@owlmeans/server-auth-identity 0.1.18-rc.49 → 0.1.18-rc.50

package/README.md

@@ -10,7 +10,7 @@ whose grants decide access (use `@owlmeans/server-oidc-rp`'s guard and gate, or
 ## Installation
 
 ```bash
-bun add @owlmeans/server-auth-identity@^0.1.18-rc.49
+bun add @owlmeans/server-auth-identity@^0.1.18-rc.50
 ```
 
 ## Concepts
@@ -309,7 +309,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.52
+npx @owlmeans/agent-skills@^0.1.18-rc.54
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/server-auth-identity",
-  "version": "0.1.18-rc.49",
-  "generatedAt": "2026-10-08T21:27:54.283Z",
+  "version": "0.1.18-rc.50",
+  "generatedAt": "2026-10-15T10:20:01.287Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/server-auth-identity/SKILL.md

@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/server-auth-identity
 
 **Layer:** Server
-**Install:** `"@owlmeans/server-auth-identity": "^0.1.18-rc.49"` in `dependencies`
+**Install:** `"@owlmeans/server-auth-identity": "^0.1.18-rc.50"` in `dependencies`
 
 The identity store a deployment owns when it does not delegate identity to an external IAM. It
 answers *who is this person* (account + credentials), *what are they in this app and organization*
@@ -25,7 +25,7 @@ serves the deployment's own app and every app it hosts (a platform's generated t
 | `identityOf(ctx).ensureAccount({ email, name? }, details?)` | The person's account: by the method's credential, then by e-mail, else registered with a personal organization; attaches `details` as a credential |
 | `identityOf(ctx).ensureProfile({ account, service, entityId, owner?, role?, scopes?, permissions?, groups?, managed? })` | Find-or-create the row of (account, app, organization); ensures the primary row first |
 | `identityKeyHelper.credentialKeyOf(details)`, `identityOf(ctx).credentialOf(details)`, `identityKeyHelper.normalizeEmail(email)` | A method's unique credential key; its stored row and account; the stored address form |
-| `orgGroupsOf(ctx)` — `.listOrgGroups(entityId, service)`, `.putOrgGroup(entityId, group)`, `.removeOrgGroup(entityId, service, key)` | An organization's groups of one app — guarded field-level writes, unique per (`service`, `key`) |
+| `orgGroupsOf(ctx)` — `.listOrgGroups(entityId, service)`, `.putOrgGroup(entityId, group)`, `.updateOrgGroup(entityId, service, key, fields)`, `.removeOrgGroup(entityId, service, key)` | An organization's groups of one app — guarded field-level writes, unique per (`service`, `key`); `OrgGroupFields` = `{ title?, managed?, permissions?, bundles? }` |
 | `makeOrgEntityResource`, `makeIdentityAccountResource`, `makeIdentityProfileResource`, `makeIdentityCredentialsResource` | Mongo resource makers (`dbAlias?`) |
 | `makeIdentityLinkingService({ service? })` | The `IdentityLinkingService` for one app |
 | `makeEntityResolverService(alias?)` | The `EntityResolverService`, cached 30 s per resolved value (slim references only) |
@@ -80,6 +80,14 @@ it read (`formerSlugs` moves only with it), `mintName` on the name still being u
 wins, both answer what was stored), `orgGroupsOf(ctx).putOrgGroup` replaces the matching element (`groups.$`) or
 pushes where none matches (`$not: { $elemMatch }`) and retries if a concurrent put won.
 
+**Inside a group the same rule holds: create with `putOrgGroup`, change with `updateOrgGroup`.**
+`updateOrgGroup(entityId, service, key, fields)` `$set`s `groups.$.<field>` (and `updatedAt`) for
+only the fields passed — `title`, `managed`, `permissions`, `bundles`; `service` / `key` are never
+rewritten — on the element `$elemMatch` selects, and answers `true` when that group existed. It never
+creates one. Two writers owning different fields of one group (a platform sync keeping `managed` +
+`bundles`, an operator granting into `permissions`) keep each other's work; a `putOrgGroup` from
+either one's stale read would undo the other's.
+
 ## Usage
 
 ### Register in a context
@@ -204,7 +212,8 @@ across organizations, not inside one.
 
 - **`Resource.take()` deletes** the record it returns — identity reads in gates use `load` / `list`.
 - **Never `update()` an org-entity** (a whole-record replace); use the resolver, the group helpers or
-  a guarded `collection.updateOne`.
+  a guarded `collection.updateOne`. Never `putOrgGroup` an existing group to change one field of it —
+  `updateOrgGroup` that field.
 - **`IdentityLinkingService` is compatible with `AccountLinkingService`** of
   `@owlmeans/server-oidc-rp` but declared independently (acyclic dependencies).
 - **The address is the identity.** Whoever calls `identityOf(ctx).ensureAccount` / `linkProfile` with an address is

package/build/consts.local.d.ts

@@ -7,4 +7,9 @@
  * resolving through `formerSlugs` rather than failing.
  */
 export declare const CACHE_TTL = 30000;
+/**
+ * The fields of an organization group a field-level update may write. `service` and `key` are the
+ * group's identity and are never rewritten in place.
+ */
+export declare const ORG_GROUP_FIELDS: readonly ['title', 'managed', 'permissions', 'bundles'];
 //# sourceMappingURL=consts.local.d.ts.map

package/build/consts.local.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consts.local.d.ts","sourceRoot":"","sources":["../src/consts.local.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,QAAS,CAAA"}
+{"version":3,"file":"consts.local.d.ts","sourceRoot":"","sources":["../src/consts.local.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,QAAS,CAAA;AAE/B;;;GAGG;AACH,eAAO,MAAM,gBAAgB,YAAI,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,CAAU,CAAA"}

package/build/consts.local.js

@@ -7,4 +7,9 @@
  * resolving through `formerSlugs` rather than failing.
  */
 export const CACHE_TTL = 30_000;
+/**
+ * The fields of an organization group a field-level update may write. `service` and `key` are the
+ * group's identity and are never rewritten in place.
+ */
+export const ORG_GROUP_FIELDS = ['title', 'managed', 'permissions', 'bundles'];
 //# sourceMappingURL=consts.local.js.map

package/build/consts.local.js.map

@@ -1 +1 @@
-{"version":3,"file":"consts.local.js","sourceRoot":"","sources":["../src/consts.local.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAA"}
+{"version":3,"file":"consts.local.js","sourceRoot":"","sources":["../src/consts.local.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAA;AAE/B;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,CAAU,CAAA"}

package/build/groups/types.d.ts

@@ -1,4 +1,7 @@
 import type { OrgGroup } from '../types.js';
+/** What `updateOrgGroup` may write — each field present is set, each absent one is left alone. */
+export interface OrgGroupFields extends Partial<Pick<OrgGroup, 'title' | 'managed' | 'permissions' | 'bundles'>> {
+}
 /** The groups apps keep in organizations of one context's identity store. */
 export interface OrgGroupHelper {
     /** The groups one app keeps in an organization. */
@@ -14,6 +17,16 @@ export interface OrgGroupHelper {
      * @throws {UnknownRecordError} when the organization does not exist.
      */
     putOrgGroup: (entityId: string, group: OrgGroup) => Promise<OrgGroup>;
+    /**
+     * Set only the given fields (`title`, `managed`, `permissions`, `bundles`) of the EXISTING group
+     * (`service`, `key`) — `true` when it matched; it never creates one.
+     *
+     * Two writers of one group that own different fields — a platform sync keeping `managed` and
+     * `bundles`, an operator granting into `permissions` — must not undo each other, and
+     * `putOrgGroup` replaces the whole element from whatever its caller read. Use `putOrgGroup` only
+     * to create a group; change an existing one through this.
+     */
+    updateOrgGroup: (entityId: string, service: string, key: string, fields: OrgGroupFields) => Promise<boolean>;
     /**
      * Remove the group (`service`, `key`) from an organization — `true` when it was there. The rows that
      * name it in their `groups` are the caller's to update.

package/build/groups/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/groups/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAE3C,6EAA6E;AAC7E,MAAM,WAAW,cAAc;IAC7B,mDAAmD;IACnD,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAA;IACzE;;;;;;;;;OASG;IACH,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IACrE;;;OAGG;IACH,cAAc,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CACrF"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/groups/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAE3C,kGAAkG;AAClG,MAAM,WAAW,cAAe,SAAQ,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,aAAa,GAAG,SAAS,CAAC,CAAC;CAAG;AAEnH,6EAA6E;AAC7E,MAAM,WAAW,cAAc;IAC7B,mDAAmD;IACnD,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAA;IACzE;;;;;;;;;OASG;IACH,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IACrE;;;;;;;;OAQG;IACH,cAAc,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5G;;;OAGG;IACH,cAAc,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CACrF"}

package/build/groups.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"groups.d.ts","sourceRoot":"","sources":["../src/groups.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAqB,QAAQ,EAAE,MAAM,YAAY,CAAA;AAG7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAE/C,eAAO,MAAM,kBAAkB,QAAS,OAAO,KAAG,cA8CjD,CAAA;AAED,8DAA8D;AAC9D,eAAO,MAAM,WAAW,qCAAyC,CAAA;AAEjE,oFAAoF;AACpF,eAAO,MAAM,aAAa,QAAe,OAAO,YAAY,MAAM,WAAW,MAAM,KAAG,OAAO,CAAC,QAAQ,EAAE,CAC/C,CAAA;AAEzD,kFAAkF;AAClF,eAAO,MAAM,WAAW,QAAe,OAAO,YAAY,MAAM,SAAS,QAAQ,KAAG,OAAO,CAAC,QAAQ,CAC/C,CAAA;AAErD,qFAAqF;AACrF,eAAO,MAAM,cAAc,QAAe,OAAO,YAAY,MAAM,WAAW,MAAM,OAAO,MAAM,KAAG,OAAO,CAAC,OAAO,CACpD,CAAA"}
+{"version":3,"file":"groups.d.ts","sourceRoot":"","sources":["../src/groups.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAqB,QAAQ,EAAE,MAAM,YAAY,CAAA;AAG7D,OAAO,KAAK,EAAkB,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACvE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAG/C,eAAO,MAAM,kBAAkB,QAAS,OAAO,KAAG,cA4DjD,CAAA;AAED,8DAA8D;AAC9D,eAAO,MAAM,WAAW,qCAAyC,CAAA;AAEjE,oFAAoF;AACpF,eAAO,MAAM,aAAa,QAAe,OAAO,YAAY,MAAM,WAAW,MAAM,KAAG,OAAO,CAAC,QAAQ,EAAE,CAC/C,CAAA;AAEzD,kFAAkF;AAClF,eAAO,MAAM,WAAW,QAAe,OAAO,YAAY,MAAM,SAAS,QAAQ,KAAG,OAAO,CAAC,QAAQ,CAC/C,CAAA;AAErD,qFAAqF;AACrF,eAAO,MAAM,cAAc,QAAe,OAAO,YAAY,MAAM,WAAW,MAAM,OAAO,MAAM,KAAG,OAAO,CAAC,OAAO,CACpD,CAAA"}

package/build/groups.js

@@ -2,6 +2,7 @@ import { UnknownRecordError } from '@owlmeans/resource';
 import { memoHelper } from '@owlmeans/context';
 import { AUTH_IDENTITY_ORG_ENTITY, MAX_GUARDED_UPDATE_ATTEMPTS } from './consts.js';
 import { nativeUtils } from './utils/native.js';
+import { ORG_GROUP_FIELDS } from './consts.local.js';
 export const makeOrgGroupHelper = (ctx) => {
     const entities = () => ctx.resource(AUTH_IDENTITY_ORG_ENTITY);
     const listOrgGroups = async (entityId, service) => ((await entities().get(entityId)).groups ?? []).filter(group => group.service === service);
@@ -28,13 +29,22 @@ export const makeOrgGroupHelper = (ctx) => {
         }
         throw new SyntaxError(`entity:group-contended:${group.service}:${group.key}`);
     };
+    const updateOrgGroup = async (entityId, service, key, fields) => {
+        const res = entities();
+        // Positional paths of the matched element only: the other fields of the group, and every
+        // other group of the organization, stay exactly as the store has them now.
+        const set = Object.fromEntries(ORG_GROUP_FIELDS.filter(field => fields[field] !== undefined)
+            .map(field => [`groups.$.${field}`, fields[field]]));
+        const result = await res.collection.updateOne({ ...nativeUtils.idFilter(res, entityId), groups: { $elemMatch: { service, key } } }, { $set: { ...set, updatedAt: new Date() } });
+        return result.matchedCount > 0;
+    };
     const removeOrgGroup = async (entityId, service, key) => {
         const res = entities();
         const pull = { $pull: { groups: { service, key } }, $set: { updatedAt: new Date() } };
         const result = await res.collection.updateOne({ ...nativeUtils.idFilter(res, entityId), groups: { $elemMatch: { service, key } } }, pull);
         return result.matchedCount > 0;
     };
-    return { listOrgGroups, putOrgGroup, removeOrgGroup };
+    return { listOrgGroups, putOrgGroup, updateOrgGroup, removeOrgGroup };
 };
 /** The organization groups of a context — one per context. */
 export const orgGroupsOf = memoHelper.oncePer(makeOrgGroupHelper);

package/build/groups.js.map

@@ -1 +1 @@
-{"version":3,"file":"groups.js","sourceRoot":"","sources":["../src/groups.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAG9C,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAA;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAI/C,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAY,EAAkB,EAAE;IACjE,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAoB,wBAAwB,CAAC,CAAA;IAEhF,MAAM,aAAa,GAAG,KAAK,EAAE,QAAgB,EAAE,OAAe,EAAuB,EAAE,CACrF,CAAC,CAAC,MAAM,QAAQ,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,CAAA;IAE5F,MAAM,WAAW,GAAG,KAAK,EAAE,QAAgB,EAAE,KAAe,EAAqB,EAAE;QACjF,IAAI,KAAK,CAAC,OAAO,KAAK,EAAE,IAAI,KAAK,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC;YAC7C,MAAM,IAAI,WAAW,CAAC,0BAA0B,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC,CAAA;QAC/E,CAAC;QACD,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAA;QACtB,MAAM,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QAC9C,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAA;QAEvD,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,2BAA2B,EAAE,EAAE,OAAO,EAAE,CAAC;YACvE,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,SAAS,CAC7C,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EACvC,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE,CACvD,CAAA;YACD,IAAI,QAAQ,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;gBAC9B,OAAO,KAAK,CAAA;YACd,CAAC;YACD,MAAM,IAAI,GAAa,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE,CAAA;YACpF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,CAAA;YACtG,IAAI,MAAM,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;gBAC5B,OAAO,KAAK,CAAA;YACd,CAAC;YACD,IAAI,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrC,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;YACxC,CAAC;QACH,CAAC;QAED,MAAM,IAAI,WAAW,CAAC,0BAA0B,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC,CAAA;IAC/E,CAAC,CAAA;IAED,MAAM,cAAc,GAAG,KAAK,EAAE,QAAgB,EAAE,OAAe,EAAE,GAAW,EAAoB,EAAE;QAChG,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAA;QACtB,MAAM,IAAI,GAAa,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE,CAAA;QAC/F,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,SAAS,CAC3C,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,CAC3F,CAAA;QAED,OAAO,MAAM,CAAC,YAAY,GAAG,CAAC,CAAA;IAChC,CAAC,CAAA;IAED,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,cAAc,EAAE,CAAA;AACvD,CAAC,CAAA;AAED,8DAA8D;AAC9D,MAAM,CAAC,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAA;AAEjE,oFAAoF;AACpF,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,GAAY,EAAE,QAAgB,EAAE,OAAe,EAAuB,EAAE,CAC1G,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;AAEzD,kFAAkF;AAClF,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAAE,GAAY,EAAE,QAAgB,EAAE,KAAe,EAAqB,EAAE,CACtG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;AAErD,qFAAqF;AACrF,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAAE,GAAY,EAAE,QAAgB,EAAE,OAAe,EAAE,GAAW,EAAoB,EAAE,CACrH,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA"}
+{"version":3,"file":"groups.js","sourceRoot":"","sources":["../src/groups.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAG9C,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAA;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAG/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAEpD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAY,EAAkB,EAAE;IACjE,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAoB,wBAAwB,CAAC,CAAA;IAEhF,MAAM,aAAa,GAAG,KAAK,EAAE,QAAgB,EAAE,OAAe,EAAuB,EAAE,CACrF,CAAC,CAAC,MAAM,QAAQ,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,CAAA;IAE5F,MAAM,WAAW,GAAG,KAAK,EAAE,QAAgB,EAAE,KAAe,EAAqB,EAAE;QACjF,IAAI,KAAK,CAAC,OAAO,KAAK,EAAE,IAAI,KAAK,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC;YAC7C,MAAM,IAAI,WAAW,CAAC,0BAA0B,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC,CAAA;QAC/E,CAAC;QACD,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAA;QACtB,MAAM,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QAC9C,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAA;QAEvD,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,2BAA2B,EAAE,EAAE,OAAO,EAAE,CAAC;YACvE,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,SAAS,CAC7C,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EACvC,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE,CACvD,CAAA;YACD,IAAI,QAAQ,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;gBAC9B,OAAO,KAAK,CAAA;YACd,CAAC;YACD,MAAM,IAAI,GAAa,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE,CAAA;YACpF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,CAAA;YACtG,IAAI,MAAM,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;gBAC5B,OAAO,KAAK,CAAA;YACd,CAAC;YACD,IAAI,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrC,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;YACxC,CAAC;QACH,CAAC;QAED,MAAM,IAAI,WAAW,CAAC,0BAA0B,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC,CAAA;IAC/E,CAAC,CAAA;IAED,MAAM,cAAc,GAAG,KAAK,EAAE,QAAgB,EAAE,OAAe,EAAE,GAAW,EAAE,MAAsB,EAAoB,EAAE;QACxH,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAA;QACtB,yFAAyF;QACzF,2EAA2E;QAC3E,MAAM,GAAG,GAAa,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC;aACnG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,YAAY,KAAK,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QACtD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,SAAS,CAC3C,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EACpF,EAAE,IAAI,EAAE,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE,CAC5C,CAAA;QAED,OAAO,MAAM,CAAC,YAAY,GAAG,CAAC,CAAA;IAChC,CAAC,CAAA;IAED,MAAM,cAAc,GAAG,KAAK,EAAE,QAAgB,EAAE,OAAe,EAAE,GAAW,EAAoB,EAAE;QAChG,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAA;QACtB,MAAM,IAAI,GAAa,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE,CAAA;QAC/F,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,SAAS,CAC3C,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,CAC3F,CAAA;QAED,OAAO,MAAM,CAAC,YAAY,GAAG,CAAC,CAAA;IAChC,CAAC,CAAA;IAED,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,CAAA;AACvE,CAAC,CAAA;AAED,8DAA8D;AAC9D,MAAM,CAAC,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAA;AAEjE,oFAAoF;AACpF,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,GAAY,EAAE,QAAgB,EAAE,OAAe,EAAuB,EAAE,CAC1G,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;AAEzD,kFAAkF;AAClF,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAAE,GAAY,EAAE,QAAgB,EAAE,KAAe,EAAqB,EAAE,CACtG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;AAErD,qFAAqF;AACrF,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAAE,GAAY,EAAE,QAAgB,EAAE,OAAe,EAAE,GAAW,EAAoB,EAAE,CACrH,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA"}

package/build/iam.d.ts

@@ -0,0 +1,22 @@
+import type { AuthPayload } from '@owlmeans/auth';
+/** Find-or-create an end-user identity scoped to an entity by email address.
+ *
+ *  Used by the OTP auth plugin: after code verification, look up whether this
+ *  email already has a profile under the entity and create one if not.
+ */
+export interface EmailIdentityArgs {
+    email: string;
+    /** The entity (project owner) this login is scoped to */
+    entityId?: string;
+    /** Human-readable display name (defaults to email) */
+    username?: string;
+}
+/** Result matches AuthPayload so it can be embedded directly in the credential. */
+export type EmailIdentityPayload = AuthPayload;
+/** Extension seam for IAM-backed identity operations — Phase 2 fills this */
+export interface IdentityIamExtension {
+    /** Inputs and result types for the email find-or-create path */
+    EmailIdentityArgs: EmailIdentityArgs;
+    EmailIdentityPayload: EmailIdentityPayload;
+}
+//# sourceMappingURL=iam.d.ts.map

package/build/iam.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"iam.d.ts","sourceRoot":"","sources":["../src/iam.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAEjD;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAA;IACb,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,sDAAsD;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,mFAAmF;AACnF,MAAM,MAAM,oBAAoB,GAAG,WAAW,CAAA;AAE9C,6EAA6E;AAC7E,MAAM,WAAW,oBAAoB;IACnC,gEAAgE;IAChE,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,oBAAoB,EAAE,oBAAoB,CAAA;CAC3C"}

package/build/iam.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=iam.js.map

package/build/iam.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"iam.js","sourceRoot":"","sources":["../src/iam.ts"],"names":[],"mappings":""}

package/build/native.d.ts

@@ -0,0 +1,14 @@
+import type { MongoResource } from '@owlmeans/mongo-resource';
+import type { ResourceRecord } from '@owlmeans/resource';
+import type { Document } from 'mongodb';
+/**
+ * The collection filter addressing one record by id, exactly as the resource itself addresses it —
+ * `id` onto `_id`, a 24-hex string as an `ObjectId`, anything else matching nothing.
+ *
+ * Field-level updates go through the native collection (the resource contract replaces whole
+ * records), so they need the id the way the collection stores it.
+ */
+export declare const idFilter: <T extends ResourceRecord>(resource: MongoResource<T>, id: string) => Document;
+/** A unique index refused the write. */
+export declare const isDuplicateKey: (error: unknown) => boolean;
+//# sourceMappingURL=native.d.ts.map

package/build/native.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native.d.ts","sourceRoot":"","sources":["../src/native.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAEvC;;;;;;GAMG;AACH,eAAO,MAAM,QAAQ,GAAI,CAAC,SAAS,cAAc,YAAY,aAAa,CAAC,CAAC,CAAC,MAAM,MAAM,KAAG,QACL,CAAA;AAEvF,wCAAwC;AACxC,eAAO,MAAM,cAAc,UAAW,OAAO,KAAG,OACoB,CAAA"}

package/build/native.js

@@ -0,0 +1,12 @@
+import { criteriaToFilter, MONGO_DUPLICATE_KEY } from '@owlmeans/mongo-resource';
+/**
+ * The collection filter addressing one record by id, exactly as the resource itself addresses it —
+ * `id` onto `_id`, a 24-hex string as an `ObjectId`, anything else matching nothing.
+ *
+ * Field-level updates go through the native collection (the resource contract replaces whole
+ * records), so they need the id the way the collection stores it.
+ */
+export const idFilter = (resource, id) => criteriaToFilter({ id }, new Map(resource.references().map(ref => [ref.field, ref])));
+/** A unique index refused the write. */
+export const isDuplicateKey = (error) => error?.code === MONGO_DUPLICATE_KEY;
+//# sourceMappingURL=native.js.map

package/build/native.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native.js","sourceRoot":"","sources":["../src/native.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAKhF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAA2B,QAA0B,EAAE,EAAU,EAAY,EAAE,CACrG,gBAAgB,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;AAEvF,wCAAwC;AACxC,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAc,EAAW,EAAE,CACvD,KAAmC,EAAE,IAAI,KAAK,mBAAmB,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/server-auth-identity",
-  "version": "0.1.18-rc.49",
+  "version": "0.1.18-rc.50",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -23,12 +23,12 @@
   },
   "dependencies": {
     "@owlmeans/auth": "^0.1.18-rc.41",
-    "@owlmeans/auth-common": "^0.1.18-rc.49",
-    "@owlmeans/basic-ids": "^0.1.18-rc.39",
+    "@owlmeans/auth-common": "^0.1.18-rc.50",
+    "@owlmeans/basic-ids": "^0.1.18-rc.40",
     "@owlmeans/context": "^0.1.18-rc.34",
     "@owlmeans/log": "^0.1.18-rc.3",
     "@owlmeans/mongo-resource": "^0.1.18-rc.44",
-    "@owlmeans/oidc": "^0.1.18-rc.57",
+    "@owlmeans/oidc": "^0.1.18-rc.58",
     "@owlmeans/resource": "^0.1.18-rc.40",
     "@owlmeans/server-context": "^0.1.18-rc.44",
     "@scure/base": "^2.4.0"

package/src/consts.local.ts

@@ -7,3 +7,9 @@
  * resolving through `formerSlugs` rather than failing.
  */
 export const CACHE_TTL = 30_000
+
+/**
+ * The fields of an organization group a field-level update may write. `service` and `key` are the
+ * group's identity and are never rewritten in place.
+ */
+export const ORG_GROUP_FIELDS = ['title', 'managed', 'permissions', 'bundles'] as const

package/src/groups/types.ts

@@ -1,5 +1,8 @@
 import type { OrgGroup } from '../types.js'
 
+/** What `updateOrgGroup` may write — each field present is set, each absent one is left alone. */
+export interface OrgGroupFields extends Partial<Pick<OrgGroup, 'title' | 'managed' | 'permissions' | 'bundles'>> {}
+
 /** The groups apps keep in organizations of one context's identity store. */
 export interface OrgGroupHelper {
   /** The groups one app keeps in an organization. */
@@ -15,6 +18,16 @@ export interface OrgGroupHelper {
    * @throws {UnknownRecordError} when the organization does not exist.
    */
   putOrgGroup: (entityId: string, group: OrgGroup) => Promise<OrgGroup>
+  /**
+   * Set only the given fields (`title`, `managed`, `permissions`, `bundles`) of the EXISTING group
+   * (`service`, `key`) — `true` when it matched; it never creates one.
+   *
+   * Two writers of one group that own different fields — a platform sync keeping `managed` and
+   * `bundles`, an operator granting into `permissions` — must not undo each other, and
+   * `putOrgGroup` replaces the whole element from whatever its caller read. Use `putOrgGroup` only
+   * to create a group; change an existing one through this.
+   */
+  updateOrgGroup: (entityId: string, service: string, key: string, fields: OrgGroupFields) => Promise<boolean>
   /**
    * Remove the group (`service`, `key`) from an organization — `true` when it was there. The rows that
    * name it in their `groups` are the caller's to update.

package/src/groups.ts

@@ -4,8 +4,9 @@ import type { Document } from 'mongodb'
 import type { OrgEntityResource, OrgGroup } from './types.js'
 import { AUTH_IDENTITY_ORG_ENTITY, MAX_GUARDED_UPDATE_ATTEMPTS } from './consts.js'
 import { nativeUtils } from './utils/native.js'
-import type { OrgGroupHelper } from './groups/types.js'
+import type { OrgGroupFields, OrgGroupHelper } from './groups/types.js'
 import type { Context } from './types.local.js'
+import { ORG_GROUP_FIELDS } from './consts.local.js'
 
 export const makeOrgGroupHelper = (ctx: Context): OrgGroupHelper => {
   const entities = () => ctx.resource<OrgEntityResource>(AUTH_IDENTITY_ORG_ENTITY)
@@ -42,6 +43,20 @@ export const makeOrgGroupHelper = (ctx: Context): OrgGroupHelper => {
     throw new SyntaxError(`entity:group-contended:${group.service}:${group.key}`)
   }
 
+  const updateOrgGroup = async (entityId: string, service: string, key: string, fields: OrgGroupFields): Promise<boolean> => {
+    const res = entities()
+    // Positional paths of the matched element only: the other fields of the group, and every
+    // other group of the organization, stay exactly as the store has them now.
+    const set: Document = Object.fromEntries(ORG_GROUP_FIELDS.filter(field => fields[field] !== undefined)
+      .map(field => [`groups.$.${field}`, fields[field]]))
+    const result = await res.collection.updateOne(
+      { ...nativeUtils.idFilter(res, entityId), groups: { $elemMatch: { service, key } } },
+      { $set: { ...set, updatedAt: new Date() } },
+    )
+
+    return result.matchedCount > 0
+  }
+
   const removeOrgGroup = async (entityId: string, service: string, key: string): Promise<boolean> => {
     const res = entities()
     const pull: Document = { $pull: { groups: { service, key } }, $set: { updatedAt: new Date() } }
@@ -52,7 +67,7 @@ export const makeOrgGroupHelper = (ctx: Context): OrgGroupHelper => {
     return result.matchedCount > 0
   }
 
-  return { listOrgGroups, putOrgGroup, removeOrgGroup }
+  return { listOrgGroups, putOrgGroup, updateOrgGroup, removeOrgGroup }
 }
 
 /** The organization groups of a context — one per context. */

package/tests/context.ts

@@ -56,14 +56,22 @@ const setPath = (doc: Rec, path: string, value: unknown): void => {
   target[steps[steps.length - 1]!] = value
 }
 
-/** `$set` (dotted, and the positional `array.$` the filter's `$elemMatch` selects), `$push`, `$pull`. */
+/**
+ * `$set` (dotted, and the positional `array.$` / `array.$.field` of the element the filter's
+ * `$elemMatch` selects), `$push`, `$pull`.
+ */
 const applyUpdate = (doc: Rec, update: Rec, filter: Rec): void => {
   for (const [path, value] of Object.entries(update.$set ?? {})) {
-    if (path.endsWith('.$')) {
-      const field = path.slice(0, -2)
+    const positional = path.match(/^([^$]+)\.\$(?:\.(.+))?$/)
+    if (positional != null) {
+      const [, field, rest] = positional as [string, string, string | undefined]
       const items = doc[field] as Rec[]
       const at = items.findIndex(item => recordQueryHelper.matchCriteria(item, filter[field].$elemMatch))
-      items[at] = structuredClone(value) as Rec
+      if (rest == null) {
+        items[at] = structuredClone(value) as Rec
+      } else {
+        setPath(items[at]!, rest, structuredClone(value))
+      }
       continue
     }
     setPath(doc, path, structuredClone(value))

package/tests/resolver.spec.ts

@@ -99,6 +99,43 @@ describe('organization groups', () => {
     expect(row().groups.filter((item: OrgGroup) => item.service === 'shop-taskly' && item.key === 'members')).toHaveLength(1)
   })
 
+  test('updateOrgGroup sets only the given fields of the matched group, and never creates one', async () => {
+    const { ctx, entityId, row } = await organization()
+    const grants = [{ scope: 'shop-taskly', permissions: { 'article--read': false } }]
+    await orgGroupsOf(ctx).putOrgGroup(entityId, { ...group('shop-taskly', 'members', 'Staff'), permissions: grants })
+    await orgGroupsOf(ctx).putOrgGroup(entityId, group('shop-other', 'members', 'Other'))
+
+    expect(await orgGroupsOf(ctx).updateOrgGroup(entityId, 'shop-taskly', 'members', {
+      managed: true, bundles: [{ permissions: ['article--read'] }],
+      // Identity fields are not the update's to write, whatever a caller passes.
+      ...({ key: 'renamed', service: 'shop-other' } as {}),
+    })).toBe(true)
+
+    expect(row().groups).toEqual([
+      { service: 'shop-taskly', key: 'members', title: 'Staff', managed: true, permissions: grants, bundles: [{ permissions: ['article--read'] }] },
+      group('shop-other', 'members', 'Other'),
+    ])
+    expect(await orgGroupsOf(ctx).updateOrgGroup(entityId, 'shop-taskly', 'editors', { title: 'Editors' })).toBe(false)
+    expect(row().groups).toHaveLength(2)
+  })
+
+  test('concurrent field-level writers of one group keep each other\'s fields', async () => {
+    const { ctx, entityId, row } = await organization()
+    await orgGroupsOf(ctx).putOrgGroup(entityId, group('shop-taskly', 'members'))
+    const grants = [{ scope: 'shop-taskly', permissions: { 'article--edit': true } }]
+
+    await Promise.all([
+      orgGroupsOf(ctx).updateOrgGroup(entityId, 'shop-taskly', 'members', { managed: true, bundles: [{ permissions: ['article--read'] }] }),
+      orgGroupsOf(ctx).updateOrgGroup(entityId, 'shop-taskly', 'members', { permissions: grants }),
+      orgGroupsOf(ctx).updateOrgGroup(entityId, 'shop-taskly', 'members', { title: 'Staff' }),
+    ])
+
+    expect(row().groups).toEqual([{
+      service: 'shop-taskly', key: 'members', title: 'Staff', managed: true, permissions: grants,
+      bundles: [{ permissions: ['article--read'] }],
+    }])
+  })
+
   test('remove pulls only that group; an unknown organization is refused', async () => {
     const { ctx, entityId, row } = await organization()
     await orgGroupsOf(ctx).putOrgGroup(entityId, group('shop-taskly', 'members'))