@open-mercato/documents 0.6.8-develop.7016.1.4ed7b1e49d

package/dist/modules/documents/commands/shared.js

@@ -0,0 +1,143 @@
+import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { hasAllFeatures } from "@open-mercato/shared/lib/auth/featureMatch";
+import { z } from "zod";
+import {
+  deriveDocumentCapabilities
+} from "../lib/capabilities.js";
+import { resolveSubjectAccess } from "../lib/permissions.js";
+import { Document } from "../data/entities.js";
+import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { hasResolvedDocumentsOrganizationAccess } from "../lib/organizationAccess.js";
+import { resolveOrganizationScopeService } from "../lib/platformServices.js";
+function resolveDocumentsCommandEntityManager(ctx) {
+  return ctx.transactionalEm ?? ctx.container.resolve("em").fork();
+}
+const actorUuidSchema = z.string().uuid();
+function normalizeActorUuid(value) {
+  if (typeof value !== "string") return null;
+  const normalized = value.trim();
+  return actorUuidSchema.safeParse(normalized).success ? normalized : null;
+}
+function isApiKeyAuth(auth) {
+  return auth.isApiKey === true || auth.sub.trim().startsWith("api_key:");
+}
+function resolveDocumentsCommandScope(ctx, input) {
+  const tenantId = ctx.auth?.tenantId ?? null;
+  const organizationId = ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null;
+  if (!tenantId || !organizationId) {
+    throw new CrudHttpError(403, { error: "Forbidden" });
+  }
+  if (input.tenantId !== tenantId || input.organizationId !== organizationId) {
+    throw new CrudHttpError(403, { error: "Forbidden" });
+  }
+  return { tenantId, organizationId };
+}
+function resolveDocumentsCommandActor(ctx) {
+  const auth = ctx.auth;
+  if (!auth) throw new CrudHttpError(403, { error: "Forbidden" });
+  const subject = auth.sub.trim();
+  if (isApiKeyAuth(auth)) {
+    const keyId = normalizeActorUuid(auth.keyId);
+    if (!keyId || subject !== `api_key:${keyId}`) {
+      throw new CrudHttpError(403, { error: "Forbidden" });
+    }
+    if (auth.userId === void 0 || auth.userId === null) return keyId;
+    const backingUserId = normalizeActorUuid(auth.userId);
+    if (backingUserId) return backingUserId;
+    throw new CrudHttpError(403, { error: "Forbidden" });
+  }
+  const actorUserId = normalizeActorUuid(subject);
+  const claimedUserId = auth.userId === void 0 || auth.userId === null ? actorUserId : normalizeActorUuid(auth.userId);
+  if (actorUserId && claimedUserId === actorUserId) return actorUserId;
+  throw new CrudHttpError(403, { error: "Forbidden" });
+}
+function resolveDocumentsCommandAclSubject(ctx) {
+  const subject = ctx.auth?.sub?.trim() ?? "";
+  if (!subject) {
+    throw new CrudHttpError(403, { error: "Forbidden" });
+  }
+  return subject;
+}
+async function resolveDocumentsCommandFeatures(ctx, scope) {
+  const aclSubject = resolveDocumentsCommandAclSubject(ctx);
+  let rbacService;
+  try {
+    rbacService = ctx.container.resolve("rbacService");
+  } catch {
+    return [];
+  }
+  if (typeof rbacService.invalidateUserCache !== "function" || typeof rbacService.loadAcl !== "function") {
+    return [];
+  }
+  await rbacService.invalidateUserCache(aclSubject);
+  const acl = await rbacService.loadAcl(aclSubject, scope);
+  if (acl.isSuperAdmin) return ["*"];
+  if (!hasResolvedDocumentsOrganizationAccess(acl, scope.organizationId)) {
+    const organizationScopeService = resolveOrganizationScopeService(ctx.container);
+    if (!organizationScopeService) return [];
+    const organizationScope = await organizationScopeService.resolve({
+      auth: {
+        ...ctx.auth ?? {},
+        sub: aclSubject,
+        tenantId: scope.tenantId,
+        orgId: ctx.auth?.orgId ?? scope.organizationId,
+        isSuperAdmin: false
+      },
+      selectedId: scope.organizationId,
+      tenantId: scope.tenantId,
+      freshAcl: true
+    });
+    if (!hasResolvedDocumentsOrganizationAccess(acl, scope.organizationId, organizationScope)) {
+      return [];
+    }
+  }
+  return Array.from(new Set(Array.isArray(acl.features) ? acl.features : []));
+}
+async function assertDocumentCommandCanEdit(ctx, em, documentId, scope) {
+  return assertDocumentCommandCapability(ctx, em, documentId, scope, "canEdit");
+}
+async function assertDocumentCommandCapability(ctx, em, documentId, scope, capability) {
+  const features = await resolveDocumentsCommandFeatures(ctx, scope);
+  const relationshipTier = await resolveSubjectAccess(
+    em,
+    documentId,
+    scope,
+    {
+      subject: resolveDocumentsCommandAclSubject(ctx),
+      userId: resolveDocumentsCommandActor(ctx)
+    },
+    ctx.container
+  );
+  const documentRow = await findOneWithDecryption(
+    em,
+    Document,
+    { id: documentId, tenantId: scope.tenantId, organizationId: scope.organizationId },
+    { fields: ["id", "archivedAt"], filters: false },
+    scope
+  );
+  const capabilities = deriveDocumentCapabilities({
+    relationshipTier,
+    managerOverride: hasAllFeatures(["documents.manage"], features),
+    archived: documentRow?.archivedAt != null,
+    userFeatures: features
+  });
+  if (!capabilities[capability]) {
+    throw new CrudHttpError(403, { error: "Forbidden" });
+  }
+  return features;
+}
+function assertCommandFeature(features, feature) {
+  if (!hasAllFeatures([feature], Array.from(features))) {
+    throw new CrudHttpError(403, { error: "Forbidden" });
+  }
+}
+export {
+  assertCommandFeature,
+  assertDocumentCommandCanEdit,
+  assertDocumentCommandCapability,
+  resolveDocumentsCommandActor,
+  resolveDocumentsCommandEntityManager,
+  resolveDocumentsCommandFeatures,
+  resolveDocumentsCommandScope
+};
+//# sourceMappingURL=shared.js.map

package/dist/modules/documents/commands/shared.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/documents/commands/shared.ts"],
+  "sourcesContent": ["import type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { hasAllFeatures } from '@open-mercato/shared/lib/auth/featureMatch'\nimport type { AuthContext } from '@open-mercato/shared/lib/auth/server'\nimport { z } from 'zod'\nimport {\n  deriveDocumentCapabilities,\n  type DocumentCapabilities,\n} from '../lib/capabilities'\nimport { resolveSubjectAccess } from '../lib/permissions'\nimport { Document } from '../data/entities'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { hasResolvedDocumentsOrganizationAccess } from '../lib/organizationAccess'\nimport { resolveOrganizationScopeService } from '../lib/platformServices'\n\nexport type DocumentsCommandScope = {\n  tenantId: string\n  organizationId: string\n}\n\n/**\n * Reuse an ambient command transaction when one is supplied. This keeps\n * composed command writes, row locks, and audit snapshots inside the caller's\n * atomic boundary instead of silently forking an independent transaction.\n */\nexport function resolveDocumentsCommandEntityManager(ctx: CommandRuntimeContext): EntityManager {\n  return ctx.transactionalEm ?? (ctx.container.resolve('em') as EntityManager).fork()\n}\n\ntype CurrentAcl = {\n  isSuperAdmin: boolean\n  features: string[]\n  organizations: string[] | null\n}\n\ntype RbacServiceLike = {\n  invalidateUserCache: (userId: string) => Promise<void>\n  loadAcl: (\n    userId: string,\n    scope: { tenantId: string; organizationId: string },\n  ) => Promise<CurrentAcl>\n}\n\nconst actorUuidSchema = z.string().uuid()\n\nfunction normalizeActorUuid(value: unknown): string | null {\n  if (typeof value !== 'string') return null\n  const normalized = value.trim()\n  return actorUuidSchema.safeParse(normalized).success ? normalized : null\n}\n\nfunction isApiKeyAuth(auth: NonNullable<CommandRuntimeContext['auth']>): boolean {\n  return auth.isApiKey === true || auth.sub.trim().startsWith('api_key:')\n}\n\nexport function resolveDocumentsCommandScope(\n  ctx: CommandRuntimeContext,\n  input: DocumentsCommandScope,\n): DocumentsCommandScope {\n  const tenantId = ctx.auth?.tenantId ?? null\n  const organizationId = ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null\n  if (!tenantId || !organizationId) {\n    throw new CrudHttpError(403, { error: 'Forbidden' })\n  }\n  if (input.tenantId !== tenantId || input.organizationId !== organizationId) {\n    throw new CrudHttpError(403, { error: 'Forbidden' })\n  }\n  return { tenantId, organizationId }\n}\n\nexport function resolveDocumentsCommandActor(ctx: CommandRuntimeContext): string {\n  const auth = ctx.auth\n  if (!auth) throw new CrudHttpError(403, { error: 'Forbidden' })\n\n  const subject = auth.sub.trim()\n  if (isApiKeyAuth(auth)) {\n    const keyId = normalizeActorUuid(auth.keyId)\n    if (!keyId || subject !== `api_key:${keyId}`) {\n      throw new CrudHttpError(403, { error: 'Forbidden' })\n    }\n    if (auth.userId === undefined || auth.userId === null) return keyId\n    const backingUserId = normalizeActorUuid(auth.userId)\n    if (backingUserId) return backingUserId\n    throw new CrudHttpError(403, { error: 'Forbidden' })\n  }\n\n  const actorUserId = normalizeActorUuid(subject)\n  const claimedUserId = auth.userId === undefined || auth.userId === null\n    ? actorUserId\n    : normalizeActorUuid(auth.userId)\n  if (actorUserId && claimedUserId === actorUserId) return actorUserId\n  throw new CrudHttpError(403, { error: 'Forbidden' })\n}\n\nfunction resolveDocumentsCommandAclSubject(ctx: CommandRuntimeContext): string {\n  const subject = ctx.auth?.sub?.trim() ?? ''\n  if (!subject) {\n    throw new CrudHttpError(403, { error: 'Forbidden' })\n  }\n  return subject\n}\n\nexport async function resolveDocumentsCommandFeatures(\n  ctx: CommandRuntimeContext,\n  scope: DocumentsCommandScope,\n): Promise<string[]> {\n  // The RBAC subject and the domain actor are deliberately different for an\n  // API key. `auth.sub` identifies the key and therefore its restricted role\n  // grants, while `auth.userId` (when present) is only the backing user used\n  // for ownership/share/audit fields. Loading ACL with the backing user would\n  // silently promote a restricted key to all of that user's permissions.\n  const aclSubject = resolveDocumentsCommandAclSubject(ctx)\n  let rbacService: RbacServiceLike\n  try {\n    rbacService = ctx.container.resolve('rbacService') as RbacServiceLike\n  } catch {\n    return []\n  }\n  // `loadAcl` is intentionally cached for ordinary request guards. Commands\n  // need a post-lock decision: evict both the distributed user entry and the\n  // service's in-memory superadmin bit before reloading, so the request's\n  // feature/role snapshot and a five-minute ACL cache cannot outlive a grant\n  // revocation that completed while this command waited for its aggregate.\n  if (\n    typeof rbacService.invalidateUserCache !== 'function'\n    || typeof rbacService.loadAcl !== 'function'\n  ) {\n    return []\n  }\n  await rbacService.invalidateUserCache(aclSubject)\n  const acl = await rbacService.loadAcl(aclSubject, scope)\n  if (acl.isSuperAdmin) return ['*']\n  if (!hasResolvedDocumentsOrganizationAccess(acl, scope.organizationId)) {\n    // Organization grants are hierarchical. Re-resolve the selected child\n    // against the freshly loaded parent grants instead of comparing raw ids,\n    // while replacing any stale token superadmin bit with the live ACL value.\n    const organizationScopeService = resolveOrganizationScopeService(ctx.container)\n    if (!organizationScopeService) return []\n    const organizationScope = await organizationScopeService.resolve({\n      auth: {\n        ...(ctx.auth ?? {}),\n        sub: aclSubject,\n        tenantId: scope.tenantId,\n        orgId: ctx.auth?.orgId ?? scope.organizationId,\n        isSuperAdmin: false,\n      } as NonNullable<AuthContext>,\n      selectedId: scope.organizationId,\n      tenantId: scope.tenantId,\n      freshAcl: true,\n    })\n    if (!hasResolvedDocumentsOrganizationAccess(acl, scope.organizationId, organizationScope)) {\n      return []\n    }\n  }\n  return Array.from(new Set(Array.isArray(acl.features) ? acl.features : []))\n}\n\nexport async function assertDocumentCommandCanEdit(\n  ctx: CommandRuntimeContext,\n  em: EntityManager,\n  documentId: string,\n  scope: DocumentsCommandScope,\n): Promise<string[]> {\n  return assertDocumentCommandCapability(ctx, em, documentId, scope, 'canEdit')\n}\n\nexport async function assertDocumentCommandCapability(\n  ctx: CommandRuntimeContext,\n  em: EntityManager,\n  documentId: string,\n  scope: DocumentsCommandScope,\n  capability: keyof Pick<\n    DocumentCapabilities,\n    'canView' | 'canComment' | 'canEdit' | 'canShare' | 'canDelete'\n  >,\n): Promise<string[]> {\n  const features = await resolveDocumentsCommandFeatures(ctx, scope)\n  // Role shares must use current assignments as well. The subject-aware\n  // resolver reloads UserRole rows for users and the key's own active roles\n  // for API keys, so neither token claims nor a backing user's broader roles\n  // can survive the aggregate lock.\n  const relationshipTier = await resolveSubjectAccess(\n    em,\n    documentId,\n    scope,\n    {\n      subject: resolveDocumentsCommandAclSubject(ctx),\n      userId: resolveDocumentsCommandActor(ctx),\n    },\n    ctx.container,\n  )\n  // Routes enforce the archived clamp with a specific 403; this command-level\n  // derivation repeats it so redo and any future non-route dispatch cannot\n  // mutate an archived document.\n  const documentRow = await findOneWithDecryption(\n    em,\n    Document,\n    { id: documentId, tenantId: scope.tenantId, organizationId: scope.organizationId },\n    { fields: ['id', 'archivedAt'], filters: false },\n    scope,\n  )\n  const capabilities = deriveDocumentCapabilities({\n    relationshipTier,\n    managerOverride: hasAllFeatures(['documents.manage'], features),\n    archived: documentRow?.archivedAt != null,\n    userFeatures: features,\n  })\n  if (!capabilities[capability]) {\n    throw new CrudHttpError(403, { error: 'Forbidden' })\n  }\n  return features\n}\n\nexport function assertCommandFeature(features: readonly string[], feature: string): void {\n  if (!hasAllFeatures([feature], Array.from(features))) {\n    throw new CrudHttpError(403, { error: 'Forbidden' })\n  }\n}\n"],
+  "mappings": "AAEA,SAAS,qBAAqB;AAC9B,SAAS,sBAAsB;AAE/B,SAAS,SAAS;AAClB;AAAA,EACE;AAAA,OAEK;AACP,SAAS,4BAA4B;AACrC,SAAS,gBAAgB;AACzB,SAAS,6BAA6B;AACtC,SAAS,8CAA8C;AACvD,SAAS,uCAAuC;AAYzC,SAAS,qCAAqC,KAA2C;AAC9F,SAAO,IAAI,mBAAoB,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AACpF;AAgBA,MAAM,kBAAkB,EAAE,OAAO,EAAE,KAAK;AAExC,SAAS,mBAAmB,OAA+B;AACzD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,aAAa,MAAM,KAAK;AAC9B,SAAO,gBAAgB,UAAU,UAAU,EAAE,UAAU,aAAa;AACtE;AAEA,SAAS,aAAa,MAA2D;AAC/E,SAAO,KAAK,aAAa,QAAQ,KAAK,IAAI,KAAK,EAAE,WAAW,UAAU;AACxE;AAEO,SAAS,6BACd,KACA,OACuB;AACvB,QAAM,WAAW,IAAI,MAAM,YAAY;AACvC,QAAM,iBAAiB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AACxE,MAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,YAAY,CAAC;AAAA,EACrD;AACA,MAAI,MAAM,aAAa,YAAY,MAAM,mBAAmB,gBAAgB;AAC1E,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,YAAY,CAAC;AAAA,EACrD;AACA,SAAO,EAAE,UAAU,eAAe;AACpC;AAEO,SAAS,6BAA6B,KAAoC;AAC/E,QAAM,OAAO,IAAI;AACjB,MAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,YAAY,CAAC;AAE9D,QAAM,UAAU,KAAK,IAAI,KAAK;AAC9B,MAAI,aAAa,IAAI,GAAG;AACtB,UAAM,QAAQ,mBAAmB,KAAK,KAAK;AAC3C,QAAI,CAAC,SAAS,YAAY,WAAW,KAAK,IAAI;AAC5C,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,YAAY,CAAC;AAAA,IACrD;AACA,QAAI,KAAK,WAAW,UAAa,KAAK,WAAW,KAAM,QAAO;AAC9D,UAAM,gBAAgB,mBAAmB,KAAK,MAAM;AACpD,QAAI,cAAe,QAAO;AAC1B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,YAAY,CAAC;AAAA,EACrD;AAEA,QAAM,cAAc,mBAAmB,OAAO;AAC9C,QAAM,gBAAgB,KAAK,WAAW,UAAa,KAAK,WAAW,OAC/D,cACA,mBAAmB,KAAK,MAAM;AAClC,MAAI,eAAe,kBAAkB,YAAa,QAAO;AACzD,QAAM,IAAI,cAAc,KAAK,EAAE,OAAO,YAAY,CAAC;AACrD;AAEA,SAAS,kCAAkC,KAAoC;AAC7E,QAAM,UAAU,IAAI,MAAM,KAAK,KAAK,KAAK;AACzC,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,YAAY,CAAC;AAAA,EACrD;AACA,SAAO;AACT;AAEA,eAAsB,gCACpB,KACA,OACmB;AAMnB,QAAM,aAAa,kCAAkC,GAAG;AACxD,MAAI;AACJ,MAAI;AACF,kBAAc,IAAI,UAAU,QAAQ,aAAa;AAAA,EACnD,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AAMA,MACE,OAAO,YAAY,wBAAwB,cACxC,OAAO,YAAY,YAAY,YAClC;AACA,WAAO,CAAC;AAAA,EACV;AACA,QAAM,YAAY,oBAAoB,UAAU;AAChD,QAAM,MAAM,MAAM,YAAY,QAAQ,YAAY,KAAK;AACvD,MAAI,IAAI,aAAc,QAAO,CAAC,GAAG;AACjC,MAAI,CAAC,uCAAuC,KAAK,MAAM,cAAc,GAAG;AAItE,UAAM,2BAA2B,gCAAgC,IAAI,SAAS;AAC9E,QAAI,CAAC,yBAA0B,QAAO,CAAC;AACvC,UAAM,oBAAoB,MAAM,yBAAyB,QAAQ;AAAA,MAC/D,MAAM;AAAA,QACJ,GAAI,IAAI,QAAQ,CAAC;AAAA,QACjB,KAAK;AAAA,QACL,UAAU,MAAM;AAAA,QAChB,OAAO,IAAI,MAAM,SAAS,MAAM;AAAA,QAChC,cAAc;AAAA,MAChB;AAAA,MACA,YAAY,MAAM;AAAA,MAClB,UAAU,MAAM;AAAA,MAChB,UAAU;AAAA,IACZ,CAAC;AACD,QAAI,CAAC,uCAAuC,KAAK,MAAM,gBAAgB,iBAAiB,GAAG;AACzF,aAAO,CAAC;AAAA,IACV;AAAA,EACF;AACA,SAAO,MAAM,KAAK,IAAI,IAAI,MAAM,QAAQ,IAAI,QAAQ,IAAI,IAAI,WAAW,CAAC,CAAC,CAAC;AAC5E;AAEA,eAAsB,6BACpB,KACA,IACA,YACA,OACmB;AACnB,SAAO,gCAAgC,KAAK,IAAI,YAAY,OAAO,SAAS;AAC9E;AAEA,eAAsB,gCACpB,KACA,IACA,YACA,OACA,YAImB;AACnB,QAAM,WAAW,MAAM,gCAAgC,KAAK,KAAK;AAKjE,QAAM,mBAAmB,MAAM;AAAA,IAC7B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,MACE,SAAS,kCAAkC,GAAG;AAAA,MAC9C,QAAQ,6BAA6B,GAAG;AAAA,IAC1C;AAAA,IACA,IAAI;AAAA,EACN;AAIA,QAAM,cAAc,MAAM;AAAA,IACxB;AAAA,IACA;AAAA,IACA,EAAE,IAAI,YAAY,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,IACjF,EAAE,QAAQ,CAAC,MAAM,YAAY,GAAG,SAAS,MAAM;AAAA,IAC/C;AAAA,EACF;AACA,QAAM,eAAe,2BAA2B;AAAA,IAC9C;AAAA,IACA,iBAAiB,eAAe,CAAC,kBAAkB,GAAG,QAAQ;AAAA,IAC9D,UAAU,aAAa,cAAc;AAAA,IACrC,cAAc;AAAA,EAChB,CAAC;AACD,MAAI,CAAC,aAAa,UAAU,GAAG;AAC7B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,YAAY,CAAC;AAAA,EACrD;AACA,SAAO;AACT;AAEO,SAAS,qBAAqB,UAA6B,SAAuB;AACvF,MAAI,CAAC,eAAe,CAAC,OAAO,GAAG,MAAM,KAAK,QAAQ,CAAC,GAAG;AACpD,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,YAAY,CAAC;AAAA,EACrD;AACF;",
+  "names": []
+}