@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.8.1-develop.7441.1.b42958b98c

package/dist/modules/auth/lib/authorizationStateLocks.js

@@ -0,0 +1,249 @@
+import { LockMode } from "@mikro-orm/core";
+import { ApiKey } from "@open-mercato/core/modules/api_keys/data/entities";
+import { Role, RoleAcl, User, UserAcl, UserRole } from "@open-mercato/core/modules/auth/data/entities";
+import { lockOrganizationHierarchyForTenant } from "@open-mercato/core/modules/directory/lib/hierarchy";
+import { findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import {
+  getTransactionLifetime,
+  onTransactionLifetimeComplete
+} from "@open-mercato/shared/lib/commands/transaction-lifetime";
+function uniqueSortedIds(values) {
+  return Array.from(new Set(values.filter((value) => value.length > 0))).sort((left, right) => left.localeCompare(right));
+}
+function relationId(value) {
+  if (typeof value === "string" && value.length > 0) return value;
+  if (!value || typeof value !== "object") return null;
+  const id = value.id;
+  return typeof id === "string" && id.length > 0 ? id : null;
+}
+const replayLockLeases = /* @__PURE__ */ new WeakMap();
+function assertLeaseContains(lease, targets) {
+  const requested = {
+    apiKeyIds: uniqueSortedIds(targets.apiKeyIds ?? []),
+    userIds: uniqueSortedIds(targets.userIds ?? []),
+    roleIds: uniqueSortedIds(targets.roleIds ?? []),
+    tenantIds: uniqueSortedIds(targets.tenantIds ?? [])
+  };
+  for (const [kind, ids] of Object.entries(requested)) {
+    for (const id of ids) {
+      if (!lease[kind].has(id)) {
+        throw new Error(`[internal] Authorization-state lock footprint was extended after it was sealed (${kind}:${id})`);
+      }
+    }
+  }
+}
+function userRoleIdentity(link) {
+  const userId = relationId(link.user);
+  const roleId = relationId(link.role);
+  return userId && roleId ? `${userId}:${roleId}` : null;
+}
+function sameIds(left, right) {
+  const canonicalLeft = uniqueSortedIds(left);
+  const canonicalRight = uniqueSortedIds(right);
+  return canonicalLeft.length === canonicalRight.length && canonicalLeft.every((value, index) => value === canonicalRight[index]);
+}
+function unexpectedIds(expected, observed) {
+  const expectedIds = new Set(expected);
+  return observed.filter((id) => !expectedIds.has(id));
+}
+function authorizationStateDrift() {
+  return new CrudHttpError(409, {
+    error: "[internal] Authorization state changed while acquiring its lock footprint"
+  });
+}
+async function lockRowsInIdOrder(em, entity, ids, lockMode = LockMode.PESSIMISTIC_WRITE) {
+  const sortedIds = uniqueSortedIds(ids);
+  if (!sortedIds.length) return [];
+  return findWithDecryption(
+    em,
+    entity,
+    { id: { $in: sortedIds } },
+    { lockMode, orderBy: { id: "ASC" }, refresh: true },
+    { tenantId: null, organizationId: null }
+  );
+}
+async function lockAuthorizationApiKeyRows(em, apiKeyIds) {
+  return lockRowsInIdOrder(em, ApiKey, apiKeyIds);
+}
+async function findApiKeyIdsReferencingRoles(em, roleIds) {
+  const ids = uniqueSortedIds(roleIds);
+  if (!ids.length) return [];
+  const apiKeys = await em.find(
+    ApiKey,
+    {
+      deletedAt: null,
+      $and: [
+        { $or: ids.map((roleId) => ({ rolesJson: { $contains: [roleId] } })) },
+        { $or: [{ expiresAt: null }, { expiresAt: { $gt: /* @__PURE__ */ new Date() } }] }
+      ]
+    },
+    { orderBy: { id: "ASC" } }
+  );
+  return uniqueSortedIds(apiKeys.map((apiKey) => String(apiKey.id)));
+}
+async function lockApiKeysReferencingRoles(em, roleIds) {
+  const apiKeyIds = await findApiKeyIdsReferencingRoles(em, roleIds);
+  return lockAuthorizationApiKeyRows(em, apiKeyIds);
+}
+async function lockAuthorizationRoleRows(em, roleIds) {
+  await lockRowsInIdOrder(em, Role, roleIds);
+}
+async function lockAuthorizationUserRows(em, userIds) {
+  await lockRowsInIdOrder(em, User, userIds);
+}
+async function lockLateReferencingApiKeyRows(em, apiKeyIds) {
+  const requested = uniqueSortedIds(apiKeyIds);
+  if (!requested.length) return;
+  const locked = await lockRowsInIdOrder(em, ApiKey, requested, LockMode.PESSIMISTIC_PARTIAL_WRITE);
+  const lockedIds = new Set(locked.map((apiKey) => String(apiKey.id)));
+  if (requested.some((id) => !lockedIds.has(id))) {
+    throw authorizationStateDrift();
+  }
+}
+async function lockRoleWriterAuthorizationState(em, roleIds) {
+  await lockRoleAclWriterAuthorizationState(em, roleIds);
+}
+async function lockAuthorizationState(em, targets, options = {}) {
+  const transactionLifetime = getTransactionLifetime(em);
+  const existingLease = transactionLifetime ? replayLockLeases.get(transactionLifetime) : void 0;
+  if (existingLease) {
+    assertLeaseContains(existingLease, targets);
+    return;
+  }
+  const apiKeyIds = uniqueSortedIds(targets.apiKeyIds ?? []);
+  const userIds = uniqueSortedIds(targets.userIds ?? []);
+  const explicitRoleIds = uniqueSortedIds(targets.roleIds ?? []);
+  const tenantIds = uniqueSortedIds(targets.tenantIds ?? []);
+  const explicitApiKeys = apiKeyIds.length ? await findWithDecryption(
+    em,
+    ApiKey,
+    { id: { $in: apiKeyIds } },
+    { orderBy: { id: "ASC" } },
+    { tenantId: null, organizationId: null }
+  ) : [];
+  const explicitApiKeyRoleIds = uniqueSortedIds(explicitApiKeys.flatMap((apiKey) => Array.isArray(apiKey.rolesJson) ? apiKey.rolesJson : []));
+  const discoveredBeforeLocks = userIds.length ? await findWithDecryption(
+    em,
+    UserRole,
+    { user: { $in: userIds } },
+    { orderBy: { id: "ASC" } },
+    { tenantId: null, organizationId: null }
+  ) : [];
+  const roleIdsBeforeLocks = uniqueSortedIds([
+    ...explicitRoleIds,
+    ...explicitApiKeyRoleIds,
+    ...discoveredBeforeLocks.flatMap((link) => {
+      const id = relationId(link.role);
+      return id ? [id] : [];
+    })
+  ]);
+  const referencingApiKeyIds = await findApiKeyIdsReferencingRoles(em, roleIdsBeforeLocks);
+  const lockedApiKeys = await lockAuthorizationApiKeyRows(em, [
+    ...apiKeyIds,
+    ...referencingApiKeyIds
+  ]);
+  for (const apiKey of lockedApiKeys) {
+    const id = String(apiKey.id);
+    if (!apiKeyIds.includes(id)) continue;
+    const before = explicitApiKeys.find((candidate) => String(candidate.id) === id);
+    const beforeRoles = Array.isArray(before?.rolesJson) ? before.rolesJson : [];
+    const lockedRoles = Array.isArray(apiKey.rolesJson) ? apiKey.rolesJson : [];
+    if (!sameIds(beforeRoles, lockedRoles)) {
+      throw authorizationStateDrift();
+    }
+  }
+  await lockAuthorizationUserRows(em, userIds);
+  const stableUserRoles = userIds.length ? await findWithDecryption(
+    em,
+    UserRole,
+    { user: { $in: userIds } },
+    { orderBy: { id: "ASC" }, refresh: true },
+    { tenantId: null, organizationId: null }
+  ) : [];
+  const discoveredIdentities = discoveredBeforeLocks.map(userRoleIdentity).filter((value) => value !== null);
+  const stableIdentities = stableUserRoles.map(userRoleIdentity).filter((value) => value !== null);
+  if (!sameIds(discoveredIdentities, stableIdentities)) {
+    throw authorizationStateDrift();
+  }
+  const roleIds = uniqueSortedIds([
+    ...roleIdsBeforeLocks,
+    ...stableUserRoles.flatMap((link) => {
+      const id = relationId(link.role);
+      return id ? [id] : [];
+    })
+  ]);
+  await lockAuthorizationRoleRows(em, roleIds);
+  const stableReferencingApiKeyIds = await findApiKeyIdsReferencingRoles(em, roleIds);
+  const lateReferencingApiKeyIds = unexpectedIds([...apiKeyIds, ...referencingApiKeyIds], stableReferencingApiKeyIds);
+  if (options.sealReplayFootprint && lateReferencingApiKeyIds.length) {
+    throw authorizationStateDrift();
+  }
+  await lockLateReferencingApiKeyRows(em, lateReferencingApiKeyIds);
+  for (const tenantId of tenantIds) {
+    await lockOrganizationHierarchyForTenant(em, tenantId);
+  }
+  if (userIds.length) {
+    await findWithDecryption(
+      em,
+      UserRole,
+      { user: { $in: userIds } },
+      { lockMode: LockMode.PESSIMISTIC_WRITE, orderBy: { id: "ASC" }, refresh: true },
+      { tenantId: null, organizationId: null }
+    );
+  }
+  if (userIds.length) {
+    await findWithDecryption(
+      em,
+      UserAcl,
+      { user: { $in: userIds } },
+      { lockMode: LockMode.PESSIMISTIC_WRITE, orderBy: { id: "ASC" }, refresh: true },
+      { tenantId: null, organizationId: null }
+    );
+  }
+  if (roleIds.length) {
+    await findWithDecryption(
+      em,
+      RoleAcl,
+      { role: { $in: roleIds } },
+      { lockMode: LockMode.PESSIMISTIC_WRITE, orderBy: { id: "ASC" }, refresh: true },
+      { tenantId: null, organizationId: null }
+    );
+  }
+  if (options.sealReplayFootprint) {
+    if (!transactionLifetime) {
+      throw new Error("[internal] Replay authorization locks require an explicit transaction lifetime");
+    }
+    replayLockLeases.set(transactionLifetime, {
+      apiKeyIds: new Set(apiKeyIds),
+      userIds: new Set(userIds),
+      roleIds: new Set(roleIds),
+      tenantIds: new Set(tenantIds)
+    });
+    onTransactionLifetimeComplete(em, () => {
+      replayLockLeases.delete(transactionLifetime);
+    });
+  }
+}
+async function lockUserRoleWriterAuthorizationState(em, targets) {
+  await lockAuthorizationState(em, targets);
+}
+async function lockUserAclWriterAuthorizationState(em, userIds) {
+  await lockAuthorizationState(em, { userIds });
+}
+async function lockRoleAclWriterAuthorizationState(em, roleIds) {
+  await lockAuthorizationState(em, { roleIds });
+}
+export {
+  findApiKeyIdsReferencingRoles,
+  lockApiKeysReferencingRoles,
+  lockAuthorizationApiKeyRows,
+  lockAuthorizationRoleRows,
+  lockAuthorizationState,
+  lockAuthorizationUserRows,
+  lockRoleAclWriterAuthorizationState,
+  lockRoleWriterAuthorizationState,
+  lockUserAclWriterAuthorizationState,
+  lockUserRoleWriterAuthorizationState
+};
+//# sourceMappingURL=authorizationStateLocks.js.map

package/dist/modules/auth/lib/authorizationStateLocks.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/auth/lib/authorizationStateLocks.ts"],
+  "sourcesContent": ["import { LockMode } from '@mikro-orm/core'\nimport type { EntityManager, EntityName, FilterQuery, FindOptions } from '@mikro-orm/postgresql'\nimport { ApiKey } from '@open-mercato/core/modules/api_keys/data/entities'\nimport { Role, RoleAcl, User, UserAcl, UserRole } from '@open-mercato/core/modules/auth/data/entities'\nimport { lockOrganizationHierarchyForTenant } from '@open-mercato/core/modules/directory/lib/hierarchy'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport {\n  getTransactionLifetime,\n  onTransactionLifetimeComplete,\n} from '@open-mercato/shared/lib/commands/transaction-lifetime'\n\nfunction uniqueSortedIds(values: readonly string[]): string[] {\n  return Array.from(new Set(values.filter((value) => value.length > 0))).sort((left, right) => left.localeCompare(right))\n}\n\nfunction relationId(value: unknown): string | null {\n  if (typeof value === 'string' && value.length > 0) return value\n  if (!value || typeof value !== 'object') return null\n  const id = (value as { id?: unknown }).id\n  return typeof id === 'string' && id.length > 0 ? id : null\n}\n\nexport type AuthorizationStateLockTargets = {\n  apiKeyIds?: readonly string[]\n  userIds?: readonly string[]\n  roleIds?: readonly string[]\n  tenantIds?: readonly string[]\n}\n\ntype AuthorizationStateLockLease = {\n  apiKeyIds: ReadonlySet<string>\n  userIds: ReadonlySet<string>\n  roleIds: ReadonlySet<string>\n  tenantIds: ReadonlySet<string>\n}\n\nconst replayLockLeases = new WeakMap<object, AuthorizationStateLockLease>()\n\nfunction assertLeaseContains(\n  lease: AuthorizationStateLockLease,\n  targets: AuthorizationStateLockTargets,\n): void {\n  const requested = {\n    apiKeyIds: uniqueSortedIds(targets.apiKeyIds ?? []),\n    userIds: uniqueSortedIds(targets.userIds ?? []),\n    roleIds: uniqueSortedIds(targets.roleIds ?? []),\n    tenantIds: uniqueSortedIds(targets.tenantIds ?? []),\n  }\n  for (const [kind, ids] of Object.entries(requested) as Array<\n    [keyof AuthorizationStateLockLease, string[]]\n  >) {\n    for (const id of ids) {\n      if (!lease[kind].has(id)) {\n        throw new Error(`[internal] Authorization-state lock footprint was extended after it was sealed (${kind}:${id})`)\n      }\n    }\n  }\n}\n\nfunction userRoleIdentity(link: UserRole): string | null {\n  const userId = relationId(link.user)\n  const roleId = relationId(link.role)\n  return userId && roleId ? `${userId}:${roleId}` : null\n}\n\nfunction sameIds(left: readonly string[], right: readonly string[]): boolean {\n  const canonicalLeft = uniqueSortedIds(left)\n  const canonicalRight = uniqueSortedIds(right)\n  return canonicalLeft.length === canonicalRight.length\n    && canonicalLeft.every((value, index) => value === canonicalRight[index])\n}\n\nfunction unexpectedIds(expected: readonly string[], observed: readonly string[]): string[] {\n  const expectedIds = new Set(expected)\n  return observed.filter((id) => !expectedIds.has(id))\n}\n\nfunction authorizationStateDrift(): CrudHttpError {\n  return new CrudHttpError(409, {\n    error: '[internal] Authorization state changed while acquiring its lock footprint',\n  })\n}\n\nasync function lockRowsInIdOrder<T extends object>(\n  em: EntityManager,\n  entity: EntityName<T>,\n  ids: readonly string[],\n  lockMode: LockMode = LockMode.PESSIMISTIC_WRITE,\n): Promise<T[]> {\n  const sortedIds = uniqueSortedIds(ids)\n  if (!sortedIds.length) return []\n  return findWithDecryption(\n    em,\n    entity,\n    { id: { $in: sortedIds } as unknown } as FilterQuery<T>,\n    { lockMode, orderBy: { id: 'ASC' }, refresh: true } as FindOptions<T>,\n    { tenantId: null, organizationId: null },\n  )\n}\n\nexport async function lockAuthorizationApiKeyRows(\n  em: EntityManager,\n  apiKeyIds: readonly string[],\n): Promise<ApiKey[]> {\n  return lockRowsInIdOrder(em, ApiKey, apiKeyIds)\n}\n\nexport async function findApiKeyIdsReferencingRoles(\n  em: EntityManager,\n  roleIds: readonly string[],\n): Promise<string[]> {\n  const ids = uniqueSortedIds(roleIds)\n  if (!ids.length) return []\n  const apiKeys = await em.find(\n    ApiKey,\n    {\n      deletedAt: null,\n      $and: [\n        { $or: ids.map((roleId) => ({ rolesJson: { $contains: [roleId] } })) },\n        { $or: [{ expiresAt: null }, { expiresAt: { $gt: new Date() } }] },\n      ],\n    } as FilterQuery<ApiKey>,\n    { orderBy: { id: 'ASC' } },\n  )\n  return uniqueSortedIds(apiKeys.map((apiKey) => String(apiKey.id)))\n}\n\nexport async function lockApiKeysReferencingRoles(\n  em: EntityManager,\n  roleIds: readonly string[],\n): Promise<ApiKey[]> {\n  const apiKeyIds = await findApiKeyIdsReferencingRoles(em, roleIds)\n  return lockAuthorizationApiKeyRows(em, apiKeyIds)\n}\n\nexport async function lockAuthorizationRoleRows(\n  em: EntityManager,\n  roleIds: readonly string[],\n): Promise<void> {\n  await lockRowsInIdOrder(em, Role, roleIds)\n}\n\nexport async function lockAuthorizationUserRows(\n  em: EntityManager,\n  userIds: readonly string[],\n): Promise<void> {\n  await lockRowsInIdOrder(em, User, userIds)\n}\n\nasync function lockLateReferencingApiKeyRows(\n  em: EntityManager,\n  apiKeyIds: readonly string[],\n): Promise<void> {\n  const requested = uniqueSortedIds(apiKeyIds)\n  if (!requested.length) return\n  const locked = await lockRowsInIdOrder(em, ApiKey, requested, LockMode.PESSIMISTIC_PARTIAL_WRITE)\n  const lockedIds = new Set(locked.map((apiKey) => String(apiKey.id)))\n  if (requested.some((id) => !lockedIds.has(id))) {\n    throw authorizationStateDrift()\n  }\n}\n\nexport async function lockRoleWriterAuthorizationState(\n  em: EntityManager,\n  roleIds: readonly string[],\n): Promise<void> {\n  await lockRoleAclWriterAuthorizationState(em, roleIds)\n}\n\nexport async function lockAuthorizationState(\n  em: EntityManager,\n  targets: AuthorizationStateLockTargets,\n  options: { sealReplayFootprint?: boolean } = {},\n): Promise<void> {\n  const transactionLifetime = getTransactionLifetime(em)\n  const existingLease = transactionLifetime\n    ? replayLockLeases.get(transactionLifetime)\n    : undefined\n  if (existingLease) {\n    assertLeaseContains(existingLease, targets)\n    return\n  }\n\n  const apiKeyIds = uniqueSortedIds(targets.apiKeyIds ?? [])\n  const userIds = uniqueSortedIds(targets.userIds ?? [])\n  const explicitRoleIds = uniqueSortedIds(targets.roleIds ?? [])\n  const tenantIds = uniqueSortedIds(targets.tenantIds ?? [])\n  const explicitApiKeys = apiKeyIds.length\n    ? await findWithDecryption(\n        em,\n        ApiKey,\n        { id: { $in: apiKeyIds } as unknown } as FilterQuery<ApiKey>,\n        { orderBy: { id: 'ASC' } },\n        { tenantId: null, organizationId: null },\n      )\n    : []\n  const explicitApiKeyRoleIds = uniqueSortedIds(explicitApiKeys.flatMap((apiKey) => (\n    Array.isArray(apiKey.rolesJson) ? apiKey.rolesJson : []\n  )))\n  const discoveredBeforeLocks = userIds.length\n    ? await findWithDecryption(\n        em,\n        UserRole,\n        { user: { $in: userIds } as unknown } as FilterQuery<UserRole>,\n        { orderBy: { id: 'ASC' } },\n        { tenantId: null, organizationId: null },\n      )\n    : []\n  const roleIdsBeforeLocks = uniqueSortedIds([\n    ...explicitRoleIds,\n    ...explicitApiKeyRoleIds,\n    ...discoveredBeforeLocks.flatMap((link) => {\n      const id = relationId(link.role)\n      return id ? [id] : []\n    }),\n  ])\n  const referencingApiKeyIds = await findApiKeyIdsReferencingRoles(em, roleIdsBeforeLocks)\n  const lockedApiKeys = await lockAuthorizationApiKeyRows(em, [\n    ...apiKeyIds,\n    ...referencingApiKeyIds,\n  ])\n\n  for (const apiKey of lockedApiKeys) {\n    const id = String(apiKey.id)\n    if (!apiKeyIds.includes(id)) continue\n    const before = explicitApiKeys.find((candidate) => String(candidate.id) === id)\n    const beforeRoles = Array.isArray(before?.rolesJson) ? before.rolesJson : []\n    const lockedRoles = Array.isArray(apiKey.rolesJson) ? apiKey.rolesJson : []\n    if (!sameIds(beforeRoles, lockedRoles)) {\n      throw authorizationStateDrift()\n    }\n  }\n\n  await lockAuthorizationUserRows(em, userIds)\n\n  const stableUserRoles = userIds.length\n    ? await findWithDecryption(\n        em,\n        UserRole,\n        { user: { $in: userIds } as unknown } as FilterQuery<UserRole>,\n        { orderBy: { id: 'ASC' }, refresh: true },\n        { tenantId: null, organizationId: null },\n      )\n    : []\n  const discoveredIdentities = discoveredBeforeLocks\n    .map(userRoleIdentity)\n    .filter((value): value is string => value !== null)\n  const stableIdentities = stableUserRoles\n    .map(userRoleIdentity)\n    .filter((value): value is string => value !== null)\n  if (!sameIds(discoveredIdentities, stableIdentities)) {\n    throw authorizationStateDrift()\n  }\n  const roleIds = uniqueSortedIds([\n    ...roleIdsBeforeLocks,\n    ...stableUserRoles.flatMap((link) => {\n      const id = relationId(link.role)\n      return id ? [id] : []\n    }),\n  ])\n\n  await lockAuthorizationRoleRows(em, roleIds)\n\n  const stableReferencingApiKeyIds = await findApiKeyIdsReferencingRoles(em, roleIds)\n  const lateReferencingApiKeyIds = unexpectedIds([...apiKeyIds, ...referencingApiKeyIds], stableReferencingApiKeyIds)\n  if (options.sealReplayFootprint && lateReferencingApiKeyIds.length) {\n    throw authorizationStateDrift()\n  }\n  await lockLateReferencingApiKeyRows(em, lateReferencingApiKeyIds)\n\n  for (const tenantId of tenantIds) {\n    await lockOrganizationHierarchyForTenant(em, tenantId)\n  }\n\n  if (userIds.length) {\n    await findWithDecryption(\n      em,\n      UserRole,\n      { user: { $in: userIds } as unknown } as FilterQuery<UserRole>,\n      { lockMode: LockMode.PESSIMISTIC_WRITE, orderBy: { id: 'ASC' }, refresh: true },\n      { tenantId: null, organizationId: null },\n    )\n  }\n\n  if (userIds.length) {\n    await findWithDecryption(\n      em,\n      UserAcl,\n      { user: { $in: userIds } as unknown } as FilterQuery<UserAcl>,\n      { lockMode: LockMode.PESSIMISTIC_WRITE, orderBy: { id: 'ASC' }, refresh: true },\n      { tenantId: null, organizationId: null },\n    )\n  }\n  if (roleIds.length) {\n    await findWithDecryption(\n      em,\n      RoleAcl,\n      { role: { $in: roleIds } as unknown } as FilterQuery<RoleAcl>,\n      { lockMode: LockMode.PESSIMISTIC_WRITE, orderBy: { id: 'ASC' }, refresh: true },\n      { tenantId: null, organizationId: null },\n    )\n  }\n\n  if (options.sealReplayFootprint) {\n    if (!transactionLifetime) {\n      throw new Error('[internal] Replay authorization locks require an explicit transaction lifetime')\n    }\n    replayLockLeases.set(transactionLifetime, {\n      apiKeyIds: new Set(apiKeyIds),\n      userIds: new Set(userIds),\n      roleIds: new Set(roleIds),\n      tenantIds: new Set(tenantIds),\n    })\n    onTransactionLifetimeComplete(em, () => {\n      replayLockLeases.delete(transactionLifetime)\n    })\n  }\n}\n\nexport async function lockUserRoleWriterAuthorizationState(\n  em: EntityManager,\n  targets: { userIds: readonly string[]; roleIds: readonly string[] },\n): Promise<void> {\n  await lockAuthorizationState(em, targets)\n}\n\nexport async function lockUserAclWriterAuthorizationState(\n  em: EntityManager,\n  userIds: readonly string[],\n): Promise<void> {\n  await lockAuthorizationState(em, { userIds })\n}\n\nexport async function lockRoleAclWriterAuthorizationState(\n  em: EntityManager,\n  roleIds: readonly string[],\n): Promise<void> {\n  await lockAuthorizationState(em, { roleIds })\n}\n"],
+  "mappings": "AAAA,SAAS,gBAAgB;AAEzB,SAAS,cAAc;AACvB,SAAS,MAAM,SAAS,MAAM,SAAS,gBAAgB;AACvD,SAAS,0CAA0C;AACnD,SAAS,0BAA0B;AACnC,SAAS,qBAAqB;AAC9B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,SAAS,gBAAgB,QAAqC;AAC5D,SAAO,MAAM,KAAK,IAAI,IAAI,OAAO,OAAO,CAAC,UAAU,MAAM,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,UAAU,KAAK,cAAc,KAAK,CAAC;AACxH;AAEA,SAAS,WAAW,OAA+B;AACjD,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,EAAG,QAAO;AAC1D,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,KAAM,MAA2B;AACvC,SAAO,OAAO,OAAO,YAAY,GAAG,SAAS,IAAI,KAAK;AACxD;AAgBA,MAAM,mBAAmB,oBAAI,QAA6C;AAE1E,SAAS,oBACP,OACA,SACM;AACN,QAAM,YAAY;AAAA,IAChB,WAAW,gBAAgB,QAAQ,aAAa,CAAC,CAAC;AAAA,IAClD,SAAS,gBAAgB,QAAQ,WAAW,CAAC,CAAC;AAAA,IAC9C,SAAS,gBAAgB,QAAQ,WAAW,CAAC,CAAC;AAAA,IAC9C,WAAW,gBAAgB,QAAQ,aAAa,CAAC,CAAC;AAAA,EACpD;AACA,aAAW,CAAC,MAAM,GAAG,KAAK,OAAO,QAAQ,SAAS,GAE/C;AACD,eAAW,MAAM,KAAK;AACpB,UAAI,CAAC,MAAM,IAAI,EAAE,IAAI,EAAE,GAAG;AACxB,cAAM,IAAI,MAAM,mFAAmF,IAAI,IAAI,EAAE,GAAG;AAAA,MAClH;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,iBAAiB,MAA+B;AACvD,QAAM,SAAS,WAAW,KAAK,IAAI;AACnC,QAAM,SAAS,WAAW,KAAK,IAAI;AACnC,SAAO,UAAU,SAAS,GAAG,MAAM,IAAI,MAAM,KAAK;AACpD;AAEA,SAAS,QAAQ,MAAyB,OAAmC;AAC3E,QAAM,gBAAgB,gBAAgB,IAAI;AAC1C,QAAM,iBAAiB,gBAAgB,KAAK;AAC5C,SAAO,cAAc,WAAW,eAAe,UAC1C,cAAc,MAAM,CAAC,OAAO,UAAU,UAAU,eAAe,KAAK,CAAC;AAC5E;AAEA,SAAS,cAAc,UAA6B,UAAuC;AACzF,QAAM,cAAc,IAAI,IAAI,QAAQ;AACpC,SAAO,SAAS,OAAO,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC;AACrD;AAEA,SAAS,0BAAyC;AAChD,SAAO,IAAI,cAAc,KAAK;AAAA,IAC5B,OAAO;AAAA,EACT,CAAC;AACH;AAEA,eAAe,kBACb,IACA,QACA,KACA,WAAqB,SAAS,mBAChB;AACd,QAAM,YAAY,gBAAgB,GAAG;AACrC,MAAI,CAAC,UAAU,OAAQ,QAAO,CAAC;AAC/B,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,EAAE,IAAI,EAAE,KAAK,UAAU,EAAa;AAAA,IACpC,EAAE,UAAU,SAAS,EAAE,IAAI,MAAM,GAAG,SAAS,KAAK;AAAA,IAClD,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,EACzC;AACF;AAEA,eAAsB,4BACpB,IACA,WACmB;AACnB,SAAO,kBAAkB,IAAI,QAAQ,SAAS;AAChD;AAEA,eAAsB,8BACpB,IACA,SACmB;AACnB,QAAM,MAAM,gBAAgB,OAAO;AACnC,MAAI,CAAC,IAAI,OAAQ,QAAO,CAAC;AACzB,QAAM,UAAU,MAAM,GAAG;AAAA,IACvB;AAAA,IACA;AAAA,MACE,WAAW;AAAA,MACX,MAAM;AAAA,QACJ,EAAE,KAAK,IAAI,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,WAAW,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE;AAAA,QACrE,EAAE,KAAK,CAAC,EAAE,WAAW,KAAK,GAAG,EAAE,WAAW,EAAE,KAAK,oBAAI,KAAK,EAAE,EAAE,CAAC,EAAE;AAAA,MACnE;AAAA,IACF;AAAA,IACA,EAAE,SAAS,EAAE,IAAI,MAAM,EAAE;AAAA,EAC3B;AACA,SAAO,gBAAgB,QAAQ,IAAI,CAAC,WAAW,OAAO,OAAO,EAAE,CAAC,CAAC;AACnE;AAEA,eAAsB,4BACpB,IACA,SACmB;AACnB,QAAM,YAAY,MAAM,8BAA8B,IAAI,OAAO;AACjE,SAAO,4BAA4B,IAAI,SAAS;AAClD;AAEA,eAAsB,0BACpB,IACA,SACe;AACf,QAAM,kBAAkB,IAAI,MAAM,OAAO;AAC3C;AAEA,eAAsB,0BACpB,IACA,SACe;AACf,QAAM,kBAAkB,IAAI,MAAM,OAAO;AAC3C;AAEA,eAAe,8BACb,IACA,WACe;AACf,QAAM,YAAY,gBAAgB,SAAS;AAC3C,MAAI,CAAC,UAAU,OAAQ;AACvB,QAAM,SAAS,MAAM,kBAAkB,IAAI,QAAQ,WAAW,SAAS,yBAAyB;AAChG,QAAM,YAAY,IAAI,IAAI,OAAO,IAAI,CAAC,WAAW,OAAO,OAAO,EAAE,CAAC,CAAC;AACnE,MAAI,UAAU,KAAK,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,GAAG;AAC9C,UAAM,wBAAwB;AAAA,EAChC;AACF;AAEA,eAAsB,iCACpB,IACA,SACe;AACf,QAAM,oCAAoC,IAAI,OAAO;AACvD;AAEA,eAAsB,uBACpB,IACA,SACA,UAA6C,CAAC,GAC/B;AACf,QAAM,sBAAsB,uBAAuB,EAAE;AACrD,QAAM,gBAAgB,sBAClB,iBAAiB,IAAI,mBAAmB,IACxC;AACJ,MAAI,eAAe;AACjB,wBAAoB,eAAe,OAAO;AAC1C;AAAA,EACF;AAEA,QAAM,YAAY,gBAAgB,QAAQ,aAAa,CAAC,CAAC;AACzD,QAAM,UAAU,gBAAgB,QAAQ,WAAW,CAAC,CAAC;AACrD,QAAM,kBAAkB,gBAAgB,QAAQ,WAAW,CAAC,CAAC;AAC7D,QAAM,YAAY,gBAAgB,QAAQ,aAAa,CAAC,CAAC;AACzD,QAAM,kBAAkB,UAAU,SAC9B,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,EAAE,IAAI,EAAE,KAAK,UAAU,EAAa;AAAA,IACpC,EAAE,SAAS,EAAE,IAAI,MAAM,EAAE;AAAA,IACzB,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,EACzC,IACA,CAAC;AACL,QAAM,wBAAwB,gBAAgB,gBAAgB,QAAQ,CAAC,WACrE,MAAM,QAAQ,OAAO,SAAS,IAAI,OAAO,YAAY,CAAC,CACvD,CAAC;AACF,QAAM,wBAAwB,QAAQ,SAClC,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,EAAE,MAAM,EAAE,KAAK,QAAQ,EAAa;AAAA,IACpC,EAAE,SAAS,EAAE,IAAI,MAAM,EAAE;AAAA,IACzB,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,EACzC,IACA,CAAC;AACL,QAAM,qBAAqB,gBAAgB;AAAA,IACzC,GAAG;AAAA,IACH,GAAG;AAAA,IACH,GAAG,sBAAsB,QAAQ,CAAC,SAAS;AACzC,YAAM,KAAK,WAAW,KAAK,IAAI;AAC/B,aAAO,KAAK,CAAC,EAAE,IAAI,CAAC;AAAA,IACtB,CAAC;AAAA,EACH,CAAC;AACD,QAAM,uBAAuB,MAAM,8BAA8B,IAAI,kBAAkB;AACvF,QAAM,gBAAgB,MAAM,4BAA4B,IAAI;AAAA,IAC1D,GAAG;AAAA,IACH,GAAG;AAAA,EACL,CAAC;AAED,aAAW,UAAU,eAAe;AAClC,UAAM,KAAK,OAAO,OAAO,EAAE;AAC3B,QAAI,CAAC,UAAU,SAAS,EAAE,EAAG;AAC7B,UAAM,SAAS,gBAAgB,KAAK,CAAC,cAAc,OAAO,UAAU,EAAE,MAAM,EAAE;AAC9E,UAAM,cAAc,MAAM,QAAQ,QAAQ,SAAS,IAAI,OAAO,YAAY,CAAC;AAC3E,UAAM,cAAc,MAAM,QAAQ,OAAO,SAAS,IAAI,OAAO,YAAY,CAAC;AAC1E,QAAI,CAAC,QAAQ,aAAa,WAAW,GAAG;AACtC,YAAM,wBAAwB;AAAA,IAChC;AAAA,EACF;AAEA,QAAM,0BAA0B,IAAI,OAAO;AAE3C,QAAM,kBAAkB,QAAQ,SAC5B,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,EAAE,MAAM,EAAE,KAAK,QAAQ,EAAa;AAAA,IACpC,EAAE,SAAS,EAAE,IAAI,MAAM,GAAG,SAAS,KAAK;AAAA,IACxC,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,EACzC,IACA,CAAC;AACL,QAAM,uBAAuB,sBAC1B,IAAI,gBAAgB,EACpB,OAAO,CAAC,UAA2B,UAAU,IAAI;AACpD,QAAM,mBAAmB,gBACtB,IAAI,gBAAgB,EACpB,OAAO,CAAC,UAA2B,UAAU,IAAI;AACpD,MAAI,CAAC,QAAQ,sBAAsB,gBAAgB,GAAG;AACpD,UAAM,wBAAwB;AAAA,EAChC;AACA,QAAM,UAAU,gBAAgB;AAAA,IAC9B,GAAG;AAAA,IACH,GAAG,gBAAgB,QAAQ,CAAC,SAAS;AACnC,YAAM,KAAK,WAAW,KAAK,IAAI;AAC/B,aAAO,KAAK,CAAC,EAAE,IAAI,CAAC;AAAA,IACtB,CAAC;AAAA,EACH,CAAC;AAED,QAAM,0BAA0B,IAAI,OAAO;AAE3C,QAAM,6BAA6B,MAAM,8BAA8B,IAAI,OAAO;AAClF,QAAM,2BAA2B,cAAc,CAAC,GAAG,WAAW,GAAG,oBAAoB,GAAG,0BAA0B;AAClH,MAAI,QAAQ,uBAAuB,yBAAyB,QAAQ;AAClE,UAAM,wBAAwB;AAAA,EAChC;AACA,QAAM,8BAA8B,IAAI,wBAAwB;AAEhE,aAAW,YAAY,WAAW;AAChC,UAAM,mCAAmC,IAAI,QAAQ;AAAA,EACvD;AAEA,MAAI,QAAQ,QAAQ;AAClB,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA,EAAE,MAAM,EAAE,KAAK,QAAQ,EAAa;AAAA,MACpC,EAAE,UAAU,SAAS,mBAAmB,SAAS,EAAE,IAAI,MAAM,GAAG,SAAS,KAAK;AAAA,MAC9E,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,IACzC;AAAA,EACF;AAEA,MAAI,QAAQ,QAAQ;AAClB,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA,EAAE,MAAM,EAAE,KAAK,QAAQ,EAAa;AAAA,MACpC,EAAE,UAAU,SAAS,mBAAmB,SAAS,EAAE,IAAI,MAAM,GAAG,SAAS,KAAK;AAAA,MAC9E,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,IACzC;AAAA,EACF;AACA,MAAI,QAAQ,QAAQ;AAClB,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA,EAAE,MAAM,EAAE,KAAK,QAAQ,EAAa;AAAA,MACpC,EAAE,UAAU,SAAS,mBAAmB,SAAS,EAAE,IAAI,MAAM,GAAG,SAAS,KAAK;AAAA,MAC9E,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,IACzC;AAAA,EACF;AAEA,MAAI,QAAQ,qBAAqB;AAC/B,QAAI,CAAC,qBAAqB;AACxB,YAAM,IAAI,MAAM,gFAAgF;AAAA,IAClG;AACA,qBAAiB,IAAI,qBAAqB;AAAA,MACxC,WAAW,IAAI,IAAI,SAAS;AAAA,MAC5B,SAAS,IAAI,IAAI,OAAO;AAAA,MACxB,SAAS,IAAI,IAAI,OAAO;AAAA,MACxB,WAAW,IAAI,IAAI,SAAS;AAAA,IAC9B,CAAC;AACD,kCAA8B,IAAI,MAAM;AACtC,uBAAiB,OAAO,mBAAmB;AAAA,IAC7C,CAAC;AAAA,EACH;AACF;AAEA,eAAsB,qCACpB,IACA,SACe;AACf,QAAM,uBAAuB,IAAI,OAAO;AAC1C;AAEA,eAAsB,oCACpB,IACA,SACe;AACf,QAAM,uBAAuB,IAAI,EAAE,QAAQ,CAAC;AAC9C;AAEA,eAAsB,oCACpB,IACA,SACe;AACf,QAAM,uBAAuB,IAAI,EAAE,QAAQ,CAAC;AAC9C;",
+  "names": []
+}

package/dist/modules/auth/lib/commandReplay.js

@@ -0,0 +1,144 @@
+import { CrudHttpError, forbidden } from "@open-mercato/shared/lib/crud/errors";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
+import {
+  lockAuthorizationState
+} from "@open-mercato/core/modules/auth/lib/authorizationStateLocks";
+import {
+  lockAuthorizationRoleRows as lockAuthorizationRoleRows2,
+  lockAuthorizationUserRows as lockAuthorizationUserRows2
+} from "@open-mercato/core/modules/auth/lib/authorizationStateLocks";
+function asRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  return value;
+}
+function canonicalize(value) {
+  if (Array.isArray(value)) {
+    return value.map(canonicalize);
+  }
+  const record = asRecord(value);
+  if (!record) return value;
+  const entries = Object.entries(record).filter(([, entry]) => entry !== void 0).sort(([left], [right]) => left.localeCompare(right)).map(([key, entry]) => [key, canonicalize(entry)]);
+  return Object.fromEntries(entries);
+}
+function replaySnapshotsEqual(left, right) {
+  return JSON.stringify(canonicalize(left)) === JSON.stringify(canonicalize(right));
+}
+async function assertReplaySnapshotMatches(current, expected) {
+  if (replaySnapshotsEqual(current, expected)) return;
+  const { translate } = await resolveTranslations();
+  throw new CrudHttpError(409, {
+    error: translate(
+      "auth.replay.errors.stale",
+      "This action cannot be replayed because the target has changed."
+    )
+  });
+}
+async function denyCredentialReplay() {
+  const { translate } = await resolveTranslations();
+  throw new CrudHttpError(400, {
+    error: translate(
+      "auth.replay.errors.credentials",
+      "Password changes cannot be replayed."
+    )
+  });
+}
+async function requireCurrentReplayFeature(ctx, feature) {
+  if (ctx.systemActor === true) return;
+  const actorUserId = ctx.auth?.sub;
+  if (!actorUserId) throw forbidden();
+  const transactionalEm = requireTransactionalReplayEntityManager(ctx);
+  let rbacService;
+  try {
+    rbacService = ctx.container.resolve("rbacService");
+  } catch {
+    throw forbidden();
+  }
+  const scope = {
+    tenantId: ctx.auth?.tenantId ?? null,
+    organizationId: ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null
+  };
+  const allowed = await rbacService.userHasAllFeaturesWithEntityManager(
+    transactionalEm,
+    actorUserId,
+    [feature],
+    scope
+  );
+  if (!allowed) throw forbidden();
+}
+async function requireCurrentReplaySuperAdmin(ctx) {
+  if (ctx.systemActor === true) return;
+  const actorUserId = ctx.auth?.sub;
+  if (!actorUserId) throw forbidden();
+  const transactionalEm = requireTransactionalReplayEntityManager(ctx);
+  let rbacService;
+  try {
+    rbacService = ctx.container.resolve("rbacService");
+  } catch {
+    throw forbidden();
+  }
+  const scope = {
+    tenantId: ctx.auth?.tenantId ?? null,
+    organizationId: ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null
+  };
+  const acl = await rbacService.loadAclWithEntityManager(transactionalEm, actorUserId, scope);
+  if (!acl.isSuperAdmin) throw forbidden();
+}
+function requireTransactionalReplayEntityManager(ctx) {
+  if (ctx.transactionalEm) return ctx.transactionalEm;
+  throw new Error("[internal] Auth replay authorization requires a transactional EntityManager");
+}
+async function rerunReplayTransactionGuardAfterLocks(params, em) {
+  if (!params.ctx.replayTransactionGuard) return;
+  await params.ctx.replayTransactionGuard({
+    operation: params.operation,
+    logEntry: params.logEntry,
+    transactionalEm: em
+  });
+}
+async function lockReplayAuthorizationState(em, ctx, targets) {
+  const actorId = ctx.auth?.sub ?? null;
+  const apiKeyId = actorId?.startsWith("api_key:") ? actorId.slice("api_key:".length) : null;
+  await lockAuthorizationState(em, {
+    apiKeyIds: apiKeyId ? [apiKeyId] : [],
+    userIds: [
+      ...apiKeyId || !actorId ? [] : [actorId],
+      ...targets.targetUserId ? [targets.targetUserId] : [],
+      ...targets.targetUserIds ?? []
+    ],
+    roleIds: [
+      ...targets.targetRoleId ? [targets.targetRoleId] : [],
+      ...targets.targetRoleIds ?? []
+    ],
+    tenantIds: [
+      ...ctx.auth?.tenantId ? [ctx.auth.tenantId] : [],
+      ...targets.targetTenantIds ?? []
+    ]
+  }, { sealReplayFootprint: true });
+}
+function extractStoredReplayInput(input, logEntry) {
+  const payload = asRecord(logEntry.commandPayload);
+  const stored = payload && "__redoInput" in payload ? asRecord(payload.__redoInput) : null;
+  if (stored) return stored;
+  const direct = asRecord(input);
+  if (!direct || direct === payload || "undo" in direct) return {};
+  return direct;
+}
+function hasStoredPasswordInput(input, logEntry) {
+  const replayInput = extractStoredReplayInput(input, logEntry);
+  return typeof replayInput.password === "string" && replayInput.password.length > 0;
+}
+export {
+  assertReplaySnapshotMatches,
+  denyCredentialReplay,
+  extractStoredReplayInput,
+  hasStoredPasswordInput,
+  lockAuthorizationRoleRows2 as lockAuthorizationRoleRows,
+  lockAuthorizationUserRows2 as lockAuthorizationUserRows,
+  lockReplayAuthorizationState,
+  replaySnapshotsEqual,
+  requireCurrentReplayFeature,
+  requireCurrentReplaySuperAdmin,
+  requireTransactionalReplayEntityManager,
+  rerunReplayTransactionGuardAfterLocks
+};
+//# sourceMappingURL=commandReplay.js.map

package/dist/modules/auth/lib/commandReplay.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/auth/lib/commandReplay.ts"],
+  "sourcesContent": ["import type {\n  CommandReplayAuthorizationArgs,\n  CommandRuntimeContext,\n  CommandUndoLogEntry,\n} from '@open-mercato/shared/lib/commands'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { CrudHttpError, forbidden } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport {\n  lockAuthorizationState,\n  lockAuthorizationRoleRows,\n  lockAuthorizationUserRows,\n} from '@open-mercato/core/modules/auth/lib/authorizationStateLocks'\n\nexport {\n  lockAuthorizationRoleRows,\n  lockAuthorizationUserRows,\n} from '@open-mercato/core/modules/auth/lib/authorizationStateLocks'\n\nfunction asRecord(value: unknown): Record<string, unknown> | null {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) return null\n  return value as Record<string, unknown>\n}\n\nfunction canonicalize(value: unknown): unknown {\n  if (Array.isArray(value)) {\n    return value.map(canonicalize)\n  }\n  const record = asRecord(value)\n  if (!record) return value\n  const entries = Object.entries(record)\n    .filter(([, entry]) => entry !== undefined)\n    .sort(([left], [right]) => left.localeCompare(right))\n    .map(([key, entry]) => [key, canonicalize(entry)])\n  return Object.fromEntries(entries)\n}\n\nexport function replaySnapshotsEqual(left: unknown, right: unknown): boolean {\n  return (\n    JSON.stringify(canonicalize(left)) === JSON.stringify(canonicalize(right))\n  )\n}\n\nexport async function assertReplaySnapshotMatches(\n  current: unknown,\n  expected: unknown,\n): Promise<void> {\n  if (replaySnapshotsEqual(current, expected)) return\n  const { translate } = await resolveTranslations()\n  throw new CrudHttpError(409, {\n    error: translate(\n      'auth.replay.errors.stale',\n      'This action cannot be replayed because the target has changed.',\n    ),\n  })\n}\n\nexport async function denyCredentialReplay(): Promise<never> {\n  const { translate } = await resolveTranslations()\n  throw new CrudHttpError(400, {\n    error: translate(\n      'auth.replay.errors.credentials',\n      'Password changes cannot be replayed.',\n    ),\n  })\n}\n\nexport async function requireCurrentReplayFeature(\n  ctx: CommandRuntimeContext,\n  feature: string,\n): Promise<void> {\n  if (ctx.systemActor === true) return\n  const actorUserId = ctx.auth?.sub\n  if (!actorUserId) throw forbidden()\n  const transactionalEm = requireTransactionalReplayEntityManager(ctx)\n\n  let rbacService: RbacService\n  try {\n    rbacService = ctx.container.resolve('rbacService') as RbacService\n  } catch {\n    throw forbidden()\n  }\n  const scope = {\n    tenantId: ctx.auth?.tenantId ?? null,\n    organizationId: ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null,\n  }\n  const allowed = await rbacService.userHasAllFeaturesWithEntityManager(\n    transactionalEm,\n    actorUserId,\n    [feature],\n    scope,\n  )\n  if (!allowed) throw forbidden()\n}\n\nexport async function requireCurrentReplaySuperAdmin(\n  ctx: CommandRuntimeContext,\n): Promise<void> {\n  if (ctx.systemActor === true) return\n  const actorUserId = ctx.auth?.sub\n  if (!actorUserId) throw forbidden()\n  const transactionalEm = requireTransactionalReplayEntityManager(ctx)\n\n  let rbacService: RbacService\n  try {\n    rbacService = ctx.container.resolve('rbacService') as RbacService\n  } catch {\n    throw forbidden()\n  }\n  const scope = {\n    tenantId: ctx.auth?.tenantId ?? null,\n    organizationId: ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null,\n  }\n  const acl = await rbacService.loadAclWithEntityManager(transactionalEm, actorUserId, scope)\n  if (!acl.isSuperAdmin) throw forbidden()\n}\n\nexport function requireTransactionalReplayEntityManager(\n  ctx: CommandRuntimeContext,\n): EntityManager {\n  if (ctx.transactionalEm) return ctx.transactionalEm\n  throw new Error('[internal] Auth replay authorization requires a transactional EntityManager')\n}\n\nexport async function rerunReplayTransactionGuardAfterLocks(\n  params: CommandReplayAuthorizationArgs<unknown>,\n  em: EntityManager,\n): Promise<void> {\n  if (!params.ctx.replayTransactionGuard) return\n  await params.ctx.replayTransactionGuard({\n    operation: params.operation,\n    logEntry: params.logEntry,\n    transactionalEm: em,\n  })\n}\n\nexport type ReplayAuthorizationLockTargets = {\n  targetUserId?: string | null\n  targetRoleId?: string | null\n  targetUserIds?: readonly string[]\n  targetRoleIds?: readonly string[]\n  targetTenantIds?: readonly string[]\n}\n\nexport async function lockReplayAuthorizationState(\n  em: EntityManager,\n  ctx: Pick<CommandRuntimeContext, 'auth'>,\n  targets: ReplayAuthorizationLockTargets,\n): Promise<void> {\n  const actorId = ctx.auth?.sub ?? null\n  const apiKeyId = actorId?.startsWith('api_key:')\n    ? actorId.slice('api_key:'.length)\n    : null\n  await lockAuthorizationState(em, {\n    apiKeyIds: apiKeyId ? [apiKeyId] : [],\n    userIds: [\n      ...(apiKeyId || !actorId ? [] : [actorId]),\n      ...(targets.targetUserId ? [targets.targetUserId] : []),\n      ...(targets.targetUserIds ?? []),\n    ],\n    roleIds: [\n      ...(targets.targetRoleId ? [targets.targetRoleId] : []),\n      ...(targets.targetRoleIds ?? []),\n    ],\n    tenantIds: [\n      ...(ctx.auth?.tenantId ? [ctx.auth.tenantId] : []),\n      ...(targets.targetTenantIds ?? []),\n    ],\n  }, { sealReplayFootprint: true })\n}\n\nexport function extractStoredReplayInput(\n  input: unknown,\n  logEntry: CommandUndoLogEntry,\n): Record<string, unknown> {\n  const payload = asRecord(logEntry.commandPayload)\n  const stored =\n    payload && '__redoInput' in payload ? asRecord(payload.__redoInput) : null\n  if (stored) return stored\n  const direct = asRecord(input)\n  if (!direct || direct === payload || 'undo' in direct) return {}\n  return direct\n}\n\nexport function hasStoredPasswordInput(\n  input: unknown,\n  logEntry: CommandUndoLogEntry,\n): boolean {\n  const replayInput = extractStoredReplayInput(input, logEntry)\n  return (\n    typeof replayInput.password === 'string' && replayInput.password.length > 0\n  )\n}\n"],
+  "mappings": "AAMA,SAAS,eAAe,iBAAiB;AACzC,SAAS,2BAA2B;AAEpC;AAAA,EACE;AAAA,OAGK;AAEP;AAAA,EACE,6BAAAA;AAAA,EACA,6BAAAC;AAAA,OACK;AAEP,SAAS,SAAS,OAAgD;AAChE,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AACxE,SAAO;AACT;AAEA,SAAS,aAAa,OAAyB;AAC7C,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM,IAAI,YAAY;AAAA,EAC/B;AACA,QAAM,SAAS,SAAS,KAAK;AAC7B,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,UAAU,OAAO,QAAQ,MAAM,EAClC,OAAO,CAAC,CAAC,EAAE,KAAK,MAAM,UAAU,MAAS,EACzC,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,MAAM,KAAK,cAAc,KAAK,CAAC,EACnD,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,aAAa,KAAK,CAAC,CAAC;AACnD,SAAO,OAAO,YAAY,OAAO;AACnC;AAEO,SAAS,qBAAqB,MAAe,OAAyB;AAC3E,SACE,KAAK,UAAU,aAAa,IAAI,CAAC,MAAM,KAAK,UAAU,aAAa,KAAK,CAAC;AAE7E;AAEA,eAAsB,4BACpB,SACA,UACe;AACf,MAAI,qBAAqB,SAAS,QAAQ,EAAG;AAC7C,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,IAAI,cAAc,KAAK;AAAA,IAC3B,OAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,uBAAuC;AAC3D,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,IAAI,cAAc,KAAK;AAAA,IAC3B,OAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,4BACpB,KACA,SACe;AACf,MAAI,IAAI,gBAAgB,KAAM;AAC9B,QAAM,cAAc,IAAI,MAAM;AAC9B,MAAI,CAAC,YAAa,OAAM,UAAU;AAClC,QAAM,kBAAkB,wCAAwC,GAAG;AAEnE,MAAI;AACJ,MAAI;AACF,kBAAc,IAAI,UAAU,QAAQ,aAAa;AAAA,EACnD,QAAQ;AACN,UAAM,UAAU;AAAA,EAClB;AACA,QAAM,QAAQ;AAAA,IACZ,UAAU,IAAI,MAAM,YAAY;AAAA,IAChC,gBAAgB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AAAA,EACnE;AACA,QAAM,UAAU,MAAM,YAAY;AAAA,IAChC;AAAA,IACA;AAAA,IACA,CAAC,OAAO;AAAA,IACR;AAAA,EACF;AACA,MAAI,CAAC,QAAS,OAAM,UAAU;AAChC;AAEA,eAAsB,+BACpB,KACe;AACf,MAAI,IAAI,gBAAgB,KAAM;AAC9B,QAAM,cAAc,IAAI,MAAM;AAC9B,MAAI,CAAC,YAAa,OAAM,UAAU;AAClC,QAAM,kBAAkB,wCAAwC,GAAG;AAEnE,MAAI;AACJ,MAAI;AACF,kBAAc,IAAI,UAAU,QAAQ,aAAa;AAAA,EACnD,QAAQ;AACN,UAAM,UAAU;AAAA,EAClB;AACA,QAAM,QAAQ;AAAA,IACZ,UAAU,IAAI,MAAM,YAAY;AAAA,IAChC,gBAAgB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AAAA,EACnE;AACA,QAAM,MAAM,MAAM,YAAY,yBAAyB,iBAAiB,aAAa,KAAK;AAC1F,MAAI,CAAC,IAAI,aAAc,OAAM,UAAU;AACzC;AAEO,SAAS,wCACd,KACe;AACf,MAAI,IAAI,gBAAiB,QAAO,IAAI;AACpC,QAAM,IAAI,MAAM,6EAA6E;AAC/F;AAEA,eAAsB,sCACpB,QACA,IACe;AACf,MAAI,CAAC,OAAO,IAAI,uBAAwB;AACxC,QAAM,OAAO,IAAI,uBAAuB;AAAA,IACtC,WAAW,OAAO;AAAA,IAClB,UAAU,OAAO;AAAA,IACjB,iBAAiB;AAAA,EACnB,CAAC;AACH;AAUA,eAAsB,6BACpB,IACA,KACA,SACe;AACf,QAAM,UAAU,IAAI,MAAM,OAAO;AACjC,QAAM,WAAW,SAAS,WAAW,UAAU,IAC3C,QAAQ,MAAM,WAAW,MAAM,IAC/B;AACJ,QAAM,uBAAuB,IAAI;AAAA,IAC/B,WAAW,WAAW,CAAC,QAAQ,IAAI,CAAC;AAAA,IACpC,SAAS;AAAA,MACP,GAAI,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO;AAAA,MACxC,GAAI,QAAQ,eAAe,CAAC,QAAQ,YAAY,IAAI,CAAC;AAAA,MACrD,GAAI,QAAQ,iBAAiB,CAAC;AAAA,IAChC;AAAA,IACA,SAAS;AAAA,MACP,GAAI,QAAQ,eAAe,CAAC,QAAQ,YAAY,IAAI,CAAC;AAAA,MACrD,GAAI,QAAQ,iBAAiB,CAAC;AAAA,IAChC;AAAA,IACA,WAAW;AAAA,MACT,GAAI,IAAI,MAAM,WAAW,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC;AAAA,MAChD,GAAI,QAAQ,mBAAmB,CAAC;AAAA,IAClC;AAAA,EACF,GAAG,EAAE,qBAAqB,KAAK,CAAC;AAClC;AAEO,SAAS,yBACd,OACA,UACyB;AACzB,QAAM,UAAU,SAAS,SAAS,cAAc;AAChD,QAAM,SACJ,WAAW,iBAAiB,UAAU,SAAS,QAAQ,WAAW,IAAI;AACxE,MAAI,OAAQ,QAAO;AACnB,QAAM,SAAS,SAAS,KAAK;AAC7B,MAAI,CAAC,UAAU,WAAW,WAAW,UAAU,OAAQ,QAAO,CAAC;AAC/D,SAAO;AACT;AAEO,SAAS,uBACd,OACA,UACS;AACT,QAAM,cAAc,yBAAyB,OAAO,QAAQ;AAC5D,SACE,OAAO,YAAY,aAAa,YAAY,YAAY,SAAS,SAAS;AAE9E;",
+  "names": ["lockAuthorizationRoleRows", "lockAuthorizationUserRows"]
+}

package/dist/modules/auth/lib/executionPrincipal.js

@@ -1,4 +1,7 @@
 import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import {
+  lockAuthorizationState
+} from "@open-mercato/core/modules/auth/lib/authorizationStateLocks";
 import { computeEmailHash } from "./emailHash.js";
 import { Role, RoleAcl, User, UserRole } from "../data/entities.js";
 const EXECUTION_PRINCIPAL_EMAIL_DOMAIN = "agent.internal";
@@ -48,6 +51,35 @@ async function provisionExecutionPrincipal(container, scope, input) {
       trx.persist(role);
       await trx.flush();
     }
+    const emailHash = computeEmailHash(principalEmail);
+    let user = await findOneWithDecryption(
+      trx,
+      User,
+      { emailHash, tenantId, deletedAt: null },
+      {},
+      { tenantId, organizationId }
+    );
+    if (!user) {
+      user = trx.create(User, {
+        email: principalEmail,
+        emailHash,
+        passwordHash: null,
+        isConfirmed: false,
+        kind,
+        name: input.displayName ?? principalKey,
+        tenantId,
+        organizationId,
+        createdAt: /* @__PURE__ */ new Date()
+      });
+      trx.persist(user);
+      await trx.flush();
+    } else if (user.kind === "human") {
+      throw new Error("[internal] resolved a human User for an execution principal");
+    }
+    await lockAuthorizationState(trx, {
+      userIds: [String(user.id)],
+      roleIds: [String(role.id)]
+    });
     const existingAcl = await findOneWithDecryption(
       trx,
       RoleAcl,
@@ -78,31 +110,6 @@ async function provisionExecutionPrincipal(container, scope, input) {
         await trx.flush();
       }
     }
-    const emailHash = computeEmailHash(principalEmail);
-    let user = await findOneWithDecryption(
-      trx,
-      User,
-      { emailHash, tenantId, deletedAt: null },
-      {},
-      { tenantId, organizationId }
-    );
-    if (!user) {
-      user = trx.create(User, {
-        email: principalEmail,
-        emailHash,
-        passwordHash: null,
-        isConfirmed: false,
-        kind,
-        name: input.displayName ?? principalKey,
-        tenantId,
-        organizationId,
-        createdAt: /* @__PURE__ */ new Date()
-      });
-      trx.persist(user);
-      await trx.flush();
-    } else if (user.kind === "human") {
-      throw new Error("[internal] resolved a human User for an execution principal");
-    }
     const existingLink = await findOneWithDecryption(
       trx,
       UserRole,

package/dist/modules/auth/lib/executionPrincipal.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/auth/lib/executionPrincipal.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { AwilixContainer } from 'awilix'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { computeEmailHash } from './emailHash'\nimport { Role, RoleAcl, User, UserRole, type UserKind } from '../data/entities'\n\n/**\n * A non-interactive execution principal: a login-less `User` plus a scoped\n * `Role` whose ACL carries EXACTLY the features that principal may use.\n *\n * This lives in `auth` because `User` / `Role` / `RoleAcl` / `UserRole` are this\n * module's entities. Any module that needs a machine identity to write under \u2014\n * an agentic task, a workflow definition declaring a grant, a future scheduled\n * job \u2014 provisions one here rather than reimplementing the four find-or-create\n * steps and the ACL replacement.\n *\n * The `enterprise` agent_orchestrator module owns an older copy of this logic\n * (`lib/identity/agentPrincipalService.ts`), which core MUST NOT import (an\n * optional peer). The naming knobs below exist so that copy can be migrated onto\n * this helper WITHOUT changing any provisioned row's identity: calling with\n * `{ namePrefix: 'agent', kind: 'agent', mergeFeatures: true }` reproduces its\n * email and role name byte-for-byte.\n */\nexport type ExecutionPrincipalScope = { tenantId: string; organizationId: string }\n\nexport type ResolvedExecutionPrincipal = {\n  userId: string\n  roleId: string\n}\n\nexport type ProvisionExecutionPrincipalInput = {\n  /**\n   * Namespaced, stable identity key \u2014 e.g. `workflow:<definitionId>`. It is the\n   * idempotency key: the deterministic email and role name are both derived from\n   * it, so re-provisioning resolves the same rows instead of creating new ones.\n   */\n  principalKey: string\n  displayName?: string\n  /** The principal's complete feature set. Replaces the role ACL unless `mergeFeatures`. */\n  features: string[]\n  /** Defaults to `service` \u2014 a machine principal that is not an AI agent. */\n  kind?: UserKind\n  /** Local-part / role-name prefix. Defaults to `principal`. */\n  namePrefix?: string\n  /**\n   * Merge into the existing ACL instead of replacing it. Default `false`:\n   * merging cannot NARROW a previously over-granted principal, which is the\n   * whole point of re-scoping on every save.\n   */\n  mergeFeatures?: boolean\n}\n\n/**\n * Non-routable internal domain. An execution principal never receives mail and\n * never logs in interactively, so this address is an identity key, not a mailbox.\n */\nconst EXECUTION_PRINCIPAL_EMAIL_DOMAIN = 'agent.internal'\nconst DEFAULT_NAME_PREFIX = 'principal'\n\nfunction slugifyPrincipalKey(principalKey: string): string {\n  return principalKey.toLowerCase().replace(/[^a-z0-9._-]+/g, '-')\n}\n\nexport function executionPrincipalEmail(\n  principalKey: string,\n  organizationId: string,\n  namePrefix: string = DEFAULT_NAME_PREFIX,\n): string {\n  return `${namePrefix}+${slugifyPrincipalKey(principalKey)}+${organizationId}@${EXECUTION_PRINCIPAL_EMAIL_DOMAIN}`\n}\n\nexport function executionPrincipalRoleName(\n  principalKey: string,\n  namePrefix: string = DEFAULT_NAME_PREFIX,\n): string {\n  return `${namePrefix}:${principalKey}`\n}\n\nexport function normalizeFeatureList(value: unknown): string[] {\n  if (!Array.isArray(value)) return []\n  const seen = new Set<string>()\n  for (const entry of value) {\n    if (typeof entry !== 'string') continue\n    const trimmed = entry.trim()\n    if (trimmed) seen.add(trimmed)\n  }\n  return Array.from(seen).sort((a, b) => a.localeCompare(b))\n}\n\n/**\n * Provisions \u2014 idempotently \u2014 the execution principal for `principalKey` and\n * pins its role ACL to exactly `features`.\n *\n * Non-interactive by construction: `passwordHash = null` + `isConfirmed = false`\n * leaves the password/SSO flow nothing to authenticate against. `isSuperAdmin`\n * is always false and the ACL's organization visibility is pinned to the\n * provisioning organization, so the principal can never out-scope its owner.\n */\nexport async function provisionExecutionPrincipal(\n  container: AwilixContainer,\n  scope: ExecutionPrincipalScope,\n  input: ProvisionExecutionPrincipalInput,\n): Promise<ResolvedExecutionPrincipal> {\n  const { tenantId, organizationId } = scope\n  const principalKey = input.principalKey.trim()\n  if (!principalKey) throw new Error('[internal] execution principal requires a principalKey')\n  if (!tenantId || !organizationId) {\n    throw new Error('[internal] execution principal requires a tenant and organization scope')\n  }\n\n  const namePrefix = input.namePrefix ?? DEFAULT_NAME_PREFIX\n  const kind: UserKind = input.kind ?? 'service'\n  const features = normalizeFeatureList(input.features)\n  const roleName = executionPrincipalRoleName(principalKey, namePrefix)\n  const principalEmail = executionPrincipalEmail(principalKey, organizationId, namePrefix)\n\n  const em = (container.resolve('em') as EntityManager).fork()\n\n  return em.transactional(async (trx) => {\n    let role = await findOneWithDecryption(\n      trx,\n      Role,\n      { name: roleName, tenantId },\n      {},\n      { tenantId, organizationId: null },\n    )\n    if (!role) {\n      role = trx.create(Role, { name: roleName, tenantId, minActiveHolders: 0, createdAt: new Date() })\n      trx.persist(role)\n      await trx.flush()\n    }\n\n    const existingAcl = await findOneWithDecryption(\n      trx,\n      RoleAcl,\n      { role, tenantId },\n      {},\n      { tenantId, organizationId: null },\n    )\n    if (!existingAcl) {\n      trx.persist(\n        trx.create(RoleAcl, {\n          role,\n          tenantId,\n          featuresJson: features,\n          isSuperAdmin: false,\n          organizationsJson: [organizationId],\n          createdAt: new Date(),\n        }),\n      )\n      await trx.flush()\n    } else {\n      const current = normalizeFeatureList(existingAcl.featuresJson)\n      const next = input.mergeFeatures ? normalizeFeatureList([...current, ...features]) : features\n      if (\n        existingAcl.isSuperAdmin ||\n        current.length !== next.length ||\n        current.some((feature, index) => feature !== next[index])\n      ) {\n        existingAcl.featuresJson = next\n        existingAcl.isSuperAdmin = false\n        existingAcl.organizationsJson = [organizationId]\n        trx.persist(existingAcl)\n        await trx.flush()\n      }\n    }\n\n    const emailHash = computeEmailHash(principalEmail)\n    let user = await findOneWithDecryption(\n      trx,\n      User,\n      { emailHash, tenantId, deletedAt: null },\n      {},\n      { tenantId, organizationId },\n    )\n    if (!user) {\n      user = trx.create(User, {\n        email: principalEmail,\n        emailHash,\n        passwordHash: null,\n        isConfirmed: false,\n        kind,\n        name: input.displayName ?? principalKey,\n        tenantId,\n        organizationId,\n        createdAt: new Date(),\n      })\n      trx.persist(user)\n      await trx.flush()\n    } else if (user.kind === 'human') {\n      // Defensive: a row resolved by the deterministic principal email must never\n      // be a human account. Never silently repurpose one.\n      throw new Error('[internal] resolved a human User for an execution principal')\n    }\n\n    const existingLink = await findOneWithDecryption(\n      trx,\n      UserRole,\n      { user, role },\n      {},\n      { tenantId, organizationId: null },\n    )\n    if (!existingLink) {\n      trx.persist(trx.create(UserRole, { user, role, createdAt: new Date() }))\n      await trx.flush()\n    }\n\n    return { userId: user.id, roleId: role.id }\n  })\n}\n\n/**\n * Resolves the `User` id of an already-provisioned execution principal without\n * writing anything. Returns null when it has not been provisioned (or was\n * soft-deleted) \u2014 callers MUST fail closed rather than fall back to a broader\n * identity.\n */\nexport async function resolveExecutionPrincipalUserId(\n  em: EntityManager,\n  principalKey: string,\n  scope: ExecutionPrincipalScope,\n  namePrefix: string = DEFAULT_NAME_PREFIX,\n): Promise<string | null> {\n  const { tenantId, organizationId } = scope\n  if (!principalKey || !tenantId || !organizationId) return null\n  const emailHash = computeEmailHash(executionPrincipalEmail(principalKey, organizationId, namePrefix))\n  const user = await findOneWithDecryption(\n    em,\n    User,\n    { emailHash, tenantId, deletedAt: null },\n    {},\n    { tenantId, organizationId },\n  )\n  return user?.id ?? null\n}\n"],
-  "mappings": "AAEA,SAAS,6BAA6B;AACtC,SAAS,wBAAwB;AACjC,SAAS,MAAM,SAAS,MAAM,gBAA+B;AAoD7D,MAAM,mCAAmC;AACzC,MAAM,sBAAsB;AAE5B,SAAS,oBAAoB,cAA8B;AACzD,SAAO,aAAa,YAAY,EAAE,QAAQ,kBAAkB,GAAG;AACjE;AAEO,SAAS,wBACd,cACA,gBACA,aAAqB,qBACb;AACR,SAAO,GAAG,UAAU,IAAI,oBAAoB,YAAY,CAAC,IAAI,cAAc,IAAI,gCAAgC;AACjH;AAEO,SAAS,2BACd,cACA,aAAqB,qBACb;AACR,SAAO,GAAG,UAAU,IAAI,YAAY;AACtC;AAEO,SAAS,qBAAqB,OAA0B;AAC7D,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO,CAAC;AACnC,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,SAAS,OAAO;AACzB,QAAI,OAAO,UAAU,SAAU;AAC/B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,QAAS,MAAK,IAAI,OAAO;AAAA,EAC/B;AACA,SAAO,MAAM,KAAK,IAAI,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,cAAc,CAAC,CAAC;AAC3D;AAWA,eAAsB,4BACpB,WACA,OACA,OACqC;AACrC,QAAM,EAAE,UAAU,eAAe,IAAI;AACrC,QAAM,eAAe,MAAM,aAAa,KAAK;AAC7C,MAAI,CAAC,aAAc,OAAM,IAAI,MAAM,wDAAwD;AAC3F,MAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,UAAM,IAAI,MAAM,yEAAyE;AAAA,EAC3F;AAEA,QAAM,aAAa,MAAM,cAAc;AACvC,QAAM,OAAiB,MAAM,QAAQ;AACrC,QAAM,WAAW,qBAAqB,MAAM,QAAQ;AACpD,QAAM,WAAW,2BAA2B,cAAc,UAAU;AACpE,QAAM,iBAAiB,wBAAwB,cAAc,gBAAgB,UAAU;AAEvF,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAE3D,SAAO,GAAG,cAAc,OAAO,QAAQ;AACrC,QAAI,OAAO,MAAM;AAAA,MACf;AAAA,MACA;AAAA,MACA,EAAE,MAAM,UAAU,SAAS;AAAA,MAC3B,CAAC;AAAA,MACD,EAAE,UAAU,gBAAgB,KAAK;AAAA,IACnC;AACA,QAAI,CAAC,MAAM;AACT,aAAO,IAAI,OAAO,MAAM,EAAE,MAAM,UAAU,UAAU,kBAAkB,GAAG,WAAW,oBAAI,KAAK,EAAE,CAAC;AAChG,UAAI,QAAQ,IAAI;AAChB,YAAM,IAAI,MAAM;AAAA,IAClB;AAEA,UAAM,cAAc,MAAM;AAAA,MACxB;AAAA,MACA;AAAA,MACA,EAAE,MAAM,SAAS;AAAA,MACjB,CAAC;AAAA,MACD,EAAE,UAAU,gBAAgB,KAAK;AAAA,IACnC;AACA,QAAI,CAAC,aAAa;AAChB,UAAI;AAAA,QACF,IAAI,OAAO,SAAS;AAAA,UAClB;AAAA,UACA;AAAA,UACA,cAAc;AAAA,UACd,cAAc;AAAA,UACd,mBAAmB,CAAC,cAAc;AAAA,UAClC,WAAW,oBAAI,KAAK;AAAA,QACtB,CAAC;AAAA,MACH;AACA,YAAM,IAAI,MAAM;AAAA,IAClB,OAAO;AACL,YAAM,UAAU,qBAAqB,YAAY,YAAY;AAC7D,YAAM,OAAO,MAAM,gBAAgB,qBAAqB,CAAC,GAAG,SAAS,GAAG,QAAQ,CAAC,IAAI;AACrF,UACE,YAAY,gBACZ,QAAQ,WAAW,KAAK,UACxB,QAAQ,KAAK,CAAC,SAAS,UAAU,YAAY,KAAK,KAAK,CAAC,GACxD;AACA,oBAAY,eAAe;AAC3B,oBAAY,eAAe;AAC3B,oBAAY,oBAAoB,CAAC,cAAc;AAC/C,YAAI,QAAQ,WAAW;AACvB,cAAM,IAAI,MAAM;AAAA,MAClB;AAAA,IACF;AAEA,UAAM,YAAY,iBAAiB,cAAc;AACjD,QAAI,OAAO,MAAM;AAAA,MACf;AAAA,MACA;AAAA,MACA,EAAE,WAAW,UAAU,WAAW,KAAK;AAAA,MACvC,CAAC;AAAA,MACD,EAAE,UAAU,eAAe;AAAA,IAC7B;AACA,QAAI,CAAC,MAAM;AACT,aAAO,IAAI,OAAO,MAAM;AAAA,QACtB,OAAO;AAAA,QACP;AAAA,QACA,cAAc;AAAA,QACd,aAAa;AAAA,QACb;AAAA,QACA,MAAM,MAAM,eAAe;AAAA,QAC3B;AAAA,QACA;AAAA,QACA,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAC;AACD,UAAI,QAAQ,IAAI;AAChB,YAAM,IAAI,MAAM;AAAA,IAClB,WAAW,KAAK,SAAS,SAAS;AAGhC,YAAM,IAAI,MAAM,6DAA6D;AAAA,IAC/E;AAEA,UAAM,eAAe,MAAM;AAAA,MACzB;AAAA,MACA;AAAA,MACA,EAAE,MAAM,KAAK;AAAA,MACb,CAAC;AAAA,MACD,EAAE,UAAU,gBAAgB,KAAK;AAAA,IACnC;AACA,QAAI,CAAC,cAAc;AACjB,UAAI,QAAQ,IAAI,OAAO,UAAU,EAAE,MAAM,MAAM,WAAW,oBAAI,KAAK,EAAE,CAAC,CAAC;AACvE,YAAM,IAAI,MAAM;AAAA,IAClB;AAEA,WAAO,EAAE,QAAQ,KAAK,IAAI,QAAQ,KAAK,GAAG;AAAA,EAC5C,CAAC;AACH;AAQA,eAAsB,gCACpB,IACA,cACA,OACA,aAAqB,qBACG;AACxB,QAAM,EAAE,UAAU,eAAe,IAAI;AACrC,MAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,eAAgB,QAAO;AAC1D,QAAM,YAAY,iBAAiB,wBAAwB,cAAc,gBAAgB,UAAU,CAAC;AACpG,QAAM,OAAO,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,IACA,EAAE,WAAW,UAAU,WAAW,KAAK;AAAA,IACvC,CAAC;AAAA,IACD,EAAE,UAAU,eAAe;AAAA,EAC7B;AACA,SAAO,MAAM,MAAM;AACrB;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { AwilixContainer } from 'awilix'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport {\n  lockAuthorizationState,\n} from '@open-mercato/core/modules/auth/lib/authorizationStateLocks'\nimport { computeEmailHash } from './emailHash'\nimport { Role, RoleAcl, User, UserRole, type UserKind } from '../data/entities'\n\n/**\n * A non-interactive execution principal: a login-less `User` plus a scoped\n * `Role` whose ACL carries EXACTLY the features that principal may use.\n *\n * This lives in `auth` because `User` / `Role` / `RoleAcl` / `UserRole` are this\n * module's entities. Any module that needs a machine identity to write under \u2014\n * an agentic task, a workflow definition declaring a grant, a future scheduled\n * job \u2014 provisions one here rather than reimplementing the four find-or-create\n * steps and the ACL replacement.\n *\n * The `enterprise` agent_orchestrator module owns an older copy of this logic\n * (`lib/identity/agentPrincipalService.ts`), which core MUST NOT import (an\n * optional peer). The naming knobs below exist so that copy can be migrated onto\n * this helper WITHOUT changing any provisioned row's identity: calling with\n * `{ namePrefix: 'agent', kind: 'agent', mergeFeatures: true }` reproduces its\n * email and role name byte-for-byte.\n */\nexport type ExecutionPrincipalScope = { tenantId: string; organizationId: string }\n\nexport type ResolvedExecutionPrincipal = {\n  userId: string\n  roleId: string\n}\n\nexport type ProvisionExecutionPrincipalInput = {\n  /**\n   * Namespaced, stable identity key \u2014 e.g. `workflow:<definitionId>`. It is the\n   * idempotency key: the deterministic email and role name are both derived from\n   * it, so re-provisioning resolves the same rows instead of creating new ones.\n   */\n  principalKey: string\n  displayName?: string\n  /** The principal's complete feature set. Replaces the role ACL unless `mergeFeatures`. */\n  features: string[]\n  /** Defaults to `service` \u2014 a machine principal that is not an AI agent. */\n  kind?: UserKind\n  /** Local-part / role-name prefix. Defaults to `principal`. */\n  namePrefix?: string\n  /**\n   * Merge into the existing ACL instead of replacing it. Default `false`:\n   * merging cannot NARROW a previously over-granted principal, which is the\n   * whole point of re-scoping on every save.\n   */\n  mergeFeatures?: boolean\n}\n\n/**\n * Non-routable internal domain. An execution principal never receives mail and\n * never logs in interactively, so this address is an identity key, not a mailbox.\n */\nconst EXECUTION_PRINCIPAL_EMAIL_DOMAIN = 'agent.internal'\nconst DEFAULT_NAME_PREFIX = 'principal'\n\nfunction slugifyPrincipalKey(principalKey: string): string {\n  return principalKey.toLowerCase().replace(/[^a-z0-9._-]+/g, '-')\n}\n\nexport function executionPrincipalEmail(\n  principalKey: string,\n  organizationId: string,\n  namePrefix: string = DEFAULT_NAME_PREFIX,\n): string {\n  return `${namePrefix}+${slugifyPrincipalKey(principalKey)}+${organizationId}@${EXECUTION_PRINCIPAL_EMAIL_DOMAIN}`\n}\n\nexport function executionPrincipalRoleName(\n  principalKey: string,\n  namePrefix: string = DEFAULT_NAME_PREFIX,\n): string {\n  return `${namePrefix}:${principalKey}`\n}\n\nexport function normalizeFeatureList(value: unknown): string[] {\n  if (!Array.isArray(value)) return []\n  const seen = new Set<string>()\n  for (const entry of value) {\n    if (typeof entry !== 'string') continue\n    const trimmed = entry.trim()\n    if (trimmed) seen.add(trimmed)\n  }\n  return Array.from(seen).sort((a, b) => a.localeCompare(b))\n}\n\n/**\n * Provisions \u2014 idempotently \u2014 the execution principal for `principalKey` and\n * pins its role ACL to exactly `features`.\n *\n * Non-interactive by construction: `passwordHash = null` + `isConfirmed = false`\n * leaves the password/SSO flow nothing to authenticate against. `isSuperAdmin`\n * is always false and the ACL's organization visibility is pinned to the\n * provisioning organization, so the principal can never out-scope its owner.\n */\nexport async function provisionExecutionPrincipal(\n  container: AwilixContainer,\n  scope: ExecutionPrincipalScope,\n  input: ProvisionExecutionPrincipalInput,\n): Promise<ResolvedExecutionPrincipal> {\n  const { tenantId, organizationId } = scope\n  const principalKey = input.principalKey.trim()\n  if (!principalKey) throw new Error('[internal] execution principal requires a principalKey')\n  if (!tenantId || !organizationId) {\n    throw new Error('[internal] execution principal requires a tenant and organization scope')\n  }\n\n  const namePrefix = input.namePrefix ?? DEFAULT_NAME_PREFIX\n  const kind: UserKind = input.kind ?? 'service'\n  const features = normalizeFeatureList(input.features)\n  const roleName = executionPrincipalRoleName(principalKey, namePrefix)\n  const principalEmail = executionPrincipalEmail(principalKey, organizationId, namePrefix)\n\n  const em = (container.resolve('em') as EntityManager).fork()\n\n  return em.transactional(async (trx) => {\n    let role = await findOneWithDecryption(\n      trx,\n      Role,\n      { name: roleName, tenantId },\n      {},\n      { tenantId, organizationId: null },\n    )\n    if (!role) {\n      role = trx.create(Role, { name: roleName, tenantId, minActiveHolders: 0, createdAt: new Date() })\n      trx.persist(role)\n      await trx.flush()\n    }\n\n    const emailHash = computeEmailHash(principalEmail)\n    let user = await findOneWithDecryption(\n      trx,\n      User,\n      { emailHash, tenantId, deletedAt: null },\n      {},\n      { tenantId, organizationId },\n    )\n    if (!user) {\n      user = trx.create(User, {\n        email: principalEmail,\n        emailHash,\n        passwordHash: null,\n        isConfirmed: false,\n        kind,\n        name: input.displayName ?? principalKey,\n        tenantId,\n        organizationId,\n        createdAt: new Date(),\n      })\n      trx.persist(user)\n      await trx.flush()\n    } else if (user.kind === 'human') {\n      // Defensive: a row resolved by the deterministic principal email must never\n      // be a human account. Never silently repurpose one.\n      throw new Error('[internal] resolved a human User for an execution principal')\n    }\n\n    await lockAuthorizationState(trx, {\n      userIds: [String(user.id)],\n      roleIds: [String(role.id)],\n    })\n\n    const existingAcl = await findOneWithDecryption(\n      trx,\n      RoleAcl,\n      { role, tenantId },\n      {},\n      { tenantId, organizationId: null },\n    )\n    if (!existingAcl) {\n      trx.persist(\n        trx.create(RoleAcl, {\n          role,\n          tenantId,\n          featuresJson: features,\n          isSuperAdmin: false,\n          organizationsJson: [organizationId],\n          createdAt: new Date(),\n        }),\n      )\n      await trx.flush()\n    } else {\n      const current = normalizeFeatureList(existingAcl.featuresJson)\n      const next = input.mergeFeatures ? normalizeFeatureList([...current, ...features]) : features\n      if (\n        existingAcl.isSuperAdmin ||\n        current.length !== next.length ||\n        current.some((feature, index) => feature !== next[index])\n      ) {\n        existingAcl.featuresJson = next\n        existingAcl.isSuperAdmin = false\n        existingAcl.organizationsJson = [organizationId]\n        trx.persist(existingAcl)\n        await trx.flush()\n      }\n    }\n\n    const existingLink = await findOneWithDecryption(\n      trx,\n      UserRole,\n      { user, role },\n      {},\n      { tenantId, organizationId: null },\n    )\n    if (!existingLink) {\n      trx.persist(trx.create(UserRole, { user, role, createdAt: new Date() }))\n      await trx.flush()\n    }\n\n    return { userId: user.id, roleId: role.id }\n  })\n}\n\n/**\n * Resolves the `User` id of an already-provisioned execution principal without\n * writing anything. Returns null when it has not been provisioned (or was\n * soft-deleted) \u2014 callers MUST fail closed rather than fall back to a broader\n * identity.\n */\nexport async function resolveExecutionPrincipalUserId(\n  em: EntityManager,\n  principalKey: string,\n  scope: ExecutionPrincipalScope,\n  namePrefix: string = DEFAULT_NAME_PREFIX,\n): Promise<string | null> {\n  const { tenantId, organizationId } = scope\n  if (!principalKey || !tenantId || !organizationId) return null\n  const emailHash = computeEmailHash(executionPrincipalEmail(principalKey, organizationId, namePrefix))\n  const user = await findOneWithDecryption(\n    em,\n    User,\n    { emailHash, tenantId, deletedAt: null },\n    {},\n    { tenantId, organizationId },\n  )\n  return user?.id ?? null\n}\n"],
+  "mappings": "AAEA,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,OACK;AACP,SAAS,wBAAwB;AACjC,SAAS,MAAM,SAAS,MAAM,gBAA+B;AAoD7D,MAAM,mCAAmC;AACzC,MAAM,sBAAsB;AAE5B,SAAS,oBAAoB,cAA8B;AACzD,SAAO,aAAa,YAAY,EAAE,QAAQ,kBAAkB,GAAG;AACjE;AAEO,SAAS,wBACd,cACA,gBACA,aAAqB,qBACb;AACR,SAAO,GAAG,UAAU,IAAI,oBAAoB,YAAY,CAAC,IAAI,cAAc,IAAI,gCAAgC;AACjH;AAEO,SAAS,2BACd,cACA,aAAqB,qBACb;AACR,SAAO,GAAG,UAAU,IAAI,YAAY;AACtC;AAEO,SAAS,qBAAqB,OAA0B;AAC7D,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO,CAAC;AACnC,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,SAAS,OAAO;AACzB,QAAI,OAAO,UAAU,SAAU;AAC/B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,QAAS,MAAK,IAAI,OAAO;AAAA,EAC/B;AACA,SAAO,MAAM,KAAK,IAAI,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,cAAc,CAAC,CAAC;AAC3D;AAWA,eAAsB,4BACpB,WACA,OACA,OACqC;AACrC,QAAM,EAAE,UAAU,eAAe,IAAI;AACrC,QAAM,eAAe,MAAM,aAAa,KAAK;AAC7C,MAAI,CAAC,aAAc,OAAM,IAAI,MAAM,wDAAwD;AAC3F,MAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,UAAM,IAAI,MAAM,yEAAyE;AAAA,EAC3F;AAEA,QAAM,aAAa,MAAM,cAAc;AACvC,QAAM,OAAiB,MAAM,QAAQ;AACrC,QAAM,WAAW,qBAAqB,MAAM,QAAQ;AACpD,QAAM,WAAW,2BAA2B,cAAc,UAAU;AACpE,QAAM,iBAAiB,wBAAwB,cAAc,gBAAgB,UAAU;AAEvF,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAE3D,SAAO,GAAG,cAAc,OAAO,QAAQ;AACrC,QAAI,OAAO,MAAM;AAAA,MACf;AAAA,MACA;AAAA,MACA,EAAE,MAAM,UAAU,SAAS;AAAA,MAC3B,CAAC;AAAA,MACD,EAAE,UAAU,gBAAgB,KAAK;AAAA,IACnC;AACA,QAAI,CAAC,MAAM;AACT,aAAO,IAAI,OAAO,MAAM,EAAE,MAAM,UAAU,UAAU,kBAAkB,GAAG,WAAW,oBAAI,KAAK,EAAE,CAAC;AAChG,UAAI,QAAQ,IAAI;AAChB,YAAM,IAAI,MAAM;AAAA,IAClB;AAEA,UAAM,YAAY,iBAAiB,cAAc;AACjD,QAAI,OAAO,MAAM;AAAA,MACf;AAAA,MACA;AAAA,MACA,EAAE,WAAW,UAAU,WAAW,KAAK;AAAA,MACvC,CAAC;AAAA,MACD,EAAE,UAAU,eAAe;AAAA,IAC7B;AACA,QAAI,CAAC,MAAM;AACT,aAAO,IAAI,OAAO,MAAM;AAAA,QACtB,OAAO;AAAA,QACP;AAAA,QACA,cAAc;AAAA,QACd,aAAa;AAAA,QACb;AAAA,QACA,MAAM,MAAM,eAAe;AAAA,QAC3B;AAAA,QACA;AAAA,QACA,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAC;AACD,UAAI,QAAQ,IAAI;AAChB,YAAM,IAAI,MAAM;AAAA,IAClB,WAAW,KAAK,SAAS,SAAS;AAGhC,YAAM,IAAI,MAAM,6DAA6D;AAAA,IAC/E;AAEA,UAAM,uBAAuB,KAAK;AAAA,MAChC,SAAS,CAAC,OAAO,KAAK,EAAE,CAAC;AAAA,MACzB,SAAS,CAAC,OAAO,KAAK,EAAE,CAAC;AAAA,IAC3B,CAAC;AAED,UAAM,cAAc,MAAM;AAAA,MACxB;AAAA,MACA;AAAA,MACA,EAAE,MAAM,SAAS;AAAA,MACjB,CAAC;AAAA,MACD,EAAE,UAAU,gBAAgB,KAAK;AAAA,IACnC;AACA,QAAI,CAAC,aAAa;AAChB,UAAI;AAAA,QACF,IAAI,OAAO,SAAS;AAAA,UAClB;AAAA,UACA;AAAA,UACA,cAAc;AAAA,UACd,cAAc;AAAA,UACd,mBAAmB,CAAC,cAAc;AAAA,UAClC,WAAW,oBAAI,KAAK;AAAA,QACtB,CAAC;AAAA,MACH;AACA,YAAM,IAAI,MAAM;AAAA,IAClB,OAAO;AACL,YAAM,UAAU,qBAAqB,YAAY,YAAY;AAC7D,YAAM,OAAO,MAAM,gBAAgB,qBAAqB,CAAC,GAAG,SAAS,GAAG,QAAQ,CAAC,IAAI;AACrF,UACE,YAAY,gBACZ,QAAQ,WAAW,KAAK,UACxB,QAAQ,KAAK,CAAC,SAAS,UAAU,YAAY,KAAK,KAAK,CAAC,GACxD;AACA,oBAAY,eAAe;AAC3B,oBAAY,eAAe;AAC3B,oBAAY,oBAAoB,CAAC,cAAc;AAC/C,YAAI,QAAQ,WAAW;AACvB,cAAM,IAAI,MAAM;AAAA,MAClB;AAAA,IACF;AAEA,UAAM,eAAe,MAAM;AAAA,MACzB;AAAA,MACA;AAAA,MACA,EAAE,MAAM,KAAK;AAAA,MACb,CAAC;AAAA,MACD,EAAE,UAAU,gBAAgB,KAAK;AAAA,IACnC;AACA,QAAI,CAAC,cAAc;AACjB,UAAI,QAAQ,IAAI,OAAO,UAAU,EAAE,MAAM,MAAM,WAAW,oBAAI,KAAK,EAAE,CAAC,CAAC;AACvE,YAAM,IAAI,MAAM;AAAA,IAClB;AAEA,WAAO,EAAE,QAAQ,KAAK,IAAI,QAAQ,KAAK,GAAG;AAAA,EAC5C,CAAC;AACH;AAQA,eAAsB,gCACpB,IACA,cACA,OACA,aAAqB,qBACG;AACxB,QAAM,EAAE,UAAU,eAAe,IAAI;AACrC,MAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,eAAgB,QAAO;AAC1D,QAAM,YAAY,iBAAiB,wBAAwB,cAAc,gBAAgB,UAAU,CAAC;AACpG,QAAM,OAAO,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,IACA,EAAE,WAAW,UAAU,WAAW,KAAK;AAAA,IACvC,CAAC;AAAA,IACD,EAAE,UAAU,eAAe;AAAA,EAC7B;AACA,SAAO,MAAM,MAAM;AACrB;",
   "names": []
 }

package/dist/modules/auth/lib/grantChecks.js

@@ -263,10 +263,15 @@ async function listSuperAdminUserIds(em, tenantId) {
 async function loadActorAcl(input) {
   const actorUserId = normalizeNullableString(input.actorUserId);
   if (!actorUserId) throw forbidden("Not authorized to grant ACL privileges.");
-  const acl = await input.rbacService.loadAcl(actorUserId, {
+  const scope = {
     tenantId: normalizeNullableString(input.tenantId),
     organizationId: normalizeNullableString(input.organizationId)
-  });
+  };
+  const loadBound = input.rbacService.loadAclWithEntityManager;
+  if (input.requireBoundRbac && typeof loadBound !== "function") {
+    throw new Error("[internal] Transaction-bound RBAC resolution is unavailable");
+  }
+  const acl = typeof loadBound === "function" ? await loadBound.call(input.rbacService, input.em, actorUserId, scope) : await input.rbacService.loadAcl(actorUserId, scope);
   return {
     isSuperAdmin: !!acl?.isSuperAdmin,
     features: normalizeStringList(acl?.features),