@open-mercato/core 0.7.0 → 0.7.1-develop.7102.1.b41f7e3e51

package/dist/modules/auth/services/rbacService.js

@@ -8,6 +8,7 @@ import {
   resolveEffectiveFeatures
 } from "@open-mercato/shared/security/featurePolicy";
 import { filterGrantsByEnabledModules } from "@open-mercato/shared/security/enabledModulesRegistry";
+import { resolveRoleOrganizationScope, roleAclAllowsOrganization } from "./roleOrganizationScope.js";
 function isAclData(value) {
   if (typeof value !== "object" || value === null) return false;
   const record = value;
@@ -19,9 +20,13 @@ function isAclData(value) {
   }
   return true;
 }
+function isRestrictedRoleAcl(acl) {
+  return Array.isArray(acl.organizationsJson) && acl.organizationsJson.length > 0 && !acl.organizationsJson.includes("__all__");
+}
 class RbacService {
-  constructor(em, cache) {
+  constructor(em, cache, organizationHierarchyService) {
     this.em = em;
+    this.organizationHierarchyService = organizationHierarchyService;
     this.cacheTtlMs = 5 * 60 * 1e3;
     // 5 minutes default
     this.cache = null;
@@ -39,12 +44,6 @@ class RbacService {
   hasAllFeatures(required, granted) {
     return authorizeFeatures(required, { grantedFeatures: granted });
   }
-  roleAclAllowsOrganization(acl, organizationId) {
-    if (!organizationId) return true;
-    const organizations = Array.isArray(acl.organizationsJson) ? acl.organizationsJson : null;
-    if (!organizations || !organizations.length || organizations.includes("__all__")) return true;
-    return organizations.includes(organizationId);
-  }
   getCacheKey(userId, scope) {
     return `rbac:${userId}:${scope.tenantId || "null"}:${scope.organizationId || "null"}`;
   }
@@ -71,6 +70,7 @@ class RbacService {
     ];
     if (scope.tenantId) {
       tags.push(this.getTenantTag(scope.tenantId));
+      tags.push(buildOrgScopeTenantCacheTag(scope.tenantId));
     }
     if (scope.organizationId) {
       tags.push(this.getOrganizationTag(scope.organizationId));
@@ -167,8 +167,8 @@ class RbacService {
       this.globalSuperAdminCache.set(userId, false);
       return false;
     }
-    const roleSuper = await em.findOne(RoleAcl, { isSuperAdmin: true, role: { $in: roleIds } });
-    const result = !!(roleSuper && roleSuper.isSuperAdmin);
+    const roleSupers = await em.find(RoleAcl, { isSuperAdmin: true, role: { $in: roleIds } });
+    const result = roleSupers.some((roleAcl) => !!roleAcl.isSuperAdmin && !isRestrictedRoleAcl(roleAcl));
     this.globalSuperAdminCache.set(userId, result);
     return result;
   }
@@ -215,28 +215,55 @@ class RbacService {
       }
       const tenantId2 = scope.tenantId || key.tenantId || null;
       const roleIds2 = Array.isArray(key.rolesJson) ? key.rolesJson.filter(Boolean) : [];
+      const keyOrganizationId = typeof key.organizationId === "string" && key.organizationId.trim().length > 0 ? key.organizationId.trim() : null;
+      const evaluatedOrganizationId = scope.organizationId || keyOrganizationId;
       let isSuper2 = false;
       const features2 = [];
-      let organizations2 = key.organizationId ? [key.organizationId] : null;
+      let roleOrganizations = [];
+      let hasApplicableRestrictedRole2 = false;
       if (tenantId2 && roleIds2.length) {
+        const roleOrganizationScope = await resolveRoleOrganizationScope(
+          this.organizationHierarchyService,
+          tenantId2,
+          evaluatedOrganizationId
+        );
         const racls = await em2.find(RoleAcl, { tenantId: tenantId2, role: { $in: roleIds2 } });
         for (const acl of racls) {
-          isSuper2 = isSuper2 || !!acl.isSuperAdmin;
-          if (Array.isArray(acl.featuresJson)) {
-            for (const f of acl.featuresJson) if (!features2.includes(f)) features2.push(f);
+          if (roleAclAllowsOrganization(acl, roleOrganizationScope)) {
+            isSuper2 = isSuper2 || !!acl.isSuperAdmin;
+            if (Array.isArray(acl.featuresJson)) {
+              for (const f of acl.featuresJson) if (!features2.includes(f)) features2.push(f);
+            }
+            if (isRestrictedRoleAcl(acl)) hasApplicableRestrictedRole2 = true;
           }
-          if (organizations2 !== null) {
-            if (acl.organizationsJson == null) {
-              organizations2 = null;
+          if (roleOrganizations !== null) {
+            if (acl.organizationsJson == null || Array.isArray(acl.organizationsJson) && acl.organizationsJson.length === 0) {
+              roleOrganizations = null;
             } else if (Array.isArray(acl.organizationsJson) && acl.organizationsJson.includes("__all__")) {
-              organizations2 = null;
+              roleOrganizations = null;
             } else {
-              organizations2 = Array.from(/* @__PURE__ */ new Set([...organizations2 || [], ...acl.organizationsJson]));
+              roleOrganizations = Array.from(/* @__PURE__ */ new Set([
+                ...roleOrganizations,
+                ...Array.isArray(acl.organizationsJson) ? acl.organizationsJson : []
+              ]));
             }
           }
         }
+        if (roleOrganizations !== null && evaluatedOrganizationId && roleOrganizationScope !== null && roleOrganizationScope.size > 0 && hasApplicableRestrictedRole2 && !roleOrganizations.includes(evaluatedOrganizationId)) {
+          roleOrganizations.push(evaluatedOrganizationId);
+        }
       }
-      const result2 = { isSuperAdmin: isSuper2, features: features2, organizations: organizations2 };
+      let organizations2 = roleOrganizations;
+      if (keyOrganizationId) {
+        const keyOrganizationScope = await resolveRoleOrganizationScope(
+          this.organizationHierarchyService,
+          tenantId2,
+          keyOrganizationId
+        );
+        organizations2 = roleOrganizations === null || roleOrganizations.some((organizationId) => keyOrganizationScope?.has(organizationId)) ? [keyOrganizationId] : [];
+      }
+      if (isSuper2 && organizations2 !== null && !features2.includes("*")) features2.push("*");
+      const result2 = { isSuperAdmin: isSuper2 && organizations2 === null, features: features2, organizations: organizations2 };
       await this.setCache(cacheKey, result2, userId, scope);
       return result2;
     }
@@ -276,13 +303,22 @@ class RbacService {
     let isSuper = false;
     const features = [];
     let organizations = [];
+    let hasApplicableRestrictedRole = false;
     if (roleIds.length) {
+      const roleOrganizationScope = await resolveRoleOrganizationScope(
+        this.organizationHierarchyService,
+        tenantId,
+        scope.organizationId
+      );
       const racls = await em.find(RoleAcl, { tenantId, role: { $in: roleIds } }, {});
       const roleAcls = Array.isArray(racls) ? racls : [];
       for (const r of roleAcls) {
-        isSuper = isSuper || !!r.isSuperAdmin;
-        if (Array.isArray(r.featuresJson)) {
-          for (const f of r.featuresJson) if (!features.includes(f)) features.push(f);
+        if (roleAclAllowsOrganization(r, roleOrganizationScope)) {
+          isSuper = isSuper || !!r.isSuperAdmin;
+          if (Array.isArray(r.featuresJson)) {
+            for (const f of r.featuresJson) if (!features.includes(f)) features.push(f);
+          }
+          if (isRestrictedRoleAcl(r)) hasApplicableRestrictedRole = true;
         }
         if (organizations !== null) {
           if (r.organizationsJson == null) organizations = null;
@@ -290,6 +326,9 @@ class RbacService {
           else organizations = Array.from(/* @__PURE__ */ new Set([...organizations || [], ...r.organizationsJson]));
         }
       }
+      if (organizations !== null && scope.organizationId && roleOrganizationScope !== null && roleOrganizationScope.size > 0 && hasApplicableRestrictedRole && !organizations.includes(scope.organizationId)) {
+        organizations.push(scope.organizationId);
+      }
     }
     if (organizations && orgId && !organizations.includes(orgId) && !organizations.includes("__all__")) {
     }
@@ -306,11 +345,15 @@ class RbacService {
   async tenantHasFeature(tenantId, feature, opts) {
     if (!tenantId || !feature) return false;
     const em = this.em.fork();
+    const roleOrganizationScope = await resolveRoleOrganizationScope(
+      this.organizationHierarchyService,
+      tenantId,
+      opts?.organizationId
+    );
     const roleAcls = await em.find(RoleAcl, { tenantId, deletedAt: null }, {});
     const list = Array.isArray(roleAcls) ? roleAcls : [];
-    const organizationId = opts?.organizationId ?? null;
     for (const acl of list) {
-      if (!this.roleAclAllowsOrganization(acl, organizationId)) continue;
+      if (!roleAclAllowsOrganization(acl, roleOrganizationScope)) continue;
       const grants = Array.isArray(acl.featuresJson) ? acl.featuresJson : [];
       if (authorizeFeatures([feature], {
         grantedFeatures: grants,

package/dist/modules/auth/services/rbacService.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/auth/services/rbacService.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CacheStrategy } from '@open-mercato/cache'\nimport { getCurrentCacheTenant, runWithCacheTenant } from '@open-mercato/cache'\nimport { UserAcl, RoleAcl, User, UserRole } from '@open-mercato/core/modules/auth/data/entities'\nimport { ApiKey } from '@open-mercato/core/modules/api_keys/data/entities'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { buildOrgScopeUserCacheTag, buildOrgScopeTenantCacheTag } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport {\n  authorizeFeatures,\n  resolveEffectiveFeatures,\n} from '@open-mercato/shared/security/featurePolicy'\nimport { filterGrantsByEnabledModules } from '@open-mercato/shared/security/enabledModulesRegistry'\n\ninterface AclData {\n  isSuperAdmin: boolean\n  features: string[]\n  organizations: string[] | null\n}\n\nfunction isAclData(value: unknown): value is AclData {\n  if (typeof value !== 'object' || value === null) return false\n  const record = value as Partial<AclData>\n  if (typeof record.isSuperAdmin !== 'boolean') return false\n  if (!Array.isArray(record.features) || record.features.some((feature) => typeof feature !== 'string')) return false\n  if (record.organizations !== null && record.organizations !== undefined) {\n    if (!Array.isArray(record.organizations)) return false\n    if (record.organizations.some((org) => typeof org !== 'string')) return false\n  }\n  return true\n}\n\nexport class RbacService {\n  private cacheTtlMs: number = 5 * 60 * 1000 // 5 minutes default\n  private cache: CacheStrategy | null = null\n  private globalSuperAdminCache = new Map<string, boolean>()\n\n  constructor(private em: EntityManager, cache?: CacheStrategy) {\n    this.cache = cache || null\n  }\n\n  /**\n   * Set cache TTL in milliseconds\n   * @param ttlMs - Time to live in milliseconds\n   */\n  setCacheTtl(ttlMs: number) {\n    this.cacheTtlMs = ttlMs\n  }\n\n  /** Compatibility wrapper for callers that already have both feature lists. */\n  public hasAllFeatures(required: string[], granted: string[]): boolean {\n    return authorizeFeatures(required, { grantedFeatures: granted })\n  }\n\n  private roleAclAllowsOrganization(acl: RoleAcl, organizationId: string | null | undefined): boolean {\n    if (!organizationId) return true\n    const organizations = Array.isArray(acl.organizationsJson) ? acl.organizationsJson : null\n    if (!organizations || !organizations.length || organizations.includes('__all__')) return true\n    return organizations.includes(organizationId)\n  }\n\n  private getCacheKey(userId: string, scope: { tenantId: string | null; organizationId: string | null }): string {\n    return `rbac:${userId}:${scope.tenantId || 'null'}:${scope.organizationId || 'null'}`\n  }\n\n  private getUserTag(userId: string): string {\n    return `rbac:user:${userId}`\n  }\n\n  private getTenantTag(tenantId: string): string {\n    return `rbac:tenant:${tenantId}`\n  }\n\n  private getOrganizationTag(organizationId: string): string {\n    return `rbac:org:${organizationId}`\n  }\n\n  private async getFromCache(cacheKey: string): Promise<AclData | null> {\n    if (!this.cache) return null\n    const cached = await this.cache.get(cacheKey)\n    if (!cached) return null\n    return isAclData(cached) ? cached : null\n  }\n\n  private async setCache(cacheKey: string, data: AclData, userId: string, scope: { tenantId: string | null; organizationId: string | null }): Promise<void> {\n    if (!this.cache) return\n\n    const tags = [\n      this.getUserTag(userId),\n      'rbac:all'\n    ]\n\n    if (scope.tenantId) {\n      tags.push(this.getTenantTag(scope.tenantId))\n    }\n\n    if (scope.organizationId) {\n      tags.push(this.getOrganizationTag(scope.organizationId))\n    }\n\n    await this.cache.set(cacheKey, data, {\n      ttl: this.cacheTtlMs,\n      tags\n    })\n  }\n\n  /**\n   * Invalidates cached ACL data for a specific user across all tenants and organizations.\n   * Call this when a user's roles or user-specific ACL is modified.\n   * \n   * @param userId - The ID of the user whose cache should be invalidated\n   */\n  async invalidateUserCache(userId: string): Promise<void> {\n    this.globalSuperAdminCache.delete(userId)\n    // Also drop the directory OrganizationScope cache for this user. That scope's\n    // accessible-org set is derived from this user's ACL/role grants, so any\n    // permission change that invalidates the RBAC cache must invalidate the\n    // resolved scope too. This is the missing `org-scope:user:*` caller required\n    // before the cross-request scope TTL can be safely enabled (issue #2259).\n    await this.deleteCacheByTags([this.getUserTag(userId), buildOrgScopeUserCacheTag(userId)])\n  }\n\n  /**\n   * Invalidates cached ACL data for all users within a specific tenant.\n   * Call this when a role's ACL is modified, since roles are tenant-scoped\n   * and affect all users in that tenant who have that role.\n   * \n   * @param tenantId - The ID of the tenant whose cache should be invalidated\n   */\n  async invalidateTenantCache(tenantId: string): Promise<void> {\n    this.globalSuperAdminCache.clear()\n    // Role ACL changes invalidate every user in the tenant; the resolved\n    // OrganizationScope for those users derives from the same grants, so drop\n    // the tenant-tagged scope entries alongside the RBAC ones (issue #2259).\n    await this.deleteCacheByTags([this.getTenantTag(tenantId), buildOrgScopeTenantCacheTag(tenantId)], [tenantId])\n  }\n\n  /**\n   * Invalidates cached ACL data for all users within a specific organization.\n   * Call this when organization-level permissions or visibility changes.\n   * \n   * @param organizationId - The ID of the organization whose cache should be invalidated\n   */\n  async invalidateOrganizationCache(organizationId: string): Promise<void> {\n    await this.deleteCacheByTags([this.getOrganizationTag(organizationId)])\n  }\n\n  /**\n   * Clears all cached ACL data.\n   * Use this for bulk operations or system-wide ACL changes.\n   */\n  async invalidateAllCache(): Promise<void> {\n    this.globalSuperAdminCache.clear()\n    await this.deleteCacheByTags(['rbac:all'])\n  }\n\n  private async deleteCacheByTags(tags: string[], tenantHints?: Array<string | null>): Promise<void> {\n    if (!this.cache) return\n    const contexts = new Set<string | null>()\n    const current = getCurrentCacheTenant()\n    contexts.add(current ?? null)\n    contexts.add(null)\n    if (Array.isArray(tenantHints)) {\n      for (const hint of tenantHints) {\n        contexts.add(hint ?? null)\n      }\n    }\n    for (const ctx of contexts) {\n      if (ctx === current) {\n        await this.cache.deleteByTags(tags)\n      } else {\n        await runWithCacheTenant(ctx, async () => {\n          await this.cache!.deleteByTags(tags)\n        })\n      }\n    }\n  }\n\n  private async isGlobalSuperAdmin(userId: string): Promise<boolean> {\n    if (this.globalSuperAdminCache.has(userId)) return this.globalSuperAdminCache.get(userId)!\n    const em = this.em.fork()\n    const userSuper = await em.findOne(UserAcl, { user: userId as any, isSuperAdmin: true })\n    if (userSuper && (userSuper as any).isSuperAdmin) {\n      this.globalSuperAdminCache.set(userId, true)\n      return true\n    }\n    const links = await findWithDecryption(\n      em,\n      UserRole,\n      { user: userId as any },\n      { populate: ['role'] },\n      { tenantId: null, organizationId: null },\n    )\n    const linkList = Array.isArray(links) ? links : []\n    if (!linkList.length) {\n      this.globalSuperAdminCache.set(userId, false)\n      return false\n    }\n    const roleIds = Array.from(new Set(linkList.map((link) => {\n      const role = link.role as any\n      return role?.id ? String(role.id) : null\n    }).filter((id): id is string => typeof id === 'string' && id.length > 0)))\n    if (!roleIds.length) {\n      this.globalSuperAdminCache.set(userId, false)\n      return false\n    }\n    const roleSuper = await em.findOne(RoleAcl, { isSuperAdmin: true, role: { $in: roleIds as any } } as any)\n    const result = !!(roleSuper && (roleSuper as any).isSuperAdmin)\n    this.globalSuperAdminCache.set(userId, result)\n    return result\n  }\n\n  /**\n   * Loads the Access Control List (ACL) for a user within a given scope.\n   * \n   * The ACL resolution follows this priority:\n   * 1. Per-user ACL (UserAcl) - if exists, use it exclusively\n   * 2. Aggregated role ACLs (RoleAcl) - combine permissions from all user's roles\n   * \n   * Results are cached for performance (default 5 minutes TTL).\n   * Cache is automatically invalidated when ACL-related data changes.\n   * \n   * @param userId - The ID of the user\n   * @param scope - The tenant and organization context for ACL evaluation\n   * @returns An object containing:\n   *   - isSuperAdmin: If true, user has unrestricted access to all features\n   *   - features: Array of feature strings (may include wildcards like 'entities.*')\n   *   - organizations: Array of organization IDs user can access, or null for all organizations\n   * \n   * @example\n   * const acl = await rbacService.loadAcl('user-123', { tenantId: 'tenant-1', organizationId: 'org-1' })\n   * // Returns: { isSuperAdmin: false, features: ['users.view', 'entities.*'], organizations: ['org-1', 'org-2'] }\n   */\n  async loadAcl(userId: string, scope: { tenantId: string | null; organizationId: string | null }): Promise<{\n    isSuperAdmin: boolean\n    features: string[]\n    organizations: string[] | null\n  }> {\n    const cacheKey = this.getCacheKey(userId, scope)\n    const cached = await this.getFromCache(cacheKey)\n    if (cached) return cached\n\n    if (!userId.startsWith('api_key:')) {\n      if (await this.isGlobalSuperAdmin(userId)) {\n        const result = { isSuperAdmin: true, features: ['*'], organizations: null }\n        await this.setCache(cacheKey, result, userId, scope)\n        return result\n      }\n    }\n\n    if (userId.startsWith('api_key:')) {\n      const apiKeyId = userId.slice('api_key:'.length)\n      const em = this.em.fork()\n      const key = await em.findOne(ApiKey, { id: apiKeyId, deletedAt: null })\n      if (!key || (key.expiresAt && key.expiresAt.getTime() < Date.now())) {\n        const result = { isSuperAdmin: false, features: [], organizations: null }\n        await this.setCache(cacheKey, result, userId, scope)\n        return result\n      }\n      const tenantId = scope.tenantId || key.tenantId || null\n      const roleIds = Array.isArray(key.rolesJson) ? key.rolesJson.filter(Boolean) : []\n      let isSuper = false\n      const features: string[] = []\n      let organizations: string[] | null = key.organizationId ? [key.organizationId] : null\n      if (tenantId && roleIds.length) {\n        const racls = await em.find(RoleAcl, { tenantId, role: { $in: roleIds as any } } as any)\n        for (const acl of racls) {\n          isSuper = isSuper || !!acl.isSuperAdmin\n          if (Array.isArray(acl.featuresJson)) {\n            for (const f of acl.featuresJson) if (!features.includes(f)) features.push(f)\n          }\n          if (organizations !== null) {\n            if (acl.organizationsJson == null) {\n              organizations = null\n            } else if (Array.isArray(acl.organizationsJson) && acl.organizationsJson.includes('__all__')) {\n              organizations = null\n            } else {\n              organizations = Array.from(new Set([...(organizations || []), ...acl.organizationsJson]))\n            }\n          }\n        }\n      }\n      const result = { isSuperAdmin: isSuper, features, organizations }\n      await this.setCache(cacheKey, result, userId, scope)\n      return result\n    }\n\n    // Use a forked EntityManager to avoid inheriting an aborted transaction from callers\n    const em = this.em.fork()\n    const user = await em.findOne(User, { id: userId })\n    if (!user) {\n      const result = { isSuperAdmin: false, features: [], organizations: null }\n      await this.setCache(cacheKey, result, userId, scope)\n      return result\n    }\n    const tenantId = scope.tenantId || user.tenantId || null\n    const orgId = scope.organizationId || user.organizationId || null\n\n    if (!tenantId) {\n      const result = { isSuperAdmin: false, features: [], organizations: null }\n      await this.setCache(cacheKey, result, userId, scope)\n      return result\n    }\n\n    // Per-user ACL first\n    const uacl = await em.findOne(UserAcl, { user: userId as any, tenantId })\n    if (uacl) {\n      const result = {\n        isSuperAdmin: !!uacl.isSuperAdmin,\n        features: Array.isArray(uacl.featuresJson) ? (uacl.featuresJson as string[]) : [],\n        organizations: Array.isArray(uacl.organizationsJson) ? (uacl.organizationsJson as string[]) : null,\n      }\n      await this.setCache(cacheKey, result, userId, scope)\n      return result\n    }\n\n    // Aggregate role ACLs\n    const links = await findWithDecryption(\n      em,\n      UserRole,\n      { user: userId as any, role: { tenantId } } as any,\n      { populate: ['role'] },\n      { tenantId, organizationId: orgId },\n    )\n    const linkList = Array.isArray(links) ? links : []\n    const roleIds = linkList.map((l) => (l.role as any)?.id).filter(Boolean)\n    let isSuper = false\n    const features: string[] = []\n    let organizations: string[] | null = []\n    if (roleIds.length) {\n      const racls = await em.find(RoleAcl, { tenantId, role: { $in: roleIds as any } } as any, {})\n      const roleAcls = Array.isArray(racls) ? racls : []\n      for (const r of roleAcls) {\n        isSuper = isSuper || !!r.isSuperAdmin\n        if (Array.isArray(r.featuresJson)) for (const f of r.featuresJson) if (!features.includes(f)) features.push(f)\n        if (organizations !== null) {\n          if (r.organizationsJson == null) organizations = null\n          else if (Array.isArray(r.organizationsJson) && r.organizationsJson.includes('__all__')) organizations = null\n          else organizations = Array.from(new Set([...(organizations || []), ...r.organizationsJson]))\n        }\n      }\n    }\n    if (organizations && orgId && !organizations.includes(orgId) && !organizations.includes('__all__')) {\n      // Out-of-scope org; caller will enforce\n    }\n    const result = { isSuperAdmin: isSuper, features, organizations }\n    await this.setCache(cacheKey, result, userId, scope)\n    return result\n  }\n\n  /**\n   * Checks whether any tenant role grants a feature.\n   *\n   * This supports non-user runtimes such as scheduler workers that execute with\n   * tenant scope but without an authenticated user.\n   */\n  async tenantHasFeature(\n    tenantId: string | null | undefined,\n    feature: string,\n    opts?: { organizationId?: string | null },\n  ): Promise<boolean> {\n    if (!tenantId || !feature) return false\n\n    const em = this.em.fork()\n    const roleAcls = await em.find(RoleAcl, { tenantId, deletedAt: null } as any, {})\n    const list = Array.isArray(roleAcls) ? roleAcls : []\n    const organizationId = opts?.organizationId ?? null\n\n    for (const acl of list) {\n      if (!this.roleAclAllowsOrganization(acl, organizationId)) continue\n      const grants = Array.isArray(acl.featuresJson) ? acl.featuresJson : []\n      if (authorizeFeatures([feature], {\n        grantedFeatures: grants,\n        unrestricted: acl.isSuperAdmin,\n      })) {\n        return true\n      }\n    }\n\n    return false\n  }\n\n  /**\n   * Checks if a user has all required features within a given scope.\n   *\n   * This is the primary authorization check method used throughout the application.\n   * It combines feature checking with organization visibility validation.\n   *\n   * Authorization logic:\n   * 1. No features required \u2192 always returns true\n   * 2. User is super admin \u2192 always returns true\n   * 3. Organization restriction check: If the user's ACL has a restricted organization list\n   *    and the requested organization is not in that list \u2192 returns false\n   * 4. Feature matching: User must have all required features (supports wildcards)\n   *\n   * @param userId - The ID of the user\n   * @param required - Array of feature strings to check (e.g., ['users.view', 'users.edit'])\n   * @param scope - The tenant and organization context for authorization\n   * @returns true if the user has all required features and organization access, false otherwise\n   *\n   * @example\n   * // Check if user can view and edit users\n   * const canManageUsers = await rbacService.userHasAllFeatures(\n   *   'user-123',\n   *   ['users.view', 'users.edit'],\n   *   { tenantId: 'tenant-1', organizationId: 'org-1' }\n   * )\n   *\n   * @example\n   * // Check with wildcard features\n   * const canAccessEntities = await rbacService.userHasAllFeatures(\n   *   'user-123',\n   *   ['entities.records.view'],\n   *   { tenantId: 'tenant-1', organizationId: 'org-1' }\n   * )\n   * // Returns true if user has 'entities.*', '*', or 'entities.records.view'\n   */\n  async userHasAllFeatures(userId: string, required: string[], scope: { tenantId: string | null; organizationId: string | null }): Promise<boolean> {\n    if (!required.length) return true\n    const acl = await this.loadAcl(userId, scope)\n    const organizationAllowed = acl.isSuperAdmin\n      || !acl.organizations\n      || !scope.organizationId\n      || acl.organizations.includes(scope.organizationId)\n      || acl.organizations.includes('__all__')\n    return authorizeFeatures(required, {\n      grantedFeatures: acl.features,\n      unrestricted: acl.isSuperAdmin,\n      scopeAllowed: organizationAllowed,\n    })\n  }\n\n  /**\n   * Returns the user's infrastructure grant list, filtered to enabled modules.\n   * The result may contain wildcards; authoritative checks must still go through\n   * `authorizeFeatures` or `userHasAllFeatures` so null overrides are enforced.\n   */\n  async getGrantedFeatures(\n    userId: string,\n    scope: { tenantId: string | null; organizationId: string | null },\n  ): Promise<string[]> {\n    const acl = await this.loadAcl(userId, scope)\n    if (acl.isSuperAdmin) return filterGrantsByEnabledModules(['*'])\n    if (\n      acl.organizations &&\n      scope.organizationId &&\n      !acl.organizations.includes(scope.organizationId) &&\n      !acl.organizations.includes('__all__')\n    ) {\n      return []\n    }\n    return filterGrantsByEnabledModules(acl.features)\n  }\n\n  /** Returns concrete active feature IDs for browser capability payloads. */\n  async getEffectiveFeatures(\n    userId: string,\n    scope: { tenantId: string | null; organizationId: string | null },\n  ): Promise<string[]> {\n    const acl = await this.loadAcl(userId, scope)\n    const organizationAllowed = acl.isSuperAdmin\n      || !acl.organizations\n      || !scope.organizationId\n      || acl.organizations.includes(scope.organizationId)\n      || acl.organizations.includes('__all__')\n    if (!organizationAllowed) return []\n    return resolveEffectiveFeatures(acl.isSuperAdmin ? ['*'] : acl.features)\n  }\n}\n"],
-  "mappings": "AAEA,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,SAAS,SAAS,MAAM,gBAAgB;AACjD,SAAS,cAAc;AACvB,SAAS,0BAA0B;AACnC,SAAS,2BAA2B,mCAAmC;AACvE;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,oCAAoC;AAQ7C,SAAS,UAAU,OAAkC;AACnD,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,SAAS;AACf,MAAI,OAAO,OAAO,iBAAiB,UAAW,QAAO;AACrD,MAAI,CAAC,MAAM,QAAQ,OAAO,QAAQ,KAAK,OAAO,SAAS,KAAK,CAAC,YAAY,OAAO,YAAY,QAAQ,EAAG,QAAO;AAC9G,MAAI,OAAO,kBAAkB,QAAQ,OAAO,kBAAkB,QAAW;AACvE,QAAI,CAAC,MAAM,QAAQ,OAAO,aAAa,EAAG,QAAO;AACjD,QAAI,OAAO,cAAc,KAAK,CAAC,QAAQ,OAAO,QAAQ,QAAQ,EAAG,QAAO;AAAA,EAC1E;AACA,SAAO;AACT;AAEO,MAAM,YAAY;AAAA,EAKvB,YAAoB,IAAmB,OAAuB;AAA1C;AAJpB,SAAQ,aAAqB,IAAI,KAAK;AACtC;AAAA,SAAQ,QAA8B;AACtC,SAAQ,wBAAwB,oBAAI,IAAqB;AAGvD,SAAK,QAAQ,SAAS;AAAA,EACxB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,YAAY,OAAe;AACzB,SAAK,aAAa;AAAA,EACpB;AAAA;AAAA,EAGO,eAAe,UAAoB,SAA4B;AACpE,WAAO,kBAAkB,UAAU,EAAE,iBAAiB,QAAQ,CAAC;AAAA,EACjE;AAAA,EAEQ,0BAA0B,KAAc,gBAAoD;AAClG,QAAI,CAAC,eAAgB,QAAO;AAC5B,UAAM,gBAAgB,MAAM,QAAQ,IAAI,iBAAiB,IAAI,IAAI,oBAAoB;AACrF,QAAI,CAAC,iBAAiB,CAAC,cAAc,UAAU,cAAc,SAAS,SAAS,EAAG,QAAO;AACzF,WAAO,cAAc,SAAS,cAAc;AAAA,EAC9C;AAAA,EAEQ,YAAY,QAAgB,OAA2E;AAC7G,WAAO,QAAQ,MAAM,IAAI,MAAM,YAAY,MAAM,IAAI,MAAM,kBAAkB,MAAM;AAAA,EACrF;AAAA,EAEQ,WAAW,QAAwB;AACzC,WAAO,aAAa,MAAM;AAAA,EAC5B;AAAA,EAEQ,aAAa,UAA0B;AAC7C,WAAO,eAAe,QAAQ;AAAA,EAChC;AAAA,EAEQ,mBAAmB,gBAAgC;AACzD,WAAO,YAAY,cAAc;AAAA,EACnC;AAAA,EAEA,MAAc,aAAa,UAA2C;AACpE,QAAI,CAAC,KAAK,MAAO,QAAO;AACxB,UAAM,SAAS,MAAM,KAAK,MAAM,IAAI,QAAQ;AAC5C,QAAI,CAAC,OAAQ,QAAO;AACpB,WAAO,UAAU,MAAM,IAAI,SAAS;AAAA,EACtC;AAAA,EAEA,MAAc,SAAS,UAAkB,MAAe,QAAgB,OAAkF;AACxJ,QAAI,CAAC,KAAK,MAAO;AAEjB,UAAM,OAAO;AAAA,MACX,KAAK,WAAW,MAAM;AAAA,MACtB;AAAA,IACF;AAEA,QAAI,MAAM,UAAU;AAClB,WAAK,KAAK,KAAK,aAAa,MAAM,QAAQ,CAAC;AAAA,IAC7C;AAEA,QAAI,MAAM,gBAAgB;AACxB,WAAK,KAAK,KAAK,mBAAmB,MAAM,cAAc,CAAC;AAAA,IACzD;AAEA,UAAM,KAAK,MAAM,IAAI,UAAU,MAAM;AAAA,MACnC,KAAK,KAAK;AAAA,MACV;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,oBAAoB,QAA+B;AACvD,SAAK,sBAAsB,OAAO,MAAM;AAMxC,UAAM,KAAK,kBAAkB,CAAC,KAAK,WAAW,MAAM,GAAG,0BAA0B,MAAM,CAAC,CAAC;AAAA,EAC3F;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,sBAAsB,UAAiC;AAC3D,SAAK,sBAAsB,MAAM;AAIjC,UAAM,KAAK,kBAAkB,CAAC,KAAK,aAAa,QAAQ,GAAG,4BAA4B,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;AAAA,EAC/G;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,4BAA4B,gBAAuC;AACvE,UAAM,KAAK,kBAAkB,CAAC,KAAK,mBAAmB,cAAc,CAAC,CAAC;AAAA,EACxE;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,qBAAoC;AACxC,SAAK,sBAAsB,MAAM;AACjC,UAAM,KAAK,kBAAkB,CAAC,UAAU,CAAC;AAAA,EAC3C;AAAA,EAEA,MAAc,kBAAkB,MAAgB,aAAmD;AACjG,QAAI,CAAC,KAAK,MAAO;AACjB,UAAM,WAAW,oBAAI,IAAmB;AACxC,UAAM,UAAU,sBAAsB;AACtC,aAAS,IAAI,WAAW,IAAI;AAC5B,aAAS,IAAI,IAAI;AACjB,QAAI,MAAM,QAAQ,WAAW,GAAG;AAC9B,iBAAW,QAAQ,aAAa;AAC9B,iBAAS,IAAI,QAAQ,IAAI;AAAA,MAC3B;AAAA,IACF;AACA,eAAW,OAAO,UAAU;AAC1B,UAAI,QAAQ,SAAS;AACnB,cAAM,KAAK,MAAM,aAAa,IAAI;AAAA,MACpC,OAAO;AACL,cAAM,mBAAmB,KAAK,YAAY;AACxC,gBAAM,KAAK,MAAO,aAAa,IAAI;AAAA,QACrC,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,mBAAmB,QAAkC;AACjE,QAAI,KAAK,sBAAsB,IAAI,MAAM,EAAG,QAAO,KAAK,sBAAsB,IAAI,MAAM;AACxF,UAAM,KAAK,KAAK,GAAG,KAAK;AACxB,UAAM,YAAY,MAAM,GAAG,QAAQ,SAAS,EAAE,MAAM,QAAe,cAAc,KAAK,CAAC;AACvF,QAAI,aAAc,UAAkB,cAAc;AAChD,WAAK,sBAAsB,IAAI,QAAQ,IAAI;AAC3C,aAAO;AAAA,IACT;AACA,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA,EAAE,MAAM,OAAc;AAAA,MACtB,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,MACrB,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,IACzC;AACA,UAAM,WAAW,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC;AACjD,QAAI,CAAC,SAAS,QAAQ;AACpB,WAAK,sBAAsB,IAAI,QAAQ,KAAK;AAC5C,aAAO;AAAA,IACT;AACA,UAAM,UAAU,MAAM,KAAK,IAAI,IAAI,SAAS,IAAI,CAAC,SAAS;AACxD,YAAM,OAAO,KAAK;AAClB,aAAO,MAAM,KAAK,OAAO,KAAK,EAAE,IAAI;AAAA,IACtC,CAAC,EAAE,OAAO,CAAC,OAAqB,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC,CAAC,CAAC;AACzE,QAAI,CAAC,QAAQ,QAAQ;AACnB,WAAK,sBAAsB,IAAI,QAAQ,KAAK;AAC5C,aAAO;AAAA,IACT;AACA,UAAM,YAAY,MAAM,GAAG,QAAQ,SAAS,EAAE,cAAc,MAAM,MAAM,EAAE,KAAK,QAAe,EAAE,CAAQ;AACxG,UAAM,SAAS,CAAC,EAAE,aAAc,UAAkB;AAClD,SAAK,sBAAsB,IAAI,QAAQ,MAAM;AAC7C,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,MAAM,QAAQ,QAAgB,OAI3B;AACD,UAAM,WAAW,KAAK,YAAY,QAAQ,KAAK;AAC/C,UAAM,SAAS,MAAM,KAAK,aAAa,QAAQ;AAC/C,QAAI,OAAQ,QAAO;AAEnB,QAAI,CAAC,OAAO,WAAW,UAAU,GAAG;AAClC,UAAI,MAAM,KAAK,mBAAmB,MAAM,GAAG;AACzC,cAAMA,UAAS,EAAE,cAAc,MAAM,UAAU,CAAC,GAAG,GAAG,eAAe,KAAK;AAC1E,cAAM,KAAK,SAAS,UAAUA,SAAQ,QAAQ,KAAK;AACnD,eAAOA;AAAA,MACT;AAAA,IACF;AAEA,QAAI,OAAO,WAAW,UAAU,GAAG;AACjC,YAAM,WAAW,OAAO,MAAM,WAAW,MAAM;AAC/C,YAAMC,MAAK,KAAK,GAAG,KAAK;AACxB,YAAM,MAAM,MAAMA,IAAG,QAAQ,QAAQ,EAAE,IAAI,UAAU,WAAW,KAAK,CAAC;AACtE,UAAI,CAAC,OAAQ,IAAI,aAAa,IAAI,UAAU,QAAQ,IAAI,KAAK,IAAI,GAAI;AACnE,cAAMD,UAAS,EAAE,cAAc,OAAO,UAAU,CAAC,GAAG,eAAe,KAAK;AACxE,cAAM,KAAK,SAAS,UAAUA,SAAQ,QAAQ,KAAK;AACnD,eAAOA;AAAA,MACT;AACA,YAAME,YAAW,MAAM,YAAY,IAAI,YAAY;AACnD,YAAMC,WAAU,MAAM,QAAQ,IAAI,SAAS,IAAI,IAAI,UAAU,OAAO,OAAO,IAAI,CAAC;AAChF,UAAIC,WAAU;AACd,YAAMC,YAAqB,CAAC;AAC5B,UAAIC,iBAAiC,IAAI,iBAAiB,CAAC,IAAI,cAAc,IAAI;AACjF,UAAIJ,aAAYC,SAAQ,QAAQ;AAC9B,cAAM,QAAQ,MAAMF,IAAG,KAAK,SAAS,EAAE,UAAAC,WAAU,MAAM,EAAE,KAAKC,SAAe,EAAE,CAAQ;AACvF,mBAAW,OAAO,OAAO;AACvB,UAAAC,WAAUA,YAAW,CAAC,CAAC,IAAI;AAC3B,cAAI,MAAM,QAAQ,IAAI,YAAY,GAAG;AACnC,uBAAW,KAAK,IAAI,aAAc,KAAI,CAACC,UAAS,SAAS,CAAC,EAAG,CAAAA,UAAS,KAAK,CAAC;AAAA,UAC9E;AACA,cAAIC,mBAAkB,MAAM;AAC1B,gBAAI,IAAI,qBAAqB,MAAM;AACjC,cAAAA,iBAAgB;AAAA,YAClB,WAAW,MAAM,QAAQ,IAAI,iBAAiB,KAAK,IAAI,kBAAkB,SAAS,SAAS,GAAG;AAC5F,cAAAA,iBAAgB;AAAA,YAClB,OAAO;AACL,cAAAA,iBAAgB,MAAM,KAAK,oBAAI,IAAI,CAAC,GAAIA,kBAAiB,CAAC,GAAI,GAAG,IAAI,iBAAiB,CAAC,CAAC;AAAA,YAC1F;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,YAAMN,UAAS,EAAE,cAAcI,UAAS,UAAAC,WAAU,eAAAC,eAAc;AAChE,YAAM,KAAK,SAAS,UAAUN,SAAQ,QAAQ,KAAK;AACnD,aAAOA;AAAA,IACT;AAGA,UAAM,KAAK,KAAK,GAAG,KAAK;AACxB,UAAM,OAAO,MAAM,GAAG,QAAQ,MAAM,EAAE,IAAI,OAAO,CAAC;AAClD,QAAI,CAAC,MAAM;AACT,YAAMA,UAAS,EAAE,cAAc,OAAO,UAAU,CAAC,GAAG,eAAe,KAAK;AACxE,YAAM,KAAK,SAAS,UAAUA,SAAQ,QAAQ,KAAK;AACnD,aAAOA;AAAA,IACT;AACA,UAAM,WAAW,MAAM,YAAY,KAAK,YAAY;AACpD,UAAM,QAAQ,MAAM,kBAAkB,KAAK,kBAAkB;AAE7D,QAAI,CAAC,UAAU;AACb,YAAMA,UAAS,EAAE,cAAc,OAAO,UAAU,CAAC,GAAG,eAAe,KAAK;AACxE,YAAM,KAAK,SAAS,UAAUA,SAAQ,QAAQ,KAAK;AACnD,aAAOA;AAAA,IACT;AAGA,UAAM,OAAO,MAAM,GAAG,QAAQ,SAAS,EAAE,MAAM,QAAe,SAAS,CAAC;AACxE,QAAI,MAAM;AACR,YAAMA,UAAS;AAAA,QACb,cAAc,CAAC,CAAC,KAAK;AAAA,QACrB,UAAU,MAAM,QAAQ,KAAK,YAAY,IAAK,KAAK,eAA4B,CAAC;AAAA,QAChF,eAAe,MAAM,QAAQ,KAAK,iBAAiB,IAAK,KAAK,oBAAiC;AAAA,MAChG;AACA,YAAM,KAAK,SAAS,UAAUA,SAAQ,QAAQ,KAAK;AACnD,aAAOA;AAAA,IACT;AAGA,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA,EAAE,MAAM,QAAe,MAAM,EAAE,SAAS,EAAE;AAAA,MAC1C,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,MACrB,EAAE,UAAU,gBAAgB,MAAM;AAAA,IACpC;AACA,UAAM,WAAW,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC;AACjD,UAAM,UAAU,SAAS,IAAI,CAAC,MAAO,EAAE,MAAc,EAAE,EAAE,OAAO,OAAO;AACvE,QAAI,UAAU;AACd,UAAM,WAAqB,CAAC;AAC5B,QAAI,gBAAiC,CAAC;AACtC,QAAI,QAAQ,QAAQ;AAClB,YAAM,QAAQ,MAAM,GAAG,KAAK,SAAS,EAAE,UAAU,MAAM,EAAE,KAAK,QAAe,EAAE,GAAU,CAAC,CAAC;AAC3F,YAAM,WAAW,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC;AACjD,iBAAW,KAAK,UAAU;AACxB,kBAAU,WAAW,CAAC,CAAC,EAAE;AACzB,YAAI,MAAM,QAAQ,EAAE,YAAY;AAAG,qBAAW,KAAK,EAAE,aAAc,KAAI,CAAC,SAAS,SAAS,CAAC,EAAG,UAAS,KAAK,CAAC;AAAA;AAC7G,YAAI,kBAAkB,MAAM;AAC1B,cAAI,EAAE,qBAAqB,KAAM,iBAAgB;AAAA,mBACxC,MAAM,QAAQ,EAAE,iBAAiB,KAAK,EAAE,kBAAkB,SAAS,SAAS,EAAG,iBAAgB;AAAA,cACnG,iBAAgB,MAAM,KAAK,oBAAI,IAAI,CAAC,GAAI,iBAAiB,CAAC,GAAI,GAAG,EAAE,iBAAiB,CAAC,CAAC;AAAA,QAC7F;AAAA,MACF;AAAA,IACF;AACA,QAAI,iBAAiB,SAAS,CAAC,cAAc,SAAS,KAAK,KAAK,CAAC,cAAc,SAAS,SAAS,GAAG;AAAA,IAEpG;AACA,UAAM,SAAS,EAAE,cAAc,SAAS,UAAU,cAAc;AAChE,UAAM,KAAK,SAAS,UAAU,QAAQ,QAAQ,KAAK;AACnD,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,iBACJ,UACA,SACA,MACkB;AAClB,QAAI,CAAC,YAAY,CAAC,QAAS,QAAO;AAElC,UAAM,KAAK,KAAK,GAAG,KAAK;AACxB,UAAM,WAAW,MAAM,GAAG,KAAK,SAAS,EAAE,UAAU,WAAW,KAAK,GAAU,CAAC,CAAC;AAChF,UAAM,OAAO,MAAM,QAAQ,QAAQ,IAAI,WAAW,CAAC;AACnD,UAAM,iBAAiB,MAAM,kBAAkB;AAE/C,eAAW,OAAO,MAAM;AACtB,UAAI,CAAC,KAAK,0BAA0B,KAAK,cAAc,EAAG;AAC1D,YAAM,SAAS,MAAM,QAAQ,IAAI,YAAY,IAAI,IAAI,eAAe,CAAC;AACrE,UAAI,kBAAkB,CAAC,OAAO,GAAG;AAAA,QAC/B,iBAAiB;AAAA,QACjB,cAAc,IAAI;AAAA,MACpB,CAAC,GAAG;AACF,eAAO;AAAA,MACT;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqCA,MAAM,mBAAmB,QAAgB,UAAoB,OAAqF;AAChJ,QAAI,CAAC,SAAS,OAAQ,QAAO;AAC7B,UAAM,MAAM,MAAM,KAAK,QAAQ,QAAQ,KAAK;AAC5C,UAAM,sBAAsB,IAAI,gBAC3B,CAAC,IAAI,iBACL,CAAC,MAAM,kBACP,IAAI,cAAc,SAAS,MAAM,cAAc,KAC/C,IAAI,cAAc,SAAS,SAAS;AACzC,WAAO,kBAAkB,UAAU;AAAA,MACjC,iBAAiB,IAAI;AAAA,MACrB,cAAc,IAAI;AAAA,MAClB,cAAc;AAAA,IAChB,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,mBACJ,QACA,OACmB;AACnB,UAAM,MAAM,MAAM,KAAK,QAAQ,QAAQ,KAAK;AAC5C,QAAI,IAAI,aAAc,QAAO,6BAA6B,CAAC,GAAG,CAAC;AAC/D,QACE,IAAI,iBACJ,MAAM,kBACN,CAAC,IAAI,cAAc,SAAS,MAAM,cAAc,KAChD,CAAC,IAAI,cAAc,SAAS,SAAS,GACrC;AACA,aAAO,CAAC;AAAA,IACV;AACA,WAAO,6BAA6B,IAAI,QAAQ;AAAA,EAClD;AAAA;AAAA,EAGA,MAAM,qBACJ,QACA,OACmB;AACnB,UAAM,MAAM,MAAM,KAAK,QAAQ,QAAQ,KAAK;AAC5C,UAAM,sBAAsB,IAAI,gBAC3B,CAAC,IAAI,iBACL,CAAC,MAAM,kBACP,IAAI,cAAc,SAAS,MAAM,cAAc,KAC/C,IAAI,cAAc,SAAS,SAAS;AACzC,QAAI,CAAC,oBAAqB,QAAO,CAAC;AAClC,WAAO,yBAAyB,IAAI,eAAe,CAAC,GAAG,IAAI,IAAI,QAAQ;AAAA,EACzE;AACF;",
-  "names": ["result", "em", "tenantId", "roleIds", "isSuper", "features", "organizations"]
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CacheStrategy } from '@open-mercato/cache'\nimport { getCurrentCacheTenant, runWithCacheTenant } from '@open-mercato/cache'\nimport { UserAcl, RoleAcl, User, UserRole } from '@open-mercato/core/modules/auth/data/entities'\nimport { ApiKey } from '@open-mercato/core/modules/api_keys/data/entities'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { OrganizationHierarchyService } from '@open-mercato/shared/lib/auth/principal-service'\nimport { buildOrgScopeUserCacheTag, buildOrgScopeTenantCacheTag } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport {\n  authorizeFeatures,\n  resolveEffectiveFeatures,\n} from '@open-mercato/shared/security/featurePolicy'\nimport { filterGrantsByEnabledModules } from '@open-mercato/shared/security/enabledModulesRegistry'\nimport { resolveRoleOrganizationScope, roleAclAllowsOrganization } from './roleOrganizationScope'\n\ninterface AclData {\n  isSuperAdmin: boolean\n  features: string[]\n  organizations: string[] | null\n}\n\nfunction isAclData(value: unknown): value is AclData {\n  if (typeof value !== 'object' || value === null) return false\n  const record = value as Partial<AclData>\n  if (typeof record.isSuperAdmin !== 'boolean') return false\n  if (!Array.isArray(record.features) || record.features.some((feature) => typeof feature !== 'string')) return false\n  if (record.organizations !== null && record.organizations !== undefined) {\n    if (!Array.isArray(record.organizations)) return false\n    if (record.organizations.some((org) => typeof org !== 'string')) return false\n  }\n  return true\n}\n\nfunction isRestrictedRoleAcl(acl: Pick<RoleAcl, 'organizationsJson'>): boolean {\n  return Array.isArray(acl.organizationsJson)\n    && acl.organizationsJson.length > 0\n    && !acl.organizationsJson.includes('__all__')\n}\n\nexport class RbacService {\n  private cacheTtlMs: number = 5 * 60 * 1000 // 5 minutes default\n  private cache: CacheStrategy | null = null\n  private globalSuperAdminCache = new Map<string, boolean>()\n\n  constructor(\n    private em: EntityManager,\n    cache?: CacheStrategy,\n    private readonly organizationHierarchyService?: OrganizationHierarchyService,\n  ) {\n    this.cache = cache || null\n  }\n\n  /**\n   * Set cache TTL in milliseconds\n   * @param ttlMs - Time to live in milliseconds\n   */\n  setCacheTtl(ttlMs: number) {\n    this.cacheTtlMs = ttlMs\n  }\n\n  /** Compatibility wrapper for callers that already have both feature lists. */\n  public hasAllFeatures(required: string[], granted: string[]): boolean {\n    return authorizeFeatures(required, { grantedFeatures: granted })\n  }\n\n  private getCacheKey(userId: string, scope: { tenantId: string | null; organizationId: string | null }): string {\n    return `rbac:${userId}:${scope.tenantId || 'null'}:${scope.organizationId || 'null'}`\n  }\n\n  private getUserTag(userId: string): string {\n    return `rbac:user:${userId}`\n  }\n\n  private getTenantTag(tenantId: string): string {\n    return `rbac:tenant:${tenantId}`\n  }\n\n  private getOrganizationTag(organizationId: string): string {\n    return `rbac:org:${organizationId}`\n  }\n\n  private async getFromCache(cacheKey: string): Promise<AclData | null> {\n    if (!this.cache) return null\n    const cached = await this.cache.get(cacheKey)\n    if (!cached) return null\n    return isAclData(cached) ? cached : null\n  }\n\n  private async setCache(cacheKey: string, data: AclData, userId: string, scope: { tenantId: string | null; organizationId: string | null }): Promise<void> {\n    if (!this.cache) return\n\n    const tags = [\n      this.getUserTag(userId),\n      'rbac:all'\n    ]\n\n    if (scope.tenantId) {\n      tags.push(this.getTenantTag(scope.tenantId))\n      // Scoped role projections depend on the selected organization's ancestor\n      // chain, so Directory hierarchy changes must evict them as well as the\n      // separately cached OrganizationScope entries.\n      tags.push(buildOrgScopeTenantCacheTag(scope.tenantId))\n    }\n\n    if (scope.organizationId) {\n      tags.push(this.getOrganizationTag(scope.organizationId))\n    }\n\n    await this.cache.set(cacheKey, data, {\n      ttl: this.cacheTtlMs,\n      tags\n    })\n  }\n\n  /**\n   * Invalidates cached ACL data for a specific user across all tenants and organizations.\n   * Call this when a user's roles or user-specific ACL is modified.\n   * \n   * @param userId - The ID of the user whose cache should be invalidated\n   */\n  async invalidateUserCache(userId: string): Promise<void> {\n    this.globalSuperAdminCache.delete(userId)\n    // Also drop the directory OrganizationScope cache for this user. That scope's\n    // accessible-org set is derived from this user's ACL/role grants, so any\n    // permission change that invalidates the RBAC cache must invalidate the\n    // resolved scope too. This is the missing `org-scope:user:*` caller required\n    // before the cross-request scope TTL can be safely enabled (issue #2259).\n    await this.deleteCacheByTags([this.getUserTag(userId), buildOrgScopeUserCacheTag(userId)])\n  }\n\n  /**\n   * Invalidates cached ACL data for all users within a specific tenant.\n   * Call this when a role's ACL is modified, since roles are tenant-scoped\n   * and affect all users in that tenant who have that role.\n   * \n   * @param tenantId - The ID of the tenant whose cache should be invalidated\n   */\n  async invalidateTenantCache(tenantId: string): Promise<void> {\n    this.globalSuperAdminCache.clear()\n    // Role ACL changes invalidate every user in the tenant; the resolved\n    // OrganizationScope for those users derives from the same grants, so drop\n    // the tenant-tagged scope entries alongside the RBAC ones (issue #2259).\n    await this.deleteCacheByTags([this.getTenantTag(tenantId), buildOrgScopeTenantCacheTag(tenantId)], [tenantId])\n  }\n\n  /**\n   * Invalidates cached ACL data for all users within a specific organization.\n   * Call this when organization-level permissions or visibility changes.\n   * \n   * @param organizationId - The ID of the organization whose cache should be invalidated\n   */\n  async invalidateOrganizationCache(organizationId: string): Promise<void> {\n    await this.deleteCacheByTags([this.getOrganizationTag(organizationId)])\n  }\n\n  /**\n   * Clears all cached ACL data.\n   * Use this for bulk operations or system-wide ACL changes.\n   */\n  async invalidateAllCache(): Promise<void> {\n    this.globalSuperAdminCache.clear()\n    await this.deleteCacheByTags(['rbac:all'])\n  }\n\n  private async deleteCacheByTags(tags: string[], tenantHints?: Array<string | null>): Promise<void> {\n    if (!this.cache) return\n    const contexts = new Set<string | null>()\n    const current = getCurrentCacheTenant()\n    contexts.add(current ?? null)\n    contexts.add(null)\n    if (Array.isArray(tenantHints)) {\n      for (const hint of tenantHints) {\n        contexts.add(hint ?? null)\n      }\n    }\n    for (const ctx of contexts) {\n      if (ctx === current) {\n        await this.cache.deleteByTags(tags)\n      } else {\n        await runWithCacheTenant(ctx, async () => {\n          await this.cache!.deleteByTags(tags)\n        })\n      }\n    }\n  }\n\n  private async isGlobalSuperAdmin(userId: string): Promise<boolean> {\n    if (this.globalSuperAdminCache.has(userId)) return this.globalSuperAdminCache.get(userId)!\n    const em = this.em.fork()\n    const userSuper = await em.findOne(UserAcl, { user: userId as any, isSuperAdmin: true })\n    if (userSuper && (userSuper as any).isSuperAdmin) {\n      this.globalSuperAdminCache.set(userId, true)\n      return true\n    }\n    const links = await findWithDecryption(\n      em,\n      UserRole,\n      { user: userId as any },\n      { populate: ['role'] },\n      { tenantId: null, organizationId: null },\n    )\n    const linkList = Array.isArray(links) ? links : []\n    if (!linkList.length) {\n      this.globalSuperAdminCache.set(userId, false)\n      return false\n    }\n    const roleIds = Array.from(new Set(linkList.map((link) => {\n      const role = link.role as any\n      return role?.id ? String(role.id) : null\n    }).filter((id): id is string => typeof id === 'string' && id.length > 0)))\n    if (!roleIds.length) {\n      this.globalSuperAdminCache.set(userId, false)\n      return false\n    }\n    const roleSupers = await em.find(RoleAcl, { isSuperAdmin: true, role: { $in: roleIds as any } } as any)\n    const result = roleSupers.some((roleAcl) => (\n      !!roleAcl.isSuperAdmin && !isRestrictedRoleAcl(roleAcl)\n    ))\n    this.globalSuperAdminCache.set(userId, result)\n    return result\n  }\n\n  /**\n   * Loads the Access Control List (ACL) for a user within a given scope.\n   * \n   * The ACL resolution follows this priority:\n   * 1. Per-user ACL (UserAcl) - if exists, use it exclusively\n   * 2. Aggregated role ACLs (RoleAcl) - combine permissions from all user's roles\n   * \n   * Results are cached for performance (default 5 minutes TTL).\n   * Cache is automatically invalidated when ACL-related data changes.\n   * \n   * @param userId - The ID of the user\n   * @param scope - The tenant and organization context for ACL evaluation\n   * @returns An object containing:\n   *   - isSuperAdmin: If true, user has unrestricted access to all features\n   *   - features: Array of feature strings (may include wildcards like 'entities.*')\n   *   - organizations: Array of organization IDs user can access, or null for all organizations\n   * \n   * @example\n   * const acl = await rbacService.loadAcl('user-123', { tenantId: 'tenant-1', organizationId: 'org-1' })\n   * // Returns: { isSuperAdmin: false, features: ['users.view', 'entities.*'], organizations: ['org-1', 'org-2'] }\n   */\n  async loadAcl(userId: string, scope: { tenantId: string | null; organizationId: string | null }): Promise<{\n    isSuperAdmin: boolean\n    features: string[]\n    organizations: string[] | null\n  }> {\n    const cacheKey = this.getCacheKey(userId, scope)\n    const cached = await this.getFromCache(cacheKey)\n    if (cached) return cached\n\n    // Direct user-level super-admin grants and unrestricted role-level\n    // super-admin grants are global. Organization-restricted role grants are\n    // deliberately excluded by isGlobalSuperAdmin and continue through the\n    // scoped ACL projection below.\n    if (!userId.startsWith('api_key:')) {\n      if (await this.isGlobalSuperAdmin(userId)) {\n        const result = { isSuperAdmin: true, features: ['*'], organizations: null }\n        await this.setCache(cacheKey, result, userId, scope)\n        return result\n      }\n    }\n\n    if (userId.startsWith('api_key:')) {\n      const apiKeyId = userId.slice('api_key:'.length)\n      const em = this.em.fork()\n      const key = await em.findOne(ApiKey, { id: apiKeyId, deletedAt: null })\n      if (!key || (key.expiresAt && key.expiresAt.getTime() < Date.now())) {\n        const result = { isSuperAdmin: false, features: [], organizations: null }\n        await this.setCache(cacheKey, result, userId, scope)\n        return result\n      }\n      const tenantId = scope.tenantId || key.tenantId || null\n      const roleIds = Array.isArray(key.rolesJson) ? key.rolesJson.filter(Boolean) : []\n      const keyOrganizationId = typeof key.organizationId === 'string' && key.organizationId.trim().length > 0\n        ? key.organizationId.trim()\n        : null\n      const evaluatedOrganizationId = scope.organizationId || keyOrganizationId\n      let isSuper = false\n      const features: string[] = []\n      let roleOrganizations: string[] | null = []\n      let hasApplicableRestrictedRole = false\n      if (tenantId && roleIds.length) {\n        const roleOrganizationScope = await resolveRoleOrganizationScope(\n          this.organizationHierarchyService,\n          tenantId,\n          evaluatedOrganizationId,\n        )\n        const racls = await em.find(RoleAcl, { tenantId, role: { $in: roleIds as any } } as any)\n        for (const acl of racls) {\n          if (roleAclAllowsOrganization(acl, roleOrganizationScope)) {\n            isSuper = isSuper || !!acl.isSuperAdmin\n            if (Array.isArray(acl.featuresJson)) {\n              for (const f of acl.featuresJson) if (!features.includes(f)) features.push(f)\n            }\n            if (isRestrictedRoleAcl(acl)) hasApplicableRestrictedRole = true\n          }\n          if (roleOrganizations !== null) {\n            if (acl.organizationsJson == null || (Array.isArray(acl.organizationsJson) && acl.organizationsJson.length === 0)) {\n              roleOrganizations = null\n            } else if (Array.isArray(acl.organizationsJson) && acl.organizationsJson.includes('__all__')) {\n              roleOrganizations = null\n            } else {\n              roleOrganizations = Array.from(new Set([\n                ...roleOrganizations,\n                ...(Array.isArray(acl.organizationsJson) ? acl.organizationsJson : []),\n              ]))\n            }\n          }\n        }\n        if (\n          roleOrganizations !== null\n          && evaluatedOrganizationId\n          && roleOrganizationScope !== null\n          && roleOrganizationScope.size > 0\n          && hasApplicableRestrictedRole\n          && !roleOrganizations.includes(evaluatedOrganizationId)\n        ) {\n          roleOrganizations.push(evaluatedOrganizationId)\n        }\n      }\n      let organizations = roleOrganizations\n      if (keyOrganizationId) {\n        const keyOrganizationScope = await resolveRoleOrganizationScope(\n          this.organizationHierarchyService,\n          tenantId,\n          keyOrganizationId,\n        )\n        organizations = roleOrganizations === null\n          || roleOrganizations.some((organizationId) => keyOrganizationScope?.has(organizationId))\n          ? [keyOrganizationId]\n          : []\n      }\n      // A role-level super-admin grant still respects the API key's effective\n      // organization allowlist. Represent it as a wildcard feature whenever\n      // the key is restricted so downstream super-admin shortcuts cannot\n      // bypass the key or role organization bounds.\n      if (isSuper && organizations !== null && !features.includes('*')) features.push('*')\n      const result = { isSuperAdmin: isSuper && organizations === null, features, organizations }\n      await this.setCache(cacheKey, result, userId, scope)\n      return result\n    }\n\n    // Use a forked EntityManager to avoid inheriting an aborted transaction from callers\n    const em = this.em.fork()\n    const user = await em.findOne(User, { id: userId })\n    if (!user) {\n      const result = { isSuperAdmin: false, features: [], organizations: null }\n      await this.setCache(cacheKey, result, userId, scope)\n      return result\n    }\n    const tenantId = scope.tenantId || user.tenantId || null\n    const orgId = scope.organizationId || user.organizationId || null\n\n    if (!tenantId) {\n      const result = { isSuperAdmin: false, features: [], organizations: null }\n      await this.setCache(cacheKey, result, userId, scope)\n      return result\n    }\n\n    // Per-user ACL first\n    const uacl = await em.findOne(UserAcl, { user: userId as any, tenantId })\n    if (uacl) {\n      const result = {\n        isSuperAdmin: !!uacl.isSuperAdmin,\n        features: Array.isArray(uacl.featuresJson) ? (uacl.featuresJson as string[]) : [],\n        organizations: Array.isArray(uacl.organizationsJson) ? (uacl.organizationsJson as string[]) : null,\n      }\n      await this.setCache(cacheKey, result, userId, scope)\n      return result\n    }\n\n    // Aggregate role ACLs\n    const links = await findWithDecryption(\n      em,\n      UserRole,\n      { user: userId as any, role: { tenantId } } as any,\n      { populate: ['role'] },\n      { tenantId, organizationId: orgId },\n    )\n    const linkList = Array.isArray(links) ? links : []\n    const roleIds = linkList.map((l) => (l.role as any)?.id).filter(Boolean)\n    let isSuper = false\n    const features: string[] = []\n    let organizations: string[] | null = []\n    let hasApplicableRestrictedRole = false\n    if (roleIds.length) {\n      const roleOrganizationScope = await resolveRoleOrganizationScope(\n        this.organizationHierarchyService,\n        tenantId,\n        scope.organizationId,\n      )\n      const racls = await em.find(RoleAcl, { tenantId, role: { $in: roleIds as any } } as any, {})\n      const roleAcls = Array.isArray(racls) ? racls : []\n      for (const r of roleAcls) {\n        if (roleAclAllowsOrganization(r, roleOrganizationScope)) {\n          isSuper = isSuper || !!r.isSuperAdmin\n          if (Array.isArray(r.featuresJson)) for (const f of r.featuresJson) if (!features.includes(f)) features.push(f)\n          if (isRestrictedRoleAcl(r)) hasApplicableRestrictedRole = true\n        }\n        if (organizations !== null) {\n          // For a user principal an empty allowlist is a deny-all scope (#4033), not\n          // \"unrestricted\": it must merge to an empty set so scoped reads and deletes\n          // fail closed. Only an absent allowlist or an explicit '__all__' widens to\n          // every organization. (The API-key branch above deliberately differs \u2014 an\n          // empty role list there means the key inherits the key's own scope.)\n          if (r.organizationsJson == null) organizations = null\n          else if (Array.isArray(r.organizationsJson) && r.organizationsJson.includes('__all__')) organizations = null\n          else organizations = Array.from(new Set([...(organizations || []), ...r.organizationsJson]))\n        }\n      }\n      if (\n        organizations !== null\n        && scope.organizationId\n        && roleOrganizationScope !== null\n        && roleOrganizationScope.size > 0\n        && hasApplicableRestrictedRole\n        && !organizations.includes(scope.organizationId)\n      ) {\n        organizations.push(scope.organizationId)\n      }\n    }\n    if (organizations && orgId && !organizations.includes(orgId) && !organizations.includes('__all__')) {\n      // Out-of-scope org; caller will enforce\n    }\n    const result = { isSuperAdmin: isSuper, features, organizations }\n    await this.setCache(cacheKey, result, userId, scope)\n    return result\n  }\n\n  /**\n   * Checks whether any tenant role grants a feature.\n   *\n   * This supports non-user runtimes such as scheduler workers that execute with\n   * tenant scope but without an authenticated user.\n   */\n  async tenantHasFeature(\n    tenantId: string | null | undefined,\n    feature: string,\n    opts?: { organizationId?: string | null },\n  ): Promise<boolean> {\n    if (!tenantId || !feature) return false\n\n    const em = this.em.fork()\n    const roleOrganizationScope = await resolveRoleOrganizationScope(\n      this.organizationHierarchyService,\n      tenantId,\n      opts?.organizationId,\n    )\n    const roleAcls = await em.find(RoleAcl, { tenantId, deletedAt: null } as any, {})\n    const list = Array.isArray(roleAcls) ? roleAcls : []\n\n    for (const acl of list) {\n      if (!roleAclAllowsOrganization(acl, roleOrganizationScope)) continue\n      const grants = Array.isArray(acl.featuresJson) ? acl.featuresJson : []\n      if (authorizeFeatures([feature], {\n        grantedFeatures: grants,\n        unrestricted: acl.isSuperAdmin,\n      })) {\n        return true\n      }\n    }\n\n    return false\n  }\n\n  /**\n   * Checks if a user has all required features within a given scope.\n   *\n   * This is the primary authorization check method used throughout the application.\n   * It combines feature checking with organization visibility validation.\n   *\n   * Authorization logic:\n   * 1. No features required \u2192 always returns true\n   * 2. User is super admin \u2192 always returns true\n   * 3. Organization restriction check: If the user's ACL has a restricted organization list\n   *    and the requested organization is not in that list \u2192 returns false\n   * 4. Feature matching: User must have all required features (supports wildcards)\n   *\n   * @param userId - The ID of the user\n   * @param required - Array of feature strings to check (e.g., ['users.view', 'users.edit'])\n   * @param scope - The tenant and organization context for authorization\n   * @returns true if the user has all required features and organization access, false otherwise\n   *\n   * @example\n   * // Check if user can view and edit users\n   * const canManageUsers = await rbacService.userHasAllFeatures(\n   *   'user-123',\n   *   ['users.view', 'users.edit'],\n   *   { tenantId: 'tenant-1', organizationId: 'org-1' }\n   * )\n   *\n   * @example\n   * // Check with wildcard features\n   * const canAccessEntities = await rbacService.userHasAllFeatures(\n   *   'user-123',\n   *   ['entities.records.view'],\n   *   { tenantId: 'tenant-1', organizationId: 'org-1' }\n   * )\n   * // Returns true if user has 'entities.*', '*', or 'entities.records.view'\n   */\n  async userHasAllFeatures(userId: string, required: string[], scope: { tenantId: string | null; organizationId: string | null }): Promise<boolean> {\n    if (!required.length) return true\n    const acl = await this.loadAcl(userId, scope)\n    const organizationAllowed = acl.isSuperAdmin\n      || !acl.organizations\n      || !scope.organizationId\n      || acl.organizations.includes(scope.organizationId)\n      || acl.organizations.includes('__all__')\n    return authorizeFeatures(required, {\n      grantedFeatures: acl.features,\n      unrestricted: acl.isSuperAdmin,\n      scopeAllowed: organizationAllowed,\n    })\n  }\n\n  /**\n   * Returns the user's infrastructure grant list, filtered to enabled modules.\n   * The result may contain wildcards; authoritative checks must still go through\n   * `authorizeFeatures` or `userHasAllFeatures` so null overrides are enforced.\n   */\n  async getGrantedFeatures(\n    userId: string,\n    scope: { tenantId: string | null; organizationId: string | null },\n  ): Promise<string[]> {\n    const acl = await this.loadAcl(userId, scope)\n    if (acl.isSuperAdmin) return filterGrantsByEnabledModules(['*'])\n    if (\n      acl.organizations &&\n      scope.organizationId &&\n      !acl.organizations.includes(scope.organizationId) &&\n      !acl.organizations.includes('__all__')\n    ) {\n      return []\n    }\n    return filterGrantsByEnabledModules(acl.features)\n  }\n\n  /** Returns concrete active feature IDs for browser capability payloads. */\n  async getEffectiveFeatures(\n    userId: string,\n    scope: { tenantId: string | null; organizationId: string | null },\n  ): Promise<string[]> {\n    const acl = await this.loadAcl(userId, scope)\n    const organizationAllowed = acl.isSuperAdmin\n      || !acl.organizations\n      || !scope.organizationId\n      || acl.organizations.includes(scope.organizationId)\n      || acl.organizations.includes('__all__')\n    if (!organizationAllowed) return []\n    return resolveEffectiveFeatures(acl.isSuperAdmin ? ['*'] : acl.features)\n  }\n}\n"],
+  "mappings": "AAEA,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,SAAS,SAAS,MAAM,gBAAgB;AACjD,SAAS,cAAc;AACvB,SAAS,0BAA0B;AAEnC,SAAS,2BAA2B,mCAAmC;AACvE;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,oCAAoC;AAC7C,SAAS,8BAA8B,iCAAiC;AAQxE,SAAS,UAAU,OAAkC;AACnD,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,SAAS;AACf,MAAI,OAAO,OAAO,iBAAiB,UAAW,QAAO;AACrD,MAAI,CAAC,MAAM,QAAQ,OAAO,QAAQ,KAAK,OAAO,SAAS,KAAK,CAAC,YAAY,OAAO,YAAY,QAAQ,EAAG,QAAO;AAC9G,MAAI,OAAO,kBAAkB,QAAQ,OAAO,kBAAkB,QAAW;AACvE,QAAI,CAAC,MAAM,QAAQ,OAAO,aAAa,EAAG,QAAO;AACjD,QAAI,OAAO,cAAc,KAAK,CAAC,QAAQ,OAAO,QAAQ,QAAQ,EAAG,QAAO;AAAA,EAC1E;AACA,SAAO;AACT;AAEA,SAAS,oBAAoB,KAAkD;AAC7E,SAAO,MAAM,QAAQ,IAAI,iBAAiB,KACrC,IAAI,kBAAkB,SAAS,KAC/B,CAAC,IAAI,kBAAkB,SAAS,SAAS;AAChD;AAEO,MAAM,YAAY;AAAA,EAKvB,YACU,IACR,OACiB,8BACjB;AAHQ;AAES;AAPnB,SAAQ,aAAqB,IAAI,KAAK;AACtC;AAAA,SAAQ,QAA8B;AACtC,SAAQ,wBAAwB,oBAAI,IAAqB;AAOvD,SAAK,QAAQ,SAAS;AAAA,EACxB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,YAAY,OAAe;AACzB,SAAK,aAAa;AAAA,EACpB;AAAA;AAAA,EAGO,eAAe,UAAoB,SAA4B;AACpE,WAAO,kBAAkB,UAAU,EAAE,iBAAiB,QAAQ,CAAC;AAAA,EACjE;AAAA,EAEQ,YAAY,QAAgB,OAA2E;AAC7G,WAAO,QAAQ,MAAM,IAAI,MAAM,YAAY,MAAM,IAAI,MAAM,kBAAkB,MAAM;AAAA,EACrF;AAAA,EAEQ,WAAW,QAAwB;AACzC,WAAO,aAAa,MAAM;AAAA,EAC5B;AAAA,EAEQ,aAAa,UAA0B;AAC7C,WAAO,eAAe,QAAQ;AAAA,EAChC;AAAA,EAEQ,mBAAmB,gBAAgC;AACzD,WAAO,YAAY,cAAc;AAAA,EACnC;AAAA,EAEA,MAAc,aAAa,UAA2C;AACpE,QAAI,CAAC,KAAK,MAAO,QAAO;AACxB,UAAM,SAAS,MAAM,KAAK,MAAM,IAAI,QAAQ;AAC5C,QAAI,CAAC,OAAQ,QAAO;AACpB,WAAO,UAAU,MAAM,IAAI,SAAS;AAAA,EACtC;AAAA,EAEA,MAAc,SAAS,UAAkB,MAAe,QAAgB,OAAkF;AACxJ,QAAI,CAAC,KAAK,MAAO;AAEjB,UAAM,OAAO;AAAA,MACX,KAAK,WAAW,MAAM;AAAA,MACtB;AAAA,IACF;AAEA,QAAI,MAAM,UAAU;AAClB,WAAK,KAAK,KAAK,aAAa,MAAM,QAAQ,CAAC;AAI3C,WAAK,KAAK,4BAA4B,MAAM,QAAQ,CAAC;AAAA,IACvD;AAEA,QAAI,MAAM,gBAAgB;AACxB,WAAK,KAAK,KAAK,mBAAmB,MAAM,cAAc,CAAC;AAAA,IACzD;AAEA,UAAM,KAAK,MAAM,IAAI,UAAU,MAAM;AAAA,MACnC,KAAK,KAAK;AAAA,MACV;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,oBAAoB,QAA+B;AACvD,SAAK,sBAAsB,OAAO,MAAM;AAMxC,UAAM,KAAK,kBAAkB,CAAC,KAAK,WAAW,MAAM,GAAG,0BAA0B,MAAM,CAAC,CAAC;AAAA,EAC3F;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,sBAAsB,UAAiC;AAC3D,SAAK,sBAAsB,MAAM;AAIjC,UAAM,KAAK,kBAAkB,CAAC,KAAK,aAAa,QAAQ,GAAG,4BAA4B,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;AAAA,EAC/G;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,4BAA4B,gBAAuC;AACvE,UAAM,KAAK,kBAAkB,CAAC,KAAK,mBAAmB,cAAc,CAAC,CAAC;AAAA,EACxE;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,qBAAoC;AACxC,SAAK,sBAAsB,MAAM;AACjC,UAAM,KAAK,kBAAkB,CAAC,UAAU,CAAC;AAAA,EAC3C;AAAA,EAEA,MAAc,kBAAkB,MAAgB,aAAmD;AACjG,QAAI,CAAC,KAAK,MAAO;AACjB,UAAM,WAAW,oBAAI,IAAmB;AACxC,UAAM,UAAU,sBAAsB;AACtC,aAAS,IAAI,WAAW,IAAI;AAC5B,aAAS,IAAI,IAAI;AACjB,QAAI,MAAM,QAAQ,WAAW,GAAG;AAC9B,iBAAW,QAAQ,aAAa;AAC9B,iBAAS,IAAI,QAAQ,IAAI;AAAA,MAC3B;AAAA,IACF;AACA,eAAW,OAAO,UAAU;AAC1B,UAAI,QAAQ,SAAS;AACnB,cAAM,KAAK,MAAM,aAAa,IAAI;AAAA,MACpC,OAAO;AACL,cAAM,mBAAmB,KAAK,YAAY;AACxC,gBAAM,KAAK,MAAO,aAAa,IAAI;AAAA,QACrC,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,mBAAmB,QAAkC;AACjE,QAAI,KAAK,sBAAsB,IAAI,MAAM,EAAG,QAAO,KAAK,sBAAsB,IAAI,MAAM;AACxF,UAAM,KAAK,KAAK,GAAG,KAAK;AACxB,UAAM,YAAY,MAAM,GAAG,QAAQ,SAAS,EAAE,MAAM,QAAe,cAAc,KAAK,CAAC;AACvF,QAAI,aAAc,UAAkB,cAAc;AAChD,WAAK,sBAAsB,IAAI,QAAQ,IAAI;AAC3C,aAAO;AAAA,IACT;AACA,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA,EAAE,MAAM,OAAc;AAAA,MACtB,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,MACrB,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,IACzC;AACA,UAAM,WAAW,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC;AACjD,QAAI,CAAC,SAAS,QAAQ;AACpB,WAAK,sBAAsB,IAAI,QAAQ,KAAK;AAC5C,aAAO;AAAA,IACT;AACA,UAAM,UAAU,MAAM,KAAK,IAAI,IAAI,SAAS,IAAI,CAAC,SAAS;AACxD,YAAM,OAAO,KAAK;AAClB,aAAO,MAAM,KAAK,OAAO,KAAK,EAAE,IAAI;AAAA,IACtC,CAAC,EAAE,OAAO,CAAC,OAAqB,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC,CAAC,CAAC;AACzE,QAAI,CAAC,QAAQ,QAAQ;AACnB,WAAK,sBAAsB,IAAI,QAAQ,KAAK;AAC5C,aAAO;AAAA,IACT;AACA,UAAM,aAAa,MAAM,GAAG,KAAK,SAAS,EAAE,cAAc,MAAM,MAAM,EAAE,KAAK,QAAe,EAAE,CAAQ;AACtG,UAAM,SAAS,WAAW,KAAK,CAAC,YAC9B,CAAC,CAAC,QAAQ,gBAAgB,CAAC,oBAAoB,OAAO,CACvD;AACD,SAAK,sBAAsB,IAAI,QAAQ,MAAM;AAC7C,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,MAAM,QAAQ,QAAgB,OAI3B;AACD,UAAM,WAAW,KAAK,YAAY,QAAQ,KAAK;AAC/C,UAAM,SAAS,MAAM,KAAK,aAAa,QAAQ;AAC/C,QAAI,OAAQ,QAAO;AAMnB,QAAI,CAAC,OAAO,WAAW,UAAU,GAAG;AAClC,UAAI,MAAM,KAAK,mBAAmB,MAAM,GAAG;AACzC,cAAMA,UAAS,EAAE,cAAc,MAAM,UAAU,CAAC,GAAG,GAAG,eAAe,KAAK;AAC1E,cAAM,KAAK,SAAS,UAAUA,SAAQ,QAAQ,KAAK;AACnD,eAAOA;AAAA,MACT;AAAA,IACF;AAEA,QAAI,OAAO,WAAW,UAAU,GAAG;AACjC,YAAM,WAAW,OAAO,MAAM,WAAW,MAAM;AAC/C,YAAMC,MAAK,KAAK,GAAG,KAAK;AACxB,YAAM,MAAM,MAAMA,IAAG,QAAQ,QAAQ,EAAE,IAAI,UAAU,WAAW,KAAK,CAAC;AACtE,UAAI,CAAC,OAAQ,IAAI,aAAa,IAAI,UAAU,QAAQ,IAAI,KAAK,IAAI,GAAI;AACnE,cAAMD,UAAS,EAAE,cAAc,OAAO,UAAU,CAAC,GAAG,eAAe,KAAK;AACxE,cAAM,KAAK,SAAS,UAAUA,SAAQ,QAAQ,KAAK;AACnD,eAAOA;AAAA,MACT;AACA,YAAME,YAAW,MAAM,YAAY,IAAI,YAAY;AACnD,YAAMC,WAAU,MAAM,QAAQ,IAAI,SAAS,IAAI,IAAI,UAAU,OAAO,OAAO,IAAI,CAAC;AAChF,YAAM,oBAAoB,OAAO,IAAI,mBAAmB,YAAY,IAAI,eAAe,KAAK,EAAE,SAAS,IACnG,IAAI,eAAe,KAAK,IACxB;AACJ,YAAM,0BAA0B,MAAM,kBAAkB;AACxD,UAAIC,WAAU;AACd,YAAMC,YAAqB,CAAC;AAC5B,UAAI,oBAAqC,CAAC;AAC1C,UAAIC,+BAA8B;AAClC,UAAIJ,aAAYC,SAAQ,QAAQ;AAC9B,cAAM,wBAAwB,MAAM;AAAA,UAClC,KAAK;AAAA,UACLD;AAAA,UACA;AAAA,QACF;AACA,cAAM,QAAQ,MAAMD,IAAG,KAAK,SAAS,EAAE,UAAAC,WAAU,MAAM,EAAE,KAAKC,SAAe,EAAE,CAAQ;AACvF,mBAAW,OAAO,OAAO;AACvB,cAAI,0BAA0B,KAAK,qBAAqB,GAAG;AACzD,YAAAC,WAAUA,YAAW,CAAC,CAAC,IAAI;AAC3B,gBAAI,MAAM,QAAQ,IAAI,YAAY,GAAG;AACnC,yBAAW,KAAK,IAAI,aAAc,KAAI,CAACC,UAAS,SAAS,CAAC,EAAG,CAAAA,UAAS,KAAK,CAAC;AAAA,YAC9E;AACA,gBAAI,oBAAoB,GAAG,EAAG,CAAAC,+BAA8B;AAAA,UAC9D;AACA,cAAI,sBAAsB,MAAM;AAC9B,gBAAI,IAAI,qBAAqB,QAAS,MAAM,QAAQ,IAAI,iBAAiB,KAAK,IAAI,kBAAkB,WAAW,GAAI;AACjH,kCAAoB;AAAA,YACtB,WAAW,MAAM,QAAQ,IAAI,iBAAiB,KAAK,IAAI,kBAAkB,SAAS,SAAS,GAAG;AAC5F,kCAAoB;AAAA,YACtB,OAAO;AACL,kCAAoB,MAAM,KAAK,oBAAI,IAAI;AAAA,gBACrC,GAAG;AAAA,gBACH,GAAI,MAAM,QAAQ,IAAI,iBAAiB,IAAI,IAAI,oBAAoB,CAAC;AAAA,cACtE,CAAC,CAAC;AAAA,YACJ;AAAA,UACF;AAAA,QACF;AACA,YACE,sBAAsB,QACnB,2BACA,0BAA0B,QAC1B,sBAAsB,OAAO,KAC7BA,gCACA,CAAC,kBAAkB,SAAS,uBAAuB,GACtD;AACA,4BAAkB,KAAK,uBAAuB;AAAA,QAChD;AAAA,MACF;AACA,UAAIC,iBAAgB;AACpB,UAAI,mBAAmB;AACrB,cAAM,uBAAuB,MAAM;AAAA,UACjC,KAAK;AAAA,UACLL;AAAA,UACA;AAAA,QACF;AACA,QAAAK,iBAAgB,sBAAsB,QACjC,kBAAkB,KAAK,CAAC,mBAAmB,sBAAsB,IAAI,cAAc,CAAC,IACrF,CAAC,iBAAiB,IAClB,CAAC;AAAA,MACP;AAKA,UAAIH,YAAWG,mBAAkB,QAAQ,CAACF,UAAS,SAAS,GAAG,EAAG,CAAAA,UAAS,KAAK,GAAG;AACnF,YAAML,UAAS,EAAE,cAAcI,YAAWG,mBAAkB,MAAM,UAAAF,WAAU,eAAAE,eAAc;AAC1F,YAAM,KAAK,SAAS,UAAUP,SAAQ,QAAQ,KAAK;AACnD,aAAOA;AAAA,IACT;AAGA,UAAM,KAAK,KAAK,GAAG,KAAK;AACxB,UAAM,OAAO,MAAM,GAAG,QAAQ,MAAM,EAAE,IAAI,OAAO,CAAC;AAClD,QAAI,CAAC,MAAM;AACT,YAAMA,UAAS,EAAE,cAAc,OAAO,UAAU,CAAC,GAAG,eAAe,KAAK;AACxE,YAAM,KAAK,SAAS,UAAUA,SAAQ,QAAQ,KAAK;AACnD,aAAOA;AAAA,IACT;AACA,UAAM,WAAW,MAAM,YAAY,KAAK,YAAY;AACpD,UAAM,QAAQ,MAAM,kBAAkB,KAAK,kBAAkB;AAE7D,QAAI,CAAC,UAAU;AACb,YAAMA,UAAS,EAAE,cAAc,OAAO,UAAU,CAAC,GAAG,eAAe,KAAK;AACxE,YAAM,KAAK,SAAS,UAAUA,SAAQ,QAAQ,KAAK;AACnD,aAAOA;AAAA,IACT;AAGA,UAAM,OAAO,MAAM,GAAG,QAAQ,SAAS,EAAE,MAAM,QAAe,SAAS,CAAC;AACxE,QAAI,MAAM;AACR,YAAMA,UAAS;AAAA,QACb,cAAc,CAAC,CAAC,KAAK;AAAA,QACrB,UAAU,MAAM,QAAQ,KAAK,YAAY,IAAK,KAAK,eAA4B,CAAC;AAAA,QAChF,eAAe,MAAM,QAAQ,KAAK,iBAAiB,IAAK,KAAK,oBAAiC;AAAA,MAChG;AACA,YAAM,KAAK,SAAS,UAAUA,SAAQ,QAAQ,KAAK;AACnD,aAAOA;AAAA,IACT;AAGA,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA,EAAE,MAAM,QAAe,MAAM,EAAE,SAAS,EAAE;AAAA,MAC1C,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,MACrB,EAAE,UAAU,gBAAgB,MAAM;AAAA,IACpC;AACA,UAAM,WAAW,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC;AACjD,UAAM,UAAU,SAAS,IAAI,CAAC,MAAO,EAAE,MAAc,EAAE,EAAE,OAAO,OAAO;AACvE,QAAI,UAAU;AACd,UAAM,WAAqB,CAAC;AAC5B,QAAI,gBAAiC,CAAC;AACtC,QAAI,8BAA8B;AAClC,QAAI,QAAQ,QAAQ;AAClB,YAAM,wBAAwB,MAAM;AAAA,QAClC,KAAK;AAAA,QACL;AAAA,QACA,MAAM;AAAA,MACR;AACA,YAAM,QAAQ,MAAM,GAAG,KAAK,SAAS,EAAE,UAAU,MAAM,EAAE,KAAK,QAAe,EAAE,GAAU,CAAC,CAAC;AAC3F,YAAM,WAAW,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC;AACjD,iBAAW,KAAK,UAAU;AACxB,YAAI,0BAA0B,GAAG,qBAAqB,GAAG;AACvD,oBAAU,WAAW,CAAC,CAAC,EAAE;AACzB,cAAI,MAAM,QAAQ,EAAE,YAAY;AAAG,uBAAW,KAAK,EAAE,aAAc,KAAI,CAAC,SAAS,SAAS,CAAC,EAAG,UAAS,KAAK,CAAC;AAAA;AAC7G,cAAI,oBAAoB,CAAC,EAAG,+BAA8B;AAAA,QAC5D;AACA,YAAI,kBAAkB,MAAM;AAM1B,cAAI,EAAE,qBAAqB,KAAM,iBAAgB;AAAA,mBACxC,MAAM,QAAQ,EAAE,iBAAiB,KAAK,EAAE,kBAAkB,SAAS,SAAS,EAAG,iBAAgB;AAAA,cACnG,iBAAgB,MAAM,KAAK,oBAAI,IAAI,CAAC,GAAI,iBAAiB,CAAC,GAAI,GAAG,EAAE,iBAAiB,CAAC,CAAC;AAAA,QAC7F;AAAA,MACF;AACA,UACE,kBAAkB,QACf,MAAM,kBACN,0BAA0B,QAC1B,sBAAsB,OAAO,KAC7B,+BACA,CAAC,cAAc,SAAS,MAAM,cAAc,GAC/C;AACA,sBAAc,KAAK,MAAM,cAAc;AAAA,MACzC;AAAA,IACF;AACA,QAAI,iBAAiB,SAAS,CAAC,cAAc,SAAS,KAAK,KAAK,CAAC,cAAc,SAAS,SAAS,GAAG;AAAA,IAEpG;AACA,UAAM,SAAS,EAAE,cAAc,SAAS,UAAU,cAAc;AAChE,UAAM,KAAK,SAAS,UAAU,QAAQ,QAAQ,KAAK;AACnD,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,iBACJ,UACA,SACA,MACkB;AAClB,QAAI,CAAC,YAAY,CAAC,QAAS,QAAO;AAElC,UAAM,KAAK,KAAK,GAAG,KAAK;AACxB,UAAM,wBAAwB,MAAM;AAAA,MAClC,KAAK;AAAA,MACL;AAAA,MACA,MAAM;AAAA,IACR;AACA,UAAM,WAAW,MAAM,GAAG,KAAK,SAAS,EAAE,UAAU,WAAW,KAAK,GAAU,CAAC,CAAC;AAChF,UAAM,OAAO,MAAM,QAAQ,QAAQ,IAAI,WAAW,CAAC;AAEnD,eAAW,OAAO,MAAM;AACtB,UAAI,CAAC,0BAA0B,KAAK,qBAAqB,EAAG;AAC5D,YAAM,SAAS,MAAM,QAAQ,IAAI,YAAY,IAAI,IAAI,eAAe,CAAC;AACrE,UAAI,kBAAkB,CAAC,OAAO,GAAG;AAAA,QAC/B,iBAAiB;AAAA,QACjB,cAAc,IAAI;AAAA,MACpB,CAAC,GAAG;AACF,eAAO;AAAA,MACT;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqCA,MAAM,mBAAmB,QAAgB,UAAoB,OAAqF;AAChJ,QAAI,CAAC,SAAS,OAAQ,QAAO;AAC7B,UAAM,MAAM,MAAM,KAAK,QAAQ,QAAQ,KAAK;AAC5C,UAAM,sBAAsB,IAAI,gBAC3B,CAAC,IAAI,iBACL,CAAC,MAAM,kBACP,IAAI,cAAc,SAAS,MAAM,cAAc,KAC/C,IAAI,cAAc,SAAS,SAAS;AACzC,WAAO,kBAAkB,UAAU;AAAA,MACjC,iBAAiB,IAAI;AAAA,MACrB,cAAc,IAAI;AAAA,MAClB,cAAc;AAAA,IAChB,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,mBACJ,QACA,OACmB;AACnB,UAAM,MAAM,MAAM,KAAK,QAAQ,QAAQ,KAAK;AAC5C,QAAI,IAAI,aAAc,QAAO,6BAA6B,CAAC,GAAG,CAAC;AAC/D,QACE,IAAI,iBACJ,MAAM,kBACN,CAAC,IAAI,cAAc,SAAS,MAAM,cAAc,KAChD,CAAC,IAAI,cAAc,SAAS,SAAS,GACrC;AACA,aAAO,CAAC;AAAA,IACV;AACA,WAAO,6BAA6B,IAAI,QAAQ;AAAA,EAClD;AAAA;AAAA,EAGA,MAAM,qBACJ,QACA,OACmB;AACnB,UAAM,MAAM,MAAM,KAAK,QAAQ,QAAQ,KAAK;AAC5C,UAAM,sBAAsB,IAAI,gBAC3B,CAAC,IAAI,iBACL,CAAC,MAAM,kBACP,IAAI,cAAc,SAAS,MAAM,cAAc,KAC/C,IAAI,cAAc,SAAS,SAAS;AACzC,QAAI,CAAC,oBAAqB,QAAO,CAAC;AAClC,WAAO,yBAAyB,IAAI,eAAe,CAAC,GAAG,IAAI,IAAI,QAAQ;AAAA,EACzE;AACF;",
+  "names": ["result", "em", "tenantId", "roleIds", "isSuper", "features", "hasApplicableRestrictedRole", "organizations"]
 }

package/dist/modules/auth/services/roleOrganizationScope.js

@@ -0,0 +1,41 @@
+function normalizeId(value) {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
+}
+async function resolveRoleOrganizationScope(hierarchyService, tenantId, organizationId) {
+  const selectedId = normalizeId(organizationId);
+  if (!selectedId) return null;
+  const normalizedTenantId = normalizeId(tenantId);
+  if (!normalizedTenantId) return /* @__PURE__ */ new Set();
+  const ids = /* @__PURE__ */ new Set([selectedId]);
+  if (!hierarchyService) return ids;
+  const ancestorIds = await hierarchyService.resolveAncestorIds({
+    tenantId: normalizedTenantId,
+    organizationId: selectedId
+  });
+  if (ancestorIds === null) return /* @__PURE__ */ new Set();
+  for (const ancestorId of ancestorIds) {
+    const normalized = normalizeId(ancestorId);
+    if (normalized) ids.add(normalized);
+  }
+  return ids;
+}
+function roleAclAllowsOrganization(acl, scope) {
+  if (!scope) return true;
+  const organizations = Array.isArray(acl.organizationsJson) ? acl.organizationsJson : null;
+  if (!organizations || organizations.length === 0 || organizations.includes("__all__")) return true;
+  return organizations.some((organizationId) => scope.has(organizationId));
+}
+function roleAclGrantsPrincipalOrganization(acl, scope) {
+  if (!scope) return true;
+  const organizations = Array.isArray(acl.organizationsJson) ? acl.organizationsJson : null;
+  if (!organizations) return true;
+  if (organizations.length === 0) return false;
+  if (organizations.includes("__all__")) return true;
+  return organizations.some((organizationId) => scope.has(organizationId));
+}
+export {
+  resolveRoleOrganizationScope,
+  roleAclAllowsOrganization,
+  roleAclGrantsPrincipalOrganization
+};
+//# sourceMappingURL=roleOrganizationScope.js.map

package/dist/modules/auth/services/roleOrganizationScope.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/auth/services/roleOrganizationScope.ts"],
+  "sourcesContent": ["import type { OrganizationHierarchyService } from '@open-mercato/shared/lib/auth/principal-service'\nimport type { RoleAcl } from '../data/entities'\n\nexport type RoleOrganizationScope = ReadonlySet<string> | null\n\nfunction normalizeId(value: unknown): string | null {\n  return typeof value === 'string' && value.trim().length > 0 ? value.trim() : null\n}\n\nexport async function resolveRoleOrganizationScope(\n  hierarchyService: OrganizationHierarchyService | null | undefined,\n  tenantId: string | null | undefined,\n  organizationId: string | null | undefined,\n): Promise<RoleOrganizationScope> {\n  const selectedId = normalizeId(organizationId)\n  if (!selectedId) return null\n  const normalizedTenantId = normalizeId(tenantId)\n  if (!normalizedTenantId) return new Set()\n\n  const ids = new Set<string>([selectedId])\n  // Auth remains independently usable when Directory is disabled: exact-org\n  // grants still apply, while parent-to-descendant expansion fails closed.\n  if (!hierarchyService) return ids\n\n  const ancestorIds = await hierarchyService.resolveAncestorIds({\n    tenantId: normalizedTenantId,\n    organizationId: selectedId,\n  })\n  // A registered Directory seam can prove an invalid/wrong-tenant selection.\n  // Fail closed for restricted roles in that case.\n  if (ancestorIds === null) return new Set()\n  for (const ancestorId of ancestorIds) {\n    const normalized = normalizeId(ancestorId)\n    if (normalized) ids.add(normalized)\n  }\n  return ids\n}\n\nexport function roleAclAllowsOrganization(\n  acl: Pick<RoleAcl, 'organizationsJson'>,\n  scope: RoleOrganizationScope,\n): boolean {\n  if (!scope) return true\n  const organizations = Array.isArray(acl.organizationsJson) ? acl.organizationsJson : null\n  if (!organizations || organizations.length === 0 || organizations.includes('__all__')) return true\n  return organizations.some((organizationId) => scope.has(organizationId))\n}\n\n/**\n * Principal eligibility \u2014 which roles may be selected as, or resolved into, an explicit share\n * target \u2014 follows the human-principal deny-all contract instead: an empty allowlist grants no\n * organization reach, so such a role must not become a share principal here (#4033).\n *\n * This deliberately differs from `roleAclAllowsOrganization` above, which governs *feature*\n * evaluation and keeps the wider \"an empty list applies everywhere\" meaning, and from the\n * API-key projection, where an empty list means \"inherit the key's own organization binding\".\n * Without this split a user who reaches an organization through a second role could inherit\n * viewer/editor access from a share assigned to a deny-all role.\n */\nexport function roleAclGrantsPrincipalOrganization(\n  acl: Pick<RoleAcl, 'organizationsJson'>,\n  scope: RoleOrganizationScope,\n): boolean {\n  if (!scope) return true\n  const organizations = Array.isArray(acl.organizationsJson) ? acl.organizationsJson : null\n  if (!organizations) return true\n  if (organizations.length === 0) return false\n  if (organizations.includes('__all__')) return true\n  return organizations.some((organizationId) => scope.has(organizationId))\n}\n"],
+  "mappings": "AAKA,SAAS,YAAY,OAA+B;AAClD,SAAO,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,IAAI,MAAM,KAAK,IAAI;AAC/E;AAEA,eAAsB,6BACpB,kBACA,UACA,gBACgC;AAChC,QAAM,aAAa,YAAY,cAAc;AAC7C,MAAI,CAAC,WAAY,QAAO;AACxB,QAAM,qBAAqB,YAAY,QAAQ;AAC/C,MAAI,CAAC,mBAAoB,QAAO,oBAAI,IAAI;AAExC,QAAM,MAAM,oBAAI,IAAY,CAAC,UAAU,CAAC;AAGxC,MAAI,CAAC,iBAAkB,QAAO;AAE9B,QAAM,cAAc,MAAM,iBAAiB,mBAAmB;AAAA,IAC5D,UAAU;AAAA,IACV,gBAAgB;AAAA,EAClB,CAAC;AAGD,MAAI,gBAAgB,KAAM,QAAO,oBAAI,IAAI;AACzC,aAAW,cAAc,aAAa;AACpC,UAAM,aAAa,YAAY,UAAU;AACzC,QAAI,WAAY,KAAI,IAAI,UAAU;AAAA,EACpC;AACA,SAAO;AACT;AAEO,SAAS,0BACd,KACA,OACS;AACT,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,gBAAgB,MAAM,QAAQ,IAAI,iBAAiB,IAAI,IAAI,oBAAoB;AACrF,MAAI,CAAC,iBAAiB,cAAc,WAAW,KAAK,cAAc,SAAS,SAAS,EAAG,QAAO;AAC9F,SAAO,cAAc,KAAK,CAAC,mBAAmB,MAAM,IAAI,cAAc,CAAC;AACzE;AAaO,SAAS,mCACd,KACA,OACS;AACT,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,gBAAgB,MAAM,QAAQ,IAAI,iBAAiB,IAAI,IAAI,oBAAoB;AACrF,MAAI,CAAC,cAAe,QAAO;AAC3B,MAAI,cAAc,WAAW,EAAG,QAAO;AACvC,MAAI,cAAc,SAAS,SAAS,EAAG,QAAO;AAC9C,SAAO,cAAc,KAAK,CAAC,mBAAmB,MAAM,IAAI,cAAc,CAAC;AACzE;",
+  "names": []
+}

package/dist/modules/business_rules/backend/logs/page.js

@@ -12,6 +12,7 @@ function ExecutionLogsPage() {
   const [pageSize] = React.useState(50);
   const [total, setTotal] = React.useState(0);
   const [totalPages, setTotalPages] = React.useState(1);
+  const [totalIsCapped, setTotalIsCapped] = React.useState(false);
   const t = useT();
   const [filterValues, setFilterValues] = React.useState({});
   const { data, isLoading, error } = useQuery({
@@ -38,6 +39,7 @@ function ExecutionLogsPage() {
       if (response) {
         setTotal(response.total || 0);
         setTotalPages(response.totalPages || 1);
+        setTotalIsCapped(response?.totalIsCapped === true);
       }
       return response?.items || [];
     }
@@ -179,7 +181,7 @@ function ExecutionLogsPage() {
       onFiltersClear: handleFiltersClear,
       isLoading,
       error: error ? t("business_rules.logs.messages.loadFailed") : void 0,
-      pagination: { page, pageSize, total, totalPages, onPageChange: setPage }
+      pagination: { page, pageSize, total, totalPages, totalIsCapped, onPageChange: setPage }
     }
   ) }) });
 }

package/dist/modules/business_rules/backend/logs/page.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/business_rules/backend/logs/page.tsx"],
-  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport Link from 'next/link'\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { DataTable } from '@open-mercato/ui/backend/DataTable'\nimport type { LegacyColumnDef as ColumnDef } from '@tanstack/react-table/legacy'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\nimport { useQuery } from '@tanstack/react-query'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport type { FilterDef, FilterValues } from '@open-mercato/ui/backend/FilterBar'\n\ntype RuleExecutionLog = {\n  id: string\n  ruleId: string\n  rule?: {\n    id: string\n    ruleId: string\n    ruleName: string\n    ruleType: string\n  } | null\n  entityType: string\n  entityId: string | null\n  eventType: string | null\n  executedAt: string\n  executionTimeMs: number\n  executionResult: 'SUCCESS' | 'FAILURE' | 'ERROR'\n  resultValue: any | null\n  errorMessage: string | null\n  inputContext: any | null\n  outputContext: any | null\n  executedBy: string | null\n  tenantId: string | null\n  organizationId: string | null\n}\n\ntype LogsResponse = {\n  items: RuleExecutionLog[]\n  total: number\n  totalPages: number\n}\n\nexport default function ExecutionLogsPage() {\n  const [page, setPage] = React.useState(1)\n  const [pageSize] = React.useState(50)\n  const [total, setTotal] = React.useState(0)\n  const [totalPages, setTotalPages] = React.useState(1)\n  const t = useT()\n  const [filterValues, setFilterValues] = React.useState<FilterValues>({})\n\n  const { data, isLoading, error } = useQuery({\n    queryKey: ['business-rules', 'logs', filterValues, page],\n    queryFn: async () => {\n      const params = new URLSearchParams()\n      params.set('page', page.toString())\n      params.set('pageSize', pageSize.toString())\n      params.set('sortField', 'executedAt')\n      params.set('sortDir', 'desc')\n\n      if (filterValues.ruleId) params.set('ruleId', filterValues.ruleId as string)\n      if (filterValues.entityType) params.set('entityType', filterValues.entityType as string)\n      if (filterValues.executionResult) params.set('executionResult', filterValues.executionResult as string)\n      if (filterValues.executedBy) params.set('executedBy', filterValues.executedBy as string)\n      if (filterValues.executedAtFrom) params.set('executedAtFrom', filterValues.executedAtFrom as string)\n      if (filterValues.executedAtTo) params.set('executedAtTo', filterValues.executedAtTo as string)\n\n      const result = await apiCall<LogsResponse>(\n        `/api/business_rules/logs?${params.toString()}`\n      )\n\n      if (!result.ok) {\n        throw new Error('Failed to fetch execution logs')\n      }\n\n      const response = result.result\n      if (response) {\n        setTotal(response.total || 0)\n        setTotalPages(response.totalPages || 1)\n      }\n\n      return response?.items || []\n    },\n  })\n\n  const handleFiltersApply = React.useCallback((values: FilterValues) => {\n    const next: FilterValues = {}\n    Object.entries(values).forEach(([key, value]) => {\n      if (value !== undefined) next[key] = value\n    })\n    setFilterValues(next)\n    setPage(1)\n  }, [])\n\n  const handleFiltersClear = React.useCallback(() => {\n    setFilterValues({})\n    setPage(1)\n  }, [])\n\n  const filters: FilterDef[] = [\n    {\n      id: 'entityType',\n      type: 'text',\n      label: t('business_rules.logs.filters.entityType'),\n      placeholder: t('business_rules.logs.filters.entityTypePlaceholder'),\n    },\n    {\n      id: 'executionResult',\n      type: 'select',\n      label: t('business_rules.logs.filters.result'),\n      options: [\n        { value: '', label: t('common.all') },\n        { value: 'SUCCESS', label: t('business_rules.logs.result.success') },\n        { value: 'FAILURE', label: t('business_rules.logs.result.failure') },\n        { value: 'ERROR', label: t('business_rules.logs.result.error') },\n      ],\n    },\n    {\n      id: 'executedBy',\n      type: 'text',\n      label: t('business_rules.logs.filters.executedBy'),\n      placeholder: t('business_rules.logs.filters.executedByPlaceholder'),\n    },\n    {\n      id: 'executedAtFrom',\n      type: 'dateRange',\n      label: t('business_rules.logs.filters.dateFrom'),\n    },\n    {\n      id: 'executedAtTo',\n      type: 'dateRange',\n      label: t('business_rules.logs.filters.dateTo'),\n    },\n  ]\n\n  const getResultBadgeClass = (result: string) => {\n    switch (result) {\n      case 'SUCCESS':\n        return 'bg-green-100 text-green-800'\n      case 'FAILURE':\n        return 'bg-yellow-100 text-yellow-800'\n      case 'ERROR':\n        return 'bg-red-100 text-red-800'\n      default:\n        return 'bg-muted text-foreground'\n    }\n  }\n\n  const columns: ColumnDef<RuleExecutionLog>[] = [\n    {\n      id: 'executedAt',\n      header: t('business_rules.logs.fields.executedAt'),\n      accessorKey: 'executedAt',\n      cell: ({ row }) => (\n        <div className=\"text-sm\">\n          {new Date(row.original.executedAt).toLocaleString()}\n        </div>\n      ),\n    },\n    {\n      id: 'rule',\n      header: t('business_rules.logs.fields.rule'),\n      cell: ({ row }) => (\n        <div>\n          {row.original.rule ? (\n            <Link\n              href={`/backend/rules/${row.original.rule.id}`}\n              className=\"text-blue-600 hover:text-blue-800 hover:underline font-medium\"\n            >\n              {row.original.rule.ruleName}\n            </Link>\n          ) : (\n            <span className=\"text-muted-foreground text-sm\">\n              {t('business_rules.logs.ruleDeleted')}\n            </span>\n          )}\n          {row.original.rule && (\n            <div className=\"text-xs text-muted-foreground mt-0.5\">\n              {row.original.rule.ruleType}\n            </div>\n          )}\n        </div>\n      ),\n    },\n    {\n      id: 'entity',\n      header: t('business_rules.logs.fields.entity'),\n      cell: ({ row }) => (\n        <div className=\"text-sm\">\n          <div className=\"font-medium\">{row.original.entityType}</div>\n          {row.original.entityId && (\n            <div className=\"text-xs text-muted-foreground truncate max-w-[200px]\" title={row.original.entityId}>\n              {row.original.entityId}\n            </div>\n          )}\n        </div>\n      ),\n    },\n    {\n      id: 'result',\n      header: t('business_rules.logs.fields.result'),\n      accessorKey: 'executionResult',\n      cell: ({ row }) => (\n        <span\n          className={`inline-flex items-center px-2 py-1 rounded text-xs font-medium ${getResultBadgeClass(\n            row.original.executionResult\n          )}`}\n        >\n          {t(`business_rules.logs.result.${row.original.executionResult.toLowerCase()}`)}\n        </span>\n      ),\n    },\n    {\n      id: 'executionTime',\n      header: t('business_rules.logs.fields.executionTime'),\n      accessorKey: 'executionTimeMs',\n      cell: ({ row }) => (\n        <div className=\"text-sm text-muted-foreground\">\n          {row.original.executionTimeMs}ms\n        </div>\n      ),\n    },\n    {\n      id: 'actions',\n      header: '',\n      cell: ({ row }) => (\n        <Link\n          href={`/backend/logs/${row.original.id}`}\n          className=\"text-sm text-blue-600 hover:text-blue-800 hover:underline\"\n        >\n          {t('common.details')}\n        </Link>\n      ),\n    },\n  ]\n\n  return (\n    <Page>\n      <PageBody>\n        <DataTable\n          title={t('business_rules.logs.list.title')}\n          columns={columns}\n          data={data || []}\n          filters={filters}\n          filterValues={filterValues}\n          onFiltersApply={handleFiltersApply}\n          onFiltersClear={handleFiltersClear}\n          isLoading={isLoading}\n          error={error ? t('business_rules.logs.messages.loadFailed') : undefined}\n          pagination={{ page, pageSize, total, totalPages, onPageChange: setPage }}\n        />\n      </PageBody>\n    </Page>\n  )\n}\n"],
-  "mappings": ";AAyJQ,cASA,YATA;AAvJR,YAAY,WAAW;AACvB,OAAO,UAAU;AACjB,SAAS,MAAM,gBAAgB;AAC/B,SAAS,iBAAiB;AAE1B,SAAS,eAAe;AACxB,SAAS,gBAAgB;AACzB,SAAS,YAAY;AAiCN,SAAR,oBAAqC;AAC1C,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAS,CAAC;AACxC,QAAM,CAAC,QAAQ,IAAI,MAAM,SAAS,EAAE;AACpC,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAS,CAAC;AAC1C,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAAS,CAAC;AACpD,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,cAAc,eAAe,IAAI,MAAM,SAAuB,CAAC,CAAC;AAEvE,QAAM,EAAE,MAAM,WAAW,MAAM,IAAI,SAAS;AAAA,IAC1C,UAAU,CAAC,kBAAkB,QAAQ,cAAc,IAAI;AAAA,IACvD,SAAS,YAAY;AACnB,YAAM,SAAS,IAAI,gBAAgB;AACnC,aAAO,IAAI,QAAQ,KAAK,SAAS,CAAC;AAClC,aAAO,IAAI,YAAY,SAAS,SAAS,CAAC;AAC1C,aAAO,IAAI,aAAa,YAAY;AACpC,aAAO,IAAI,WAAW,MAAM;AAE5B,UAAI,aAAa,OAAQ,QAAO,IAAI,UAAU,aAAa,MAAgB;AAC3E,UAAI,aAAa,WAAY,QAAO,IAAI,cAAc,aAAa,UAAoB;AACvF,UAAI,aAAa,gBAAiB,QAAO,IAAI,mBAAmB,aAAa,eAAyB;AACtG,UAAI,aAAa,WAAY,QAAO,IAAI,cAAc,aAAa,UAAoB;AACvF,UAAI,aAAa,eAAgB,QAAO,IAAI,kBAAkB,aAAa,cAAwB;AACnG,UAAI,aAAa,aAAc,QAAO,IAAI,gBAAgB,aAAa,YAAsB;AAE7F,YAAM,SAAS,MAAM;AAAA,QACnB,4BAA4B,OAAO,SAAS,CAAC;AAAA,MAC/C;AAEA,UAAI,CAAC,OAAO,IAAI;AACd,cAAM,IAAI,MAAM,gCAAgC;AAAA,MAClD;AAEA,YAAM,WAAW,OAAO;AACxB,UAAI,UAAU;AACZ,iBAAS,SAAS,SAAS,CAAC;AAC5B,sBAAc,SAAS,cAAc,CAAC;AAAA,MACxC;AAEA,aAAO,UAAU,SAAS,CAAC;AAAA,IAC7B;AAAA,EACF,CAAC;AAED,QAAM,qBAAqB,MAAM,YAAY,CAAC,WAAyB;AACrE,UAAM,OAAqB,CAAC;AAC5B,WAAO,QAAQ,MAAM,EAAE,QAAQ,CAAC,CAAC,KAAK,KAAK,MAAM;AAC/C,UAAI,UAAU,OAAW,MAAK,GAAG,IAAI;AAAA,IACvC,CAAC;AACD,oBAAgB,IAAI;AACpB,YAAQ,CAAC;AAAA,EACX,GAAG,CAAC,CAAC;AAEL,QAAM,qBAAqB,MAAM,YAAY,MAAM;AACjD,oBAAgB,CAAC,CAAC;AAClB,YAAQ,CAAC;AAAA,EACX,GAAG,CAAC,CAAC;AAEL,QAAM,UAAuB;AAAA,IAC3B;AAAA,MACE,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,OAAO,EAAE,wCAAwC;AAAA,MACjD,aAAa,EAAE,mDAAmD;AAAA,IACpE;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,OAAO,EAAE,oCAAoC;AAAA,MAC7C,SAAS;AAAA,QACP,EAAE,OAAO,IAAI,OAAO,EAAE,YAAY,EAAE;AAAA,QACpC,EAAE,OAAO,WAAW,OAAO,EAAE,oCAAoC,EAAE;AAAA,QACnE,EAAE,OAAO,WAAW,OAAO,EAAE,oCAAoC,EAAE;AAAA,QACnE,EAAE,OAAO,SAAS,OAAO,EAAE,kCAAkC,EAAE;AAAA,MACjE;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,OAAO,EAAE,wCAAwC;AAAA,MACjD,aAAa,EAAE,mDAAmD;AAAA,IACpE;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,OAAO,EAAE,sCAAsC;AAAA,IACjD;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,OAAO,EAAE,oCAAoC;AAAA,IAC/C;AAAA,EACF;AAEA,QAAM,sBAAsB,CAAC,WAAmB;AAC9C,YAAQ,QAAQ;AAAA,MACd,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT;AACE,eAAO;AAAA,IACX;AAAA,EACF;AAEA,QAAM,UAAyC;AAAA,IAC7C;AAAA,MACE,IAAI;AAAA,MACJ,QAAQ,EAAE,uCAAuC;AAAA,MACjD,aAAa;AAAA,MACb,MAAM,CAAC,EAAE,IAAI,MACX,oBAAC,SAAI,WAAU,WACZ,cAAI,KAAK,IAAI,SAAS,UAAU,EAAE,eAAe,GACpD;AAAA,IAEJ;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,QAAQ,EAAE,iCAAiC;AAAA,MAC3C,MAAM,CAAC,EAAE,IAAI,MACX,qBAAC,SACE;AAAA,YAAI,SAAS,OACZ;AAAA,UAAC;AAAA;AAAA,YACC,MAAM,kBAAkB,IAAI,SAAS,KAAK,EAAE;AAAA,YAC5C,WAAU;AAAA,YAET,cAAI,SAAS,KAAK;AAAA;AAAA,QACrB,IAEA,oBAAC,UAAK,WAAU,iCACb,YAAE,iCAAiC,GACtC;AAAA,QAED,IAAI,SAAS,QACZ,oBAAC,SAAI,WAAU,wCACZ,cAAI,SAAS,KAAK,UACrB;AAAA,SAEJ;AAAA,IAEJ;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,QAAQ,EAAE,mCAAmC;AAAA,MAC7C,MAAM,CAAC,EAAE,IAAI,MACX,qBAAC,SAAI,WAAU,WACb;AAAA,4BAAC,SAAI,WAAU,eAAe,cAAI,SAAS,YAAW;AAAA,QACrD,IAAI,SAAS,YACZ,oBAAC,SAAI,WAAU,wDAAuD,OAAO,IAAI,SAAS,UACvF,cAAI,SAAS,UAChB;AAAA,SAEJ;AAAA,IAEJ;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,QAAQ,EAAE,mCAAmC;AAAA,MAC7C,aAAa;AAAA,MACb,MAAM,CAAC,EAAE,IAAI,MACX;AAAA,QAAC;AAAA;AAAA,UACC,WAAW,kEAAkE;AAAA,YAC3E,IAAI,SAAS;AAAA,UACf,CAAC;AAAA,UAEA,YAAE,8BAA8B,IAAI,SAAS,gBAAgB,YAAY,CAAC,EAAE;AAAA;AAAA,MAC/E;AAAA,IAEJ;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,QAAQ,EAAE,0CAA0C;AAAA,MACpD,aAAa;AAAA,MACb,MAAM,CAAC,EAAE,IAAI,MACX,qBAAC,SAAI,WAAU,iCACZ;AAAA,YAAI,SAAS;AAAA,QAAgB;AAAA,SAChC;AAAA,IAEJ;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,QAAQ;AAAA,MACR,MAAM,CAAC,EAAE,IAAI,MACX;AAAA,QAAC;AAAA;AAAA,UACC,MAAM,iBAAiB,IAAI,SAAS,EAAE;AAAA,UACtC,WAAU;AAAA,UAET,YAAE,gBAAgB;AAAA;AAAA,MACrB;AAAA,IAEJ;AAAA,EACF;AAEA,SACE,oBAAC,QACC,8BAAC,YACC;AAAA,IAAC;AAAA;AAAA,MACC,OAAO,EAAE,gCAAgC;AAAA,MACzC;AAAA,MACA,MAAM,QAAQ,CAAC;AAAA,MACf;AAAA,MACA;AAAA,MACA,gBAAgB;AAAA,MAChB,gBAAgB;AAAA,MAChB;AAAA,MACA,OAAO,QAAQ,EAAE,yCAAyC,IAAI;AAAA,MAC9D,YAAY,EAAE,MAAM,UAAU,OAAO,YAAY,cAAc,QAAQ;AAAA;AAAA,EACzE,GACF,GACF;AAEJ;",
+  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport Link from 'next/link'\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { DataTable } from '@open-mercato/ui/backend/DataTable'\nimport type { LegacyColumnDef as ColumnDef } from '@tanstack/react-table/legacy'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\nimport { useQuery } from '@tanstack/react-query'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport type { FilterDef, FilterValues } from '@open-mercato/ui/backend/FilterBar'\n\ntype RuleExecutionLog = {\n  id: string\n  ruleId: string\n  rule?: {\n    id: string\n    ruleId: string\n    ruleName: string\n    ruleType: string\n  } | null\n  entityType: string\n  entityId: string | null\n  eventType: string | null\n  executedAt: string\n  executionTimeMs: number\n  executionResult: 'SUCCESS' | 'FAILURE' | 'ERROR'\n  resultValue: any | null\n  errorMessage: string | null\n  inputContext: any | null\n  outputContext: any | null\n  executedBy: string | null\n  tenantId: string | null\n  organizationId: string | null\n}\n\ntype LogsResponse = {\n  items: RuleExecutionLog[]\n  total: number\n  totalPages: number\n  totalIsCapped?: boolean\n}\n\nexport default function ExecutionLogsPage() {\n  const [page, setPage] = React.useState(1)\n  const [pageSize] = React.useState(50)\n  const [total, setTotal] = React.useState(0)\n  const [totalPages, setTotalPages] = React.useState(1)\n  const [totalIsCapped, setTotalIsCapped] = React.useState(false)\n  const t = useT()\n  const [filterValues, setFilterValues] = React.useState<FilterValues>({})\n\n  const { data, isLoading, error } = useQuery({\n    queryKey: ['business-rules', 'logs', filterValues, page],\n    queryFn: async () => {\n      const params = new URLSearchParams()\n      params.set('page', page.toString())\n      params.set('pageSize', pageSize.toString())\n      params.set('sortField', 'executedAt')\n      params.set('sortDir', 'desc')\n\n      if (filterValues.ruleId) params.set('ruleId', filterValues.ruleId as string)\n      if (filterValues.entityType) params.set('entityType', filterValues.entityType as string)\n      if (filterValues.executionResult) params.set('executionResult', filterValues.executionResult as string)\n      if (filterValues.executedBy) params.set('executedBy', filterValues.executedBy as string)\n      if (filterValues.executedAtFrom) params.set('executedAtFrom', filterValues.executedAtFrom as string)\n      if (filterValues.executedAtTo) params.set('executedAtTo', filterValues.executedAtTo as string)\n\n      const result = await apiCall<LogsResponse>(\n        `/api/business_rules/logs?${params.toString()}`\n      )\n\n      if (!result.ok) {\n        throw new Error('Failed to fetch execution logs')\n      }\n\n      const response = result.result\n      if (response) {\n        setTotal(response.total || 0)\n        setTotalPages(response.totalPages || 1)\n        setTotalIsCapped(response?.totalIsCapped === true)\n      }\n\n      return response?.items || []\n    },\n  })\n\n  const handleFiltersApply = React.useCallback((values: FilterValues) => {\n    const next: FilterValues = {}\n    Object.entries(values).forEach(([key, value]) => {\n      if (value !== undefined) next[key] = value\n    })\n    setFilterValues(next)\n    setPage(1)\n  }, [])\n\n  const handleFiltersClear = React.useCallback(() => {\n    setFilterValues({})\n    setPage(1)\n  }, [])\n\n  const filters: FilterDef[] = [\n    {\n      id: 'entityType',\n      type: 'text',\n      label: t('business_rules.logs.filters.entityType'),\n      placeholder: t('business_rules.logs.filters.entityTypePlaceholder'),\n    },\n    {\n      id: 'executionResult',\n      type: 'select',\n      label: t('business_rules.logs.filters.result'),\n      options: [\n        { value: '', label: t('common.all') },\n        { value: 'SUCCESS', label: t('business_rules.logs.result.success') },\n        { value: 'FAILURE', label: t('business_rules.logs.result.failure') },\n        { value: 'ERROR', label: t('business_rules.logs.result.error') },\n      ],\n    },\n    {\n      id: 'executedBy',\n      type: 'text',\n      label: t('business_rules.logs.filters.executedBy'),\n      placeholder: t('business_rules.logs.filters.executedByPlaceholder'),\n    },\n    {\n      id: 'executedAtFrom',\n      type: 'dateRange',\n      label: t('business_rules.logs.filters.dateFrom'),\n    },\n    {\n      id: 'executedAtTo',\n      type: 'dateRange',\n      label: t('business_rules.logs.filters.dateTo'),\n    },\n  ]\n\n  const getResultBadgeClass = (result: string) => {\n    switch (result) {\n      case 'SUCCESS':\n        return 'bg-green-100 text-green-800'\n      case 'FAILURE':\n        return 'bg-yellow-100 text-yellow-800'\n      case 'ERROR':\n        return 'bg-red-100 text-red-800'\n      default:\n        return 'bg-muted text-foreground'\n    }\n  }\n\n  const columns: ColumnDef<RuleExecutionLog>[] = [\n    {\n      id: 'executedAt',\n      header: t('business_rules.logs.fields.executedAt'),\n      accessorKey: 'executedAt',\n      cell: ({ row }) => (\n        <div className=\"text-sm\">\n          {new Date(row.original.executedAt).toLocaleString()}\n        </div>\n      ),\n    },\n    {\n      id: 'rule',\n      header: t('business_rules.logs.fields.rule'),\n      cell: ({ row }) => (\n        <div>\n          {row.original.rule ? (\n            <Link\n              href={`/backend/rules/${row.original.rule.id}`}\n              className=\"text-blue-600 hover:text-blue-800 hover:underline font-medium\"\n            >\n              {row.original.rule.ruleName}\n            </Link>\n          ) : (\n            <span className=\"text-muted-foreground text-sm\">\n              {t('business_rules.logs.ruleDeleted')}\n            </span>\n          )}\n          {row.original.rule && (\n            <div className=\"text-xs text-muted-foreground mt-0.5\">\n              {row.original.rule.ruleType}\n            </div>\n          )}\n        </div>\n      ),\n    },\n    {\n      id: 'entity',\n      header: t('business_rules.logs.fields.entity'),\n      cell: ({ row }) => (\n        <div className=\"text-sm\">\n          <div className=\"font-medium\">{row.original.entityType}</div>\n          {row.original.entityId && (\n            <div className=\"text-xs text-muted-foreground truncate max-w-[200px]\" title={row.original.entityId}>\n              {row.original.entityId}\n            </div>\n          )}\n        </div>\n      ),\n    },\n    {\n      id: 'result',\n      header: t('business_rules.logs.fields.result'),\n      accessorKey: 'executionResult',\n      cell: ({ row }) => (\n        <span\n          className={`inline-flex items-center px-2 py-1 rounded text-xs font-medium ${getResultBadgeClass(\n            row.original.executionResult\n          )}`}\n        >\n          {t(`business_rules.logs.result.${row.original.executionResult.toLowerCase()}`)}\n        </span>\n      ),\n    },\n    {\n      id: 'executionTime',\n      header: t('business_rules.logs.fields.executionTime'),\n      accessorKey: 'executionTimeMs',\n      cell: ({ row }) => (\n        <div className=\"text-sm text-muted-foreground\">\n          {row.original.executionTimeMs}ms\n        </div>\n      ),\n    },\n    {\n      id: 'actions',\n      header: '',\n      cell: ({ row }) => (\n        <Link\n          href={`/backend/logs/${row.original.id}`}\n          className=\"text-sm text-blue-600 hover:text-blue-800 hover:underline\"\n        >\n          {t('common.details')}\n        </Link>\n      ),\n    },\n  ]\n\n  return (\n    <Page>\n      <PageBody>\n        <DataTable\n          title={t('business_rules.logs.list.title')}\n          columns={columns}\n          data={data || []}\n          filters={filters}\n          filterValues={filterValues}\n          onFiltersApply={handleFiltersApply}\n          onFiltersClear={handleFiltersClear}\n          isLoading={isLoading}\n          error={error ? t('business_rules.logs.messages.loadFailed') : undefined}\n          pagination={{ page, pageSize, total, totalPages, totalIsCapped, onPageChange: setPage }}\n        />\n      </PageBody>\n    </Page>\n  )\n}\n"],
+  "mappings": ";AA4JQ,cASA,YATA;AA1JR,YAAY,WAAW;AACvB,OAAO,UAAU;AACjB,SAAS,MAAM,gBAAgB;AAC/B,SAAS,iBAAiB;AAE1B,SAAS,eAAe;AACxB,SAAS,gBAAgB;AACzB,SAAS,YAAY;AAkCN,SAAR,oBAAqC;AAC1C,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAS,CAAC;AACxC,QAAM,CAAC,QAAQ,IAAI,MAAM,SAAS,EAAE;AACpC,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAS,CAAC;AAC1C,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAAS,CAAC;AACpD,QAAM,CAAC,eAAe,gBAAgB,IAAI,MAAM,SAAS,KAAK;AAC9D,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,cAAc,eAAe,IAAI,MAAM,SAAuB,CAAC,CAAC;AAEvE,QAAM,EAAE,MAAM,WAAW,MAAM,IAAI,SAAS;AAAA,IAC1C,UAAU,CAAC,kBAAkB,QAAQ,cAAc,IAAI;AAAA,IACvD,SAAS,YAAY;AACnB,YAAM,SAAS,IAAI,gBAAgB;AACnC,aAAO,IAAI,QAAQ,KAAK,SAAS,CAAC;AAClC,aAAO,IAAI,YAAY,SAAS,SAAS,CAAC;AAC1C,aAAO,IAAI,aAAa,YAAY;AACpC,aAAO,IAAI,WAAW,MAAM;AAE5B,UAAI,aAAa,OAAQ,QAAO,IAAI,UAAU,aAAa,MAAgB;AAC3E,UAAI,aAAa,WAAY,QAAO,IAAI,cAAc,aAAa,UAAoB;AACvF,UAAI,aAAa,gBAAiB,QAAO,IAAI,mBAAmB,aAAa,eAAyB;AACtG,UAAI,aAAa,WAAY,QAAO,IAAI,cAAc,aAAa,UAAoB;AACvF,UAAI,aAAa,eAAgB,QAAO,IAAI,kBAAkB,aAAa,cAAwB;AACnG,UAAI,aAAa,aAAc,QAAO,IAAI,gBAAgB,aAAa,YAAsB;AAE7F,YAAM,SAAS,MAAM;AAAA,QACnB,4BAA4B,OAAO,SAAS,CAAC;AAAA,MAC/C;AAEA,UAAI,CAAC,OAAO,IAAI;AACd,cAAM,IAAI,MAAM,gCAAgC;AAAA,MAClD;AAEA,YAAM,WAAW,OAAO;AACxB,UAAI,UAAU;AACZ,iBAAS,SAAS,SAAS,CAAC;AAC5B,sBAAc,SAAS,cAAc,CAAC;AACtC,yBAAiB,UAAU,kBAAkB,IAAI;AAAA,MACnD;AAEA,aAAO,UAAU,SAAS,CAAC;AAAA,IAC7B;AAAA,EACF,CAAC;AAED,QAAM,qBAAqB,MAAM,YAAY,CAAC,WAAyB;AACrE,UAAM,OAAqB,CAAC;AAC5B,WAAO,QAAQ,MAAM,EAAE,QAAQ,CAAC,CAAC,KAAK,KAAK,MAAM;AAC/C,UAAI,UAAU,OAAW,MAAK,GAAG,IAAI;AAAA,IACvC,CAAC;AACD,oBAAgB,IAAI;AACpB,YAAQ,CAAC;AAAA,EACX,GAAG,CAAC,CAAC;AAEL,QAAM,qBAAqB,MAAM,YAAY,MAAM;AACjD,oBAAgB,CAAC,CAAC;AAClB,YAAQ,CAAC;AAAA,EACX,GAAG,CAAC,CAAC;AAEL,QAAM,UAAuB;AAAA,IAC3B;AAAA,MACE,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,OAAO,EAAE,wCAAwC;AAAA,MACjD,aAAa,EAAE,mDAAmD;AAAA,IACpE;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,OAAO,EAAE,oCAAoC;AAAA,MAC7C,SAAS;AAAA,QACP,EAAE,OAAO,IAAI,OAAO,EAAE,YAAY,EAAE;AAAA,QACpC,EAAE,OAAO,WAAW,OAAO,EAAE,oCAAoC,EAAE;AAAA,QACnE,EAAE,OAAO,WAAW,OAAO,EAAE,oCAAoC,EAAE;AAAA,QACnE,EAAE,OAAO,SAAS,OAAO,EAAE,kCAAkC,EAAE;AAAA,MACjE;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,OAAO,EAAE,wCAAwC;AAAA,MACjD,aAAa,EAAE,mDAAmD;AAAA,IACpE;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,OAAO,EAAE,sCAAsC;AAAA,IACjD;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,OAAO,EAAE,oCAAoC;AAAA,IAC/C;AAAA,EACF;AAEA,QAAM,sBAAsB,CAAC,WAAmB;AAC9C,YAAQ,QAAQ;AAAA,MACd,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT;AACE,eAAO;AAAA,IACX;AAAA,EACF;AAEA,QAAM,UAAyC;AAAA,IAC7C;AAAA,MACE,IAAI;AAAA,MACJ,QAAQ,EAAE,uCAAuC;AAAA,MACjD,aAAa;AAAA,MACb,MAAM,CAAC,EAAE,IAAI,MACX,oBAAC,SAAI,WAAU,WACZ,cAAI,KAAK,IAAI,SAAS,UAAU,EAAE,eAAe,GACpD;AAAA,IAEJ;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,QAAQ,EAAE,iCAAiC;AAAA,MAC3C,MAAM,CAAC,EAAE,IAAI,MACX,qBAAC,SACE;AAAA,YAAI,SAAS,OACZ;AAAA,UAAC;AAAA;AAAA,YACC,MAAM,kBAAkB,IAAI,SAAS,KAAK,EAAE;AAAA,YAC5C,WAAU;AAAA,YAET,cAAI,SAAS,KAAK;AAAA;AAAA,QACrB,IAEA,oBAAC,UAAK,WAAU,iCACb,YAAE,iCAAiC,GACtC;AAAA,QAED,IAAI,SAAS,QACZ,oBAAC,SAAI,WAAU,wCACZ,cAAI,SAAS,KAAK,UACrB;AAAA,SAEJ;AAAA,IAEJ;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,QAAQ,EAAE,mCAAmC;AAAA,MAC7C,MAAM,CAAC,EAAE,IAAI,MACX,qBAAC,SAAI,WAAU,WACb;AAAA,4BAAC,SAAI,WAAU,eAAe,cAAI,SAAS,YAAW;AAAA,QACrD,IAAI,SAAS,YACZ,oBAAC,SAAI,WAAU,wDAAuD,OAAO,IAAI,SAAS,UACvF,cAAI,SAAS,UAChB;AAAA,SAEJ;AAAA,IAEJ;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,QAAQ,EAAE,mCAAmC;AAAA,MAC7C,aAAa;AAAA,MACb,MAAM,CAAC,EAAE,IAAI,MACX;AAAA,QAAC;AAAA;AAAA,UACC,WAAW,kEAAkE;AAAA,YAC3E,IAAI,SAAS;AAAA,UACf,CAAC;AAAA,UAEA,YAAE,8BAA8B,IAAI,SAAS,gBAAgB,YAAY,CAAC,EAAE;AAAA;AAAA,MAC/E;AAAA,IAEJ;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,QAAQ,EAAE,0CAA0C;AAAA,MACpD,aAAa;AAAA,MACb,MAAM,CAAC,EAAE,IAAI,MACX,qBAAC,SAAI,WAAU,iCACZ;AAAA,YAAI,SAAS;AAAA,QAAgB;AAAA,SAChC;AAAA,IAEJ;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,QAAQ;AAAA,MACR,MAAM,CAAC,EAAE,IAAI,MACX;AAAA,QAAC;AAAA;AAAA,UACC,MAAM,iBAAiB,IAAI,SAAS,EAAE;AAAA,UACtC,WAAU;AAAA,UAET,YAAE,gBAAgB;AAAA;AAAA,MACrB;AAAA,IAEJ;AAAA,EACF;AAEA,SACE,oBAAC,QACC,8BAAC,YACC;AAAA,IAAC;AAAA;AAAA,MACC,OAAO,EAAE,gCAAgC;AAAA,MACzC;AAAA,MACA,MAAM,QAAQ,CAAC;AAAA,MACf;AAAA,MACA;AAAA,MACA,gBAAgB;AAAA,MAChB,gBAAgB;AAAA,MAChB;AAAA,MACA,OAAO,QAAQ,EAAE,yCAAyC,IAAI;AAAA,MAC9D,YAAY,EAAE,MAAM,UAAU,OAAO,YAAY,eAAe,cAAc,QAAQ;AAAA;AAAA,EACxF,GACF,GACF;AAEJ;",
   "names": []
 }

package/dist/modules/business_rules/backend/rules/page.js

@@ -20,6 +20,7 @@ function RulesListPage() {
   const [pageSize] = React.useState(20);
   const [total, setTotal] = React.useState(0);
   const [totalPages, setTotalPages] = React.useState(1);
+  const [totalIsCapped, setTotalIsCapped] = React.useState(false);
   const t = useT();
   const router = useRouter();
   const queryClient = useQueryClient();
@@ -48,6 +49,7 @@ function RulesListPage() {
       if (response) {
         setTotal(response.total || 0);
         setTotalPages(response.totalPages || 1);
+        setTotalIsCapped(response?.totalIsCapped === true);
       }
       return response?.items || [];
     }
@@ -277,7 +279,7 @@ function RulesListPage() {
             createLabel: t("business_rules.actions.create")
           }
         ),
-        pagination: { page, pageSize, total, totalPages, onPageChange: setPage }
+        pagination: { page, pageSize, total, totalPages, totalIsCapped, onPageChange: setPage }
       }
     ) }),
     ConfirmDialogElement