@portaidentity/server 1.7.3 → 1.8.0

package/dist/rbac/permission-repository.d.ts

@@ -29,12 +29,21 @@ import type { Permission, CreatePermissionInput, UpdatePermissionInput } from '.
  */
 export declare function insertPermission(input: CreatePermissionInput): Promise<Permission>;
 /**
- * Find a permission by its UUID.
+ * Find a permission through its authoritative application parent.
  *
+ * @param applicationId - Parent application UUID
  * @param id - Permission UUID
  * @returns Permission or null if not found
  */
-export declare function findPermissionById(id: string): Promise<Permission | null>;
+export declare function findPermissionById(applicationId: string, id: string): Promise<Permission | null>;
+/**
+ * Lock and return a permission through its authoritative application parent.
+ *
+ * @param applicationId - Parent application UUID
+ * @param id - Permission UUID
+ * @returns Locked permission or null when the parent-child pair does not exist
+ */
+export declare function lockPermissionById(applicationId: string, id: string): Promise<Permission | null>;
 /**
  * Find a permission by application ID and slug.
  *
@@ -49,22 +58,40 @@ export declare function findPermissionBySlug(applicationId: string, slug: string
  * Only explicitly provided fields (not undefined) are included in the
  * UPDATE statement. Null is a valid value for description (clears it).
  *
+ * @param applicationId - Parent application UUID
  * @param id - Permission UUID
  * @param input - Fields to update (name, description only)
  * @returns Updated permission
  * @throws Error if permission not found or no fields provided
  */
-export declare function updatePermission(id: string, input: UpdatePermissionInput): Promise<Permission>;
+export declare function updatePermission(applicationId: string, id: string, input: UpdatePermissionInput): Promise<Permission>;
 /**
- * Delete a permission by ID.
+ * Check whether a module belongs to an application before permission creation.
  *
- * Returns true if a row was deleted, false if the permission didn't exist.
- * CASCADE constraints will automatically remove related role_permissions entries.
+ * The parent predicate prevents a globally valid module UUID from being attached
+ * to a permission owned by another application.
  *
- * @param id - Permission UUID
- * @returns true if deleted, false if not found
+ * @param applicationId - Parent application UUID
+ * @param moduleId - Module UUID supplied by the permission request
+ * @returns True when the module exists beneath the application
  */
-export declare function deletePermission(id: string): Promise<boolean>;
+export declare function lockPermissionModule(applicationId: string, moduleId: string): Promise<boolean>;
+/** Lock, capture, and delete a permission through its authoritative application parent. */
+export declare function deletePermission(applicationId: string, permissionId: string): Promise<{
+    permission: Permission;
+    userIds: string[];
+    roleIds: string[];
+    grantIds: string[];
+} | null>;
+/** Lock and capture a permission without deleting it. */
+export declare function capturePermissionForDeletion(applicationId: string, permissionId: string): Promise<{
+    permission: Permission;
+    userIds: string[];
+    roleIds: string[];
+    grantIds: string[];
+} | null>;
+/** Physically delete a permission previously locked through its parent. */
+export declare function deleteCapturedPermission(applicationId: string, permissionId: string): Promise<void>;
 /**
  * List permissions for an application, optionally filtered by module.
  *
@@ -87,14 +114,4 @@ export declare function listPermissionsByApplication(applicationId: string, modu
  * @returns true if the slug already exists
  */
 export declare function permissionSlugExists(applicationId: string, slug: string): Promise<boolean>;
-/**
- * Count roles that have a specific permission assigned.
- *
- * Used by the service layer as a deletion guard: if roles have this
- * permission, it cannot be deleted without force=true.
- *
- * @param permissionId - Permission UUID
- * @returns Number of roles with this permission
- */
-export declare function countRolesWithPermission(permissionId: string): Promise<number>;
 //# sourceMappingURL=permission-repository.d.ts.map

package/dist/rbac/permission-repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permission-repository.d.ts","sourceRoot":"","sources":["../../src/rbac/permission-repository.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAiB,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAO1G;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,UAAU,CAAC,CAiBxF;AAMD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAU/E;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAU5B;AAMD;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,UAAU,CAAC,CA+BrB;AAMD;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CASnE;AAMD;;;;;;;;;GASG;AACH,wBAAsB,4BAA4B,CAChD,aAAa,EAAE,MAAM,EACrB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,UAAU,EAAE,CAAC,CAgBvB;AAMD;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CACxC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,OAAO,CAAC,CAQlB;AAMD;;;;;;;;GAQG;AACH,wBAAsB,wBAAwB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CASpF"}
+{"version":3,"file":"permission-repository.d.ts","sourceRoot":"","sources":["../../src/rbac/permission-repository.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,KAAK,EACV,UAAU,EAEV,qBAAqB,EACrB,qBAAqB,EACtB,MAAM,YAAY,CAAC;AAOpB;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,UAAU,CAAC,CAiBxF;AAMD;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,aAAa,EAAE,MAAM,EACrB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAU5B;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,aAAa,EAAE,MAAM,EACrB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAQ5B;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAU5B;AAMD;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CACpC,aAAa,EAAE,MAAM,EACrB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,UAAU,CAAC,CAgCrB;AAED;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CACxC,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC,CAQlB;AAMD,2FAA2F;AAC3F,wBAAsB,gBAAgB,CACpC,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;IACT,UAAU,EAAE,UAAU,CAAC;IACvB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,GAAG,IAAI,CAAC,CAKR;AAED,yDAAyD;AACzD,wBAAsB,4BAA4B,CAChD,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;IACT,UAAU,EAAE,UAAU,CAAC;IACvB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,GAAG,IAAI,CAAC,CAoDR;AAED,2EAA2E;AAC3E,wBAAsB,wBAAwB,CAC5C,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAKf;AAMD;;;;;;;;;GASG;AACH,wBAAsB,4BAA4B,CAChD,aAAa,EAAE,MAAM,EACrB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,UAAU,EAAE,CAAC,CAgBvB;AAMD;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQhG"}

package/dist/rbac/permission-repository.js

@@ -48,18 +48,32 @@ export async function insertPermission(input) {
 // Find
 // ---------------------------------------------------------------------------
 /**
- * Find a permission by its UUID.
+ * Find a permission through its authoritative application parent.
  *
+ * @param applicationId - Parent application UUID
  * @param id - Permission UUID
  * @returns Permission or null if not found
  */
-export async function findPermissionById(id) {
+export async function findPermissionById(applicationId, id) {
     const pool = getPool();
-    const result = await pool.query('SELECT * FROM permissions WHERE id = $1', [id]);
+    const result = await pool.query('SELECT * FROM permissions WHERE application_id = $1 AND id = $2', [applicationId, id]);
     if (result.rows.length === 0)
         return null;
     return mapRowToPermission(result.rows[0]);
 }
+/**
+ * Lock and return a permission through its authoritative application parent.
+ *
+ * @param applicationId - Parent application UUID
+ * @param id - Permission UUID
+ * @returns Locked permission or null when the parent-child pair does not exist
+ */
+export async function lockPermissionById(applicationId, id) {
+    const result = await getPool().query(`SELECT * FROM permissions
+     WHERE application_id = $1 AND id = $2
+     FOR UPDATE`, [applicationId, id]);
+    return result.rows[0] ? mapRowToPermission(result.rows[0]) : null;
+}
 /**
  * Find a permission by application ID and slug.
  *
@@ -83,17 +97,18 @@ export async function findPermissionBySlug(applicationId, slug) {
  * Only explicitly provided fields (not undefined) are included in the
  * UPDATE statement. Null is a valid value for description (clears it).
  *
+ * @param applicationId - Parent application UUID
  * @param id - Permission UUID
  * @param input - Fields to update (name, description only)
  * @returns Updated permission
  * @throws Error if permission not found or no fields provided
  */
-export async function updatePermission(id, input) {
+export async function updatePermission(applicationId, id, input) {
     const pool = getPool();
     // Build dynamic SET clause — only name and description are updatable
     const setClauses = [];
-    const values = [id]; // $1 is always the ID
-    let paramIndex = 2;
+    const values = [applicationId, id];
+    let paramIndex = 3;
     if (input.name !== undefined) {
         setClauses.push(`name = $${paramIndex}`);
         values.push(input.name);
@@ -106,29 +121,89 @@ export async function updatePermission(id, input) {
     if (setClauses.length === 0) {
         throw new Error('No fields to update');
     }
-    const sql = `UPDATE permissions SET ${setClauses.join(', ')} WHERE id = $1 RETURNING *`;
+    const sql = `UPDATE permissions SET ${setClauses.join(', ')}
+    WHERE application_id = $1 AND id = $2 RETURNING *`;
     const result = await pool.query(sql, values);
     if (result.rows.length === 0) {
         throw new Error('Permission not found');
     }
     return mapRowToPermission(result.rows[0]);
 }
-// ---------------------------------------------------------------------------
-// Delete
-// ---------------------------------------------------------------------------
 /**
- * Delete a permission by ID.
+ * Check whether a module belongs to an application before permission creation.
  *
- * Returns true if a row was deleted, false if the permission didn't exist.
- * CASCADE constraints will automatically remove related role_permissions entries.
+ * The parent predicate prevents a globally valid module UUID from being attached
+ * to a permission owned by another application.
  *
- * @param id - Permission UUID
- * @returns true if deleted, false if not found
+ * @param applicationId - Parent application UUID
+ * @param moduleId - Module UUID supplied by the permission request
+ * @returns True when the module exists beneath the application
  */
-export async function deletePermission(id) {
+export async function lockPermissionModule(applicationId, moduleId) {
+    const result = await getPool().query(`SELECT id FROM application_modules
+     WHERE application_id = $1 AND id = $2
+     FOR KEY SHARE`, [applicationId, moduleId]);
+    return result.rows.length === 1;
+}
+// ---------------------------------------------------------------------------
+// Delete
+// ---------------------------------------------------------------------------
+/** Lock, capture, and delete a permission through its authoritative application parent. */
+export async function deletePermission(applicationId, permissionId) {
+    const capture = await capturePermissionForDeletion(applicationId, permissionId);
+    if (!capture)
+        return null;
+    await deleteCapturedPermission(applicationId, permissionId);
+    return capture;
+}
+/** Lock and capture a permission without deleting it. */
+export async function capturePermissionForDeletion(applicationId, permissionId) {
     const pool = getPool();
-    const result = await pool.query('DELETE FROM permissions WHERE id = $1', [id]);
-    return (result.rowCount ?? 0) > 0;
+    const target = await pool.query(`SELECT * FROM permissions WHERE application_id = $1 AND id = $2 FOR UPDATE`, [applicationId, permissionId]);
+    if (!target.rows[0])
+        return null;
+    await pool.query(`SELECT role.id
+     FROM roles role
+     JOIN role_permissions mapping ON mapping.role_id = role.id
+     WHERE mapping.permission_id = $1
+       AND role.application_id = $2
+     ORDER BY role.id
+     FOR UPDATE OF role`, [permissionId, applicationId]);
+    const graph = await pool.query(`WITH affected_roles AS (
+       SELECT mapping.role_id
+       FROM role_permissions mapping
+       JOIN roles role ON role.id = mapping.role_id
+       WHERE mapping.permission_id = $1
+         AND role.application_id = $2
+     ), affected_users AS (
+       SELECT DISTINCT assignment.user_id FROM user_roles assignment
+       WHERE assignment.role_id = ANY(ARRAY(SELECT role_id FROM affected_roles))
+     )
+     SELECT
+       ARRAY(SELECT user_id FROM affected_users ORDER BY user_id) AS user_ids,
+       ARRAY(SELECT role_id FROM affected_roles ORDER BY role_id) AS role_ids,
+       ARRAY(
+         SELECT payload.id FROM oidc_payloads payload
+         WHERE payload.type = 'Grant'
+           AND payload.payload->>'accountId' = ANY(ARRAY(SELECT user_id::text FROM affected_users))
+           AND payload.payload->>'clientId' = ANY(ARRAY(
+             SELECT client_id FROM clients WHERE application_id = $2
+           ))
+         ORDER BY payload.id
+       ) AS grant_ids`, [permissionId, applicationId]);
+    return {
+        permission: mapRowToPermission(target.rows[0]),
+        userIds: graph.rows[0].user_ids,
+        roleIds: graph.rows[0].role_ids,
+        grantIds: graph.rows[0].grant_ids,
+    };
+}
+/** Physically delete a permission previously locked through its parent. */
+export async function deleteCapturedPermission(applicationId, permissionId) {
+    await getPool().query('DELETE FROM permissions WHERE application_id = $1 AND id = $2', [
+        applicationId,
+        permissionId,
+    ]);
 }
 // ---------------------------------------------------------------------------
 // List
@@ -170,21 +245,4 @@ export async function permissionSlugExists(applicationId, slug) {
     const result = await pool.query('SELECT EXISTS(SELECT 1 FROM permissions WHERE application_id = $1 AND slug = $2) as exists', [applicationId, slug]);
     return result.rows[0].exists;
 }
-// ---------------------------------------------------------------------------
-// Role count (deletion guard)
-// ---------------------------------------------------------------------------
-/**
- * Count roles that have a specific permission assigned.
- *
- * Used by the service layer as a deletion guard: if roles have this
- * permission, it cannot be deleted without force=true.
- *
- * @param permissionId - Permission UUID
- * @returns Number of roles with this permission
- */
-export async function countRolesWithPermission(permissionId) {
-    const pool = getPool();
-    const result = await pool.query('SELECT COUNT(*)::int as count FROM role_permissions WHERE permission_id = $1', [permissionId]);
-    return parseInt(result.rows[0].count, 10);
-}
 //# sourceMappingURL=permission-repository.js.map

package/dist/rbac/permission-repository.js.map

@@ -1 +1 @@
-{"version":3,"file":"permission-repository.js","sourceRoot":"","sources":["../../src/rbac/permission-repository.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEhD,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAA4B;IACjE,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;iBAEa,EACb;QACE,KAAK,CAAC,aAAa;QACnB,KAAK,CAAC,QAAQ,IAAI,IAAI;QACtB,KAAK,CAAC,IAAI;QACV,KAAK,CAAC,IAAI;QACV,KAAK,CAAC,WAAW,IAAI,IAAI;KAC1B,CACF,CAAC;IAEF,OAAO,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EAAU;IACjD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,yCAAyC,EACzC,CAAC,EAAE,CAAC,CACL,CAAC;IAEF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,aAAqB,EACrB,IAAY;IAEZ,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,mEAAmE,EACnE,CAAC,aAAa,EAAE,IAAI,CAAC,CACtB,CAAC;IAEF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,EAAU,EACV,KAA4B;IAE5B,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,qEAAqE;IACrE,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,MAAM,GAAc,CAAC,EAAE,CAAC,CAAC,CAAC,sBAAsB;IACtD,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,UAAU,CAAC,IAAI,CAAC,WAAW,UAAU,EAAE,CAAC,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxB,UAAU,EAAE,CAAC;IACf,CAAC;IAED,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACpC,UAAU,CAAC,IAAI,CAAC,kBAAkB,UAAU,EAAE,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,GAAG,GAAG,0BAA0B,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,4BAA4B,CAAC;IACxF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAgB,GAAG,EAAE,MAAM,CAAC,CAAC;IAE5D,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;IAED,OAAO,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EAAU;IAC/C,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,uCAAuC,EACvC,CAAC,EAAE,CAAC,CACL,CAAC;IAEF,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC;AAED,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,aAAqB,EACrB,QAAiB;IAEjB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,0FAA0F,EAC1F,CAAC,aAAa,EAAE,QAAQ,CAAC,CAC1B,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,uEAAuE,EACvE,CAAC,aAAa,CAAC,CAChB,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC7C,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,aAAqB,EACrB,IAAY;IAEZ,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,4FAA4F,EAC5F,CAAC,aAAa,EAAE,IAAI,CAAC,CACtB,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAC/B,CAAC;AAED,8EAA8E;AAC9E,8BAA8B;AAC9B,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,YAAoB;IACjE,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,8EAA8E,EAC9E,CAAC,YAAY,CAAC,CACf,CAAC;IAEF,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC5C,CAAC"}
+{"version":3,"file":"permission-repository.js","sourceRoot":"","sources":["../../src/rbac/permission-repository.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAO7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEhD,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAA4B;IACjE,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;iBAEa,EACb;QACE,KAAK,CAAC,aAAa;QACnB,KAAK,CAAC,QAAQ,IAAI,IAAI;QACtB,KAAK,CAAC,IAAI;QACV,KAAK,CAAC,IAAI;QACV,KAAK,CAAC,WAAW,IAAI,IAAI;KAC1B,CACF,CAAC;IAEF,OAAO,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,aAAqB,EACrB,EAAU;IAEV,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,iEAAiE,EACjE,CAAC,aAAa,EAAE,EAAE,CAAC,CACpB,CAAC;IAEF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,aAAqB,EACrB,EAAU;IAEV,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC,KAAK,CAClC;;gBAEY,EACZ,CAAC,aAAa,EAAE,EAAE,CAAC,CACpB,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACpE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,aAAqB,EACrB,IAAY;IAEZ,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,mEAAmE,EACnE,CAAC,aAAa,EAAE,IAAI,CAAC,CACtB,CAAC;IAEF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,aAAqB,EACrB,EAAU,EACV,KAA4B;IAE5B,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,qEAAqE;IACrE,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,MAAM,GAAc,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IAC9C,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,UAAU,CAAC,IAAI,CAAC,WAAW,UAAU,EAAE,CAAC,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxB,UAAU,EAAE,CAAC;IACf,CAAC;IAED,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACpC,UAAU,CAAC,IAAI,CAAC,kBAAkB,UAAU,EAAE,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,GAAG,GAAG,0BAA0B,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;sDACP,CAAC;IACrD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAgB,GAAG,EAAE,MAAM,CAAC,CAAC;IAE5D,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;IAED,OAAO,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,aAAqB,EACrB,QAAgB;IAEhB,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC,KAAK,CAClC;;mBAEe,EACf,CAAC,aAAa,EAAE,QAAQ,CAAC,CAC1B,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;AAClC,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,aAAqB,EACrB,YAAoB;IAOpB,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAChF,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,wBAAwB,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAC5D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,yDAAyD;AACzD,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,aAAqB,EACrB,YAAoB;IAOpB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,4EAA4E,EAC5E,CAAC,aAAa,EAAE,YAAY,CAAC,CAC9B,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,IAAI,CAAC,KAAK,CACd;;;;;;wBAMoB,EACpB,CAAC,YAAY,EAAE,aAAa,CAAC,CAC9B,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAK5B;;;;;;;;;;;;;;;;;;;;;sBAqBkB,EAClB,CAAC,YAAY,EAAE,aAAa,CAAC,CAC9B,CAAC;IACF,OAAO;QACL,UAAU,EAAE,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9C,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,QAAQ;QAChC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,QAAQ;QAChC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,SAAS;KACnC,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,aAAqB,EACrB,YAAoB;IAEpB,MAAM,OAAO,EAAE,CAAC,KAAK,CAAC,+DAA+D,EAAE;QACrF,aAAa;QACb,YAAY;KACb,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,aAAqB,EACrB,QAAiB;IAEjB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,0FAA0F,EAC1F,CAAC,aAAa,EAAE,QAAQ,CAAC,CAC1B,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,uEAAuE,EACvE,CAAC,aAAa,CAAC,CAChB,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC7C,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,aAAqB,EAAE,IAAY;IAC5E,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,4FAA4F,EAC5F,CAAC,aAAa,EAAE,IAAI,CAAC,CACtB,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAC/B,CAAC"}

package/dist/rbac/permission-service.d.ts

@@ -4,9 +4,8 @@
  * Orchestrates permission CRUD operations with slug format validation,
  * uniqueness checks, deletion guards, cache management, and audit logging.
  *
- * Permission slugs follow the module:resource:action format (e.g.,
- * "crm:contacts:read") and are immutable after creation — only name
- * and description can be updated.
+ * Permission slugs are application-defined claim values and are immutable after creation — only
+ * name and description can be updated.
  *
  * All write operations follow the pattern:
  *   validate → DB operation → cache invalidate → audit log
@@ -19,8 +18,7 @@ import type { Permission, Role, CreatePermissionInput, UpdatePermissionInput } f
 /**
  * Create a new permission for an application.
  *
- * Validates that the slug follows the module:resource:action format
- * and ensures uniqueness within the application.
+ * Validates the exact claim value and ensures uniqueness within the application.
  *
  * @param input - Permission creation data
  * @param actorId - Optional UUID of the admin performing the action
@@ -31,10 +29,11 @@ export declare function createPermission(input: CreatePermissionInput, actorId?:
 /**
  * Find a permission by ID.
  *
+ * @param applicationId - Parent application UUID
  * @param id - Permission UUID
  * @returns Permission or null if not found
  */
-export declare function findPermissionById(id: string): Promise<Permission | null>;
+export declare function findPermissionById(applicationId: string, id: string): Promise<Permission | null>;
 /**
  * Find a permission by application ID and slug.
  *
@@ -54,32 +53,32 @@ export declare function listPermissionsByApplication(applicationId: string, modu
 /**
  * Update a permission by ID (name and description only — slug is immutable).
  *
+ * @param applicationId - Parent application UUID
  * @param id - Permission UUID
  * @param input - Fields to update (name, description only)
  * @param actorId - Optional UUID of the admin performing the action
  * @returns Updated permission
  * @throws PermissionNotFoundError if permission doesn't exist
  */
-export declare function updatePermission(id: string, input: UpdatePermissionInput, actorId?: string): Promise<Permission>;
+export declare function updatePermission(applicationId: string, id: string, input: UpdatePermissionInput, actorId?: string): Promise<Permission>;
 /**
- * Delete a permission by ID.
+ * Delete a permission through its authoritative application parent.
  *
- * By default (force=false), refuses to delete permissions that are
- * assigned to any role. Pass force=true to delete regardless —
- * CASCADE will remove role_permissions entries.
- *
- * @param id - Permission UUID
- * @param force - If true, delete even if assigned to roles
- * @param actorId - Optional UUID of the admin performing the action
- * @throws PermissionNotFoundError if permission doesn't exist
- * @throws RbacValidationError if assigned to roles and force is false
+ * @param applicationId - Parent application UUID.
+ * @param permissionId - Child permission UUID.
+ * @param actorId - Actor identifier used for audit attribution when applicable.
+ * @returns Whether the actor must authenticate again
+ * @throws PermissionNotFoundError when the permission is absent from the requested boundary.
  */
-export declare function deletePermission(id: string, force?: boolean, actorId?: string): Promise<void>;
+export declare function deletePermission(applicationId: string, permissionId: string, actorId?: string): Promise<{
+    reauthenticationRequired: boolean;
+}>;
 /**
  * Get all roles that have a specific permission assigned.
  *
+ * @param applicationId - Parent application UUID
  * @param permissionId - Permission UUID
  * @returns Array of roles with this permission
  */
-export declare function getRolesWithPermission(permissionId: string): Promise<Role[]>;
+export declare function getRolesWithPermission(applicationId: string, permissionId: string): Promise<Role[]>;
 //# sourceMappingURL=permission-service.d.ts.map

package/dist/rbac/permission-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permission-service.d.ts","sourceRoot":"","sources":["../../src/rbac/permission-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAiBH,OAAO,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAMjG;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,qBAAqB,EAC5B,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,CAAC,CAgCrB;AAMD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAE/E;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAE5B;AAED;;;;;;GAMG;AACH,wBAAsB,4BAA4B,CAChD,aAAa,EAAE,MAAM,EACrB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,UAAU,EAAE,CAAC,CAEvB;AAMD;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,qBAAqB,EAC5B,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,CAAC,CAmBrB;AAMD;;;;;;;;;;;;GAYG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,MAAM,EACV,KAAK,GAAE,OAAe,EACtB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAgCf;AAMD;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAElF"}
+{"version":3,"file":"permission-service.d.ts","sourceRoot":"","sources":["../../src/rbac/permission-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAkBH,OAAO,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAgBjG;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,qBAAqB,EAC5B,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,CAAC,CAuCrB;AAMD;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,aAAa,EAAE,MAAM,EACrB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAE5B;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAE5B;AAED;;;;;;GAMG;AACH,wBAAsB,4BAA4B,CAChD,aAAa,EAAE,MAAM,EACrB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,UAAU,EAAE,CAAC,CAEvB;AAMD;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CACpC,aAAa,EAAE,MAAM,EACrB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,qBAAqB,EAC5B,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,CAAC,CA2BrB;AAMD;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CACpC,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,wBAAwB,EAAE,OAAO,CAAA;CAAE,CAAC,CAkChD;AAMD;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,EAAE,CAAC,CAIjB"}

package/dist/rbac/permission-service.js

@@ -4,9 +4,8 @@
  * Orchestrates permission CRUD operations with slug format validation,
  * uniqueness checks, deletion guards, cache management, and audit logging.
  *
- * Permission slugs follow the module:resource:action format (e.g.,
- * "crm:contacts:read") and are immutable after creation — only name
- * and description can be updated.
+ * Permission slugs are application-defined claim values and are immutable after creation — only
+ * name and description can be updated.
  *
  * All write operations follow the pattern:
  *   validate → DB operation → cache invalidate → audit log
@@ -15,20 +14,27 @@
  * @see mapping-repository.ts — Role-permission lookups
  * @see cache.ts — Redis cache operations
  */
-import { insertPermission, findPermissionById as repoFindPermissionById, findPermissionBySlug as repoFindPermissionBySlug, updatePermission as repoUpdatePermission, deletePermission as repoDeletePermission, listPermissionsByApplication as repoListPermissionsByApplication, permissionSlugExists, countRolesWithPermission, } from './permission-repository.js';
+import { insertPermission, findPermissionById as repoFindPermissionById, lockPermissionById, lockPermissionModule, findPermissionBySlug as repoFindPermissionBySlug, updatePermission as repoUpdatePermission, capturePermissionForDeletion, deleteCapturedPermission, listPermissionsByApplication as repoListPermissionsByApplication, permissionSlugExists, } from './permission-repository.js';
 import { getRolesWithPermission as repoGetRolesWithPermission } from './mapping-repository.js';
-import { invalidateAllUserRbacCaches } from './cache.js';
-import { validatePermissionSlug } from './slugs.js';
+import { normalizeRbacSlug, validatePermissionSlug } from './slugs.js';
 import { PermissionNotFoundError, RbacValidationError } from './errors.js';
 import { writeAuditLog } from '../lib/audit-log.js';
+import { getDatabaseTransactionClient } from '../lib/database.js';
+import { writeAuditLogInTransaction } from '../lib/audit-log.js';
+import { registerDeletionCleanup } from '../lib/deletion-cleanup.js';
+import { revokeAffectedAuthorityInTransaction } from '../lib/authority-revocation.js';
+import { getApplicationBySlug } from '../applications/service.js';
+import { ALL_ADMIN_PERMISSIONS } from '../lib/admin-permissions.js';
+const PERMISSION_DELETED_EVENT = 'permission.deleted';
+const ADMIN_APPLICATION_SLUG = 'porta-admin';
+const ADMIN_PERMISSION_SLUGS = new Set(ALL_ADMIN_PERMISSIONS);
 // ---------------------------------------------------------------------------
 // Create
 // ---------------------------------------------------------------------------
 /**
  * Create a new permission for an application.
  *
- * Validates that the slug follows the module:resource:action format
- * and ensures uniqueness within the application.
+ * Validates the exact claim value and ensures uniqueness within the application.
  *
  * @param input - Permission creation data
  * @param actorId - Optional UUID of the admin performing the action
@@ -36,17 +42,26 @@ import { writeAuditLog } from '../lib/audit-log.js';
  * @throws RbacValidationError if slug format is invalid or already exists
  */
 export async function createPermission(input, actorId) {
-    // Validate permission slug format (module:resource:action)
-    if (!validatePermissionSlug(input.slug)) {
-        throw new RbacValidationError(`Invalid permission slug format: "${input.slug}". Must follow module:resource:action pattern with at least 3 colon-separated segments.`);
+    const slug = normalizeRbacSlug(input.slug);
+    if (!validatePermissionSlug(slug)) {
+        throw new RbacValidationError('Invalid permission slug. Must be 1-150 characters without control characters.');
+    }
+    await guardCanonicalAdminPermission(input.applicationId, slug);
+    if (input.moduleId) {
+        if (!getDatabaseTransactionClient()) {
+            throw new Error('Permission module validation requires an active database transaction');
+        }
+        if (!(await lockPermissionModule(input.applicationId, input.moduleId))) {
+            throw new RbacValidationError('Permission module must belong to the selected application');
+        }
     }
     // Check slug uniqueness within the application
-    const exists = await permissionSlugExists(input.applicationId, input.slug);
+    const exists = await permissionSlugExists(input.applicationId, slug);
     if (exists) {
-        throw new RbacValidationError(`Permission slug "${input.slug}" already exists for this application.`);
+        throw new RbacValidationError(`Permission slug "${slug}" already exists for this application.`);
     }
     // Insert the permission
-    const permission = await insertPermission(input);
+    const permission = await insertPermission({ ...input, slug });
     // Audit log (fire-and-forget)
     void writeAuditLog({
         eventType: 'permission.created',
@@ -66,11 +81,12 @@ export async function createPermission(input, actorId) {
 /**
  * Find a permission by ID.
  *
+ * @param applicationId - Parent application UUID
  * @param id - Permission UUID
  * @returns Permission or null if not found
  */
-export async function findPermissionById(id) {
-    return repoFindPermissionById(id);
+export async function findPermissionById(applicationId, id) {
+    return repoFindPermissionById(applicationId, id);
 }
 /**
  * Find a permission by application ID and slug.
@@ -98,26 +114,34 @@ export async function listPermissionsByApplication(applicationId, moduleId) {
 /**
  * Update a permission by ID (name and description only — slug is immutable).
  *
+ * @param applicationId - Parent application UUID
  * @param id - Permission UUID
  * @param input - Fields to update (name, description only)
  * @param actorId - Optional UUID of the admin performing the action
  * @returns Updated permission
  * @throws PermissionNotFoundError if permission doesn't exist
  */
-export async function updatePermission(id, input, actorId) {
-    // Verify permission exists
-    const existing = await repoFindPermissionById(id);
+export async function updatePermission(applicationId, id, input, actorId) {
+    if (!getDatabaseTransactionClient()) {
+        throw new Error('Permission update requires an active database transaction');
+    }
+    const existing = await lockPermissionById(applicationId, id);
     if (!existing) {
         throw new PermissionNotFoundError(id);
     }
+    await guardCanonicalAdminPermission(applicationId, existing.slug);
+    const changed = (input.name !== undefined && input.name !== existing.name) ||
+        (input.description !== undefined && input.description !== existing.description);
+    if (!changed)
+        return existing;
     // Perform the update (slug is not updatable at the repository level)
-    const updated = await repoUpdatePermission(id, input);
+    const updated = await repoUpdatePermission(applicationId, id, input);
     // Audit log (fire-and-forget)
     void writeAuditLog({
         eventType: 'permission.updated',
         eventCategory: 'admin',
         actorId,
-        metadata: { permissionId: id, changes: input },
+        metadata: { applicationId, permissionId: id, changes: input },
     });
     return updated;
 }
@@ -125,44 +149,50 @@ export async function updatePermission(id, input, actorId) {
 // Delete
 // ---------------------------------------------------------------------------
 /**
- * Delete a permission by ID.
- *
- * By default (force=false), refuses to delete permissions that are
- * assigned to any role. Pass force=true to delete regardless —
- * CASCADE will remove role_permissions entries.
+ * Delete a permission through its authoritative application parent.
  *
- * @param id - Permission UUID
- * @param force - If true, delete even if assigned to roles
- * @param actorId - Optional UUID of the admin performing the action
- * @throws PermissionNotFoundError if permission doesn't exist
- * @throws RbacValidationError if assigned to roles and force is false
+ * @param applicationId - Parent application UUID.
+ * @param permissionId - Child permission UUID.
+ * @param actorId - Actor identifier used for audit attribution when applicable.
+ * @returns Whether the actor must authenticate again
+ * @throws PermissionNotFoundError when the permission is absent from the requested boundary.
  */
-export async function deletePermission(id, force = false, actorId) {
-    // Verify permission exists
-    const existing = await repoFindPermissionById(id);
-    if (!existing) {
-        throw new PermissionNotFoundError(id);
-    }
-    // Deletion guard: check for assigned roles
-    if (!force) {
-        const roleCount = await countRolesWithPermission(id);
-        if (roleCount > 0) {
-            throw new RbacValidationError(`Cannot delete permission "${existing.slug}": assigned to ${roleCount} role(s). Use force=true to override.`);
-        }
-    }
-    // Delete the permission (CASCADE handles related records)
-    await repoDeletePermission(id);
-    // Invalidate user caches — permissions may have changed for users who had this
-    if (force) {
-        await invalidateAllUserRbacCaches();
-    }
-    // Audit log (fire-and-forget)
-    void writeAuditLog({
-        eventType: 'permission.deleted',
-        eventCategory: 'admin',
+export async function deletePermission(applicationId, permissionId, actorId) {
+    const transaction = getDatabaseTransactionClient();
+    if (!transaction)
+        throw new Error('Permission deletion requires an active database transaction');
+    const capture = await capturePermissionForDeletion(applicationId, permissionId);
+    if (!capture)
+        throw new PermissionNotFoundError(permissionId);
+    await guardCanonicalAdminPermission(applicationId, capture.permission.slug);
+    const revoked = await revokeAffectedAuthorityInTransaction(capture.userIds);
+    await writeAuditLogInTransaction(transaction, {
         actorId,
-        metadata: { permissionId: id, slug: existing.slug, force },
+        eventType: PERMISSION_DELETED_EVENT,
+        eventCategory: 'admin',
+        metadata: {
+            applicationId,
+            permissionId,
+            slug: capture.permission.slug,
+        },
+    });
+    await deleteCapturedPermission(applicationId, permissionId);
+    await registerDeletionCleanup({
+        resource: 'permission',
+        targetId: permissionId,
+        parentId: applicationId,
+        userIds: capture.userIds,
+        clientIds: [],
+        publicClientIds: [],
+        grantIds: revoked.grantIds,
+        roleIds: capture.roleIds,
+        permissionIds: [permissionId],
+        claimIds: [],
+        applicationIds: [applicationId],
     });
+    return {
+        reauthenticationRequired: actorId !== undefined && capture.userIds.includes(actorId),
+    };
 }
 // ---------------------------------------------------------------------------
 // Role lookups
@@ -170,10 +200,23 @@ export async function deletePermission(id, force = false, actorId) {
 /**
  * Get all roles that have a specific permission assigned.
  *
+ * @param applicationId - Parent application UUID
  * @param permissionId - Permission UUID
  * @returns Array of roles with this permission
  */
-export async function getRolesWithPermission(permissionId) {
-    return repoGetRolesWithPermission(permissionId);
+export async function getRolesWithPermission(applicationId, permissionId) {
+    const permission = await repoFindPermissionById(applicationId, permissionId);
+    if (!permission)
+        throw new PermissionNotFoundError(permissionId);
+    return repoGetRolesWithPermission(applicationId, permissionId);
+}
+/** Reject generic creation or mutation of canonical Porta Admin permissions. */
+async function guardCanonicalAdminPermission(applicationId, permissionSlug) {
+    if (!ADMIN_PERMISSION_SLUGS.has(permissionSlug))
+        return;
+    const adminApplication = await getApplicationBySlug(ADMIN_APPLICATION_SLUG);
+    if (adminApplication?.id === applicationId) {
+        throw new RbacValidationError('Canonical Porta Admin permissions cannot be modified');
+    }
 }
 //# sourceMappingURL=permission-service.js.map