\n  id: AUTH_ROLE_ACL_UPDATE_COMMAND_ID,\n  resourceKind: 'auth.role_acl',\n  labelKey: 'auth.audit.roleAcl.update',\n  labelFallback: 'Change role permissions',\n  resourceId: (input) => input.roleId,\n  loadAcl: (em, input) =>\n    em.findOne(RoleAcl, { role: input.roleId as unknown as Role, tenantId: input.tenantId }),\n  persist: async ({ em, input, existing }) => {\n    const acl =\n      (existing as RoleAcl | null) ??\n      em.create(RoleAcl, {\n        role: em.getReference(Role, input.roleId),\n        tenantId: input.tenantId,\n        createdAt: new Date(),\n        isSuperAdmin: false,\n      })\n    await withAtomicFlush(\n      em,\n      [\n        () => {\n          acl.organizationsJson = input.organizations\n          acl.isSuperAdmin = input.isSuperAdmin\n          acl.featuresJson = input.features\n          em.persist(acl)\n        },\n      ],\n      { transaction: true, label: AUTH_ROLE_ACL_UPDATE_COMMAND_ID },\n    )\n  },\n  invalidate: async ({ ctx, input }) => {\n    // Every user in the tenant inherits this role's grants, so the whole tenant\n    // scope is invalidated.\n    const rbacService = ctx.container.resolve('rbacService') as RbacService\n    await rbacService.invalidateTenantCache(input.tenantId)\n    // Sidebar nav caches depend on RBAC; invalidate tenant scope nav caches\n    await deleteCacheTags(ctx, [`rbac:tenant:${input.tenantId}`])\n  },\n  snapshotWhenAbsent: () => null,\n  // Looked up by id alone: the entry already names this role through\n  // `resource_id`, and a tenant predicate would only blank the label when a\n  // super admin edits a role from outside the tenant scope they are writing in.\n  loadTarget: async (em, input) => {\n    const role = await em.findOne(Role, { id: input.roleId } as FilterQuery<Role>)\n    if (!role) return null\n    return { kind: 'role', id: input.roleId, name: role.name ?? null }\n  },\n})\n\nconst updateUserAclCommand = createAclUpdateCommand<UserAclUpdateInput>({\n  id: AUTH_USER_ACL_UPDATE_COMMAND_ID,\n  resourceKind: 'auth.user_acl',\n  labelKey: 'auth.audit.userAcl.update',\n  labelFallback: 'Change user permissions',\n  resourceId: (input) => input.userId,\n  loadAcl: (em, input) =>\n    em.findOne(UserAcl, { user: input.userId as unknown as User, tenantId: input.tenantId }),\n  persist: async ({ em, input, existing }) => {\n    if (input.clear) {\n      if (!existing) return\n      const aclToRemove = existing as UserAcl\n      await withAtomicFlush(\n        em,\n        [\n          () => {\n            em.remove(aclToRemove)\n          },\n        ],\n        { transaction: true, label: AUTH_USER_ACL_UPDATE_COMMAND_ID },\n      )\n      return\n    }\n    const acl =\n      (existing as UserAcl | null) ??\n      em.create(UserAcl, {\n        user: em.getReference(User, input.userId),\n        tenantId: input.tenantId,\n        createdAt: new Date(),\n        isSuperAdmin: false,\n      })\n    await withAtomicFlush(\n      em,\n      [\n        () => {\n          acl.isSuperAdmin = input.isSuperAdmin\n          acl.featuresJson = input.features\n          acl.organizationsJson = input.organizations\n          em.persist(acl)\n        },\n      ],\n      { transaction: true, label: AUTH_USER_ACL_UPDATE_COMMAND_ID },\n    )\n  },\n  invalidate: async ({ ctx, input }) => {\n    const rbacService = ctx.container.resolve('rbacService') as RbacService\n    await rbacService.invalidateUserCache(input.userId)\n    await deleteCacheTags(ctx, [`rbac:user:${input.userId}`])\n  },\n  // Clearing removes the row, so an absent row is the real post-state here.\n  snapshotWhenAbsent: (input) => (input.clear ? { ...EMPTY_ACL_SNAPSHOT } : null),\n  // `userId` arrives in the request body and `auth:user` carries encrypted\n  // personal data, so the lookup is tenant-scoped: an id belonging to another\n  // tenant must not be decrypted under this scope and stamped into this\n  // tenant's trail. A global account (`users.tenant_id` is nullable) still\n  // resolves, mirroring how the role route widens its own lookup.\n  loadTarget: async (em, input, ctx) => {\n    const user = await findOneWithDecryption(\n      em,\n      User,\n      { id: input.userId, $or: [{ tenantId: input.tenantId }, { tenantId: null }] } as FilterQuery<User>,\n      {},\n      { tenantId: input.tenantId, organizationId: ctx.auth?.orgId ?? null },\n    )\n    if (!user) return null\n    return { kind: 'user', id: input.userId, email: user.email ?? null, name: user.name ?? null }\n  },\n  sanitizedRequest: (input) => input.requested ?? null,\n})\n\nregisterCommand(updateRoleAclCommand)\nregisterCommand(updateUserAclCommand)\n"],
-  "mappings": "AAyBA,SAAS,uBAAuB;AAChC,SAAS,sBAAsB;AAC/B,SAAS,uBAAuB;AAChC,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B,SAAS,6BAA6B;AAEtC,SAAS,MAAM,SAAS,MAAM,eAAe;AAG7C,MAAM,SAAS,aAAa,MAAM,EAAE,MAAM,EAAE,WAAW,eAAe,CAAC;AA8BvE,MAAM,qBAAkC;AAAA,EACtC,cAAc;AAAA,EACd,UAAU,CAAC;AAAA,EACX,eAAe;AACjB;AAmDA,SAAS,mBAAmB,MAAc,OAAuB;AAC/D,MAAI,SAAS,MAAO,QAAO;AAC3B,SAAO,OAAO,QAAQ,KAAK;AAC7B;AAEA,SAAS,aAAa,QAA2B;AAC/C,MAAI,CAAC,MAAM,QAAQ,MAAM,EAAG,QAAO,CAAC;AACpC,SAAO,CAAC,GAAG,MAAM,EAAE,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ,EAAE,KAAK,kBAAkB;AAC1G;AAEA,SAAS,mBAAmB,KAAgD;AAC1E,MAAI,CAAC,IAAK,QAAO,EAAE,GAAG,mBAAmB;AACzC,SAAO;AAAA,IACL,cAAc,QAAQ,IAAI,YAAY;AAAA,IACtC,UAAU,aAAa,IAAI,YAAY;AAAA,IACvC,eAAe,MAAM,QAAQ,IAAI,iBAAiB,IAAI,aAAa,IAAI,iBAAiB,IAAI;AAAA,EAC9F;AACF;AAEA,SAAS,YAAY,UAAgC;AACnD,SAAO,SAAS,gBAAgB,SAAS,SAAS,SAAS;AAC7D;AAEA,SAAS,cAAc,QAAqB,OAAqC;AAC/E,MAAI,CAAC,YAAY,MAAM,KAAK,YAAY,KAAK,EAAG,QAAO;AACvD,MAAI,YAAY,MAAM,KAAK,CAAC,YAAY,KAAK,EAAG,QAAO;AACvD,SAAO;AACT;AAEA,SAAS,UAAU,KAA2C;AAC5D,SAAO,IAAI,UAAU,QAAQ,IAAI;AACnC;AAcA,SAAS,sBAAsB,KAA4B,UAAiC;AAC1F,OAAK,IAAI,MAAM,YAAY,UAAU,SAAU,QAAO;AACtD,SAAO,IAAI,0BAA0B,IAAI,MAAM,SAAS;AAC1D;AAUA,eAAe,gBAAgB,KAA4B,MAA+B;AACxF,MAAI;AACJ,MAAI;AACF,YAAQ,IAAI,UAAU,QAAQ,OAAO;AAAA,EACvC,SAAS,KAAK;AACZ,WAAO,MAAM,gDAAgD,EAAE,KAAK,KAAK,CAAC;AAC1E;AAAA,EACF;AACA,MAAI,CAAC,OAAO,aAAc;AAC1B,QAAM,MAAM,aAAa,IAAI;AAC/B;AA4BO,MAAM,kCAAkC;AACxC,MAAM,kCAAkC;AA+B/C,eAAe,iBACb,QACA,OACA,KAC2B;AAC3B,MAAI;AACF,WAAO,MAAM,OAAO,WAAW,UAAU,GAAG,EAAE,KAAK,GAAG,OAAO,GAAG;AAAA,EAClE,SAAS,KAAK;AACZ,WAAO,KAAK,wDAAwD;AAAA,MAClE;AAAA,MACA,WAAW,OAAO;AAAA,MAClB,YAAY,OAAO,WAAW,KAAK;AAAA,MACnC,UAAU,MAAM;AAAA,IAClB,CAAC;AACD,WAAO;AAAA,EACT;AACF;AAEA,SAAS,kBAAkB,QAIQ;AACjC,QAAM,UAAmC,CAAC;AAC1C,MAAI,OAAO,OAAQ,SAAQ,SAAS,OAAO;AAC3C,MAAI,OAAO,OAAQ,SAAQ,SAAS,OAAO;AAC3C,MAAI,OAAO,iBAAkB,SAAQ,mBAAmB,OAAO;AAC/D,SAAO,OAAO,KAAK,OAAO,EAAE,SAAS,UAAU;AACjD;AAOA,SAAS,uBACP,QACyC;AACzC,SAAO;AAAA,IACL,IAAI,OAAO;AAAA;AAAA,IAEX,YAAY;AAAA,IACZ,MAAM,QAAQ,OAAO,KAAK;AACxB,YAAM,WAAW,MAAM,OAAO,QAAQ,UAAU,GAAG,EAAE,KAAK,GAAG,KAAK;AAClE,aAAO,EAAE,QAAQ,mBAAmB,QAAQ,EAAE;AAAA,IAChD;AAAA,IACA,MAAM,QAAQ,OAAO,KAAK;AACxB,YAAM,KAAK,UAAU,GAAG;AACxB,YAAM,WAAW,MAAM,OAAO,QAAQ,IAAI,KAAK;AAC/C,YAAM,OAAO,QAAQ,EAAE,IAAI,OAAO,SAAS,CAAC;AAe5C,UAAI;AACF,cAAM,OAAO,WAAW,EAAE,KAAK,MAAM,CAAC;AAAA,MACxC,SAAS,KAAK;AACZ,eAAO,MAAM,qEAAqE;AAAA,UAChF;AAAA,UACA,WAAW,OAAO;AAAA,UAClB,YAAY,OAAO,WAAW,KAAK;AAAA,UACnC,UAAU,MAAM;AAAA,QAClB,CAAC;AAAA,MACH;AACA,aAAO;AAAA,QACL,YAAY,OAAO,WAAW,KAAK;AAAA,QACnC,UAAU,MAAM;AAAA,QAChB,gBAAgB,sBAAsB,KAAK,MAAM,QAAQ;AAAA,MAC3D;AAAA,IACF;AAAA,IACA,cAAc,OAAO,OAAO,SAAS,QAAQ;AAG3C,YAAM,YAAY,MAAM,OAAO,QAAQ,UAAU,GAAG,EAAE,KAAK,GAAG,KAAK;AACnE,UAAI,UAAW,QAAO,mBAAmB,SAAS;AAClD,aAAO,OAAO,mBAAmB,KAAK;AAAA,IACxC;AAAA,IACA,UAAU,OAAO,EAAE,OAAO,QAAQ,KAAK,UAAU,MAAM;AACrD,YAAM,SAAU,UAAU,UAAsC;AAChE,YAAM,QAAS,UAAU,SAAqC;AAK9D,YAAM,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,eAAe,QAAQ,KAAK;AAClE,YAAM,mBAAmB,OAAO,mBAAmB,KAAK,KAAK;AAO7D,UAAI,CAAC,WAAW,CAAC,iBAAkB,QAAO,EAAE,SAAS,KAAK;AAC1D,YAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,YAAM,SAAS,MAAM,iBAAiB,QAAQ,OAAO,GAAG;AACxD,aAAO;AAAA,QACL,aAAa,UAAU,OAAO,UAAU,OAAO,aAAa;AAAA,QAC5D,cAAc,OAAO;AAAA,QACrB,YAAY,OAAO;AAAA,QACnB,UAAU,OAAO;AAAA,QACjB,gBAAgB,OAAO;AAAA,QACvB,gBAAgB;AAAA,QAChB,eAAe;AAAA,QACf,SAAS,kBAAkB;AAAA,UACzB;AAAA;AAAA;AAAA;AAAA,UAIA,QAAQ,WAAW,UAAU,QAAQ,cAAc,QAAQ,KAAK,IAAI;AAAA,UACpE;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACF;AAEA,MAAM,uBAAuB,uBAA2C;AAAA,EACtE,IAAI;AAAA,EACJ,cAAc;AAAA,EACd,UAAU;AAAA,EACV,eAAe;AAAA,EACf,YAAY,CAAC,UAAU,MAAM;AAAA,EAC7B,SAAS,CAAC,IAAI,UACZ,GAAG,QAAQ,SAAS,EAAE,MAAM,MAAM,QAA2B,UAAU,MAAM,SAAS,CAAC;AAAA,EACzF,SAAS,OAAO,EAAE,IAAI,OAAO,SAAS,MAAM;AAC1C,UAAM,MACH,YACD,GAAG,OAAO,SAAS;AAAA,MACjB,MAAM,GAAG,aAAa,MAAM,MAAM,MAAM;AAAA,MACxC,UAAU,MAAM;AAAA,MAChB,WAAW,oBAAI,KAAK;AAAA,MACpB,cAAc;AAAA,IAChB,CAAC;AACH,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,QACE,MAAM;AACJ,cAAI,oBAAoB,MAAM;AAC9B,cAAI,eAAe,MAAM;AACzB,cAAI,eAAe,MAAM;AACzB,aAAG,QAAQ,GAAG;AAAA,QAChB;AAAA,MACF;AAAA,MACA,EAAE,aAAa,MAAM,OAAO,gCAAgC;AAAA,IAC9D;AAAA,EACF;AAAA,EACA,YAAY,OAAO,EAAE,KAAK,MAAM,MAAM;AAGpC,UAAM,cAAc,IAAI,UAAU,QAAQ,aAAa;AACvD,UAAM,YAAY,sBAAsB,MAAM,QAAQ;AAEtD,UAAM,gBAAgB,KAAK,CAAC,eAAe,MAAM,QAAQ,EAAE,CAAC;AAAA,EAC9D;AAAA,EACA,oBAAoB,MAAM;AAAA;AAAA;AAAA;AAAA,EAI1B,YAAY,OAAO,IAAI,UAAU;AAC/B,UAAM,OAAO,MAAM,GAAG,QAAQ,MAAM,EAAE,IAAI,MAAM,OAAO,CAAsB;AAC7E,QAAI,CAAC,KAAM,QAAO;AAClB,WAAO,EAAE,MAAM,QAAQ,IAAI,MAAM,QAAQ,MAAM,KAAK,QAAQ,KAAK;AAAA,EACnE;AACF,CAAC;AAED,MAAM,uBAAuB,uBAA2C;AAAA,EACtE,IAAI;AAAA,EACJ,cAAc;AAAA,EACd,UAAU;AAAA,EACV,eAAe;AAAA,EACf,YAAY,CAAC,UAAU,MAAM;AAAA,EAC7B,SAAS,CAAC,IAAI,UACZ,GAAG,QAAQ,SAAS,EAAE,MAAM,MAAM,QAA2B,UAAU,MAAM,SAAS,CAAC;AAAA,EACzF,SAAS,OAAO,EAAE,IAAI,OAAO,SAAS,MAAM;AAC1C,QAAI,MAAM,OAAO;AACf,UAAI,CAAC,SAAU;AACf,YAAM,cAAc;AACpB,YAAM;AAAA,QACJ;AAAA,QACA;AAAA,UACE,MAAM;AACJ,eAAG,OAAO,WAAW;AAAA,UACvB;AAAA,QACF;AAAA,QACA,EAAE,aAAa,MAAM,OAAO,gCAAgC;AAAA,MAC9D;AACA;AAAA,IACF;AACA,UAAM,MACH,YACD,GAAG,OAAO,SAAS;AAAA,MACjB,MAAM,GAAG,aAAa,MAAM,MAAM,MAAM;AAAA,MACxC,UAAU,MAAM;AAAA,MAChB,WAAW,oBAAI,KAAK;AAAA,MACpB,cAAc;AAAA,IAChB,CAAC;AACH,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,QACE,MAAM;AACJ,cAAI,eAAe,MAAM;AACzB,cAAI,eAAe,MAAM;AACzB,cAAI,oBAAoB,MAAM;AAC9B,aAAG,QAAQ,GAAG;AAAA,QAChB;AAAA,MACF;AAAA,MACA,EAAE,aAAa,MAAM,OAAO,gCAAgC;AAAA,IAC9D;AAAA,EACF;AAAA,EACA,YAAY,OAAO,EAAE,KAAK,MAAM,MAAM;AACpC,UAAM,cAAc,IAAI,UAAU,QAAQ,aAAa;AACvD,UAAM,YAAY,oBAAoB,MAAM,MAAM;AAClD,UAAM,gBAAgB,KAAK,CAAC,aAAa,MAAM,MAAM,EAAE,CAAC;AAAA,EAC1D;AAAA;AAAA,EAEA,oBAAoB,CAAC,UAAW,MAAM,QAAQ,EAAE,GAAG,mBAAmB,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM1E,YAAY,OAAO,IAAI,OAAO,QAAQ;AACpC,UAAM,OAAO,MAAM;AAAA,MACjB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,MAAM,QAAQ,KAAK,CAAC,EAAE,UAAU,MAAM,SAAS,GAAG,EAAE,UAAU,KAAK,CAAC,EAAE;AAAA,MAC5E,CAAC;AAAA,MACD,EAAE,UAAU,MAAM,UAAU,gBAAgB,IAAI,MAAM,SAAS,KAAK;AAAA,IACtE;AACA,QAAI,CAAC,KAAM,QAAO;AAClB,WAAO,EAAE,MAAM,QAAQ,IAAI,MAAM,QAAQ,OAAO,KAAK,SAAS,MAAM,MAAM,KAAK,QAAQ,KAAK;AAAA,EAC9F;AAAA,EACA,kBAAkB,CAAC,UAAU,MAAM,aAAa;AAClD,CAAC;AAED,gBAAgB,oBAAoB;AACpC,gBAAgB,oBAAoB;",
-  "names": []
-}

package/dist/modules/auth/lib/userIdFilter.js

@@ -1,16 +0,0 @@
-import { isIdsParamProvided, parseIdsParam } from "@open-mercato/shared/lib/crud/ids";
-const MAX_USER_LOOKUP_IDS = 100;
-function resolveUserIdFilter(rawIds, id, maxIds = MAX_USER_LOOKUP_IDS) {
-  const single = typeof id === "string" && id.trim() ? id.trim() : null;
-  if (!isIdsParamProvided(rawIds)) {
-    return single ? { kind: "ids", ids: [single] } : { kind: "unfiltered" };
-  }
-  const parsed = parseIdsParam(rawIds, maxIds);
-  const ids = single ? parsed.filter((value) => value === single) : parsed;
-  return ids.length ? { kind: "ids", ids } : { kind: "none" };
-}
-export {
-  MAX_USER_LOOKUP_IDS,
-  resolveUserIdFilter
-};
-//# sourceMappingURL=userIdFilter.js.map

package/dist/modules/auth/lib/userIdFilter.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../src/modules/auth/lib/userIdFilter.ts"],
-  "sourcesContent": ["import { isIdsParamProvided, parseIdsParam } from '@open-mercato/shared/lib/crud/ids'\n\n// Batch id lookup shares the list's page cap, so `?ids=` can never pull more rows than `?pageSize=`.\nexport const MAX_USER_LOOKUP_IDS = 100\n\nexport type UserIdFilter =\n  /** Neither `?id=` nor `?ids=` was supplied \u2014 the list is filtered by the other params only. */\n  | { kind: 'unfiltered' }\n  /** Restrict the list to these ids. */\n  | { kind: 'ids'; ids: string[] }\n  /**\n   * `?ids=` was supplied but nothing usable survived \u2014 either no value was a UUID, or the\n   * intersection with `?id=` is empty. Match nothing rather than dropping the filter and returning\n   * the full first page, which would turn a malformed request into a record-count side channel\n   * (the same rule `mergeIdFilter` enforces for CRUD list routes, #4143 Finding 3).\n   */\n  | { kind: 'none' }\n\nexport function resolveUserIdFilter(\n  rawIds: unknown,\n  id?: string | null,\n  maxIds: number = MAX_USER_LOOKUP_IDS,\n): UserIdFilter {\n  const single = typeof id === 'string' && id.trim() ? id.trim() : null\n  if (!isIdsParamProvided(rawIds)) {\n    return single ? { kind: 'ids', ids: [single] } : { kind: 'unfiltered' }\n  }\n  const parsed = parseIdsParam(rawIds, maxIds)\n  const ids = single ? parsed.filter((value) => value === single) : parsed\n  return ids.length ? { kind: 'ids', ids } : { kind: 'none' }\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB,qBAAqB;AAG3C,MAAM,sBAAsB;AAe5B,SAAS,oBACd,QACA,IACA,SAAiB,qBACH;AACd,QAAM,SAAS,OAAO,OAAO,YAAY,GAAG,KAAK,IAAI,GAAG,KAAK,IAAI;AACjE,MAAI,CAAC,mBAAmB,MAAM,GAAG;AAC/B,WAAO,SAAS,EAAE,MAAM,OAAO,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,aAAa;AAAA,EACxE;AACA,QAAM,SAAS,cAAc,QAAQ,MAAM;AAC3C,QAAM,MAAM,SAAS,OAAO,OAAO,CAAC,UAAU,UAAU,MAAM,IAAI;AAClE,SAAO,IAAI,SAAS,EAAE,MAAM,OAAO,IAAI,IAAI,EAAE,MAAM,OAAO;AAC5D;",
-  "names": []
-}

package/dist/modules/auth/services/principalService.js

@@ -1,200 +0,0 @@
-import { sql } from "kysely";
-import { escapeLikePattern } from "@open-mercato/shared/lib/db/escapeLikePattern";
-import { findOneWithDecryption, findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
-import { Role, RoleAcl, User, UserRole } from "../data/entities.js";
-import { listSuperAdminUserIds } from "../lib/grantChecks.js";
-import { resolveRoleOrganizationScope, roleAclGrantsPrincipalOrganization } from "./roleOrganizationScope.js";
-const MAX_ROLE_PAGE_SIZE = 100;
-const MAX_ROLE_RESULTS = 1e3;
-function normalizeIds(ids) {
-  return Array.from(new Set(ids.map((id) => id.trim()).filter(Boolean)));
-}
-function relationId(value) {
-  if (typeof value === "string") return value.trim() || null;
-  if (!value || typeof value !== "object") return null;
-  const id = value.id;
-  return typeof id === "string" && id.trim().length > 0 ? id.trim() : null;
-}
-class DefaultAuthPrincipalService {
-  constructor(em, organizationHierarchyService) {
-    this.em = em;
-    this.organizationHierarchyService = organizationHierarchyService;
-  }
-  async principalExists(input) {
-    if (input.type === "role") {
-      return (await this.filterActiveRoleIds([input.id], input.scope)).includes(input.id);
-    }
-    return Boolean(await findOneWithDecryption(
-      this.em,
-      User,
-      {
-        id: input.id,
-        tenantId: input.scope.tenantId,
-        deletedAt: null,
-        $or: [{ organizationId: null }, { organizationId: input.scope.organizationId }]
-      },
-      { fields: ["id"] },
-      input.scope
-    ));
-  }
-  async resolveActiveUserRoleIds(userId, scope) {
-    const links = await findWithDecryption(
-      this.em,
-      UserRole,
-      {
-        user: userId,
-        deletedAt: null,
-        role: { tenantId: scope.tenantId, deletedAt: null }
-      },
-      { fields: ["role"] },
-      scope
-    );
-    return this.filterActiveRoleIds(
-      normalizeIds(links.flatMap((link) => {
-        const id = relationId(link.role);
-        return id ? [id] : [];
-      })),
-      scope
-    );
-  }
-  async filterActiveRoleIds(roleIds, scope) {
-    const ids = normalizeIds(roleIds);
-    if (ids.length === 0) return [];
-    const roles = await findWithDecryption(
-      this.em,
-      Role,
-      { id: { $in: ids }, tenantId: scope.tenantId, deletedAt: null },
-      { fields: ["id"] },
-      scope
-    );
-    const activeIds = normalizeIds(roles.map((role) => role.id));
-    if (activeIds.length === 0) return [];
-    const roleOrganizationScope = await resolveRoleOrganizationScope(
-      this.organizationHierarchyService,
-      scope.tenantId,
-      scope.organizationId
-    );
-    const acls = await findWithDecryption(
-      this.em,
-      RoleAcl,
-      {
-        tenantId: scope.tenantId,
-        role: { $in: activeIds },
-        deletedAt: null
-      },
-      { fields: ["role", "organizationsJson"] },
-      scope
-    );
-    const eligibilityById = /* @__PURE__ */ new Map();
-    for (const acl of acls) {
-      const id = relationId(acl.role);
-      if (!id) continue;
-      eligibilityById.set(
-        id,
-        eligibilityById.get(id) === true || roleAclGrantsPrincipalOrganization(acl, roleOrganizationScope)
-      );
-    }
-    return activeIds.filter((id) => eligibilityById.get(id) !== false);
-  }
-  async resolveLabels(input) {
-    const ids = normalizeIds(input.ids);
-    if (ids.length === 0) return [];
-    if (input.type === "role") {
-      const eligibleIds = await this.filterActiveRoleIds(ids, input.scope);
-      if (eligibleIds.length === 0) return [];
-      const roles = await findWithDecryption(
-        this.em,
-        Role,
-        { id: { $in: eligibleIds }, tenantId: input.scope.tenantId, deletedAt: null },
-        { fields: ["id", "name"] },
-        input.scope
-      );
-      return roles.map((role) => ({ id: role.id, label: role.name, secondary: null }));
-    }
-    const users = await findWithDecryption(
-      this.em,
-      User,
-      {
-        id: { $in: ids },
-        tenantId: input.scope.tenantId,
-        deletedAt: null,
-        $or: [{ organizationId: null }, { organizationId: input.scope.organizationId }]
-      },
-      { fields: ["id", "name", "email"] },
-      input.scope
-    );
-    return users.map((user) => ({
-      id: user.id,
-      label: user.name?.trim() || user.email,
-      secondary: user.name?.trim() && user.email !== user.name.trim() ? user.email : null
-    }));
-  }
-  async queryActiveRolePage(input) {
-    const page = Math.max(1, Math.floor(input.page));
-    const pageSize = Math.min(MAX_ROLE_PAGE_SIZE, Math.max(1, Math.floor(input.pageSize)));
-    const offset = (page - 1) * pageSize;
-    const excludedIds = normalizeIds(input.excludedIds ?? []);
-    const roleOrganizationScope = await resolveRoleOrganizationScope(
-      this.organizationHierarchyService,
-      input.scope.tenantId,
-      input.scope.organizationId
-    );
-    const db = this.em.getKysely();
-    let eligibleRoles = db.selectFrom("roles as r").where("r.tenant_id", "=", input.scope.tenantId).where("r.deleted_at", "is", null);
-    if (roleOrganizationScope) {
-      const allowedOrganizations = Array.from(roleOrganizationScope);
-      const organizationPredicates = [
-        sql`ra.organizations_json is null`,
-        sql`ra.organizations_json::jsonb @> ${JSON.stringify(["__all__"])}::jsonb`,
-        ...allowedOrganizations.map((organizationId) => sql`ra.organizations_json::jsonb @> ${JSON.stringify([organizationId])}::jsonb`)
-      ];
-      const organizationAllowed = sql`(${sql.join(organizationPredicates, sql` or `)})`;
-      eligibleRoles = eligibleRoles.where(sql`(
-        not exists (
-          select 1
-          from role_acls as ra_any
-          where ra_any.role_id = r.id
-            and ra_any.tenant_id = ${input.scope.tenantId}
-            and ra_any.deleted_at is null
-        )
-        or exists (
-          select 1
-          from role_acls as ra
-          where ra.role_id = r.id
-            and ra.tenant_id = ${input.scope.tenantId}
-            and ra.deleted_at is null
-            and ${organizationAllowed}
-        )
-      )`);
-    }
-    if (input.search?.trim()) {
-      const searchPattern = `%${escapeLikePattern(input.search.trim())}%`;
-      eligibleRoles = eligibleRoles.where(sql`r.name ilike ${searchPattern}`);
-    }
-    if (excludedIds.length > 0) {
-      eligibleRoles = eligibleRoles.where("r.id", "not in", excludedIds);
-    }
-    const boundedRoleIds = eligibleRoles.select("r.id").limit(MAX_ROLE_RESULTS).as("bounded_roles");
-    const countQuery = db.selectFrom(boundedRoleIds).select(sql`count(*)`.as("count"));
-    const pageQuery = eligibleRoles.select(["r.id", "r.name"]).orderBy("r.id", "asc").limit(offset < MAX_ROLE_RESULTS ? Math.min(pageSize, MAX_ROLE_RESULTS - offset) : 0).offset(Math.min(offset, MAX_ROLE_RESULTS));
-    const [rows, countRow] = await Promise.all([
-      pageQuery.execute(),
-      countQuery.executeTakeFirst()
-    ]);
-    const parsedTotal = Number(countRow?.count ?? 0);
-    const total = Number.isFinite(parsedTotal) ? Math.min(MAX_ROLE_RESULTS, Math.max(0, Math.floor(parsedTotal))) : 0;
-    return {
-      items: rows.map((role) => ({ id: role.id, label: role.name, secondary: null })),
-      page,
-      pageSize,
-      total
-    };
-  }
-  async listSuperAdminUserIds(tenantId) {
-    return Array.from(await listSuperAdminUserIds(this.em, tenantId));
-  }
-}
-export {
-  DefaultAuthPrincipalService
-};
-//# sourceMappingURL=principalService.js.map

package/dist/modules/auth/services/principalService.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../src/modules/auth/services/principalService.ts"],
-  "sourcesContent": ["import type { FilterQuery } from '@mikro-orm/core'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { sql } from 'kysely'\nimport type {\n  AuthPrincipalLabel,\n  AuthPrincipalRolePage,\n  AuthPrincipalService,\n  OrganizationHierarchyService,\n  PrincipalScope,\n} from '@open-mercato/shared/lib/auth/principal-service'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { Role, RoleAcl, User, UserRole } from '../data/entities'\nimport { listSuperAdminUserIds } from '../lib/grantChecks'\nimport { resolveRoleOrganizationScope, roleAclGrantsPrincipalOrganization } from './roleOrganizationScope'\n\nconst MAX_ROLE_PAGE_SIZE = 100\nconst MAX_ROLE_RESULTS = 1_000\n\ntype AuthPrincipalDatabase = {\n  roles: {\n    id: string\n    tenant_id: string\n    name: string\n    deleted_at: Date | null\n  }\n  role_acls: {\n    role_id: string\n    tenant_id: string\n    organizations_json: string[] | null\n    deleted_at: Date | null\n  }\n}\n\nfunction normalizeIds(ids: string[]): string[] {\n  return Array.from(new Set(ids.map((id) => id.trim()).filter(Boolean)))\n}\n\nfunction relationId(value: unknown): string | null {\n  if (typeof value === 'string') return value.trim() || null\n  if (!value || typeof value !== 'object') return null\n  const id = (value as { id?: unknown }).id\n  return typeof id === 'string' && id.trim().length > 0 ? id.trim() : null\n}\n\nexport class DefaultAuthPrincipalService implements AuthPrincipalService {\n  constructor(\n    private readonly em: EntityManager,\n    private readonly organizationHierarchyService?: OrganizationHierarchyService,\n  ) {}\n\n  async principalExists(input: {\n    type: 'user' | 'role'\n    id: string\n    scope: PrincipalScope\n  }): Promise<boolean> {\n    if (input.type === 'role') {\n      return (await this.filterActiveRoleIds([input.id], input.scope)).includes(input.id)\n    }\n    return Boolean(await findOneWithDecryption(\n      this.em,\n      User,\n      {\n        id: input.id,\n        tenantId: input.scope.tenantId,\n        deletedAt: null,\n        $or: [{ organizationId: null }, { organizationId: input.scope.organizationId }],\n      } as FilterQuery<User>,\n      { fields: ['id'] as const },\n      input.scope,\n    ))\n  }\n\n  async resolveActiveUserRoleIds(userId: string, scope: PrincipalScope): Promise<string[]> {\n    const links = await findWithDecryption(\n      this.em,\n      UserRole,\n      {\n        user: userId,\n        deletedAt: null,\n        role: { tenantId: scope.tenantId, deletedAt: null },\n      } as FilterQuery<UserRole>,\n      { fields: ['role'] as const },\n      scope,\n    )\n    return this.filterActiveRoleIds(\n      normalizeIds(links.flatMap((link) => {\n        const id = relationId(link.role)\n        return id ? [id] : []\n      })),\n      scope,\n    )\n  }\n\n  async filterActiveRoleIds(roleIds: string[], scope: PrincipalScope): Promise<string[]> {\n    const ids = normalizeIds(roleIds)\n    if (ids.length === 0) return []\n    const roles = await findWithDecryption(\n      this.em,\n      Role,\n      { id: { $in: ids }, tenantId: scope.tenantId, deletedAt: null } as FilterQuery<Role>,\n      { fields: ['id'] as const },\n      scope,\n    )\n    const activeIds = normalizeIds(roles.map((role) => role.id))\n    if (activeIds.length === 0) return []\n    const roleOrganizationScope = await resolveRoleOrganizationScope(\n      this.organizationHierarchyService,\n      scope.tenantId,\n      scope.organizationId,\n    )\n    const acls = await findWithDecryption(\n      this.em,\n      RoleAcl,\n      {\n        tenantId: scope.tenantId,\n        role: { $in: activeIds },\n        deletedAt: null,\n      } as FilterQuery<RoleAcl>,\n      { fields: ['role', 'organizationsJson'] as const },\n      scope,\n    )\n    const eligibilityById = new Map<string, boolean>()\n    for (const acl of acls) {\n      const id = relationId(acl.role)\n      if (!id) continue\n      eligibilityById.set(\n        id,\n        eligibilityById.get(id) === true || roleAclGrantsPrincipalOrganization(acl, roleOrganizationScope),\n      )\n    }\n    // A tenant role without an ACL remains a valid explicit-share principal.\n    // Only an existing ACL can restrict that role away from this organization.\n    return activeIds.filter((id) => eligibilityById.get(id) !== false)\n  }\n\n  async resolveLabels(input: {\n    type: 'user' | 'role'\n    ids: string[]\n    scope: PrincipalScope\n  }): Promise<AuthPrincipalLabel[]> {\n    const ids = normalizeIds(input.ids)\n    if (ids.length === 0) return []\n    if (input.type === 'role') {\n      const eligibleIds = await this.filterActiveRoleIds(ids, input.scope)\n      if (eligibleIds.length === 0) return []\n      const roles = await findWithDecryption(\n        this.em,\n        Role,\n        { id: { $in: eligibleIds }, tenantId: input.scope.tenantId, deletedAt: null } as FilterQuery<Role>,\n        { fields: ['id', 'name'] as const },\n        input.scope,\n      )\n      return roles.map((role) => ({ id: role.id, label: role.name, secondary: null }))\n    }\n    const users = await findWithDecryption(\n      this.em,\n      User,\n      {\n        id: { $in: ids },\n        tenantId: input.scope.tenantId,\n        deletedAt: null,\n        $or: [{ organizationId: null }, { organizationId: input.scope.organizationId }],\n      } as FilterQuery<User>,\n      { fields: ['id', 'name', 'email'] as const },\n      input.scope,\n    )\n    return users.map((user) => ({\n      id: user.id,\n      label: user.name?.trim() || user.email,\n      secondary: user.name?.trim() && user.email !== user.name.trim() ? user.email : null,\n    }))\n  }\n\n  async queryActiveRolePage(input: {\n    scope: PrincipalScope\n    search?: string\n    excludedIds?: string[]\n    page: number\n    pageSize: number\n  }): Promise<AuthPrincipalRolePage> {\n    const page = Math.max(1, Math.floor(input.page))\n    const pageSize = Math.min(MAX_ROLE_PAGE_SIZE, Math.max(1, Math.floor(input.pageSize)))\n    const offset = (page - 1) * pageSize\n    const excludedIds = normalizeIds(input.excludedIds ?? [])\n    const roleOrganizationScope = await resolveRoleOrganizationScope(\n      this.organizationHierarchyService,\n      input.scope.tenantId,\n      input.scope.organizationId,\n    )\n    const db = this.em.getKysely<AuthPrincipalDatabase>()\n    let eligibleRoles = db\n      .selectFrom('roles as r')\n      .where('r.tenant_id', '=', input.scope.tenantId)\n      .where('r.deleted_at', 'is', null)\n\n    if (roleOrganizationScope) {\n      const allowedOrganizations = Array.from(roleOrganizationScope)\n      const organizationPredicates = [\n        sql<boolean>`ra.organizations_json is null`,\n        sql<boolean>`ra.organizations_json::jsonb @> ${JSON.stringify(['__all__'])}::jsonb`,\n        ...allowedOrganizations.map((organizationId) => (\n          sql<boolean>`ra.organizations_json::jsonb @> ${JSON.stringify([organizationId])}::jsonb`\n        )),\n      ]\n      const organizationAllowed = sql<boolean>`(${sql.join(organizationPredicates, sql` or `)})`\n      eligibleRoles = eligibleRoles.where(sql<boolean>`(\n        not exists (\n          select 1\n          from role_acls as ra_any\n          where ra_any.role_id = r.id\n            and ra_any.tenant_id = ${input.scope.tenantId}\n            and ra_any.deleted_at is null\n        )\n        or exists (\n          select 1\n          from role_acls as ra\n          where ra.role_id = r.id\n            and ra.tenant_id = ${input.scope.tenantId}\n            and ra.deleted_at is null\n            and ${organizationAllowed}\n        )\n      )`)\n    }\n    if (input.search?.trim()) {\n      const searchPattern = `%${escapeLikePattern(input.search.trim())}%`\n      eligibleRoles = eligibleRoles.where(sql<boolean>`r.name ilike ${searchPattern}`)\n    }\n    if (excludedIds.length > 0) {\n      eligibleRoles = eligibleRoles.where('r.id', 'not in', excludedIds)\n    }\n\n    const boundedRoleIds = eligibleRoles\n      .select('r.id')\n      .limit(MAX_ROLE_RESULTS)\n      .as('bounded_roles')\n    const countQuery = db\n      .selectFrom(boundedRoleIds)\n      .select(sql<string>`count(*)`.as('count'))\n    const pageQuery = eligibleRoles\n      .select(['r.id', 'r.name'])\n      .orderBy('r.id', 'asc')\n      .limit(offset < MAX_ROLE_RESULTS ? Math.min(pageSize, MAX_ROLE_RESULTS - offset) : 0)\n      .offset(Math.min(offset, MAX_ROLE_RESULTS))\n\n    const [rows, countRow] = await Promise.all([\n      pageQuery.execute() as Promise<Array<{ id: string; name: string }>>,\n      countQuery.executeTakeFirst() as Promise<{ count?: string | number } | undefined>,\n    ])\n    const parsedTotal = Number(countRow?.count ?? 0)\n    const total = Number.isFinite(parsedTotal)\n      ? Math.min(MAX_ROLE_RESULTS, Math.max(0, Math.floor(parsedTotal)))\n      : 0\n\n    return {\n      items: rows.map((role) => ({ id: role.id, label: role.name, secondary: null })),\n      page,\n      pageSize,\n      total,\n    }\n  }\n\n  async listSuperAdminUserIds(tenantId: string): Promise<string[]> {\n    return Array.from(await listSuperAdminUserIds(this.em, tenantId))\n  }\n}\n"],
-  "mappings": "AAEA,SAAS,WAAW;AAQpB,SAAS,yBAAyB;AAClC,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,MAAM,SAAS,MAAM,gBAAgB;AAC9C,SAAS,6BAA6B;AACtC,SAAS,8BAA8B,0CAA0C;AAEjF,MAAM,qBAAqB;AAC3B,MAAM,mBAAmB;AAiBzB,SAAS,aAAa,KAAyB;AAC7C,SAAO,MAAM,KAAK,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,EAAE,OAAO,OAAO,CAAC,CAAC;AACvE;AAEA,SAAS,WAAW,OAA+B;AACjD,MAAI,OAAO,UAAU,SAAU,QAAO,MAAM,KAAK,KAAK;AACtD,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,KAAM,MAA2B;AACvC,SAAO,OAAO,OAAO,YAAY,GAAG,KAAK,EAAE,SAAS,IAAI,GAAG,KAAK,IAAI;AACtE;AAEO,MAAM,4BAA4D;AAAA,EACvE,YACmB,IACA,8BACjB;AAFiB;AACA;AAAA,EAChB;AAAA,EAEH,MAAM,gBAAgB,OAID;AACnB,QAAI,MAAM,SAAS,QAAQ;AACzB,cAAQ,MAAM,KAAK,oBAAoB,CAAC,MAAM,EAAE,GAAG,MAAM,KAAK,GAAG,SAAS,MAAM,EAAE;AAAA,IACpF;AACA,WAAO,QAAQ,MAAM;AAAA,MACnB,KAAK;AAAA,MACL;AAAA,MACA;AAAA,QACE,IAAI,MAAM;AAAA,QACV,UAAU,MAAM,MAAM;AAAA,QACtB,WAAW;AAAA,QACX,KAAK,CAAC,EAAE,gBAAgB,KAAK,GAAG,EAAE,gBAAgB,MAAM,MAAM,eAAe,CAAC;AAAA,MAChF;AAAA,MACA,EAAE,QAAQ,CAAC,IAAI,EAAW;AAAA,MAC1B,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,yBAAyB,QAAgB,OAA0C;AACvF,UAAM,QAAQ,MAAM;AAAA,MAClB,KAAK;AAAA,MACL;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,WAAW;AAAA,QACX,MAAM,EAAE,UAAU,MAAM,UAAU,WAAW,KAAK;AAAA,MACpD;AAAA,MACA,EAAE,QAAQ,CAAC,MAAM,EAAW;AAAA,MAC5B;AAAA,IACF;AACA,WAAO,KAAK;AAAA,MACV,aAAa,MAAM,QAAQ,CAAC,SAAS;AACnC,cAAM,KAAK,WAAW,KAAK,IAAI;AAC/B,eAAO,KAAK,CAAC,EAAE,IAAI,CAAC;AAAA,MACtB,CAAC,CAAC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,oBAAoB,SAAmB,OAA0C;AACrF,UAAM,MAAM,aAAa,OAAO;AAChC,QAAI,IAAI,WAAW,EAAG,QAAO,CAAC;AAC9B,UAAM,QAAQ,MAAM;AAAA,MAClB,KAAK;AAAA,MACL;AAAA,MACA,EAAE,IAAI,EAAE,KAAK,IAAI,GAAG,UAAU,MAAM,UAAU,WAAW,KAAK;AAAA,MAC9D,EAAE,QAAQ,CAAC,IAAI,EAAW;AAAA,MAC1B;AAAA,IACF;AACA,UAAM,YAAY,aAAa,MAAM,IAAI,CAAC,SAAS,KAAK,EAAE,CAAC;AAC3D,QAAI,UAAU,WAAW,EAAG,QAAO,CAAC;AACpC,UAAM,wBAAwB,MAAM;AAAA,MAClC,KAAK;AAAA,MACL,MAAM;AAAA,MACN,MAAM;AAAA,IACR;AACA,UAAM,OAAO,MAAM;AAAA,MACjB,KAAK;AAAA,MACL;AAAA,MACA;AAAA,QACE,UAAU,MAAM;AAAA,QAChB,MAAM,EAAE,KAAK,UAAU;AAAA,QACvB,WAAW;AAAA,MACb;AAAA,MACA,EAAE,QAAQ,CAAC,QAAQ,mBAAmB,EAAW;AAAA,MACjD;AAAA,IACF;AACA,UAAM,kBAAkB,oBAAI,IAAqB;AACjD,eAAW,OAAO,MAAM;AACtB,YAAM,KAAK,WAAW,IAAI,IAAI;AAC9B,UAAI,CAAC,GAAI;AACT,sBAAgB;AAAA,QACd;AAAA,QACA,gBAAgB,IAAI,EAAE,MAAM,QAAQ,mCAAmC,KAAK,qBAAqB;AAAA,MACnG;AAAA,IACF;AAGA,WAAO,UAAU,OAAO,CAAC,OAAO,gBAAgB,IAAI,EAAE,MAAM,KAAK;AAAA,EACnE;AAAA,EAEA,MAAM,cAAc,OAIc;AAChC,UAAM,MAAM,aAAa,MAAM,GAAG;AAClC,QAAI,IAAI,WAAW,EAAG,QAAO,CAAC;AAC9B,QAAI,MAAM,SAAS,QAAQ;AACzB,YAAM,cAAc,MAAM,KAAK,oBAAoB,KAAK,MAAM,KAAK;AACnE,UAAI,YAAY,WAAW,EAAG,QAAO,CAAC;AACtC,YAAM,QAAQ,MAAM;AAAA,QAClB,KAAK;AAAA,QACL;AAAA,QACA,EAAE,IAAI,EAAE,KAAK,YAAY,GAAG,UAAU,MAAM,MAAM,UAAU,WAAW,KAAK;AAAA,QAC5E,EAAE,QAAQ,CAAC,MAAM,MAAM,EAAW;AAAA,QAClC,MAAM;AAAA,MACR;AACA,aAAO,MAAM,IAAI,CAAC,UAAU,EAAE,IAAI,KAAK,IAAI,OAAO,KAAK,MAAM,WAAW,KAAK,EAAE;AAAA,IACjF;AACA,UAAM,QAAQ,MAAM;AAAA,MAClB,KAAK;AAAA,MACL;AAAA,MACA;AAAA,QACE,IAAI,EAAE,KAAK,IAAI;AAAA,QACf,UAAU,MAAM,MAAM;AAAA,QACtB,WAAW;AAAA,QACX,KAAK,CAAC,EAAE,gBAAgB,KAAK,GAAG,EAAE,gBAAgB,MAAM,MAAM,eAAe,CAAC;AAAA,MAChF;AAAA,MACA,EAAE,QAAQ,CAAC,MAAM,QAAQ,OAAO,EAAW;AAAA,MAC3C,MAAM;AAAA,IACR;AACA,WAAO,MAAM,IAAI,CAAC,UAAU;AAAA,MAC1B,IAAI,KAAK;AAAA,MACT,OAAO,KAAK,MAAM,KAAK,KAAK,KAAK;AAAA,MACjC,WAAW,KAAK,MAAM,KAAK,KAAK,KAAK,UAAU,KAAK,KAAK,KAAK,IAAI,KAAK,QAAQ;AAAA,IACjF,EAAE;AAAA,EACJ;AAAA,EAEA,MAAM,oBAAoB,OAMS;AACjC,UAAM,OAAO,KAAK,IAAI,GAAG,KAAK,MAAM,MAAM,IAAI,CAAC;AAC/C,UAAM,WAAW,KAAK,IAAI,oBAAoB,KAAK,IAAI,GAAG,KAAK,MAAM,MAAM,QAAQ,CAAC,CAAC;AACrF,UAAM,UAAU,OAAO,KAAK;AAC5B,UAAM,cAAc,aAAa,MAAM,eAAe,CAAC,CAAC;AACxD,UAAM,wBAAwB,MAAM;AAAA,MAClC,KAAK;AAAA,MACL,MAAM,MAAM;AAAA,MACZ,MAAM,MAAM;AAAA,IACd;AACA,UAAM,KAAK,KAAK,GAAG,UAAiC;AACpD,QAAI,gBAAgB,GACjB,WAAW,YAAY,EACvB,MAAM,eAAe,KAAK,MAAM,MAAM,QAAQ,EAC9C,MAAM,gBAAgB,MAAM,IAAI;AAEnC,QAAI,uBAAuB;AACzB,YAAM,uBAAuB,MAAM,KAAK,qBAAqB;AAC7D,YAAM,yBAAyB;AAAA,QAC7B;AAAA,QACA,sCAA+C,KAAK,UAAU,CAAC,SAAS,CAAC,CAAC;AAAA,QAC1E,GAAG,qBAAqB,IAAI,CAAC,mBAC3B,sCAA+C,KAAK,UAAU,CAAC,cAAc,CAAC,CAAC,SAChF;AAAA,MACH;AACA,YAAM,sBAAsB,OAAgB,IAAI,KAAK,wBAAwB,SAAS,CAAC;AACvF,sBAAgB,cAAc,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA,qCAKL,MAAM,MAAM,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iCAOxB,MAAM,MAAM,QAAQ;AAAA;AAAA,kBAEnC,mBAAmB;AAAA;AAAA,QAE7B;AAAA,IACJ;AACA,QAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,YAAM,gBAAgB,IAAI,kBAAkB,MAAM,OAAO,KAAK,CAAC,CAAC;AAChE,sBAAgB,cAAc,MAAM,mBAA4B,aAAa,EAAE;AAAA,IACjF;AACA,QAAI,YAAY,SAAS,GAAG;AAC1B,sBAAgB,cAAc,MAAM,QAAQ,UAAU,WAAW;AAAA,IACnE;AAEA,UAAM,iBAAiB,cACpB,OAAO,MAAM,EACb,MAAM,gBAAgB,EACtB,GAAG,eAAe;AACrB,UAAM,aAAa,GAChB,WAAW,cAAc,EACzB,OAAO,cAAsB,GAAG,OAAO,CAAC;AAC3C,UAAM,YAAY,cACf,OAAO,CAAC,QAAQ,QAAQ,CAAC,EACzB,QAAQ,QAAQ,KAAK,EACrB,MAAM,SAAS,mBAAmB,KAAK,IAAI,UAAU,mBAAmB,MAAM,IAAI,CAAC,EACnF,OAAO,KAAK,IAAI,QAAQ,gBAAgB,CAAC;AAE5C,UAAM,CAAC,MAAM,QAAQ,IAAI,MAAM,QAAQ,IAAI;AAAA,MACzC,UAAU,QAAQ;AAAA,MAClB,WAAW,iBAAiB;AAAA,IAC9B,CAAC;AACD,UAAM,cAAc,OAAO,UAAU,SAAS,CAAC;AAC/C,UAAM,QAAQ,OAAO,SAAS,WAAW,IACrC,KAAK,IAAI,kBAAkB,KAAK,IAAI,GAAG,KAAK,MAAM,WAAW,CAAC,CAAC,IAC/D;AAEJ,WAAO;AAAA,MACL,OAAO,KAAK,IAAI,CAAC,UAAU,EAAE,IAAI,KAAK,IAAI,OAAO,KAAK,MAAM,WAAW,KAAK,EAAE;AAAA,MAC9E;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,sBAAsB,UAAqC;AAC/D,WAAO,MAAM,KAAK,MAAM,sBAAsB,KAAK,IAAI,QAAQ,CAAC;AAAA,EAClE;AACF;",
-  "names": []
-}

package/dist/modules/auth/services/roleOrganizationScope.js

@@ -1,41 +0,0 @@
-function normalizeId(value) {
-  return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
-}
-async function resolveRoleOrganizationScope(hierarchyService, tenantId, organizationId) {
-  const selectedId = normalizeId(organizationId);
-  if (!selectedId) return null;
-  const normalizedTenantId = normalizeId(tenantId);
-  if (!normalizedTenantId) return /* @__PURE__ */ new Set();
-  const ids = /* @__PURE__ */ new Set([selectedId]);
-  if (!hierarchyService) return ids;
-  const ancestorIds = await hierarchyService.resolveAncestorIds({
-    tenantId: normalizedTenantId,
-    organizationId: selectedId
-  });
-  if (ancestorIds === null) return /* @__PURE__ */ new Set();
-  for (const ancestorId of ancestorIds) {
-    const normalized = normalizeId(ancestorId);
-    if (normalized) ids.add(normalized);
-  }
-  return ids;
-}
-function roleAclAllowsOrganization(acl, scope) {
-  if (!scope) return true;
-  const organizations = Array.isArray(acl.organizationsJson) ? acl.organizationsJson : null;
-  if (!organizations || organizations.length === 0 || organizations.includes("__all__")) return true;
-  return organizations.some((organizationId) => scope.has(organizationId));
-}
-function roleAclGrantsPrincipalOrganization(acl, scope) {
-  if (!scope) return true;
-  const organizations = Array.isArray(acl.organizationsJson) ? acl.organizationsJson : null;
-  if (!organizations) return true;
-  if (organizations.length === 0) return false;
-  if (organizations.includes("__all__")) return true;
-  return organizations.some((organizationId) => scope.has(organizationId));
-}
-export {
-  resolveRoleOrganizationScope,
-  roleAclAllowsOrganization,
-  roleAclGrantsPrincipalOrganization
-};
-//# sourceMappingURL=roleOrganizationScope.js.map

package/dist/modules/auth/services/roleOrganizationScope.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../src/modules/auth/services/roleOrganizationScope.ts"],
-  "sourcesContent": ["import type { OrganizationHierarchyService } from '@open-mercato/shared/lib/auth/principal-service'\nimport type { RoleAcl } from '../data/entities'\n\nexport type RoleOrganizationScope = ReadonlySet<string> | null\n\nfunction normalizeId(value: unknown): string | null {\n  return typeof value === 'string' && value.trim().length > 0 ? value.trim() : null\n}\n\nexport async function resolveRoleOrganizationScope(\n  hierarchyService: OrganizationHierarchyService | null | undefined,\n  tenantId: string | null | undefined,\n  organizationId: string | null | undefined,\n): Promise<RoleOrganizationScope> {\n  const selectedId = normalizeId(organizationId)\n  if (!selectedId) return null\n  const normalizedTenantId = normalizeId(tenantId)\n  if (!normalizedTenantId) return new Set()\n\n  const ids = new Set<string>([selectedId])\n  // Auth remains independently usable when Directory is disabled: exact-org\n  // grants still apply, while parent-to-descendant expansion fails closed.\n  if (!hierarchyService) return ids\n\n  const ancestorIds = await hierarchyService.resolveAncestorIds({\n    tenantId: normalizedTenantId,\n    organizationId: selectedId,\n  })\n  // A registered Directory seam can prove an invalid/wrong-tenant selection.\n  // Fail closed for restricted roles in that case.\n  if (ancestorIds === null) return new Set()\n  for (const ancestorId of ancestorIds) {\n    const normalized = normalizeId(ancestorId)\n    if (normalized) ids.add(normalized)\n  }\n  return ids\n}\n\nexport function roleAclAllowsOrganization(\n  acl: Pick<RoleAcl, 'organizationsJson'>,\n  scope: RoleOrganizationScope,\n): boolean {\n  if (!scope) return true\n  const organizations = Array.isArray(acl.organizationsJson) ? acl.organizationsJson : null\n  if (!organizations || organizations.length === 0 || organizations.includes('__all__')) return true\n  return organizations.some((organizationId) => scope.has(organizationId))\n}\n\n/**\n * Principal eligibility \u2014 which roles may be selected as, or resolved into, an explicit share\n * target \u2014 follows the human-principal deny-all contract instead: an empty allowlist grants no\n * organization reach, so such a role must not become a share principal here (#4033).\n *\n * This deliberately differs from `roleAclAllowsOrganization` above, which governs *feature*\n * evaluation and keeps the wider \"an empty list applies everywhere\" meaning, and from the\n * API-key projection, where an empty list means \"inherit the key's own organization binding\".\n * Without this split a user who reaches an organization through a second role could inherit\n * viewer/editor access from a share assigned to a deny-all role.\n */\nexport function roleAclGrantsPrincipalOrganization(\n  acl: Pick<RoleAcl, 'organizationsJson'>,\n  scope: RoleOrganizationScope,\n): boolean {\n  if (!scope) return true\n  const organizations = Array.isArray(acl.organizationsJson) ? acl.organizationsJson : null\n  if (!organizations) return true\n  if (organizations.length === 0) return false\n  if (organizations.includes('__all__')) return true\n  return organizations.some((organizationId) => scope.has(organizationId))\n}\n"],
-  "mappings": "AAKA,SAAS,YAAY,OAA+B;AAClD,SAAO,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,IAAI,MAAM,KAAK,IAAI;AAC/E;AAEA,eAAsB,6BACpB,kBACA,UACA,gBACgC;AAChC,QAAM,aAAa,YAAY,cAAc;AAC7C,MAAI,CAAC,WAAY,QAAO;AACxB,QAAM,qBAAqB,YAAY,QAAQ;AAC/C,MAAI,CAAC,mBAAoB,QAAO,oBAAI,IAAI;AAExC,QAAM,MAAM,oBAAI,IAAY,CAAC,UAAU,CAAC;AAGxC,MAAI,CAAC,iBAAkB,QAAO;AAE9B,QAAM,cAAc,MAAM,iBAAiB,mBAAmB;AAAA,IAC5D,UAAU;AAAA,IACV,gBAAgB;AAAA,EAClB,CAAC;AAGD,MAAI,gBAAgB,KAAM,QAAO,oBAAI,IAAI;AACzC,aAAW,cAAc,aAAa;AACpC,UAAM,aAAa,YAAY,UAAU;AACzC,QAAI,WAAY,KAAI,IAAI,UAAU;AAAA,EACpC;AACA,SAAO;AACT;AAEO,SAAS,0BACd,KACA,OACS;AACT,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,gBAAgB,MAAM,QAAQ,IAAI,iBAAiB,IAAI,IAAI,oBAAoB;AACrF,MAAI,CAAC,iBAAiB,cAAc,WAAW,KAAK,cAAc,SAAS,SAAS,EAAG,QAAO;AAC9F,SAAO,cAAc,KAAK,CAAC,mBAAmB,MAAM,IAAI,cAAc,CAAC;AACzE;AAaO,SAAS,mCACd,KACA,OACS;AACT,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,gBAAgB,MAAM,QAAQ,IAAI,iBAAiB,IAAI,IAAI,oBAAoB;AACrF,MAAI,CAAC,cAAe,QAAO;AAC3B,MAAI,cAAc,WAAW,EAAG,QAAO;AACvC,MAAI,cAAc,SAAS,SAAS,EAAG,QAAO;AAC9C,SAAO,cAAc,KAAK,CAAC,mBAAmB,MAAM,IAAI,cAAc,CAAC;AACzE;",
-  "names": []
-}