@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.9.0

package/dist/modules/auth/lib/tokenHash.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/auth/lib/tokenHash.ts"],
-  "sourcesContent": ["import { createHmac, randomBytes } from 'node:crypto'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('auth').child({ component: 'token-hash' })\n\nconst DEV_ONLY_SECRET = 'om-auth-token-dev-only-secret'\nlet missingSecretWarned = false\n\nfunction resolveTokenSecret(): string {\n  const secret =\n    process.env.AUTH_TOKEN_SECRET ||\n    process.env.AUTH_SECRET ||\n    process.env.NEXTAUTH_SECRET ||\n    process.env.JWT_SECRET\n  if (!secret) {\n    if (process.env.NODE_ENV === 'production') {\n      throw new Error(\n        '[auth.tokenHash] No AUTH_TOKEN_SECRET/AUTH_SECRET/NEXTAUTH_SECRET/JWT_SECRET set. ' +\n        'Refusing to start in production without a token hashing secret.',\n      )\n    }\n    if (!missingSecretWarned) {\n      missingSecretWarned = true\n      logger.warn('No AUTH_TOKEN_SECRET/AUTH_SECRET/NEXTAUTH_SECRET/JWT_SECRET set \u2014 using insecure dev-only default. Set a secret before deploying to production.')\n    }\n    return DEV_ONLY_SECRET\n  }\n  return secret\n}\n\nexport function generateAuthToken(): string {\n  return randomBytes(32).toString('hex')\n}\n\nexport function hashAuthToken(rawToken: string): string {\n  return createHmac('sha256', resolveTokenSecret()).update(rawToken).digest('hex')\n}\n\n"],
-  "mappings": "AAAA,SAAS,YAAY,mBAAmB;AACxC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,MAAM,EAAE,MAAM,EAAE,WAAW,aAAa,CAAC;AAErE,MAAM,kBAAkB;AACxB,IAAI,sBAAsB;AAE1B,SAAS,qBAA6B;AACpC,QAAM,SACJ,QAAQ,IAAI,qBACZ,QAAQ,IAAI,eACZ,QAAQ,IAAI,mBACZ,QAAQ,IAAI;AACd,MAAI,CAAC,QAAQ;AACX,QAAI,QAAQ,IAAI,aAAa,cAAc;AACzC,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AACA,QAAI,CAAC,qBAAqB;AACxB,4BAAsB;AACtB,aAAO,KAAK,sJAAiJ;AAAA,IAC/J;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEO,SAAS,oBAA4B;AAC1C,SAAO,YAAY,EAAE,EAAE,SAAS,KAAK;AACvC;AAEO,SAAS,cAAc,UAA0B;AACtD,SAAO,WAAW,UAAU,mBAAmB,CAAC,EAAE,OAAO,QAAQ,EAAE,OAAO,KAAK;AACjF;",
+  "sourcesContent": ["import { createHmac, randomBytes } from 'node:crypto'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { parseBooleanToken } from '@open-mercato/shared/lib/boolean'\n\nconst logger = createLogger('auth').child({ component: 'token-hash' })\n\nconst DEV_ONLY_SECRET = 'om-auth-token-dev-only-secret'\nconst DEV_FALLBACK_NODE_ENVS = new Set(['', 'development', 'test'])\nlet missingSecretWarned = false\n\nfunction isDevFallbackAllowed(nodeEnv: string): boolean {\n  if (DEV_FALLBACK_NODE_ENVS.has(nodeEnv)) return true\n  return parseBooleanToken(process.env.OM_ALLOW_DEV_AUTH_SECRET) === true\n}\n\nfunction resolveTokenSecret(): string {\n  const secret =\n    process.env.AUTH_TOKEN_SECRET ||\n    process.env.AUTH_SECRET ||\n    process.env.NEXTAUTH_SECRET ||\n    process.env.JWT_SECRET\n  if (!secret) {\n    const nodeEnv = (process.env.NODE_ENV ?? '').trim()\n    if (nodeEnv === 'production') {\n      throw new Error(\n        '[auth.tokenHash] No AUTH_TOKEN_SECRET/AUTH_SECRET/NEXTAUTH_SECRET/JWT_SECRET set. ' +\n        'Refusing to start in production without a token hashing secret.',\n      )\n    }\n    if (!isDevFallbackAllowed(nodeEnv)) {\n      throw new Error(\n        `[auth.tokenHash] No AUTH_TOKEN_SECRET/AUTH_SECRET/NEXTAUTH_SECRET/JWT_SECRET set (NODE_ENV=${nodeEnv}). ` +\n        'The insecure dev-only token hashing secret is only used when NODE_ENV is development or test. ' +\n        'Set a token hashing secret, or set OM_ALLOW_DEV_AUTH_SECRET=true to opt in explicitly.',\n      )\n    }\n    if (!missingSecretWarned) {\n      missingSecretWarned = true\n      logger.warn('No AUTH_TOKEN_SECRET/AUTH_SECRET/NEXTAUTH_SECRET/JWT_SECRET set \u2014 using insecure dev-only default. Set a secret before deploying to production.')\n    }\n    return DEV_ONLY_SECRET\n  }\n  return secret\n}\n\nexport function generateAuthToken(): string {\n  return randomBytes(32).toString('hex')\n}\n\nexport function hashAuthToken(rawToken: string): string {\n  return createHmac('sha256', resolveTokenSecret()).update(rawToken).digest('hex')\n}\n\n"],
+  "mappings": "AAAA,SAAS,YAAY,mBAAmB;AACxC,SAAS,oBAAoB;AAC7B,SAAS,yBAAyB;AAElC,MAAM,SAAS,aAAa,MAAM,EAAE,MAAM,EAAE,WAAW,aAAa,CAAC;AAErE,MAAM,kBAAkB;AACxB,MAAM,yBAAyB,oBAAI,IAAI,CAAC,IAAI,eAAe,MAAM,CAAC;AAClE,IAAI,sBAAsB;AAE1B,SAAS,qBAAqB,SAA0B;AACtD,MAAI,uBAAuB,IAAI,OAAO,EAAG,QAAO;AAChD,SAAO,kBAAkB,QAAQ,IAAI,wBAAwB,MAAM;AACrE;AAEA,SAAS,qBAA6B;AACpC,QAAM,SACJ,QAAQ,IAAI,qBACZ,QAAQ,IAAI,eACZ,QAAQ,IAAI,mBACZ,QAAQ,IAAI;AACd,MAAI,CAAC,QAAQ;AACX,UAAM,WAAW,QAAQ,IAAI,YAAY,IAAI,KAAK;AAClD,QAAI,YAAY,cAAc;AAC5B,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AACA,QAAI,CAAC,qBAAqB,OAAO,GAAG;AAClC,YAAM,IAAI;AAAA,QACR,8FAA8F,OAAO;AAAA,MAGvG;AAAA,IACF;AACA,QAAI,CAAC,qBAAqB;AACxB,4BAAsB;AACtB,aAAO,KAAK,sJAAiJ;AAAA,IAC/J;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEO,SAAS,oBAA4B;AAC1C,SAAO,YAAY,EAAE,EAAE,SAAS,KAAK;AACvC;AAEO,SAAS,cAAc,UAA0B;AACtD,SAAO,WAAW,UAAU,mBAAmB,CAAC,EAAE,OAAO,QAAQ,EAAE,OAAO,KAAK;AACjF;",
   "names": []
 }

package/dist/modules/auth/services/rbacService.js

@@ -1,7 +1,8 @@
 import { getCurrentCacheTenant, runWithCacheTenant } from "@open-mercato/cache";
 import { UserAcl, RoleAcl, User, UserRole } from "@open-mercato/core/modules/auth/data/entities";
 import { ApiKey } from "@open-mercato/core/modules/api_keys/data/entities";
-import { findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { Organization } from "@open-mercato/core/modules/directory/data/entities";
+import { findOneWithDecryption, findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
 import { buildOrgScopeUserCacheTag, buildOrgScopeTenantCacheTag } from "@open-mercato/core/modules/directory/utils/organizationScope";
 import {
   authorizeFeatures,
@@ -9,6 +10,20 @@ import {
 } from "@open-mercato/shared/security/featurePolicy";
 import { filterGrantsByEnabledModules } from "@open-mercato/shared/security/enabledModulesRegistry";
 import { resolveRoleOrganizationScope, roleAclAllowsOrganization } from "./roleOrganizationScope.js";
+async function resolveRoleOrganizationScopeWithEntityManager(em, tenantId, organizationId) {
+  if (!organizationId) return null;
+  if (!tenantId) return /* @__PURE__ */ new Set();
+  const organization = await findOneWithDecryption(
+    em,
+    Organization,
+    { id: organizationId, tenant: tenantId, deletedAt: null },
+    { fields: ["id", "ancestorIds"] },
+    { tenantId, organizationId }
+  );
+  if (!organization) return /* @__PURE__ */ new Set();
+  const ancestors = Array.isArray(organization.ancestorIds) ? organization.ancestorIds.filter((value) => typeof value === "string" && value.length > 0) : [];
+  return /* @__PURE__ */ new Set([organizationId, ...ancestors]);
+}
 function isAclData(value) {
   if (typeof value !== "object" || value === null) return false;
   const record = value;
@@ -23,6 +38,106 @@ function isAclData(value) {
 function isRestrictedRoleAcl(acl) {
   return Array.isArray(acl.organizationsJson) && acl.organizationsJson.length > 0 && !acl.organizationsJson.includes("__all__");
 }
+function isStringListOrNull(value) {
+  return value === null || Array.isArray(value) && value.every((entry) => typeof entry === "string");
+}
+function isFeatureOrganizationRoleGrant(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const record = value;
+  return typeof record.isSuperAdmin === "boolean" && isStringListOrNull(record.featuresJson) && isStringListOrNull(record.organizationsJson);
+}
+function isFeatureOrganizationGrants(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const record = value;
+  switch (record.kind) {
+    case "none":
+      return true;
+    case "api_key":
+      return (record.organizationId === null || typeof record.organizationId === "string") && Array.isArray(record.roleGrants) && record.roleGrants.every(isFeatureOrganizationRoleGrant);
+    case "user_acl":
+      return typeof record.isSuperAdmin === "boolean" && Array.isArray(record.features) && record.features.every((feature) => typeof feature === "string") && isStringListOrNull(record.organizations);
+    case "roles":
+      return Array.isArray(record.roleGrants) && record.roleGrants.every(isFeatureOrganizationRoleGrant);
+    default:
+      return false;
+  }
+}
+function toFeatureOrganizationRoleGrant(acl) {
+  return {
+    isSuperAdmin: acl.isSuperAdmin === true,
+    featuresJson: Array.isArray(acl.featuresJson) ? [...acl.featuresJson] : null,
+    organizationsJson: Array.isArray(acl.organizationsJson) ? [...acl.organizationsJson] : null
+  };
+}
+function normalizeFeatureOrganizationCandidates(organizations) {
+  const normalized = /* @__PURE__ */ new Map();
+  for (const organization of organizations) {
+    const id = typeof organization.id === "string" ? organization.id.trim() : "";
+    if (!id || normalized.has(id)) continue;
+    const ancestorIds = Array.isArray(organization.ancestorIds) ? Array.from(new Set(organization.ancestorIds.map((ancestorId) => typeof ancestorId === "string" ? ancestorId.trim() : "").filter(Boolean))) : [];
+    normalized.set(id, { id, ancestorIds });
+  }
+  return Array.from(normalized.values());
+}
+function buildFeatureOrganizationScope(organization) {
+  return /* @__PURE__ */ new Set([organization.id, ...organization.ancestorIds ?? []]);
+}
+function roleAclProvidesGlobalFeatureScope(acl) {
+  const organizations = Array.isArray(acl.organizationsJson) ? acl.organizationsJson : null;
+  return !organizations || organizations.length === 0 || organizations.includes("__all__");
+}
+function roleAclProvidesGlobalVisibility(acl, emptyOrganizationsAreUnrestricted) {
+  const organizations = Array.isArray(acl.organizationsJson) ? acl.organizationsJson : null;
+  if (!organizations || organizations.includes("__all__")) return true;
+  return emptyOrganizationsAreUnrestricted && organizations.length === 0;
+}
+function roleAclProvidesOrganizationVisibility(acl, organizationScope, emptyOrganizationsAreUnrestricted) {
+  const organizations = Array.isArray(acl.organizationsJson) ? acl.organizationsJson : null;
+  if (!organizations || organizations.includes("__all__")) return true;
+  if (organizations.length === 0) return emptyOrganizationsAreUnrestricted;
+  return organizations.some((organizationId) => organizationScope.has(organizationId));
+}
+function roleAclsAuthorizeFeatures(roleAcls, required, organization, emptyOrganizationsAreUnrestricted) {
+  const organizationScope = buildFeatureOrganizationScope(organization);
+  const grantedFeatures = /* @__PURE__ */ new Set();
+  let unrestricted = false;
+  let scopeAllowed = false;
+  for (const acl of roleAcls) {
+    if (roleAclProvidesOrganizationVisibility(acl, organizationScope, emptyOrganizationsAreUnrestricted)) {
+      scopeAllowed = true;
+    }
+    if (!roleAclAllowsOrganization(acl, organizationScope)) continue;
+    unrestricted = unrestricted || acl.isSuperAdmin === true;
+    for (const feature of Array.isArray(acl.featuresJson) ? acl.featuresJson : []) {
+      grantedFeatures.add(feature);
+    }
+  }
+  return authorizeFeatures([...required], {
+    grantedFeatures: Array.from(grantedFeatures),
+    unrestricted,
+    scopeAllowed: scopeAllowed || unrestricted
+  });
+}
+function roleAclsAuthorizeFeaturesGlobally(roleAcls, required, emptyOrganizationsAreUnrestricted) {
+  const grantedFeatures = /* @__PURE__ */ new Set();
+  let unrestricted = false;
+  let scopeAllowed = false;
+  for (const acl of roleAcls) {
+    if (roleAclProvidesGlobalVisibility(acl, emptyOrganizationsAreUnrestricted)) {
+      scopeAllowed = true;
+    }
+    if (!roleAclProvidesGlobalFeatureScope(acl)) continue;
+    unrestricted = unrestricted || acl.isSuperAdmin === true;
+    for (const feature of Array.isArray(acl.featuresJson) ? acl.featuresJson : []) {
+      grantedFeatures.add(feature);
+    }
+  }
+  return authorizeFeatures([...required], {
+    grantedFeatures: Array.from(grantedFeatures),
+    unrestricted,
+    scopeAllowed: scopeAllowed || unrestricted
+  });
+}
 class RbacService {
   constructor(em, cache, organizationHierarchyService) {
     this.em = em;
@@ -64,6 +179,12 @@ class RbacService {
   }
   async setCache(cacheKey, data, userId, scope) {
     if (!this.cache) return;
+    await this.cache.set(cacheKey, data, {
+      ttl: this.cacheTtlMs,
+      tags: this.buildCacheTags(userId, scope)
+    });
+  }
+  buildCacheTags(userId, scope) {
     const tags = [
       this.getUserTag(userId),
       "rbac:all"
@@ -75,10 +196,7 @@ class RbacService {
     if (scope.organizationId) {
       tags.push(this.getOrganizationTag(scope.organizationId));
     }
-    await this.cache.set(cacheKey, data, {
-      ttl: this.cacheTtlMs,
-      tags
-    });
+    return tags;
   }
   /**
    * Invalidates cached ACL data for a specific user across all tenants and organizations.
@@ -336,6 +454,158 @@ class RbacService {
     await this.setCache(cacheKey, result, userId, scope);
     return result;
   }
+  /**
+   * Cache-bypassing ACL resolution bound to a caller-supplied EntityManager.
+   * Replay authorization uses this additive seam after taking its canonical
+   * locks so every user, membership, role, ACL, API-key, and organization-scope
+   * read observes the exact transaction that performs the mutation.
+   */
+  async loadAclWithEntityManager(em, userId, scope) {
+    if (userId.startsWith("api_key:")) {
+      const key = await em.findOne(ApiKey, {
+        id: userId.slice("api_key:".length),
+        deletedAt: null
+      });
+      if (!key || key.expiresAt && key.expiresAt.getTime() < Date.now()) {
+        return { isSuperAdmin: false, features: [], organizations: null };
+      }
+      const tenantId2 = scope.tenantId || key.tenantId || null;
+      const roleIds2 = Array.isArray(key.rolesJson) ? key.rolesJson.filter(Boolean) : [];
+      const keyOrganizationId = typeof key.organizationId === "string" && key.organizationId.trim().length > 0 ? key.organizationId.trim() : null;
+      const evaluatedOrganizationId = scope.organizationId || keyOrganizationId;
+      const roleScope2 = await resolveRoleOrganizationScopeWithEntityManager(
+        em,
+        tenantId2,
+        evaluatedOrganizationId
+      );
+      const roleAcls2 = tenantId2 && roleIds2.length ? await em.find(RoleAcl, { tenantId: tenantId2, role: { $in: roleIds2 } }) : [];
+      let isSuperAdmin2 = false;
+      const features2 = [];
+      let organizations2 = [];
+      let hasApplicableRestrictedRole2 = false;
+      for (const acl of roleAcls2) {
+        if (roleAclAllowsOrganization(acl, roleScope2)) {
+          isSuperAdmin2 = isSuperAdmin2 || acl.isSuperAdmin === true;
+          for (const feature of Array.isArray(acl.featuresJson) ? acl.featuresJson : []) {
+            if (!features2.includes(feature)) features2.push(feature);
+          }
+          if (isRestrictedRoleAcl(acl)) hasApplicableRestrictedRole2 = true;
+        }
+        if (organizations2 !== null) {
+          if (acl.organizationsJson == null || acl.organizationsJson.length === 0 || acl.organizationsJson.includes("__all__")) {
+            organizations2 = null;
+          } else {
+            organizations2 = Array.from(/* @__PURE__ */ new Set([...organizations2, ...acl.organizationsJson]));
+          }
+        }
+      }
+      if (organizations2 !== null && evaluatedOrganizationId && roleScope2 !== null && roleScope2.size > 0 && hasApplicableRestrictedRole2 && !organizations2.includes(evaluatedOrganizationId)) {
+        organizations2.push(evaluatedOrganizationId);
+      }
+      if (keyOrganizationId) {
+        const keyScope = await resolveRoleOrganizationScopeWithEntityManager(em, tenantId2, keyOrganizationId);
+        organizations2 = organizations2 === null || organizations2.some((organizationId2) => keyScope?.has(organizationId2)) ? [keyOrganizationId] : [];
+      }
+      if (isSuperAdmin2 && organizations2 !== null && !features2.includes("*")) features2.push("*");
+      return { isSuperAdmin: isSuperAdmin2 && organizations2 === null, features: features2, organizations: organizations2 };
+    }
+    const directGlobalGrant = await em.findOne(
+      UserAcl,
+      { user: userId, isSuperAdmin: true }
+    );
+    if (directGlobalGrant?.isSuperAdmin) {
+      return { isSuperAdmin: true, features: ["*"], organizations: null };
+    }
+    const globalLinks = await findWithDecryption(
+      em,
+      UserRole,
+      { user: userId },
+      { populate: ["role"] },
+      { tenantId: null, organizationId: null }
+    );
+    const globalRoleIds = globalLinks.map((link) => typeof link.role === "string" ? link.role : link.role?.id ? String(link.role.id) : null).filter((roleId) => typeof roleId === "string" && roleId.length > 0);
+    if (globalRoleIds.length) {
+      const globalRoleGrants = await em.find(
+        RoleAcl,
+        {
+          role: { $in: globalRoleIds },
+          isSuperAdmin: true
+        }
+      );
+      if (globalRoleGrants.some((grant) => grant.isSuperAdmin && !isRestrictedRoleAcl(grant))) {
+        return { isSuperAdmin: true, features: ["*"], organizations: null };
+      }
+    }
+    const user = await em.findOne(User, { id: userId });
+    if (!user) return { isSuperAdmin: false, features: [], organizations: null };
+    const tenantId = scope.tenantId || user.tenantId || null;
+    const organizationId = scope.organizationId || user.organizationId || null;
+    if (!tenantId) return { isSuperAdmin: false, features: [], organizations: null };
+    const userAcl = await em.findOne(UserAcl, { user: userId, tenantId });
+    if (userAcl) {
+      return {
+        isSuperAdmin: userAcl.isSuperAdmin === true,
+        features: Array.isArray(userAcl.featuresJson) ? [...userAcl.featuresJson] : [],
+        organizations: Array.isArray(userAcl.organizationsJson) ? [...userAcl.organizationsJson] : null
+      };
+    }
+    const links = await findWithDecryption(
+      em,
+      UserRole,
+      { user: userId, role: { tenantId } },
+      { populate: ["role"] },
+      { tenantId, organizationId }
+    );
+    const roleIds = links.map((link) => typeof link.role === "string" ? link.role : link.role?.id ? String(link.role.id) : null).filter((roleId) => typeof roleId === "string" && roleId.length > 0);
+    const roleAcls = roleIds.length ? await em.find(RoleAcl, { tenantId, role: { $in: roleIds } }) : [];
+    const roleScope = await resolveRoleOrganizationScopeWithEntityManager(
+      em,
+      tenantId,
+      scope.organizationId
+    );
+    let isSuperAdmin = false;
+    const features = [];
+    let organizations = [];
+    let hasApplicableRestrictedRole = false;
+    for (const acl of roleAcls) {
+      if (roleAclAllowsOrganization(acl, roleScope)) {
+        isSuperAdmin = isSuperAdmin || acl.isSuperAdmin === true;
+        for (const feature of Array.isArray(acl.featuresJson) ? acl.featuresJson : []) {
+          if (!features.includes(feature)) features.push(feature);
+        }
+        if (isRestrictedRoleAcl(acl)) hasApplicableRestrictedRole = true;
+      }
+      if (organizations !== null) {
+        if (acl.organizationsJson == null || acl.organizationsJson.includes("__all__")) {
+          organizations = null;
+        } else {
+          organizations = Array.from(/* @__PURE__ */ new Set([...organizations, ...acl.organizationsJson]));
+        }
+      }
+    }
+    if (organizations !== null && scope.organizationId && roleScope && roleScope.size > 0 && hasApplicableRestrictedRole && !organizations.includes(scope.organizationId)) {
+      organizations.push(scope.organizationId);
+    }
+    return { isSuperAdmin, features, organizations };
+  }
+  async userHasAllFeaturesWithEntityManager(em, userId, required, scope) {
+    if (!required.length) return true;
+    const acl = await this.loadAclWithEntityManager(em, userId, scope);
+    const organizationAllowed = acl.isSuperAdmin || !acl.organizations || !scope.organizationId || acl.organizations.includes(scope.organizationId) || acl.organizations.includes("__all__");
+    return authorizeFeatures(required, {
+      grantedFeatures: acl.features,
+      unrestricted: acl.isSuperAdmin,
+      scopeAllowed: organizationAllowed
+    });
+  }
+  async getGrantedFeaturesWithEntityManager(em, userId, scope) {
+    const acl = await this.loadAclWithEntityManager(em, userId, scope);
+    if (acl.isSuperAdmin) return filterGrantsByEnabledModules(["*"]);
+    if (acl.organizations && scope.organizationId && !acl.organizations.includes(scope.organizationId) && !acl.organizations.includes("__all__")) {
+      return [];
+    }
+    return filterGrantsByEnabledModules(acl.features);
+  }
   /**
    * Checks whether any tenant role grants a feature.
    *
@@ -409,6 +679,117 @@ class RbacService {
       scopeAllowed: organizationAllowed
     });
   }
+  async resolveFeatureOrganizationAccess(userId, required, input) {
+    const allowAll = (organizations) => normalizeFeatureOrganizationCandidates(organizations).map((organization) => organization.id);
+    const denyAll = () => [];
+    if (!required.length) return { unrestricted: true, filterOrganizationIds: allowAll };
+    if (!input.tenantId) return { unrestricted: false, filterOrganizationIds: denyAll };
+    if (!userId.startsWith("api_key:") && await this.isGlobalSuperAdmin(userId) && authorizeFeatures(required, { grantedFeatures: ["*"], unrestricted: true })) {
+      return { unrestricted: true, filterOrganizationIds: allowAll };
+    }
+    const grants = await this.loadFeatureOrganizationGrants(userId, input.tenantId);
+    if (grants.kind === "none") return { unrestricted: false, filterOrganizationIds: denyAll };
+    if (grants.kind === "api_key") {
+      const keyOrganizationId = grants.organizationId;
+      const unrestricted = keyOrganizationId === null && roleAclsAuthorizeFeaturesGlobally(grants.roleGrants, required, true);
+      if (unrestricted) return { unrestricted: true, filterOrganizationIds: allowAll };
+      return {
+        unrestricted: false,
+        filterOrganizationIds: (candidates) => normalizeFeatureOrganizationCandidates(candidates).filter((organization) => (!keyOrganizationId || organization.id === keyOrganizationId) && roleAclsAuthorizeFeatures(grants.roleGrants, required, organization, true)).map((organization) => organization.id)
+      };
+    }
+    if (grants.kind === "user_acl") {
+      const grantedFeatures = grants.features;
+      const allowedOrganizations = grants.organizations;
+      const hasGlobalScope = grants.isSuperAdmin || allowedOrganizations === null || allowedOrganizations.includes("__all__");
+      const unrestricted = authorizeFeatures([...required], {
+        grantedFeatures,
+        unrestricted: grants.isSuperAdmin,
+        scopeAllowed: hasGlobalScope
+      });
+      if (unrestricted) return { unrestricted: true, filterOrganizationIds: allowAll };
+      return {
+        unrestricted: false,
+        filterOrganizationIds: (candidates) => normalizeFeatureOrganizationCandidates(candidates).filter((organization) => {
+          const scopeAllowed = grants.isSuperAdmin || allowedOrganizations === null || allowedOrganizations.includes("__all__") || allowedOrganizations.includes(organization.id);
+          return authorizeFeatures([...required], {
+            grantedFeatures,
+            unrestricted: grants.isSuperAdmin,
+            scopeAllowed
+          });
+        }).map((organization) => organization.id)
+      };
+    }
+    if (roleAclsAuthorizeFeaturesGlobally(grants.roleGrants, required, false)) {
+      return { unrestricted: true, filterOrganizationIds: allowAll };
+    }
+    return {
+      unrestricted: false,
+      filterOrganizationIds: (candidates) => normalizeFeatureOrganizationCandidates(candidates).filter((organization) => roleAclsAuthorizeFeatures(grants.roleGrants, required, organization, false)).map((organization) => organization.id)
+    };
+  }
+  async loadFeatureOrganizationGrants(userId, tenantId) {
+    const cacheKey = `rbac:feature-organizations:${userId}:${tenantId}`;
+    if (this.cache) {
+      const cached = await this.cache.get(cacheKey);
+      if (isFeatureOrganizationGrants(cached)) return cached;
+    }
+    const grants = await this.queryFeatureOrganizationGrants(userId, tenantId);
+    if (this.cache) {
+      await this.cache.set(cacheKey, grants, {
+        ttl: this.cacheTtlMs,
+        tags: this.buildCacheTags(userId, { tenantId, organizationId: null })
+      });
+    }
+    return grants;
+  }
+  async queryFeatureOrganizationGrants(userId, tenantId) {
+    const em = this.em.fork();
+    if (userId.startsWith("api_key:")) {
+      const apiKeyId = userId.slice("api_key:".length);
+      const key = await em.findOne(ApiKey, { id: apiKeyId, deletedAt: null });
+      if (!key || key.expiresAt && key.expiresAt.getTime() < Date.now() || key.tenantId && key.tenantId !== tenantId) {
+        return { kind: "none" };
+      }
+      const roleIds2 = Array.isArray(key.rolesJson) ? key.rolesJson.filter(Boolean) : [];
+      if (!roleIds2.length) return { kind: "none" };
+      const roleAcls2 = await em.find(RoleAcl, {
+        tenantId,
+        role: { $in: roleIds2 }
+      });
+      const keyOrganizationId = typeof key.organizationId === "string" && key.organizationId.trim().length > 0 ? key.organizationId.trim() : null;
+      return {
+        kind: "api_key",
+        organizationId: keyOrganizationId,
+        roleGrants: roleAcls2.map(toFeatureOrganizationRoleGrant)
+      };
+    }
+    const user = await em.findOne(User, { id: userId });
+    if (!user) return { kind: "none" };
+    const userAcl = await em.findOne(UserAcl, { user: userId, tenantId });
+    if (userAcl) {
+      return {
+        kind: "user_acl",
+        isSuperAdmin: userAcl.isSuperAdmin === true,
+        features: Array.isArray(userAcl.featuresJson) ? [...userAcl.featuresJson] : [],
+        organizations: Array.isArray(userAcl.organizationsJson) ? [...userAcl.organizationsJson] : null
+      };
+    }
+    const links = await findWithDecryption(
+      em,
+      UserRole,
+      { user: userId, role: { tenantId } },
+      { populate: ["role"] },
+      { tenantId, organizationId: null }
+    );
+    const roleIds = Array.from(new Set(links.map((link) => link.role?.id).filter((roleId) => typeof roleId === "string" && roleId.length > 0)));
+    if (!roleIds.length) return { kind: "none" };
+    const roleAcls = await em.find(RoleAcl, {
+      tenantId,
+      role: { $in: roleIds }
+    });
+    return { kind: "roles", roleGrants: roleAcls.map(toFeatureOrganizationRoleGrant) };
+  }
   /**
    * Returns the user's infrastructure grant list, filtered to enabled modules.
    * The result may contain wildcards; authoritative checks must still go through