@portaidentity/server 1.7.2 → 1.8.0

package/dist/rbac/slugs.js

@@ -3,38 +3,38 @@
  *
  * Two types of slugs are used in the RBAC module:
  *
- * 1. **Role slugs** — kebab-case identifiers (e.g., "crm-editor").
- *    Same format as organization/application slugs. Auto-generated
- *    from role names or provided manually.
- *
- * 2. **Permission slugs** — colon-separated namespaced identifiers
- *    following the `module:resource:action` format (e.g., "crm:contacts:read").
- *    Each segment must be lowercase alphanumeric with hyphens.
- *    Minimum 3 segments required.
+ * Role and permission slugs are exact external claim values. Explicit values keep their case and
+ * printable characters after surrounding whitespace is removed. Generated role slugs retain the
+ * familiar kebab-case default.
  *
  * This module provides:
  * - `generateRoleSlug(name)` — Derive a role slug from a role name
- * - `validateRoleSlug(slug)` — Check role slug format (kebab-case, 1-100 chars)
- * - `validatePermissionSlug(slug)` — Check permission slug follows module:resource:action
+ * - `normalizeRbacSlug(slug)` — Remove surrounding whitespace before storage and comparison
+ * - `validateRoleSlug(slug)` — Check the role claim value safety bounds
+ * - `validatePermissionSlug(slug)` — Check the permission claim value safety bounds
  * - `parsePermissionSlug(slug)` — Decompose a permission slug into its parts
  */
 // ---------------------------------------------------------------------------
 // Role slug format
 // ---------------------------------------------------------------------------
-/**
- * Role slug format regex: 1–100 characters, lowercase alphanumeric + hyphens.
- * Must start and end with an alphanumeric character (no leading/trailing hyphens).
- * Single character slugs are allowed (unlike organization slugs which require 3+).
- */
-const ROLE_SLUG_REGEX = /^[a-z0-9]([a-z0-9-]{0,98}[a-z0-9])?$/;
-// ---------------------------------------------------------------------------
-// Permission slug format
-// ---------------------------------------------------------------------------
-/**
- * Each segment of a permission slug: lowercase alphanumeric + hyphens,
- * must start and end with an alphanumeric character.
- */
-const PERMISSION_SEGMENT_REGEX = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
+/** Removes surrounding whitespace while preserving the exact internal claim value. */
+export function normalizeRbacSlug(slug) {
+    return slug.trim();
+}
+/** Returns whether text contains an ASCII or C1 control character. */
+function containsControlCharacter(value) {
+    return [...value].some((character) => {
+        const codePoint = character.codePointAt(0) ?? 0;
+        return codePoint <= 0x1f || (codePoint >= 0x7f && codePoint <= 0x9f);
+    });
+}
+/** Validates one normalized, bounded, control-free external claim value. */
+function validateRbacSlug(slug, maximumLength) {
+    const normalized = normalizeRbacSlug(slug);
+    return (normalized.length > 0 &&
+        normalized.length <= maximumLength &&
+        !containsControlCharacter(normalized));
+}
 // ---------------------------------------------------------------------------
 // Role slug generation
 // ---------------------------------------------------------------------------
@@ -80,11 +80,8 @@ export function generateRoleSlug(name) {
 /**
  * Validate a role slug format.
  *
- * Rules:
- * - 1–100 characters long
- * - Lowercase alphanumeric characters and hyphens only
- * - Cannot start or end with a hyphen
- * - Empty strings are invalid
+ * The trimmed value must contain 1–100 printable characters. Case and internal characters are
+ * preserved because this value is emitted directly to external applications.
  *
  * Does NOT check uniqueness — that's the repository/service layer's job.
  *
@@ -94,28 +91,18 @@ export function generateRoleSlug(name) {
  * @example
  * validateRoleSlug('crm-editor')  // true
  * validateRoleSlug('admin')       // true
- * validateRoleSlug('CRM Editor')  // false (spaces, uppercase)
+ * validateRoleSlug('CRM Editor')  // true
  * validateRoleSlug('')            // false (empty)
  */
 export function validateRoleSlug(slug) {
-    // Must be 1–100 characters
-    if (!slug || slug.length > 100) {
-        return false;
-    }
-    return ROLE_SLUG_REGEX.test(slug);
+    return validateRbacSlug(slug, 100);
 }
 // ---------------------------------------------------------------------------
 // Permission slug validation
 // ---------------------------------------------------------------------------
 /**
- * Validate a permission slug follows the module:resource:action format.
- *
- * Rules:
- * - Must have at least 3 segments separated by colons
- * - Each segment must be lowercase alphanumeric with hyphens
- * - Each segment must start and end with an alphanumeric character
- * - Empty segments are not allowed
- * - Total length must not exceed 150 characters (matches DB column)
+ * Validate a permission claim value. `module:resource:action` remains a useful convention, but is
+ * not mandatory for external applications that already use another identifier scheme.
  *
  * @param slug - Permission slug to validate
  * @returns true if the slug format is valid, false otherwise
@@ -124,22 +111,12 @@ export function validateRoleSlug(slug) {
  * validatePermissionSlug('crm:contacts:read')     // true
  * validatePermissionSlug('admin:system:manage')    // true
  * validatePermissionSlug('crm:sub-module:items:write') // true (4+ segments OK)
- * validatePermissionSlug('contacts-read')          // false (no colons)
- * validatePermissionSlug('a:b')                    // false (only 2 segments)
+ * validatePermissionSlug('CAN_ADD_ORDER')          // true
+ * validatePermissionSlug('access-that-resource')   // true
  * validatePermissionSlug('')                       // false (empty)
  */
 export function validatePermissionSlug(slug) {
-    // Must be non-empty and within DB column limit (VARCHAR(150))
-    if (!slug || slug.length > 150) {
-        return false;
-    }
-    // Split on colons — need at least 3 segments
-    const segments = slug.split(':');
-    if (segments.length < 3) {
-        return false;
-    }
-    // Each segment must match the segment format
-    return segments.every((segment) => segment.length > 0 && PERMISSION_SEGMENT_REGEX.test(segment));
+    return validateRbacSlug(slug, 150);
 }
 /**
  * Parse a permission slug into its module, resource, and action components.
@@ -149,7 +126,7 @@ export function validatePermissionSlug(slug) {
  * both 3-segment slugs (crm:contacts:read) and 4+ segment slugs
  * (crm:sub-module:items:write → module="crm", resource="sub-module:items", action="write").
  *
- * Returns null if the slug is invalid (fails validatePermissionSlug).
+ * Returns null when the claim value does not use the conventional three-or-more-part colon form.
  *
  * @param slug - Permission slug to parse
  * @returns Parsed components or null if invalid
@@ -165,10 +142,10 @@ export function validatePermissionSlug(slug) {
  * // null
  */
 export function parsePermissionSlug(slug) {
-    if (!validatePermissionSlug(slug)) {
+    const segments = normalizeRbacSlug(slug).split(':');
+    if (!validatePermissionSlug(slug) || segments.length < 3 || segments.some((part) => !part)) {
         return null;
     }
-    const segments = slug.split(':');
     // First segment = module, last = action, middle = resource
     const module = segments[0];
     const action = segments[segments.length - 1];

package/dist/rbac/slugs.js.map

@@ -1 +1 @@
-{"version":3,"file":"slugs.js","sourceRoot":"","sources":["../../src/rbac/slugs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,eAAe,GAAG,sCAAsC,CAAC;AAE/D,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,wBAAwB,GAAG,iCAAiC,CAAC;AAEnE,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,IAAI,GAAG,IAAI;SACd,WAAW,EAAE;QACd,qEAAqE;SACpE,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;QAC5B,oDAAoD;SACnD,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;QACpB,sCAAsC;SACrC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAE3B,iFAAiF;IACjF,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,2BAA2B;IAC3B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,8DAA8D;IAC9D,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,6CAA6C;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,6CAA6C;IAC7C,OAAO,QAAQ,CAAC,KAAK,CACnB,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CAC1E,CAAC;AACJ,CAAC;AAaD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,2DAA2D;IAC3D,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEjD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC"}
+{"version":3,"file":"slugs.js","sourceRoot":"","sources":["../../src/rbac/slugs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,sFAAsF;AACtF,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;AACrB,CAAC;AAED,sEAAsE;AACtE,SAAS,wBAAwB,CAAC,KAAa;IAC7C,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE;QACnC,MAAM,SAAS,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAChD,OAAO,SAAS,IAAI,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,SAAS,IAAI,IAAI,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,4EAA4E;AAC5E,SAAS,gBAAgB,CAAC,IAAY,EAAE,aAAqB;IAC3D,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC3C,OAAO,CACL,UAAU,CAAC,MAAM,GAAG,CAAC;QACrB,UAAU,CAAC,MAAM,IAAI,aAAa;QAClC,CAAC,wBAAwB,CAAC,UAAU,CAAC,CACtC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,IAAI,GAAG,IAAI;SACd,WAAW,EAAE;QACd,qEAAqE;SACpE,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;QAC5B,oDAAoD;SACnD,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;QACpB,sCAAsC;SACrC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAE3B,iFAAiF;IACjF,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AACrC,CAAC;AAED,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,OAAO,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AACrC,CAAC;AAaD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3F,OAAO,IAAI,CAAC;IACd,CAAC;IACD,2DAA2D;IAC3D,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEjD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC"}

package/dist/rbac/types.d.ts

@@ -62,8 +62,7 @@ export interface UpdateRoleInput {
  * Full permission record as stored in the database.
  * Maps to the `permissions` table columns (see migration 006).
  * Permissions are defined globally per application, optionally scoped
- * to a module. The slug follows the module:resource:action format
- * (e.g., "crm:contacts:read").
+ * to a module. The slug is the exact permission value emitted to the application.
  */
 export interface Permission {
     id: string;
@@ -89,8 +88,7 @@ export interface PermissionRow {
 }
 /**
  * Input for creating a new permission.
- * The slug must follow the module:resource:action format and is
- * validated by the service layer before insert.
+ * The slug is an application-defined claim value validated by the service layer before insert.
  */
 export interface CreatePermissionInput {
     applicationId: string;

package/dist/rbac/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/rbac/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAMH;;;;GAIG;AACH,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,IAAI,CAAC;IACjB,UAAU,EAAE,IAAI,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAMD;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,IAAI,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,IAAI,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAMD;;;;GAIG;AACH,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,IAAI,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,IAAI,CAAC;CAClB;AAMD;;;GAGG;AACH,MAAM,WAAW,mBAAoB,SAAQ,IAAI;IAC/C,WAAW,EAAE,UAAU,EAAE,CAAC;CAC3B;AAMD,6CAA6C;AAC7C,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,GAAG,YAAY,CAAC;IAC/B,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;CAC5B;AAED,mDAAmD;AACnD,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,GAAG,YAAY,CAAC;IAC/B,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;CAC5B;AAMD;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAU/C;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,aAAa,GAAG,UAAU,CAUjE;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,WAAW,GAAG,QAAQ,CAO3D"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/rbac/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAMH;;;;GAIG;AACH,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,IAAI,CAAC;IACjB,UAAU,EAAE,IAAI,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAMD;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,IAAI,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,IAAI,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAMD;;;;GAIG;AACH,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,IAAI,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,IAAI,CAAC;CAClB;AAMD;;;GAGG;AACH,MAAM,WAAW,mBAAoB,SAAQ,IAAI;IAC/C,WAAW,EAAE,UAAU,EAAE,CAAC;CAC3B;AAMD,6CAA6C;AAC7C,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,GAAG,YAAY,CAAC;IAC/B,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;CAC5B;AAED,mDAAmD;AACnD,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,GAAG,YAAY,CAAC;IAC/B,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;CAC5B;AAMD;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAU/C;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,aAAa,GAAG,UAAU,CAUjE;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,WAAW,GAAG,QAAQ,CAO3D"}

package/dist/rbac/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/rbac/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAiLH,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,aAAa,EAAE,GAAG,CAAC,cAAc;QACjC,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU;KAC1B,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAkB;IACnD,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,aAAa,EAAE,GAAG,CAAC,cAAc;QACjC,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,SAAS,EAAE,GAAG,CAAC,UAAU;KAC1B,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAgB;IAC/C,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,OAAO;QACnB,MAAM,EAAE,GAAG,CAAC,OAAO;QACnB,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,SAAS,EAAE,GAAG,CAAC,UAAU;KAC1B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/rbac/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AA+KH,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,aAAa,EAAE,GAAG,CAAC,cAAc;QACjC,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU;KAC1B,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAkB;IACnD,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,aAAa,EAAE,GAAG,CAAC,cAAc;QACjC,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,SAAS,EAAE,GAAG,CAAC,UAAU;KAC1B,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAgB;IAC/C,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,OAAO;QACnB,MAAM,EAAE,GAAG,CAAC,OAAO;QACnB,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,SAAS,EAAE,GAAG,CAAC,UAAU;KAC1B,CAAC;AACJ,CAAC"}

package/dist/rbac/user-role-service.d.ts

@@ -5,14 +5,8 @@
  * roles and permissions, and building the claims arrays that get
  * injected into OIDC tokens.
  *
- * The claims-building functions (buildRoleClaims, buildPermissionClaims)
- * are the token hot path — they use cache-first resolution to minimize
- * database queries during token issuance.
- *
- * Cache strategy for claims:
- * 1. Check Redis for cached slug arrays
- * 2. On cache hit → return immediately (fast path)
- * 3. On cache miss → query DB, cache result, return
+ * Token claim construction reads PostgreSQL directly. This makes role and
+ * permission deletion authoritative even when an older Redis entry remains.
  *
  * @see mapping-repository.ts — Database operations for user-role join table
  * @see cache.ts — Redis cache for role/permission slug arrays
@@ -24,47 +18,57 @@ import type { Role, Permission, UserRole } from './types.js';
  * Uses ON CONFLICT DO NOTHING for idempotent assignment. Invalidates
  * the user's RBAC cache since their effective permissions may change.
  *
+ * @param organizationId - Authoritative organization UUID
  * @param userId - User UUID
  * @param roleIds - Array of role UUIDs to assign
- * @param assignedBy - Optional UUID of the admin performing the assignment
+ * @param assignedBy - UUID of the admin performing the assignment
  */
-export declare function assignRolesToUser(userId: string, roleIds: string[], assignedBy?: string): Promise<void>;
+export declare function assignRolesToUser(organizationId: string, userId: string, roleIds: string[], assignedBy: string): Promise<void>;
 /**
  * Remove roles from a user (bulk).
  *
  * Invalidates the user's RBAC cache since their effective permissions
  * may change.
  *
+ * @param organizationId - Authoritative organization UUID
  * @param userId - User UUID
  * @param roleIds - Array of role UUIDs to remove
- * @param actorId - Optional UUID of the admin performing the action
+ * @param actorId - UUID of the admin performing the action
+ * @returns Whether the actor must authenticate again
  */
-export declare function removeRolesFromUser(userId: string, roleIds: string[], actorId?: string): Promise<void>;
+export declare function removeRolesFromUser(organizationId: string, userId: string, roleIds: string[], actorId: string): Promise<{
+    reauthenticationRequired: boolean;
+}>;
 /**
  * Get all roles assigned to a user.
  *
+ * @param organizationId - Authoritative organization UUID
  * @param userId - User UUID
  * @returns Array of Role objects
  */
-export declare function getUserRoles(userId: string): Promise<Role[]>;
+export declare function getUserRoles(organizationId: string, userId: string): Promise<Role[]>;
+/** Read all roles for internal authority resolution without a route parent. */
+export declare function getUserRolesForAuthority(userId: string): Promise<Role[]>;
 /**
  * Get all permissions for a user (resolved through roles).
  *
+ * @param organizationId - Authoritative organization UUID
  * @param userId - User UUID
  * @returns Deduplicated array of Permission objects
  */
-export declare function getUserPermissions(userId: string): Promise<Permission[]>;
+export declare function getUserPermissions(organizationId: string, userId: string): Promise<Permission[]>;
 /**
  * List users with a specific role within an organization.
  *
  * Supports pagination for admin UI views.
  *
+ * @param applicationId - Authoritative application UUID
  * @param roleId - Role UUID
  * @param orgId - Organization UUID
  * @param options - Pagination options
  * @returns Paginated user-role assignments and total count
  */
-export declare function getUsersWithRole(roleId: string, orgId: string, options?: {
+export declare function getUsersWithRole(applicationId: string, roleId: string, orgId: string, options?: {
     page?: number;
     pageSize?: number;
 }): Promise<{
@@ -77,25 +81,20 @@ export declare function getUsersWithRole(roleId: string, orgId: string, options?
  * Returns an array of role slugs (e.g., ["crm-editor", "invoice-approver"])
  * for inclusion in the token's custom claims.
  *
- * Cache-first: checks Redis for cached role slugs. On cache miss,
- * resolves from DB and caches the result for future token issuances.
- *
  * @param userId - User UUID
+ * @param applicationId - Application UUID that owns the requested token authority
  * @returns Array of role slug strings
  */
-export declare function buildRoleClaims(userId: string): Promise<string[]>;
+export declare function buildRoleClaims(userId: string, applicationId: string): Promise<string[]>;
 /**
  * Build permission claims for a user's token.
  *
  * Returns an array of permission slugs (e.g., ["crm:contacts:read",
  * "crm:deals:write"]) for inclusion in the token's custom claims.
  *
- * Cache-first: checks Redis for cached permission slugs. On cache miss,
- * resolves through the full user → roles → permissions chain from DB
- * and caches the result.
- *
  * @param userId - User UUID
+ * @param applicationId - Application UUID that owns the requested token authority
  * @returns Array of permission slug strings
  */
-export declare function buildPermissionClaims(userId: string): Promise<string[]>;
+export declare function buildPermissionClaims(userId: string, applicationId: string): Promise<string[]>;
 //# sourceMappingURL=user-role-service.d.ts.map

package/dist/rbac/user-role-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-role-service.d.ts","sourceRoot":"","sources":["../../src/rbac/user-role-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAiBH,OAAO,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAM7D;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EAAE,EACjB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EAAE,EACjB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAgBf;AAMD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAElE;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAE9E;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAC7C,OAAO,CAAC;IAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAK9C;AAMD;;;;;;;;;;;GAWG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAevE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAe7E"}
+{"version":3,"file":"user-role-service.d.ts","sourceRoot":"","sources":["../../src/rbac/user-role-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAaH,OAAO,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAwB7D;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CACrC,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EAAE,EACjB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,mBAAmB,CACvC,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EAAE,EACjB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC;IAAE,wBAAwB,EAAE,OAAO,CAAA;CAAE,CAAC,CAsChD;AAMD;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAE1F;AAED,+EAA+E;AAC/E,wBAAsB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAE9E;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,UAAU,EAAE,CAAC,CAEvB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAC7C,OAAO,CAAC;IAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAK9C;AA0DD;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAG9F;AAED;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,EAAE,CAAC,CAGnB"}

package/dist/rbac/user-role-service.js

@@ -5,21 +5,24 @@
  * roles and permissions, and building the claims arrays that get
  * injected into OIDC tokens.
  *
- * The claims-building functions (buildRoleClaims, buildPermissionClaims)
- * are the token hot path — they use cache-first resolution to minimize
- * database queries during token issuance.
- *
- * Cache strategy for claims:
- * 1. Check Redis for cached slug arrays
- * 2. On cache hit → return immediately (fast path)
- * 3. On cache miss → query DB, cache result, return
+ * Token claim construction reads PostgreSQL directly. This makes role and
+ * permission deletion authoritative even when an older Redis entry remains.
  *
  * @see mapping-repository.ts — Database operations for user-role join table
  * @see cache.ts — Redis cache for role/permission slug arrays
  */
-import { assignRolesToUser as repoAssignRoles, removeRolesFromUser as repoRemoveRoles, getRolesForUser as repoGetRolesForUser, getPermissionsForUser as repoGetPermissionsForUser, getUsersWithRole as repoGetUsersWithRole, } from './mapping-repository.js';
-import { getCachedUserRoles, setCachedUserRoles, getCachedUserPermissions, setCachedUserPermissions, invalidateUserRbacCache, } from './cache.js';
+import { assignRolesToUser as repoAssignRoles, removeRolesFromUser as repoRemoveRoles, getRolesForUser as repoGetRolesForUser, getPermissionsForUser as repoGetPermissionsForUser, getUsersWithRole as repoGetUsersWithRole, getRolesForOrganizationUser, getPermissionsForOrganizationUser, lockUserRoleTargets, } from './mapping-repository.js';
 import { writeAuditLog } from '../lib/audit-log.js';
+import { getDatabaseTransactionClient } from '../lib/database.js';
+import { writeAuditLogInTransaction } from '../lib/audit-log.js';
+import { registerAuthorityCleanup } from '../lib/deletion-cleanup.js';
+import { revokeAffectedAuthorityInTransaction } from '../lib/authority-revocation.js';
+import { getApplicationBySlug } from '../applications/service.js';
+import { ADMIN_ROLE_DEFINITIONS, getPermissionsForAdminRole, resolvePermissionsFromRoles, } from '../lib/admin-permissions.js';
+import { RoleDelegationError, RoleNotFoundError } from './errors.js';
+import { UserNotFoundError } from '../users/errors.js';
+import { lockControlPlaneOrganization, requireActiveSuperAdminSurvivor, } from '../users/repository.js';
+const ADMIN_APPLICATION_SLUG = 'porta-admin';
 // ---------------------------------------------------------------------------
 // Assignment management
 // ---------------------------------------------------------------------------
@@ -29,23 +32,35 @@ import { writeAuditLog } from '../lib/audit-log.js';
  * Uses ON CONFLICT DO NOTHING for idempotent assignment. Invalidates
  * the user's RBAC cache since their effective permissions may change.
  *
+ * @param organizationId - Authoritative organization UUID
  * @param userId - User UUID
  * @param roleIds - Array of role UUIDs to assign
- * @param assignedBy - Optional UUID of the admin performing the assignment
+ * @param assignedBy - UUID of the admin performing the assignment
  */
-export async function assignRolesToUser(userId, roleIds, assignedBy) {
+export async function assignRolesToUser(organizationId, userId, roleIds, assignedBy) {
     if (roleIds.length === 0)
         return;
-    await repoAssignRoles(userId, roleIds, assignedBy);
-    // Invalidate user's cached roles and permissions
-    await invalidateUserRbacCache(userId);
+    if (!getDatabaseTransactionClient()) {
+        throw new Error('User role assignment requires an active database transaction');
+    }
+    const targets = await requireUserRoleTargets(organizationId, userId, roleIds);
+    await requireDelegableRoles(targets.roles, assignedBy, targets.adminApplicationId);
+    const insertedRoleIds = await repoAssignRoles(organizationId, userId, roleIds, assignedBy);
+    if (insertedRoleIds.length === 0)
+        return;
+    await registerAuthorityCleanup({
+        userIds: [userId],
+        grantIds: [],
+        roleIds: [],
+        revokeOidcState: false,
+    });
     // Audit log (fire-and-forget)
     void writeAuditLog({
         eventType: 'user.roles.assigned',
         eventCategory: 'admin',
         userId,
         actorId: assignedBy,
-        metadata: { roleIds },
+        metadata: { organizationId, roleIds: insertedRoleIds },
     });
 }
 /**
@@ -54,24 +69,47 @@ export async function assignRolesToUser(userId, roleIds, assignedBy) {
  * Invalidates the user's RBAC cache since their effective permissions
  * may change.
  *
+ * @param organizationId - Authoritative organization UUID
  * @param userId - User UUID
  * @param roleIds - Array of role UUIDs to remove
- * @param actorId - Optional UUID of the admin performing the action
+ * @param actorId - UUID of the admin performing the action
+ * @returns Whether the actor must authenticate again
  */
-export async function removeRolesFromUser(userId, roleIds, actorId) {
+export async function removeRolesFromUser(organizationId, userId, roleIds, actorId) {
     if (roleIds.length === 0)
-        return;
-    await repoRemoveRoles(userId, roleIds);
-    // Invalidate user's cached roles and permissions
-    await invalidateUserRbacCache(userId);
-    // Audit log (fire-and-forget)
-    void writeAuditLog({
+        return { reauthenticationRequired: false };
+    const transaction = getDatabaseTransactionClient();
+    if (!transaction) {
+        throw new Error('User role removal requires an active database transaction');
+    }
+    await lockControlPlaneOrganization(organizationId);
+    const targets = await requireUserRoleTargets(organizationId, userId, roleIds);
+    if (targets.assignedRoleIds.length === 0)
+        return { reauthenticationRequired: false };
+    const removesExactSuperAdmin = targets.roles.some((role) => targets.assignedRoleIds.includes(role.id) &&
+        role.applicationId === targets.adminApplicationId &&
+        role.slug === ADMIN_ROLE_DEFINITIONS.SUPER_ADMIN.slug);
+    if (targets.user.status === 'active' && removesExactSuperAdmin) {
+        await requireActiveSuperAdminSurvivor(organizationId, userId);
+    }
+    const revoked = await revokeAffectedAuthorityInTransaction([userId]);
+    const removedRoleIds = await repoRemoveRoles(organizationId, userId, [
+        ...targets.assignedRoleIds,
+    ]);
+    await writeAuditLogInTransaction(transaction, {
         eventType: 'user.roles.removed',
         eventCategory: 'admin',
         userId,
         actorId,
-        metadata: { roleIds },
+        metadata: { organizationId, roleIds: removedRoleIds },
     });
+    await registerAuthorityCleanup({
+        userIds: [userId],
+        grantIds: revoked.grantIds,
+        roleIds: [],
+        revokeOidcState: true,
+    });
+    return { reauthenticationRequired: actorId === userId };
 }
 // ---------------------------------------------------------------------------
 // Query operations
@@ -79,35 +117,76 @@ export async function removeRolesFromUser(userId, roleIds, actorId) {
 /**
  * Get all roles assigned to a user.
  *
+ * @param organizationId - Authoritative organization UUID
  * @param userId - User UUID
  * @returns Array of Role objects
  */
-export async function getUserRoles(userId) {
+export async function getUserRoles(organizationId, userId) {
+    return getRolesForOrganizationUser(organizationId, userId);
+}
+/** Read all roles for internal authority resolution without a route parent. */
+export async function getUserRolesForAuthority(userId) {
     return repoGetRolesForUser(userId);
 }
 /**
  * Get all permissions for a user (resolved through roles).
  *
+ * @param organizationId - Authoritative organization UUID
  * @param userId - User UUID
  * @returns Deduplicated array of Permission objects
  */
-export async function getUserPermissions(userId) {
-    return repoGetPermissionsForUser(userId);
+export async function getUserPermissions(organizationId, userId) {
+    return getPermissionsForOrganizationUser(organizationId, userId);
 }
 /**
  * List users with a specific role within an organization.
  *
  * Supports pagination for admin UI views.
  *
+ * @param applicationId - Authoritative application UUID
  * @param roleId - Role UUID
  * @param orgId - Organization UUID
  * @param options - Pagination options
  * @returns Paginated user-role assignments and total count
  */
-export async function getUsersWithRole(roleId, orgId, options) {
+export async function getUsersWithRole(applicationId, roleId, orgId, options) {
     const page = options?.page ?? 1;
     const pageSize = options?.pageSize ?? 20;
-    return repoGetUsersWithRole(roleId, orgId, page, pageSize);
+    return repoGetUsersWithRole(applicationId, roleId, orgId, page, pageSize);
+}
+/** Lock the target user and every requested role, then reject missing records. */
+async function requireUserRoleTargets(organizationId, userId, roleIds) {
+    const requestedRoleIds = [...new Set(roleIds)].sort();
+    const targets = await lockUserRoleTargets(organizationId, userId, requestedRoleIds);
+    if (!targets.user)
+        throw new UserNotFoundError(userId);
+    if (targets.roles.length !== requestedRoleIds.length) {
+        const found = new Set(targets.roles.map((role) => role.id));
+        const missing = requestedRoleIds.find((roleId) => !found.has(roleId));
+        throw new RoleNotFoundError(missing ?? 'requested role');
+    }
+    const adminApplication = await getApplicationBySlug(ADMIN_APPLICATION_SLUG);
+    return {
+        user: targets.user,
+        roles: targets.roles,
+        assignedRoleIds: targets.assignedRoleIds,
+        adminApplicationId: adminApplication?.id ?? null,
+    };
+}
+/** Enforce the static capability ceiling for canonical Admin role assignments. */
+async function requireDelegableRoles(roles, actorId, adminApplicationId) {
+    if (adminApplicationId === null)
+        return;
+    const requestedCapabilities = roles
+        .filter((role) => role.applicationId === adminApplicationId)
+        .flatMap((role) => getPermissionsForAdminRole(role.slug));
+    if (requestedCapabilities.length === 0)
+        return;
+    const actorRoles = await repoGetRolesForUser(actorId, adminApplicationId);
+    const actorCapabilities = new Set(resolvePermissionsFromRoles(actorRoles.map((role) => role.slug)));
+    if (requestedCapabilities.some((capability) => !actorCapabilities.has(capability))) {
+        throw new RoleDelegationError();
+    }
 }
 // ---------------------------------------------------------------------------
 // Token claims building (hot path)
@@ -118,24 +197,13 @@ export async function getUsersWithRole(roleId, orgId, options) {
  * Returns an array of role slugs (e.g., ["crm-editor", "invoice-approver"])
  * for inclusion in the token's custom claims.
  *
- * Cache-first: checks Redis for cached role slugs. On cache miss,
- * resolves from DB and caches the result for future token issuances.
- *
  * @param userId - User UUID
+ * @param applicationId - Application UUID that owns the requested token authority
  * @returns Array of role slug strings
  */
-export async function buildRoleClaims(userId) {
-    // 1. Check cache for user role slugs
-    const cached = await getCachedUserRoles(userId);
-    if (cached !== null) {
-        return cached;
-    }
-    // 2. Cache miss — resolve from DB
-    const roles = await repoGetRolesForUser(userId);
-    const slugs = roles.map((role) => role.slug);
-    // 3. Cache the slugs for future requests
-    await setCachedUserRoles(userId, slugs);
-    return slugs;
+export async function buildRoleClaims(userId, applicationId) {
+    const roles = await repoGetRolesForUser(userId, applicationId);
+    return [...new Set(roles.map((role) => role.slug))];
 }
 /**
  * Build permission claims for a user's token.
@@ -143,24 +211,12 @@ export async function buildRoleClaims(userId) {
  * Returns an array of permission slugs (e.g., ["crm:contacts:read",
  * "crm:deals:write"]) for inclusion in the token's custom claims.
  *
- * Cache-first: checks Redis for cached permission slugs. On cache miss,
- * resolves through the full user → roles → permissions chain from DB
- * and caches the result.
- *
  * @param userId - User UUID
+ * @param applicationId - Application UUID that owns the requested token authority
  * @returns Array of permission slug strings
  */
-export async function buildPermissionClaims(userId) {
-    // 1. Check cache for user permission slugs
-    const cached = await getCachedUserPermissions(userId);
-    if (cached !== null) {
-        return cached;
-    }
-    // 2. Cache miss — resolve from DB (through roles)
-    const permissions = await repoGetPermissionsForUser(userId);
-    const slugs = permissions.map((perm) => perm.slug);
-    // 3. Cache the slugs for future requests
-    await setCachedUserPermissions(userId, slugs);
-    return slugs;
+export async function buildPermissionClaims(userId, applicationId) {
+    const permissions = await repoGetPermissionsForUser(userId, applicationId);
+    return [...new Set(permissions.map((permission) => permission.slug))];
 }
 //# sourceMappingURL=user-role-service.js.map

package/dist/rbac/user-role-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-role-service.js","sourceRoot":"","sources":["../../src/rbac/user-role-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EACL,iBAAiB,IAAI,eAAe,EACpC,mBAAmB,IAAI,eAAe,EACtC,eAAe,IAAI,mBAAmB,EACtC,qBAAqB,IAAI,yBAAyB,EAClD,gBAAgB,IAAI,oBAAoB,GACzC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAc,EACd,OAAiB,EACjB,UAAmB;IAEnB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEjC,MAAM,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;IAEnD,iDAAiD;IACjD,MAAM,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAEtC,8BAA8B;IAC9B,KAAK,aAAa,CAAC;QACjB,SAAS,EAAE,qBAAqB;QAChC,aAAa,EAAE,OAAO;QACtB,MAAM;QACN,OAAO,EAAE,UAAU;QACnB,QAAQ,EAAE,EAAE,OAAO,EAAE;KACtB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,OAAiB,EACjB,OAAgB;IAEhB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEjC,MAAM,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEvC,iDAAiD;IACjD,MAAM,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAEtC,8BAA8B;IAC9B,KAAK,aAAa,CAAC;QACjB,SAAS,EAAE,oBAAoB;QAC/B,aAAa,EAAE,OAAO;QACtB,MAAM;QACN,OAAO;QACP,QAAQ,EAAE,EAAE,OAAO,EAAE;KACtB,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAc;IAC/C,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAc;IACrD,OAAO,yBAAyB,CAAC,MAAM,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAc,EACd,KAAa,EACb,OAA8C;IAE9C,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,IAAI,CAAC,CAAC;IAChC,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,EAAE,CAAC;IAEzC,OAAO,oBAAoB,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC7D,CAAC;AAED,8EAA8E;AAC9E,mCAAmC;AACnC,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAc;IAClD,qCAAqC;IACrC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,kCAAkC;IAClC,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAE7C,yCAAyC;IACzC,MAAM,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAExC,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,MAAc;IACxD,2CAA2C;IAC3C,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACtD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,kDAAkD;IAClD,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEnD,yCAAyC;IACzC,MAAM,wBAAwB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAE9C,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"user-role-service.js","sourceRoot":"","sources":["../../src/rbac/user-role-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EACL,iBAAiB,IAAI,eAAe,EACpC,mBAAmB,IAAI,eAAe,EACtC,eAAe,IAAI,mBAAmB,EACtC,qBAAqB,IAAI,yBAAyB,EAClD,gBAAgB,IAAI,oBAAoB,EACxC,2BAA2B,EAC3B,iCAAiC,EACjC,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,oCAAoC,EAAE,MAAM,gCAAgC,CAAC;AACtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EACL,4BAA4B,EAC5B,+BAA+B,GAChC,MAAM,wBAAwB,CAAC;AAEhC,MAAM,sBAAsB,GAAG,aAAa,CAAC;AAE7C,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,cAAsB,EACtB,MAAc,EACd,OAAiB,EACjB,UAAkB;IAElB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACjC,IAAI,CAAC,4BAA4B,EAAE,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9E,MAAM,qBAAqB,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAEnF,MAAM,eAAe,GAAG,MAAM,eAAe,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;IAC3F,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACzC,MAAM,wBAAwB,CAAC;QAC7B,OAAO,EAAE,CAAC,MAAM,CAAC;QACjB,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,EAAE;QACX,eAAe,EAAE,KAAK;KACvB,CAAC,CAAC;IAEH,8BAA8B;IAC9B,KAAK,aAAa,CAAC;QACjB,SAAS,EAAE,qBAAqB;QAChC,aAAa,EAAE,OAAO;QACtB,MAAM;QACN,OAAO,EAAE,UAAU;QACnB,QAAQ,EAAE,EAAE,cAAc,EAAE,OAAO,EAAE,eAAe,EAAE;KACvD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,cAAsB,EACtB,MAAc,EACd,OAAiB,EACjB,OAAe;IAEf,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC;IACrE,MAAM,WAAW,GAAG,4BAA4B,EAAE,CAAC;IACnD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,4BAA4B,CAAC,cAAc,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9E,IAAI,OAAO,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC;IAErF,MAAM,sBAAsB,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAC/C,CAAC,IAAI,EAAE,EAAE,CACP,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,aAAa,KAAK,OAAO,CAAC,kBAAkB;QACjD,IAAI,CAAC,IAAI,KAAK,sBAAsB,CAAC,WAAW,CAAC,IAAI,CACxD,CAAC;IACF,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,sBAAsB,EAAE,CAAC;QAC/D,MAAM,+BAA+B,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,oCAAoC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACrE,MAAM,cAAc,GAAG,MAAM,eAAe,CAAC,cAAc,EAAE,MAAM,EAAE;QACnE,GAAG,OAAO,CAAC,eAAe;KAC3B,CAAC,CAAC;IACH,MAAM,0BAA0B,CAAC,WAAW,EAAE;QAC5C,SAAS,EAAE,oBAAoB;QAC/B,aAAa,EAAE,OAAO;QACtB,MAAM;QACN,OAAO;QACP,QAAQ,EAAE,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE;KACtD,CAAC,CAAC;IACH,MAAM,wBAAwB,CAAC;QAC7B,OAAO,EAAE,CAAC,MAAM,CAAC;QACjB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO,EAAE,EAAE;QACX,eAAe,EAAE,IAAI;KACtB,CAAC,CAAC;IACH,OAAO,EAAE,wBAAwB,EAAE,OAAO,KAAK,MAAM,EAAE,CAAC;AAC1D,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,cAAsB,EAAE,MAAc;IACvE,OAAO,2BAA2B,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;AAC7D,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,MAAc;IAC3D,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,cAAsB,EACtB,MAAc;IAEd,OAAO,iCAAiC,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,aAAqB,EACrB,MAAc,EACd,KAAa,EACb,OAA8C;IAE9C,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,IAAI,CAAC,CAAC;IAChC,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,EAAE,CAAC;IAEzC,OAAO,oBAAoB,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC5E,CAAC;AAUD,kFAAkF;AAClF,KAAK,UAAU,sBAAsB,CACnC,cAAsB,EACtB,MAAc,EACd,OAA0B;IAE1B,MAAM,gBAAgB,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACtD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,cAAc,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACpF,IAAI,CAAC,OAAO,CAAC,IAAI;QAAE,MAAM,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,gBAAgB,CAAC,MAAM,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACtE,MAAM,IAAI,iBAAiB,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,gBAAgB,GAAG,MAAM,oBAAoB,CAAC,sBAAsB,CAAC,CAAC;IAC5E,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,kBAAkB,EAAE,gBAAgB,EAAE,EAAE,IAAI,IAAI;KACjD,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,KAAK,UAAU,qBAAqB,CAClC,KAAsB,EACtB,OAAe,EACf,kBAAiC;IAEjC,IAAI,kBAAkB,KAAK,IAAI;QAAE,OAAO;IACxC,MAAM,qBAAqB,GAAG,KAAK;SAChC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,KAAK,kBAAkB,CAAC;SAC3D,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,IAAI,qBAAqB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAE/C,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;IAC1E,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAC/B,2BAA2B,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CACjE,CAAC;IACF,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACnF,MAAM,IAAI,mBAAmB,EAAE,CAAC;IAClC,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,mCAAmC;AACnC,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAc,EAAE,aAAqB;IACzE,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC/D,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAc,EACd,aAAqB;IAErB,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC3E,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC"}