@portaidentity/server 1.7.3 → 1.8.0

package/dist/rbac/permission-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"permission-service.js","sourceRoot":"","sources":["../../src/rbac/permission-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EACL,gBAAgB,EAChB,kBAAkB,IAAI,sBAAsB,EAC5C,oBAAoB,IAAI,wBAAwB,EAChD,gBAAgB,IAAI,oBAAoB,EACxC,gBAAgB,IAAI,oBAAoB,EACxC,4BAA4B,IAAI,gCAAgC,EAChE,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,sBAAsB,IAAI,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AAC/F,OAAO,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAA4B,EAC5B,OAAgB;IAEhB,2DAA2D;IAC3D,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,mBAAmB,CAC3B,oCAAoC,KAAK,CAAC,IAAI,yFAAyF,CACxI,CAAC;IACJ,CAAC;IAED,+CAA+C;IAC/C,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3E,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,IAAI,mBAAmB,CAC3B,oBAAoB,KAAK,CAAC,IAAI,wCAAwC,CACvE,CAAC;IACJ,CAAC;IAED,wBAAwB;IACxB,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAEjD,8BAA8B;IAC9B,KAAK,aAAa,CAAC;QACjB,SAAS,EAAE,oBAAoB;QAC/B,aAAa,EAAE,OAAO;QACtB,OAAO;QACP,QAAQ,EAAE;YACR,YAAY,EAAE,UAAU,CAAC,EAAE;YAC3B,aAAa,EAAE,UAAU,CAAC,aAAa;YACvC,IAAI,EAAE,UAAU,CAAC,IAAI;SACtB;KACF,CAAC,CAAC;IAEH,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EAAU;IACjD,OAAO,sBAAsB,CAAC,EAAE,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,aAAqB,EACrB,IAAY;IAEZ,OAAO,wBAAwB,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,aAAqB,EACrB,QAAiB;IAEjB,OAAO,gCAAgC,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;AACnE,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,EAAU,EACV,KAA4B,EAC5B,OAAgB;IAEhB,2BAA2B;IAC3B,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,uBAAuB,CAAC,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,qEAAqE;IACrE,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAEtD,8BAA8B;IAC9B,KAAK,aAAa,CAAC;QACjB,SAAS,EAAE,oBAAoB;QAC/B,aAAa,EAAE,OAAO;QACtB,OAAO;QACP,QAAQ,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;KAC/C,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,EAAU,EACV,KAAK,GAAY,KAAK,EACtB,OAAgB;IAEhB,2BAA2B;IAC3B,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,uBAAuB,CAAC,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,2CAA2C;IAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,SAAS,GAAG,MAAM,wBAAwB,CAAC,EAAE,CAAC,CAAC;QACrD,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YAClB,MAAM,IAAI,mBAAmB,CAC3B,6BAA6B,QAAQ,CAAC,IAAI,kBAAkB,SAAS,uCAAuC,CAC7G,CAAC;QACJ,CAAC;IACH,CAAC;IAED,0DAA0D;IAC1D,MAAM,oBAAoB,CAAC,EAAE,CAAC,CAAC;IAE/B,+EAA+E;IAC/E,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,2BAA2B,EAAE,CAAC;IACtC,CAAC;IAED,8BAA8B;IAC9B,KAAK,aAAa,CAAC;QACjB,SAAS,EAAE,oBAAoB;QAC/B,aAAa,EAAE,OAAO;QACtB,OAAO;QACP,QAAQ,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE;KAC3D,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,YAAoB;IAC/D,OAAO,0BAA0B,CAAC,YAAY,CAAC,CAAC;AAClD,CAAC"}
+{"version":3,"file":"permission-service.js","sourceRoot":"","sources":["../../src/rbac/permission-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EACL,gBAAgB,EAChB,kBAAkB,IAAI,sBAAsB,EAC5C,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,IAAI,wBAAwB,EAChD,gBAAgB,IAAI,oBAAoB,EACxC,4BAA4B,EAC5B,wBAAwB,EACxB,4BAA4B,IAAI,gCAAgC,EAChE,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,sBAAsB,IAAI,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AAC/F,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,oCAAoC,EAAE,MAAM,gCAAgC,CAAC;AACtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAEpE,MAAM,wBAAwB,GAAG,oBAAoB,CAAC;AACtD,MAAM,sBAAsB,GAAG,aAAa,CAAC;AAC7C,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAS,qBAAqB,CAAC,CAAC;AAEtE,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAA4B,EAC5B,OAAgB;IAEhB,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,mBAAmB,CAC3B,+EAA+E,CAChF,CAAC;IACJ,CAAC;IACD,MAAM,6BAA6B,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IAC/D,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,IAAI,CAAC,4BAA4B,EAAE,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,oBAAoB,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,mBAAmB,CAAC,2DAA2D,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;IAED,+CAA+C;IAC/C,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IACrE,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,IAAI,wCAAwC,CAAC,CAAC;IAClG,CAAC;IAED,wBAAwB;IACxB,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAE9D,8BAA8B;IAC9B,KAAK,aAAa,CAAC;QACjB,SAAS,EAAE,oBAAoB;QAC/B,aAAa,EAAE,OAAO;QACtB,OAAO;QACP,QAAQ,EAAE;YACR,YAAY,EAAE,UAAU,CAAC,EAAE;YAC3B,aAAa,EAAE,UAAU,CAAC,aAAa;YACvC,IAAI,EAAE,UAAU,CAAC,IAAI;SACtB;KACF,CAAC,CAAC;IAEH,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,aAAqB,EACrB,EAAU;IAEV,OAAO,sBAAsB,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,aAAqB,EACrB,IAAY;IAEZ,OAAO,wBAAwB,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,aAAqB,EACrB,QAAiB;IAEjB,OAAO,gCAAgC,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;AACnE,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,aAAqB,EACrB,EAAU,EACV,KAA4B,EAC5B,OAAgB;IAEhB,IAAI,CAAC,4BAA4B,EAAE,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,uBAAuB,CAAC,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,6BAA6B,CAAC,aAAa,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAElE,MAAM,OAAO,GACX,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,CAAC;QAC1D,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,CAAC,CAAC;IAClF,IAAI,CAAC,OAAO;QAAE,OAAO,QAAQ,CAAC;IAE9B,qEAAqE;IACrE,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,aAAa,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;IAErE,8BAA8B;IAC9B,KAAK,aAAa,CAAC;QACjB,SAAS,EAAE,oBAAoB;QAC/B,aAAa,EAAE,OAAO;QACtB,OAAO;QACP,QAAQ,EAAE,EAAE,aAAa,EAAE,YAAY,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;KAC9D,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,aAAqB,EACrB,YAAoB,EACpB,OAAgB;IAEhB,MAAM,WAAW,GAAG,4BAA4B,EAAE,CAAC;IACnD,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjG,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAChF,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,uBAAuB,CAAC,YAAY,CAAC,CAAC;IAC9D,MAAM,6BAA6B,CAAC,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,MAAM,oCAAoC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5E,MAAM,0BAA0B,CAAC,WAAW,EAAE;QAC5C,OAAO;QACP,SAAS,EAAE,wBAAwB;QACnC,aAAa,EAAE,OAAO;QACtB,QAAQ,EAAE;YACR,aAAa;YACb,YAAY;YACZ,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI;SAC9B;KACF,CAAC,CAAC;IACH,MAAM,wBAAwB,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAC5D,MAAM,uBAAuB,CAAC;QAC5B,QAAQ,EAAE,YAAY;QACtB,QAAQ,EAAE,YAAY;QACtB,QAAQ,EAAE,aAAa;QACvB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,EAAE;QACb,eAAe,EAAE,EAAE;QACnB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,aAAa,EAAE,CAAC,YAAY,CAAC;QAC7B,QAAQ,EAAE,EAAE;QACZ,cAAc,EAAE,CAAC,aAAa,CAAC;KAChC,CAAC,CAAC;IACH,OAAO;QACL,wBAAwB,EAAE,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;KACrF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,aAAqB,EACrB,YAAoB;IAEpB,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAC7E,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,uBAAuB,CAAC,YAAY,CAAC,CAAC;IACjE,OAAO,0BAA0B,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;AACjE,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,6BAA6B,CAC1C,aAAqB,EACrB,cAAsB;IAEtB,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,cAAc,CAAC;QAAE,OAAO;IACxD,MAAM,gBAAgB,GAAG,MAAM,oBAAoB,CAAC,sBAAsB,CAAC,CAAC;IAC5E,IAAI,gBAAgB,EAAE,EAAE,KAAK,aAAa,EAAE,CAAC;QAC3C,MAAM,IAAI,mBAAmB,CAAC,sDAAsD,CAAC,CAAC;IACxF,CAAC;AACH,CAAC"}

package/dist/rbac/role-repository.d.ts

@@ -29,12 +29,21 @@ import type { Role, CreateRoleInput, UpdateRoleInput } from './types.js';
  */
 export declare function insertRole(input: CreateRoleInput): Promise<Role>;
 /**
- * Find a role by its UUID.
+ * Find a role through its authoritative application parent.
  *
+ * @param applicationId - Parent application UUID
  * @param id - Role UUID
  * @returns Role or null if not found
  */
-export declare function findRoleById(id: string): Promise<Role | null>;
+export declare function findRoleById(applicationId: string, id: string): Promise<Role | null>;
+/**
+ * Lock and return a role through its authoritative application parent.
+ *
+ * @param applicationId - Parent application UUID
+ * @param id - Role UUID
+ * @returns Locked role or null when the parent-child pair does not exist
+ */
+export declare function lockRoleById(applicationId: string, id: string): Promise<Role | null>;
 /**
  * Find a role by application ID and slug.
  *
@@ -51,23 +60,29 @@ export declare function findRoleBySlug(applicationId: string, slug: string): Pro
  * fields that weren't specified. Null is a valid value for description
  * (clears it).
  *
+ * @param applicationId - Parent application UUID
  * @param id - Role UUID
  * @param input - Fields to update (only non-undefined fields are applied)
  * @returns Updated role
  * @throws Error if role not found or no fields provided
  */
-export declare function updateRole(id: string, input: UpdateRoleInput): Promise<Role>;
-/**
- * Delete a role by ID.
- *
- * Returns true if a row was deleted, false if the role didn't exist.
- * CASCADE constraints will automatically remove related role_permissions
- * and user_roles entries.
- *
- * @param id - Role UUID
- * @returns true if deleted, false if not found
- */
-export declare function deleteRole(id: string): Promise<boolean>;
+export declare function updateRole(applicationId: string, id: string, input: UpdateRoleInput): Promise<Role>;
+/** Lock, capture, and delete a role through its authoritative application parent. */
+export declare function deleteRole(applicationId: string, roleId: string): Promise<{
+    role: Role;
+    userIds: string[];
+    permissionIds: string[];
+    grantIds: string[];
+} | null>;
+/** Lock and capture a role without deleting it. */
+export declare function captureRoleForDeletion(applicationId: string, roleId: string): Promise<{
+    role: Role;
+    userIds: string[];
+    permissionIds: string[];
+    grantIds: string[];
+} | null>;
+/** Physically delete a role previously locked through its parent. */
+export declare function deleteCapturedRole(applicationId: string, roleId: string): Promise<void>;
 /**
  * List all roles for an application, ordered by name ascending.
  *
@@ -91,14 +106,4 @@ export declare function listRolesByApplication(applicationId: string): Promise<R
  * @returns true if the slug already exists
  */
 export declare function roleSlugExists(applicationId: string, slug: string, excludeId?: string): Promise<boolean>;
-/**
- * Count users assigned to a role.
- *
- * Used by the service layer as a deletion guard: if users are assigned,
- * the role cannot be deleted without force=true.
- *
- * @param roleId - Role UUID
- * @returns Number of users with this role
- */
-export declare function countUsersWithRole(roleId: string): Promise<number>;
 //# sourceMappingURL=role-repository.d.ts.map

package/dist/rbac/role-repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role-repository.d.ts","sourceRoot":"","sources":["../../src/rbac/role-repository.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,KAAK,EAAE,IAAI,EAAW,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAOlF;;;;;;;;;GASG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBtE;AAMD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAUnE;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAU9F;AAgBD;;;;;;;;;;;;GAYG;AACH,wBAAsB,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BlF;AAMD;;;;;;;;;GASG;AACH,wBAAsB,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAS7D;AAMD;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CASnF;AAMD;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAClC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,MAAM,EACZ,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,OAAO,CAAC,CAgBlB;AAMD;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CASxE"}
+{"version":3,"file":"role-repository.d.ts","sourceRoot":"","sources":["../../src/rbac/role-repository.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,KAAK,EAAE,IAAI,EAAW,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAOlF;;;;;;;;;GASG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAWtE;AAMD;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAU1F;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAQ1F;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAU9F;AAgBD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,UAAU,CAC9B,aAAa,EAAE,MAAM,EACrB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,eAAe,GACrB,OAAO,CAAC,IAAI,CAAC,CA+Bf;AAMD,qFAAqF;AACrF,wBAAsB,UAAU,CAC9B,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IACT,IAAI,EAAE,IAAI,CAAC;IACX,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,GAAG,IAAI,CAAC,CAKR;AAED,mDAAmD;AACnD,wBAAsB,sBAAsB,CAC1C,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IACT,IAAI,EAAE,IAAI,CAAC;IACX,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,GAAG,IAAI,CAAC,CAoCR;AAED,qEAAqE;AACrE,wBAAsB,kBAAkB,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK7F;AAMD;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CASnF;AAMD;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAClC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,MAAM,EACZ,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,OAAO,CAAC,CAgBlB"}

package/dist/rbac/role-repository.js

@@ -35,30 +35,39 @@ export async function insertRole(input) {
     const pool = getPool();
     const result = await pool.query(`INSERT INTO roles (application_id, name, slug, description)
      VALUES ($1, $2, $3, $4)
-     RETURNING *`, [
-        input.applicationId,
-        input.name,
-        input.slug ?? null,
-        input.description ?? null,
-    ]);
+     RETURNING *`, [input.applicationId, input.name, input.slug ?? null, input.description ?? null]);
     return mapRowToRole(result.rows[0]);
 }
 // ---------------------------------------------------------------------------
 // Find
 // ---------------------------------------------------------------------------
 /**
- * Find a role by its UUID.
+ * Find a role through its authoritative application parent.
  *
+ * @param applicationId - Parent application UUID
  * @param id - Role UUID
  * @returns Role or null if not found
  */
-export async function findRoleById(id) {
+export async function findRoleById(applicationId, id) {
     const pool = getPool();
-    const result = await pool.query('SELECT * FROM roles WHERE id = $1', [id]);
+    const result = await pool.query('SELECT * FROM roles WHERE application_id = $1 AND id = $2', [applicationId, id]);
     if (result.rows.length === 0)
         return null;
     return mapRowToRole(result.rows[0]);
 }
+/**
+ * Lock and return a role through its authoritative application parent.
+ *
+ * @param applicationId - Parent application UUID
+ * @param id - Role UUID
+ * @returns Locked role or null when the parent-child pair does not exist
+ */
+export async function lockRoleById(applicationId, id) {
+    const result = await getPool().query(`SELECT * FROM roles
+     WHERE application_id = $1 AND id = $2
+     FOR UPDATE`, [applicationId, id]);
+    return result.rows[0] ? mapRowToRole(result.rows[0]) : null;
+}
 /**
  * Find a role by application ID and slug.
  *
@@ -93,17 +102,18 @@ const FIELD_TO_COLUMN = {
  * fields that weren't specified. Null is a valid value for description
  * (clears it).
  *
+ * @param applicationId - Parent application UUID
  * @param id - Role UUID
  * @param input - Fields to update (only non-undefined fields are applied)
  * @returns Updated role
  * @throws Error if role not found or no fields provided
  */
-export async function updateRole(id, input) {
+export async function updateRole(applicationId, id, input) {
     const pool = getPool();
     // Build dynamic SET clause from provided fields
     const setClauses = [];
-    const values = [id]; // $1 is always the ID
-    let paramIndex = 2;
+    const values = [applicationId, id];
+    let paramIndex = 3;
     for (const [field, column] of Object.entries(FIELD_TO_COLUMN)) {
         const value = input[field];
         // Include the field if it's explicitly set (including null for clearing)
@@ -116,7 +126,8 @@ export async function updateRole(id, input) {
     if (setClauses.length === 0) {
         throw new Error('No fields to update');
     }
-    const sql = `UPDATE roles SET ${setClauses.join(', ')} WHERE id = $1 RETURNING *`;
+    const sql = `UPDATE roles SET ${setClauses.join(', ')}
+    WHERE application_id = $1 AND id = $2 RETURNING *`;
     const result = await pool.query(sql, values);
     if (result.rows.length === 0) {
         throw new Error('Role not found');
@@ -126,20 +137,49 @@ export async function updateRole(id, input) {
 // ---------------------------------------------------------------------------
 // Delete
 // ---------------------------------------------------------------------------
-/**
- * Delete a role by ID.
- *
- * Returns true if a row was deleted, false if the role didn't exist.
- * CASCADE constraints will automatically remove related role_permissions
- * and user_roles entries.
- *
- * @param id - Role UUID
- * @returns true if deleted, false if not found
- */
-export async function deleteRole(id) {
+/** Lock, capture, and delete a role through its authoritative application parent. */
+export async function deleteRole(applicationId, roleId) {
+    const capture = await captureRoleForDeletion(applicationId, roleId);
+    if (!capture)
+        return null;
+    await deleteCapturedRole(applicationId, roleId);
+    return capture;
+}
+/** Lock and capture a role without deleting it. */
+export async function captureRoleForDeletion(applicationId, roleId) {
     const pool = getPool();
-    const result = await pool.query('DELETE FROM roles WHERE id = $1', [id]);
-    return (result.rowCount ?? 0) > 0;
+    const target = await pool.query(`SELECT * FROM roles WHERE application_id = $1 AND id = $2 FOR UPDATE`, [applicationId, roleId]);
+    if (!target.rows[0])
+        return null;
+    const graph = await pool.query(`WITH affected_users AS (
+       SELECT user_id FROM user_roles WHERE role_id = $1
+     )
+     SELECT
+       ARRAY(SELECT user_id FROM affected_users ORDER BY user_id) AS user_ids,
+       ARRAY(SELECT permission_id FROM role_permissions WHERE role_id = $1 ORDER BY permission_id)
+         AS permission_ids,
+       ARRAY(
+         SELECT payload.id FROM oidc_payloads payload
+         WHERE payload.type = 'Grant'
+           AND payload.payload->>'accountId' = ANY(ARRAY(SELECT user_id::text FROM affected_users))
+           AND payload.payload->>'clientId' = ANY(ARRAY(
+             SELECT client_id FROM clients WHERE application_id = $2
+           ))
+         ORDER BY payload.id
+       ) AS grant_ids`, [roleId, applicationId]);
+    return {
+        role: mapRowToRole(target.rows[0]),
+        userIds: graph.rows[0].user_ids,
+        permissionIds: graph.rows[0].permission_ids,
+        grantIds: graph.rows[0].grant_ids,
+    };
+}
+/** Physically delete a role previously locked through its parent. */
+export async function deleteCapturedRole(applicationId, roleId) {
+    await getPool().query('DELETE FROM roles WHERE application_id = $1 AND id = $2', [
+        applicationId,
+        roleId,
+    ]);
 }
 // ---------------------------------------------------------------------------
 // List
@@ -182,21 +222,4 @@ export async function roleSlugExists(applicationId, slug, excludeId) {
     const result = await pool.query('SELECT EXISTS(SELECT 1 FROM roles WHERE application_id = $1 AND slug = $2) as exists', [applicationId, slug]);
     return result.rows[0].exists;
 }
-// ---------------------------------------------------------------------------
-// User count (deletion guard)
-// ---------------------------------------------------------------------------
-/**
- * Count users assigned to a role.
- *
- * Used by the service layer as a deletion guard: if users are assigned,
- * the role cannot be deleted without force=true.
- *
- * @param roleId - Role UUID
- * @returns Number of users with this role
- */
-export async function countUsersWithRole(roleId) {
-    const pool = getPool();
-    const result = await pool.query('SELECT COUNT(*)::int as count FROM user_roles WHERE role_id = $1', [roleId]);
-    return parseInt(result.rows[0].count, 10);
-}
 //# sourceMappingURL=role-repository.js.map

package/dist/rbac/role-repository.js.map

@@ -1 +1 @@
-{"version":3,"file":"role-repository.js","sourceRoot":"","sources":["../../src/rbac/role-repository.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE7C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAAsB;IACrD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;iBAEa,EACb;QACE,KAAK,CAAC,aAAa;QACnB,KAAK,CAAC,IAAI;QACV,KAAK,CAAC,IAAI,IAAI,IAAI;QAClB,KAAK,CAAC,WAAW,IAAI,IAAI;KAC1B,CACF,CAAC;IAEF,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC;AAED,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAU;IAC3C,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,mCAAmC,EACnC,CAAC,EAAE,CAAC,CACL,CAAC;IAEF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,aAAqB,EAAE,IAAY;IACtE,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,6DAA6D,EAC7D,CAAC,aAAa,EAAE,IAAI,CAAC,CACtB,CAAC;IAEF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,eAAe,GAA2B;IAC9C,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,WAAW,EAAE,aAAa;CAC3B,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,EAAU,EAAE,KAAsB;IACjE,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,gDAAgD;IAChD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,MAAM,GAAc,CAAC,EAAE,CAAC,CAAC,CAAC,sBAAsB;IACtD,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,KAA8B,CAAC,CAAC;QACpD,yEAAyE;QACzE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,UAAU,CAAC,IAAI,CAAC,GAAG,MAAM,OAAO,UAAU,EAAE,CAAC,CAAC;YAC9C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,UAAU,EAAE,CAAC;QACf,CAAC;IACH,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,GAAG,GAAG,oBAAoB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,4BAA4B,CAAC;IAClF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAU,GAAG,EAAE,MAAM,CAAC,CAAC;IAEtD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACpC,CAAC;IAED,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,EAAU;IACzC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,iCAAiC,EACjC,CAAC,EAAE,CAAC,CACL,CAAC;IAEF,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC;AAED,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,aAAqB;IAChE,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,iEAAiE,EACjE,CAAC,aAAa,CAAC,CAChB,CAAC;IAEF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;AACvC,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,aAAqB,EACrB,IAAY,EACZ,SAAkB;IAElB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,mGAAmG,EACnG,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,CACjC,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/B,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,sFAAsF,EACtF,CAAC,aAAa,EAAE,IAAI,CAAC,CACtB,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAC/B,CAAC;AAED,8EAA8E;AAC9E,8BAA8B;AAC9B,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAc;IACrD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,kEAAkE,EAClE,CAAC,MAAM,CAAC,CACT,CAAC;IAEF,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC5C,CAAC"}
+{"version":3,"file":"role-repository.js","sourceRoot":"","sources":["../../src/rbac/role-repository.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE7C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAAsB;IACrD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;iBAEa,EACb,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,CACjF,CAAC;IAEF,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC;AAED,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,aAAqB,EAAE,EAAU;IAClE,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,2DAA2D,EAC3D,CAAC,aAAa,EAAE,EAAE,CAAC,CACpB,CAAC;IAEF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,aAAqB,EAAE,EAAU;IAClE,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC,KAAK,CAClC;;gBAEY,EACZ,CAAC,aAAa,EAAE,EAAE,CAAC,CACpB,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,aAAqB,EAAE,IAAY;IACtE,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,6DAA6D,EAC7D,CAAC,aAAa,EAAE,IAAI,CAAC,CACtB,CAAC;IAEF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,eAAe,GAA2B;IAC9C,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,WAAW,EAAE,aAAa;CAC3B,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,aAAqB,EACrB,EAAU,EACV,KAAsB;IAEtB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,gDAAgD;IAChD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,MAAM,GAAc,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IAC9C,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,KAA8B,CAAC,CAAC;QACpD,yEAAyE;QACzE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,UAAU,CAAC,IAAI,CAAC,GAAG,MAAM,OAAO,UAAU,EAAE,CAAC,CAAC;YAC9C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,UAAU,EAAE,CAAC;QACf,CAAC;IACH,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,GAAG,GAAG,oBAAoB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;sDACD,CAAC;IACrD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAU,GAAG,EAAE,MAAM,CAAC,CAAC;IAEtD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACpC,CAAC;IAED,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,aAAqB,EACrB,MAAc;IAOd,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACpE,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,kBAAkB,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAChD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,mDAAmD;AACnD,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,aAAqB,EACrB,MAAc;IAOd,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,sEAAsE,EACtE,CAAC,aAAa,EAAE,MAAM,CAAC,CACxB,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAK5B;;;;;;;;;;;;;;;sBAekB,EAClB,CAAC,MAAM,EAAE,aAAa,CAAC,CACxB,CAAC;IACF,OAAO;QACL,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,QAAQ;QAChC,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,cAAc;QAC5C,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,SAAS;KACnC,CAAC;AACJ,CAAC;AAED,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,aAAqB,EAAE,MAAc;IAC5E,MAAM,OAAO,EAAE,CAAC,KAAK,CAAC,yDAAyD,EAAE;QAC/E,aAAa;QACb,MAAM;KACP,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,aAAqB;IAChE,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,iEAAiE,EACjE,CAAC,aAAa,CAAC,CAChB,CAAC;IAEF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;AACvC,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,aAAqB,EACrB,IAAY,EACZ,SAAkB;IAElB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,mGAAmG,EACnG,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,CACjC,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/B,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,sFAAsF,EACtF,CAAC,aAAa,EAAE,IAAI,CAAC,CACtB,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAC/B,CAAC"}

package/dist/rbac/role-service.d.ts

@@ -1,15 +1,10 @@
 /**
  * Role service — business logic for role management.
  *
- * Orchestrates role CRUD operations with slug validation, uniqueness
- * checks, deletion guards, cache management, and audit logging.
- * Also handles role-permission assignment operations.
- *
- * All write operations follow the pattern:
- *   validate → DB operation → cache invalidate/re-cache → audit log
- *
- * Uses fire-and-forget audit logging — audit failures never block
- * the primary operation.
+ * Orchestrates application-scoped role CRUD and direct permission mappings.
+ * Authority reductions revoke affected database state in the request transaction;
+ * cache cleanup runs after commit. Canonical Porta Admin roles and mappings are
+ * protected from generic mutation.
  *
  * @see role-repository.ts — Database operations
  * @see mapping-repository.ts — Role-permission join table operations
@@ -31,10 +26,11 @@ export declare function createRole(input: CreateRoleInput, actorId?: string): Pr
 /**
  * Find a role by ID. Cache-first, falls back to DB.
  *
+ * @param applicationId - Parent application UUID
  * @param id - Role UUID
  * @returns Role or null if not found
  */
-export declare function findRoleById(id: string): Promise<Role | null>;
+export declare function findRoleById(applicationId: string, id: string): Promise<Role | null>;
 /**
  * Find a role by application ID and slug.
  *
@@ -54,58 +50,65 @@ export declare function listRolesByApplication(applicationId: string): Promise<R
  * Update a role by ID.
  *
  * If the slug is being changed, validates the new slug format and
- * checks uniqueness within the application. Invalidates and re-caches
- * the role after update.
+ * checks uniqueness within the application. An actual slug change revokes
+ * authority for users assigned to the role; metadata-only changes do not.
  *
+ * @param applicationId - Parent application UUID
  * @param id - Role UUID
  * @param input - Fields to update
  * @param actorId - Optional UUID of the admin performing the action
- * @returns Updated role
+ * @returns Updated role and whether the actor must authenticate again
  * @throws RoleNotFoundError if role doesn't exist
  * @throws RbacValidationError if new slug is invalid or already exists
  */
-export declare function updateRole(id: string, input: UpdateRoleInput, actorId?: string): Promise<Role>;
+export declare function updateRole(applicationId: string, id: string, input: UpdateRoleInput, actorId?: string): Promise<{
+    role: Role;
+    reauthenticationRequired: boolean;
+}>;
 /**
- * Delete a role by ID.
- *
- * By default (force=false), refuses to delete roles that have users
- * assigned. Pass force=true to delete regardless — CASCADE will
- * remove user_roles and role_permissions entries.
+ * Delete a role through its authoritative application parent.
  *
- * @param id - Role UUID
- * @param force - If true, delete even if users are assigned
- * @param actorId - Optional UUID of the admin performing the action
- * @throws RoleNotFoundError if role doesn't exist
- * @throws RbacValidationError if users are assigned and force is false
+ * @param applicationId - Parent application UUID.
+ * @param roleId - Child role UUID.
+ * @param actorId - Actor identifier used for audit attribution when applicable.
+ * @returns Whether the actor must authenticate again
+ * @throws RoleNotFoundError when the selected role does not exist within the requested boundary.
  */
-export declare function deleteRole(id: string, force?: boolean, actorId?: string): Promise<void>;
+export declare function deleteRole(applicationId: string, roleId: string, actorId?: string): Promise<{
+    reauthenticationRequired: boolean;
+}>;
 /**
  * Assign permissions to a role.
  *
- * Delegates to the mapping repository for bulk insert. Invalidates
- * all user RBAC caches since user permissions may have changed.
+ * Validates every permission against the role's application and schedules
+ * cache invalidation only for users assigned to the role.
  *
+ * @param applicationId - Parent application UUID
  * @param roleId - Role UUID
  * @param permissionIds - Array of permission UUIDs to assign
  * @param actorId - Optional UUID of the admin performing the action
  */
-export declare function assignPermissionsToRole(roleId: string, permissionIds: string[], actorId?: string): Promise<void>;
+export declare function assignPermissionsToRole(applicationId: string, roleId: string, permissionIds: string[], actorId?: string): Promise<void>;
 /**
  * Remove permissions from a role.
  *
- * Delegates to the mapping repository. Invalidates all user RBAC
- * caches since user permissions may have changed.
+ * Validates every permission against the role's application. An actual
+ * removal revokes affected authority; an absent mapping is a committed no-op.
  *
+ * @param applicationId - Parent application UUID
  * @param roleId - Role UUID
  * @param permissionIds - Array of permission UUIDs to remove
  * @param actorId - Optional UUID of the admin performing the action
  */
-export declare function removePermissionsFromRole(roleId: string, permissionIds: string[], actorId?: string): Promise<void>;
+export declare function removePermissionsFromRole(applicationId: string, roleId: string, permissionIds: string[], actorId?: string): Promise<{
+    reauthenticationRequired: boolean;
+}>;
 /**
  * Get all permissions assigned to a role.
  *
+ * @param applicationId - Parent application UUID
  * @param roleId - Role UUID
  * @returns Array of permissions
  */
-export declare function getPermissionsForRole(roleId: string): Promise<Permission[]>;
+export declare function getPermissionsForRole(applicationId: string, roleId: string): Promise<Permission[]>;
 //# sourceMappingURL=role-service.d.ts.map

package/dist/rbac/role-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role-service.d.ts","sourceRoot":"","sources":["../../src/rbac/role-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AA0BH,OAAO,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAMrF;;;;;;;;;;GAUG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAkCxF;AAMD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAanE;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAE9F;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAEnF;AAMD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,UAAU,CAC9B,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,eAAe,EACtB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAuCf;AAMD;;;;;;;;;;;;GAYG;AACH,wBAAsB,UAAU,CAC9B,EAAE,EAAE,MAAM,EACV,KAAK,GAAE,OAAe,EACtB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAkCf;AAMD;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EAAE,EACvB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAef;AAED;;;;;;;;;GASG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EAAE,EACvB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAef;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAEjF"}
+{"version":3,"file":"role-service.d.ts","sourceRoot":"","sources":["../../src/rbac/role-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAwBH,OAAO,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAqBrF;;;;;;;;;;GAUG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAiCxF;AAMD;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAa1F;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAE9F;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAEnF;AAMD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,UAAU,CAC9B,aAAa,EAAE,MAAM,EACrB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,eAAe,EACtB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,wBAAwB,EAAE,OAAO,CAAA;CAAE,CAAC,CAoE5D;AAMD;;;;;;;;GAQG;AACH,wBAAsB,UAAU,CAC9B,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,wBAAwB,EAAE,OAAO,CAAA;CAAE,CAAC,CAkChD;AAMD;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,CAC3C,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EAAE,EACvB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CA0Bf;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,yBAAyB,CAC7C,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EAAE,EACvB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,wBAAwB,EAAE,OAAO,CAAA;CAAE,CAAC,CAgChD;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,UAAU,EAAE,CAAC,CAIvB"}