@open-mercato/shared 0.6.8-develop.7048.1.b011912b63 → 0.6.8-develop.7049.1.b41427429a

package/dist/lib/auth/organizationAccess.js

@@ -1,10 +1,13 @@
+function isUnrestrictedOrganizationScope(input) {
+  return input.isSuperAdmin || input.allowedOrganizationIds === null;
+}
 function isOrganizationAccessAllowed(input) {
-  if (input.isSuperAdmin) return true;
-  if (input.allowedOrganizationIds === null) return true;
+  if (isUnrestrictedOrganizationScope(input)) return true;
   if (!input.targetOrganizationId) return false;
-  return input.allowedOrganizationIds.includes(input.targetOrganizationId);
+  return (input.allowedOrganizationIds ?? []).includes(input.targetOrganizationId);
 }
 export {
-  isOrganizationAccessAllowed
+  isOrganizationAccessAllowed,
+  isUnrestrictedOrganizationScope
 };
 //# sourceMappingURL=organizationAccess.js.map

package/dist/lib/auth/organizationAccess.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/lib/auth/organizationAccess.ts"],
-  "sourcesContent": ["export type OrganizationAccessDecisionInput = {\n  isSuperAdmin: boolean\n  allowedOrganizationIds: readonly string[] | null\n  targetOrganizationId: string | null\n}\n\n/**\n * Fail-closed organization-access predicate. The single source of truth for\n * \"may this principal act on `targetOrganizationId`\".\n *\n * Decision table:\n * - `isSuperAdmin === true`            -> allow (global access)\n * - `allowedOrganizationIds === null`  -> allow (truly unrestricted)\n * - restricted + no target org         -> deny (empty/unknown scope is not a bypass)\n * - restricted + target org            -> allow iff the target is a member of the allowed set\n */\nexport function isOrganizationAccessAllowed(input: OrganizationAccessDecisionInput): boolean {\n  if (input.isSuperAdmin) return true\n  if (input.allowedOrganizationIds === null) return true\n  if (!input.targetOrganizationId) return false\n  return input.allowedOrganizationIds.includes(input.targetOrganizationId)\n}\n"],
-  "mappings": "AAgBO,SAAS,4BAA4B,OAAiD;AAC3F,MAAI,MAAM,aAAc,QAAO;AAC/B,MAAI,MAAM,2BAA2B,KAAM,QAAO;AAClD,MAAI,CAAC,MAAM,qBAAsB,QAAO;AACxC,SAAO,MAAM,uBAAuB,SAAS,MAAM,oBAAoB;AACzE;",
+  "sourcesContent": ["export type OrganizationAccessDecisionInput = {\n  isSuperAdmin: boolean\n  allowedOrganizationIds: readonly string[] | null\n  targetOrganizationId: string | null\n}\n\nexport type UnrestrictedOrganizationScopeInput = {\n  isSuperAdmin: boolean\n  allowedOrganizationIds: readonly string[] | null | undefined\n}\n\nexport function isUnrestrictedOrganizationScope(input: UnrestrictedOrganizationScopeInput): boolean {\n  return input.isSuperAdmin || input.allowedOrganizationIds === null\n}\n\n/**\n * Fail-closed organization-access predicate. The single source of truth for\n * \"may this principal act on `targetOrganizationId`\".\n *\n * Decision table:\n * - `isSuperAdmin === true`            -> allow (global access)\n * - `allowedOrganizationIds === null`  -> allow (truly unrestricted)\n * - restricted + no target org         -> deny (empty/unknown scope is not a bypass)\n * - restricted + target org            -> allow iff the target is a member of the allowed set\n */\nexport function isOrganizationAccessAllowed(input: OrganizationAccessDecisionInput): boolean {\n  if (isUnrestrictedOrganizationScope(input)) return true\n  if (!input.targetOrganizationId) return false\n  return (input.allowedOrganizationIds ?? []).includes(input.targetOrganizationId)\n}\n"],
+  "mappings": "AAWO,SAAS,gCAAgC,OAAoD;AAClG,SAAO,MAAM,gBAAgB,MAAM,2BAA2B;AAChE;AAYO,SAAS,4BAA4B,OAAiD;AAC3F,MAAI,gCAAgC,KAAK,EAAG,QAAO;AACnD,MAAI,CAAC,MAAM,qBAAsB,QAAO;AACxC,UAAQ,MAAM,0BAA0B,CAAC,GAAG,SAAS,MAAM,oBAAoB;AACjF;",
   "names": []
 }

package/dist/lib/version.js

@@ -1,4 +1,4 @@
-const APP_VERSION = "0.6.8-develop.7048.1.b011912b63";
+const APP_VERSION = "0.6.8-develop.7049.1.b41427429a";
 const appVersion = APP_VERSION;
 export {
   APP_VERSION,

package/dist/lib/version.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/lib/version.ts"],
-  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.6.8-develop.7048.1.b011912b63';\nexport const appVersion = APP_VERSION;\n"],
+  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.6.8-develop.7049.1.b41427429a';\nexport const appVersion = APP_VERSION;\n"],
   "mappings": "AACO,MAAM,cAAc;AACpB,MAAM,aAAa;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/shared",
-  "version": "0.6.8-develop.7048.1.b011912b63",
+  "version": "0.6.8-develop.7049.1.b41427429a",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -109,7 +109,7 @@
     "@mikro-orm/core": "^7.1.8",
     "@mikro-orm/decorators": "^7.1.8",
     "@mikro-orm/postgresql": "^7.1.8",
-    "@open-mercato/cache": "0.6.8-develop.7048.1.b011912b63",
+    "@open-mercato/cache": "0.6.8-develop.7049.1.b41427429a",
     "@types/html-to-text": "^9.0.4",
     "@types/sanitize-html": "^2.16.1",
     "dotenv": "^17.4.2",

package/src/lib/auth/__tests__/organizationAccess.test.ts

@@ -1,4 +1,39 @@
-import { isOrganizationAccessAllowed } from '@open-mercato/shared/lib/auth/organizationAccess'
+import {
+  isOrganizationAccessAllowed,
+  isUnrestrictedOrganizationScope,
+} from '@open-mercato/shared/lib/auth/organizationAccess'
+
+describe('isUnrestrictedOrganizationScope', () => {
+  it('allows super admins regardless of allowed organizations', () => {
+    expect(
+      isUnrestrictedOrganizationScope({
+        isSuperAdmin: true,
+        allowedOrganizationIds: [],
+      }),
+    ).toBe(true)
+  })
+
+  it('allows truly unrestricted non-superadmin scopes', () => {
+    expect(
+      isUnrestrictedOrganizationScope({
+        isSuperAdmin: false,
+        allowedOrganizationIds: null,
+      }),
+    ).toBe(true)
+  })
+
+  it.each([undefined, [] as string[], ['org-a']])(
+    'denies restricted non-superadmin scopes with allowedOrganizationIds=%p',
+    (allowedOrganizationIds) => {
+      expect(
+        isUnrestrictedOrganizationScope({
+          isSuperAdmin: false,
+          allowedOrganizationIds,
+        }),
+      ).toBe(false)
+    },
+  )
+})
 
 describe('isOrganizationAccessAllowed', () => {
   it('allows super admins regardless of scope', () => {

package/src/lib/auth/organizationAccess.ts

@@ -4,6 +4,15 @@ export type OrganizationAccessDecisionInput = {
   targetOrganizationId: string | null
 }
 
+export type UnrestrictedOrganizationScopeInput = {
+  isSuperAdmin: boolean
+  allowedOrganizationIds: readonly string[] | null | undefined
+}
+
+export function isUnrestrictedOrganizationScope(input: UnrestrictedOrganizationScopeInput): boolean {
+  return input.isSuperAdmin || input.allowedOrganizationIds === null
+}
+
 /**
  * Fail-closed organization-access predicate. The single source of truth for
  * "may this principal act on `targetOrganizationId`".
@@ -15,8 +24,7 @@ export type OrganizationAccessDecisionInput = {
  * - restricted + target org            -> allow iff the target is a member of the allowed set
  */
 export function isOrganizationAccessAllowed(input: OrganizationAccessDecisionInput): boolean {
-  if (input.isSuperAdmin) return true
-  if (input.allowedOrganizationIds === null) return true
+  if (isUnrestrictedOrganizationScope(input)) return true
   if (!input.targetOrganizationId) return false
-  return input.allowedOrganizationIds.includes(input.targetOrganizationId)
+  return (input.allowedOrganizationIds ?? []).includes(input.targetOrganizationId)
 }