@openlup/platform 0.15.0 → 0.17.0

package/src/identity/privacyUseCases.ts

@@ -0,0 +1,48 @@
+import { privacyExportResponseSchema, erasureReceiptSchema, privacySubjectSchema, privacyEraseRequestSchema } from "./contracts/privacy.js";
+import { PrivacyRefusal, type PrivacyUseCaseDependencies, type AuthorizedHumanAdministrator, type PrivacyOperations } from "./privacyPorts.js";
+import type { PrivacySubjectRef, PrivacyEraseRequest, PrivacyExport, ErasureReceipt } from "./contracts/privacy.js";
+
+export async function exportPersonalData<C>(deps: PrivacyUseCaseDependencies<C>, actor: AuthorizedHumanAdministrator, input: PrivacySubjectRef): Promise<PrivacyExport> {
+  const subject = privacySubjectSchema.parse(input);
+  return deps.unitOfWork.run(async context => {
+    const resolved = await deps.store.resolve(context, subject);
+    if (!resolved) throw new PrivacyRefusal("PRIVACY_SUBJECT_NOT_FOUND");
+    const documents = [];
+    for (const contributor of deps.registry.contributors) {
+      const document = await contributor.export(context, resolved);
+      if (document.contributorId !== contributor.id || document.version !== contributor.version) throw new PrivacyRefusal("PRIVACY_OWNERSHIP_UNDECLARED");
+      documents.push(document);
+    }
+    return privacyExportResponseSchema.parse({ format: "personal-data.v1", generatedAt: deps.now().toISOString(), subject, documents, missingContributors: [...deps.registry.missingContributors], erasure: await deps.store.findReceipt(context, subject) });
+  });
+}
+export async function erasePersonalData<C>(deps: PrivacyUseCaseDependencies<C>, actor: AuthorizedHumanAdministrator, request: PrivacyEraseRequest): Promise<ErasureReceipt> {
+  const input = privacyEraseRequestSchema.parse(request);
+  // Capability refusal precedes even opening a managed transaction or provider request.
+  if (!deps.store.erasureSupported) throw new PrivacyRefusal("MANAGED_PRIVACY_ERASURE_UNAVAILABLE");
+  if (deps.registry.missingContributors.length || !deps.registry.contributors.some(c => c.id === "identity")) throw new PrivacyRefusal("PRIVACY_CONTRIBUTOR_MISSING");
+  return deps.unitOfWork.run(async context => {
+    await deps.store.prepareErasure(context);
+    // Domain relation locks precede subject/member row locks and remain held to commit.
+    for (const contributor of deps.registry.contributors) await contributor.prepareErasure(context);
+    const resolved = await deps.store.resolve(context, input.subject, actor);
+    await deps.store.authorizeErasure(context, actor);
+    const previous = await deps.store.findReceipt(context, input.subject, input.idempotencyKey);
+    if (previous) return erasureReceiptSchema.parse({ ...previous, outcome: "ALREADY_ERASED" });
+    if (!resolved) throw new PrivacyRefusal("PRIVACY_SUBJECT_NOT_FOUND");
+    const assessments = [];
+    for (const contributor of deps.registry.contributors) {
+      const assessment = await contributor.assessErasure(context, resolved);
+      if (assessment.obligations.some(o => o.disposition === "unresolved")) throw new PrivacyRefusal("PRIVACY_OWNERSHIP_UNDECLARED");
+      assessments.push(assessment);
+    }
+    const dispositions = [];
+    for (let i = 0; i < deps.registry.contributors.length; i++) dispositions.push(await deps.registry.contributors[i]!.eraseOrRetain(context, resolved, assessments[i]!, actor));
+    const receipt = erasureReceiptSchema.parse({ version: "identity.erasure.v1", erasureId: deps.randomId(), completedAt: deps.now().toISOString(), outcome: "ERASED", obligations: dispositions.flatMap(d => d.obligations) });
+    await deps.store.saveReceipt(context, resolved, actor, input.idempotencyKey, receipt, dispositions);
+    return receipt;
+  });
+}
+export function createPrivacyOperations<C>(deps: PrivacyUseCaseDependencies<C>): PrivacyOperations {
+  return { export: (actor, subject) => exportPersonalData(deps, actor, subject), erase: (actor, input) => erasePersonalData(deps, actor, input) };
+}

package/src/identity/reconcileAccountForPrincipal.ts

@@ -0,0 +1,99 @@
+import { assessEmailTrust, type EmailTrustPolicy } from "./emailTrustPolicy.js";
+import type { EmailTrustFailureCode } from "./contracts/emailTrust.js";
+import type { AccountLinkStore } from "./ports.js";
+
+
+
+export interface ReconcileAccountInput {
+  principalId: string;
+  email: string | null;
+  emailVerified: boolean;
+}
+
+export type ReconcileAccountErrorCode =
+  | EmailTrustFailureCode
+  | "NO_VERIFIED_EMAIL"
+  | "RESERVED_PRINCIPAL_REFUSED"
+  | "PRINCIPAL_EMAIL_MISMATCH"
+  | "ACCOUNT_LINK_CONFLICT"
+  | "EMAIL_OWNED_BY_OTHER_PRINCIPAL";
+
+export type ReconcileAccountResult =
+  | { ok: true; accountId: string; created: boolean; linked: boolean }
+  | { ok: false; code: ReconcileAccountErrorCode; existingPrincipalId?: string | null };
+
+export async function reconcileAccountForPrincipal(
+  store: AccountLinkStore,
+  input: ReconcileAccountInput,
+  emailTrustPolicy: EmailTrustPolicy,
+): Promise<ReconcileAccountResult> {
+  const email = normalizeEmail(input.email);
+  if (!email || !input.emailVerified) {
+    return { ok: false, code: "NO_VERIFIED_EMAIL" };
+  }
+  if (await store.isReservedPrincipal(input.principalId)) {
+    return { ok: false, code: "RESERVED_PRINCIPAL_REFUSED" };
+  }
+
+  const byPrincipal = await store.findAccountByPrincipalId(input.principalId);
+  if (byPrincipal) {
+    const accountEmail = normalizeEmail(byPrincipal.email);
+    if (accountEmail && accountEmail !== email) {
+      return { ok: false, code: "PRINCIPAL_EMAIL_MISMATCH", existingPrincipalId: input.principalId };
+    }
+    return { ok: true, accountId: byPrincipal.id, created: false, linked: false };
+  }
+
+  const trust = await assessEmailTrust(emailTrustPolicy);
+  if (!trust.trusted) return { ok: false, code: trust.code };
+
+  const viaEmail = await resolveByEmail(store, email, input.principalId);
+  if (viaEmail) return viaEmail;
+  try {
+    const created = await store.createAccount({
+      email,
+      principalId: input.principalId,
+      acquisitionSource: "social_signup",
+      lifecycleStage: "lead",
+    });
+    return { ok: true, accountId: created.id, created: true, linked: true };
+  } catch (err) {
+    const retry = await resolveByEmail(store, email, input.principalId);
+    if (retry) return retry;
+    throw err;
+  }
+}
+
+function normalizeEmail(email: string | null | undefined): string {
+  return (email ?? "").trim().toLowerCase();
+}
+
+async function resolveByEmail(
+  store: AccountLinkStore,
+  email: string,
+  principalId: string,
+): Promise<ReconcileAccountResult | null> {
+  const account = await store.findAccountByEmail(email);
+  if (!account) return null;
+
+  if (account.principalId === principalId) {
+    return { ok: true, accountId: account.id, created: false, linked: false };
+  }
+  if (account.principalId !== null) {
+    return {
+      ok: false,
+      code: "EMAIL_OWNED_BY_OTHER_PRINCIPAL",
+      existingPrincipalId: account.principalId,
+    };
+  }
+
+  const link = await store.linkPrincipalToAccount(account.id, principalId);
+  if (link.ok === true) {
+    return { ok: true, accountId: account.id, created: false, linked: true };
+  }
+  return {
+    ok: false,
+    code: "ACCOUNT_LINK_CONFLICT",
+    existingPrincipalId: link.existingPrincipalId,
+  };
+}

package/src/identity/reconcileAccountHandler.ts

@@ -0,0 +1,36 @@
+import type { EmailTrustPolicy } from "./emailTrustPolicy.js";
+import { createIdentityResponder, type IdentityResponseOptions } from "./response.js";
+import type { HttpRequest, HttpResponse } from "../http/index.js";
+import type { AccountLinkStore, IdentityVerifierPort } from "./ports.js";
+import { reconcileAccountForPrincipal, type ReconcileAccountErrorCode } from "./reconcileAccountForPrincipal.js";
+import { readBearerToken } from "./adminAuthorization.js";
+
+export function createReconcileAccountHandler(options: IdentityResponseOptions & {
+  verifier: IdentityVerifierPort;
+  store: AccountLinkStore;
+  emailTrustPolicy: EmailTrustPolicy;
+  message?: (code: ReconcileAccountErrorCode) => string;
+}) {
+  const { sendBffError, sendBffSuccess, sendMethodNotAllowed } = createIdentityResponder(options);
+  return async (req: HttpRequest, res: HttpResponse): Promise<void> => {
+    if (req.method !== "POST") return sendMethodNotAllowed(res, ["POST"]);
+    const token = readBearerToken(req);
+    if (!token) return sendBffError(res, "UNAUTHORIZED", "Customer session required");
+    try {
+      const principal = await options.verifier.verifyAccessToken(token);
+      if (!principal) return sendBffError(res, "UNAUTHORIZED", "Customer session required");
+      const result = await reconcileAccountForPrincipal(options.store, principal, options.emailTrustPolicy);
+      if (!result.ok) {
+        const code = result.code === "NO_VERIFIED_EMAIL" ? "BAD_REQUEST"
+          : result.code === "EMAIL_TRUST_SETTINGS_UNAVAILABLE" ? "UPSTREAM_UNAVAILABLE"
+          : result.code === "RESERVED_PRINCIPAL_REFUSED" || result.code === "EMAIL_TRUST_ENVELOPE_REFUSED" ? "FORBIDDEN" : "CONFLICT";
+        sendBffError(res, code,
+          options.message?.(result.code) ?? result.code, { details: { code: result.code } });
+        return;
+      }
+      sendBffSuccess(res, { accountId: result.accountId, created: result.created, linked: result.linked });
+    } catch {
+      sendBffError(res, "UPSTREAM_UNAVAILABLE", "Account reconciliation failed");
+    }
+  };
+}

package/src/identity/removeAdminUserUseCase.ts

@@ -0,0 +1,85 @@
+import type { OperatorInvitationStore } from "./operatorInvitationPorts.js";
+import { identityMessages, type IdentityMessages } from "./messages.js";
+export type RemoveAdminUserResponse = {
+  revoked?: true;
+  error?: string;
+  code?: string;
+};
+
+export interface RemoveAdminUserGateway {
+  getUser: (accessToken: string) => Promise<{
+    user: { id: string } | null;
+    error: unknown;
+  }>;
+  findAdminUser: (userId: string) => Promise<{ id: string; role: string } | null>;
+  revokeAdminUser: (userId: string) => Promise<{ error: { message: string } | null }>;
+}
+
+export async function runRemoveAdminUserUseCase(
+  request: { accessToken: string | null; userId: string },
+  gateway: RemoveAdminUserGateway,
+  messages: IdentityMessages = identityMessages.en,
+  invitationStore?: Pick<OperatorInvitationStore, "remove">,
+): Promise<{ status: number; body: RemoveAdminUserResponse }> {
+  try {
+    if (!request.accessToken) {
+      return { status: 401, body: { code: "UNAUTHORIZED", error: messages.unauthorized } };
+    }
+
+    const { user, error: authError } = await gateway.getUser(request.accessToken);
+    if (authError || !user) {
+      return { status: 401, body: { code: "INVALID_TOKEN", error: messages.invalidToken } };
+    }
+
+    const callerAdmin = await gateway.findAdminUser(user.id);
+    if (!callerAdmin || callerAdmin.role !== "admin") {
+      return { status: 403, body: { code: "REMOVE_FORBIDDEN", error: messages.removeForbidden } };
+    }
+
+    if (!request.userId) {
+      return { status: 400, body: { code: "USER_ID_REQUIRED", error: messages.userIdRequired } };
+    }
+
+    if (request.userId === user.id) {
+      return { status: 403, body: { code: "SELF_REVOKE_FORBIDDEN", error: messages.selfRemoveForbidden } };
+    }
+
+    if (invitationStore) {
+      try {
+        await invitationStore.remove({ actorPrincipalId: user.id, targetPrincipalId: request.userId });
+        return { status: 200, body: { revoked: true } };
+      } catch (error) {
+        const failure = error as { identityCode?: string; bffCode?: string; message?: string };
+        if (failure.identityCode) return { status: failure.bffCode === "FORBIDDEN" ? 403 : failure.bffCode === "BAD_REQUEST" ? 400 : 409, body: { code: failure.identityCode, error: failure.identityCode } };
+        return mapRevokeError(failure.message ?? "revoke_failed", messages);
+      }
+    }
+    const { error: revokeError } = await gateway.revokeAdminUser(request.userId);
+    if (revokeError) {
+      return mapRevokeError(revokeError.message, messages);
+    }
+
+    return { status: 200, body: { revoked: true } };
+  } catch (err) {
+    return { status: 500, body: { code: "IDENTITY_ACTION_FAILED", error: String(err) } };
+  }
+}
+
+function mapRevokeError(message: string, messages: IdentityMessages): { status: number; body: RemoveAdminUserResponse } {
+  if (message.includes("last_active_human_admin") || message.includes("last_admin_lockout")) {
+    return { status: 409, body: { code: "LAST_ACTIVE_HUMAN_ADMIN", error: messages.lastAdmin } };
+  }
+  if (message.includes("self_revoke_forbidden")) {
+    return { status: 403, body: { code: "SELF_REVOKE_FORBIDDEN", error: messages.selfRevoke } };
+  }
+  if (message.includes("machine_actor_revoke_forbidden")) {
+    return { status: 403, body: { code: "MACHINE_ACTOR_REVOKE_FORBIDDEN", error: messages.machineRevoke } };
+  }
+  if (message.includes("target_not_found") || message.includes("target_not_active")) {
+    return { status: 400, body: { code: "ADMIN_NOT_FOUND", error: messages.adminNotFound } };
+  }
+  if (message.includes("forbidden")) {
+    return { status: 403, body: { code: "ADMIN_REQUIRED", error: messages.adminRequired } };
+  }
+  return { status: 500, body: { code: "REVOKE_FAILED", error: messages.revokeFailed(message) } };
+}

package/src/identity/response.ts

@@ -0,0 +1,3 @@
+import { createBffResponder, type BffResponderOptions } from "../bff/index.js";
+export type IdentityResponseOptions = BffResponderOptions;
+export const createIdentityResponder = createBffResponder;

package/src/identity/sql.ts

@@ -0,0 +1,10 @@
+/** A projection of canonical migration units, never a second migration chain. */
+export const IDENTITY_MIGRATIONS = [
+  { id: "20260810180001_self_host_actor_auth", catalogPath: "db/platform/migrations/20260810180001_self_host_actor_auth.sql", position: 11, sha256: "84c80d328785151f1fdb5fc4b69220469ffb9c8579054c473ead910a273dfe7b", url: new URL("../../sql/20260810180001_self_host_actor_auth.sql", import.meta.url) },
+  { id: "20260810204057_customer_identity_read", catalogPath: "db/platform/migrations/20260810204057_customer_identity_read.sql", position: 12, sha256: "1aa626c0187a4ed9d08f152540e0d17c68cd678d2caf3e896ac444b5a38aafe3", url: new URL("../../sql/20260810204057_customer_identity_read.sql", import.meta.url) },
+  { id: "20260814090000_customer_selfservice_recovery", catalogPath: "db/platform/migrations/20260814090000_customer_selfservice_recovery.sql", position: 29, sha256: "ca7f58994533727eb58da148d549ff986fe8f55bb2ffc9eaf61e7d239675ba2e", url: new URL("../../sql/20260814090000_customer_selfservice_recovery.sql", import.meta.url) },
+  { id: "20260901143000_admin_membership_authority_foundation", catalogPath: "db/platform/migrations/20260901143000_admin_membership_authority_foundation.sql", position: 60, sha256: "bb4703b669d17e5a0eb4d9a4e8889d12e5286d4b5a813226a77ef2b71df8281f", url: new URL("../../sql/20260901143000_admin_membership_authority_foundation.sql", import.meta.url) },
+  { id: "20261018120000_identity_operator_invitations", catalogPath: "db/platform/migrations/20261018120000_identity_operator_invitations.sql", position: 67, sha256: "b73034908bd5e27819bcd421d17037a0f00a24aa3df1be1f8f9ca411bf984349", url: new URL("../../sql/20261018120000_identity_operator_invitations.sql", import.meta.url) },
+  { id: "20261018180000_identity_operator_challenges", catalogPath: "db/platform/migrations/20261018180000_identity_operator_challenges.sql", position: 68, sha256: "191cf0c151a5882ad20d6043624da50afad799df739fff326d67560d3e00a031", url: new URL("../../sql/20261018180000_identity_operator_challenges.sql", import.meta.url) },
+  { id: "20261018190000_identity_privacy_erasures", catalogPath: "db/platform/migrations/20261018190000_identity_privacy_erasures.sql", position: 69, sha256: "f39b691cb14c0e9ec1a7460d77dc46e16bca4d2448838e4882f78885a6d92351", url: new URL("../../sql/20261018190000_identity_privacy_erasures.sql", import.meta.url) },
+] as const;