@portaidentity/server 1.7.3 → 1.9.0

package/dist/portability/apply.js

@@ -0,0 +1,274 @@
+/** Atomic selective portability import orchestration. */
+import { createHash } from 'node:crypto';
+import { writeAuditLogInTransaction } from '../lib/audit-log.js';
+import { getPool, runDatabaseTransaction } from '../lib/database.js';
+import { registerPortabilityCleanup } from './cleanup.js';
+import { writePortabilityApplication, writePortabilityClaimDefinition, writePortabilityModule, writePortabilityOrganization, writePortabilityPermission, writePortabilityRole, writePortabilityRolePermissions, } from './import-repository.js';
+import { writePortabilityClient, writePortabilityUser, writePortabilityUserClaimValue, writePortabilityUserRole, } from './import-user-client-writers.js';
+import { buildResolvedPortabilityPlan } from './plan.js';
+import { key, normalizedEmail, normalizedRbac, normalizedSlug } from './plan-support.js';
+import { PortabilityError, } from './types.js';
+/**
+ * @param plan - Valid resolved plan
+ * @param entityType - Manifest collection
+ * @param naturalKey - Exact public record identity
+ * @returns Planned action for the record
+ */
+function plannedAction(plan, entityType, naturalKey) {
+    const encoded = JSON.stringify(naturalKey);
+    const item = plan.result.items.find((candidate) => candidate.entity_type === entityType && JSON.stringify(candidate.natural_key) === encoded);
+    if (item === undefined)
+        throw new Error('Portability plan is missing a write action');
+    return item.action;
+}
+/**
+ * @param rows - Existing destination records
+ * @param selectKey - Normalized natural-key selector
+ * @param naturalKey - Normalized key to find
+ * @returns Existing private identifier, or null when absent
+ */
+function existingId(rows, selectKey, naturalKey) {
+    return rows.find((row) => selectKey(row) === naturalKey)?.id ?? null;
+}
+/**
+ * Apply organization and application-authorization records in dependency order.
+ *
+ * @param plan - Valid plan and destination snapshot from this transaction
+ */
+async function applyAuthorizationRecords(plan) {
+    const { manifest, snapshot } = plan;
+    const organizationIds = new Map(snapshot.organizations.map((row) => [normalizedSlug(row.slug), row.id]));
+    const applicationIds = new Map(snapshot.applications.map((row) => [normalizedSlug(row.slug), row.id]));
+    const moduleIds = new Map(snapshot.applicationModules.map((row) => [
+        key(normalizedSlug(row.application_slug), normalizedSlug(row.slug)),
+        row.id,
+    ]));
+    const roleIds = new Map(snapshot.roles.map((row) => [
+        key(normalizedSlug(row.application_slug), normalizedRbac(row.slug)),
+        row.id,
+    ]));
+    const permissionIds = new Map(snapshot.permissions.map((row) => [
+        key(normalizedSlug(row.application_slug), normalizedRbac(row.slug)),
+        row.id,
+    ]));
+    const claimIds = new Map(snapshot.claimDefinitions.map((row) => [
+        key(normalizedSlug(row.application_slug), row.claim_name),
+        row.id,
+    ]));
+    const userIds = new Map(snapshot.users.map((row) => [
+        key(normalizedSlug(row.organization_slug), normalizedEmail(row.email)),
+        row.id,
+    ]));
+    const clientIds = new Map(snapshot.clients.map((row) => [row.client_id, row.id]));
+    for (const record of manifest.organizations) {
+        const naturalKey = { slug: record.slug };
+        const action = plannedAction(plan, 'organizations', naturalKey);
+        if (action === 'skipped')
+            continue;
+        const normalizedKey = normalizedSlug(record.slug);
+        const id = await writePortabilityOrganization(record, organizationIds.get(normalizedKey) ?? null, new Set(snapshot.brandingAssets
+            .filter((asset) => normalizedSlug(asset.organization_slug) === normalizedKey)
+            .map((asset) => asset.asset_type)));
+        organizationIds.set(normalizedKey, id);
+    }
+    for (const record of manifest.applications) {
+        const naturalKey = { slug: record.slug };
+        const action = plannedAction(plan, 'applications', naturalKey);
+        if (action === 'skipped')
+            continue;
+        const normalizedKey = normalizedSlug(record.slug);
+        const id = await writePortabilityApplication(record, applicationIds.get(normalizedKey) ?? null);
+        applicationIds.set(normalizedKey, id);
+    }
+    for (const record of manifest.application_modules) {
+        const naturalKey = { application_slug: record.application_slug, slug: record.slug };
+        const action = plannedAction(plan, 'application_modules', naturalKey);
+        if (action === 'skipped')
+            continue;
+        const applicationId = applicationIds.get(normalizedSlug(record.application_slug));
+        if (applicationId === undefined)
+            throw new Error('Resolved application is missing');
+        const normalizedKey = key(normalizedSlug(record.application_slug), normalizedSlug(record.slug));
+        const id = await writePortabilityModule(record, applicationId, moduleIds.get(normalizedKey) ?? null);
+        moduleIds.set(normalizedKey, id);
+    }
+    for (const record of manifest.roles) {
+        const naturalKey = { application_slug: record.application_slug, slug: record.slug };
+        const action = plannedAction(plan, 'roles', naturalKey);
+        if (action === 'skipped')
+            continue;
+        const applicationId = applicationIds.get(normalizedSlug(record.application_slug));
+        if (applicationId === undefined)
+            throw new Error('Resolved application is missing');
+        const normalizedKey = key(normalizedSlug(record.application_slug), normalizedRbac(record.slug));
+        const id = await writePortabilityRole(record, applicationId, roleIds.get(normalizedKey) ?? null);
+        roleIds.set(normalizedKey, id);
+    }
+    for (const record of manifest.permissions) {
+        const naturalKey = { application_slug: record.application_slug, slug: record.slug };
+        const action = plannedAction(plan, 'permissions', naturalKey);
+        if (action === 'skipped')
+            continue;
+        const appKey = normalizedSlug(record.application_slug);
+        const applicationId = applicationIds.get(appKey);
+        if (applicationId === undefined)
+            throw new Error('Resolved application is missing');
+        const moduleId = record.module_slug === null
+            ? null
+            : (moduleIds.get(key(appKey, normalizedSlug(record.module_slug))) ?? null);
+        if (record.module_slug !== null && moduleId === null) {
+            throw new Error('Resolved application module is missing');
+        }
+        const normalizedKey = key(appKey, normalizedRbac(record.slug));
+        const id = await writePortabilityPermission(record, applicationId, moduleId, permissionIds.get(normalizedKey) ?? null);
+        permissionIds.set(normalizedKey, id);
+    }
+    for (const record of manifest.claim_definitions) {
+        const naturalKey = { application_slug: record.application_slug, claim_name: record.claim_name };
+        const action = plannedAction(plan, 'claim_definitions', naturalKey);
+        if (action === 'skipped')
+            continue;
+        const appKey = normalizedSlug(record.application_slug);
+        const applicationId = applicationIds.get(appKey);
+        if (applicationId === undefined)
+            throw new Error('Resolved application is missing');
+        const destinationId = existingId(snapshot.claimDefinitions, (row) => key(normalizedSlug(row.application_slug), row.claim_name), key(appKey, record.claim_name));
+        const id = await writePortabilityClaimDefinition(record, applicationId, destinationId);
+        claimIds.set(key(appKey, record.claim_name), id);
+    }
+    for (const record of manifest.role_permission_mappings) {
+        const naturalKey = { application_slug: record.application_slug, role_slug: record.role_slug };
+        const action = plannedAction(plan, 'role_permission_mappings', naturalKey);
+        if (action === 'skipped')
+            continue;
+        const appKey = normalizedSlug(record.application_slug);
+        const roleId = roleIds.get(key(appKey, normalizedRbac(record.role_slug)));
+        if (roleId === undefined)
+            throw new Error('Resolved role is missing');
+        const mappedPermissionIds = record.permission_slugs.map((slug) => {
+            const permissionId = permissionIds.get(key(appKey, normalizedRbac(slug)));
+            if (permissionId === undefined)
+                throw new Error('Resolved permission is missing');
+            return permissionId;
+        });
+        await writePortabilityRolePermissions(roleId, mappedPermissionIds);
+    }
+    return { organizationIds, applicationIds, roleIds, claimIds, userIds, clientIds };
+}
+/**
+ * Apply users, their listed relationships, and clients after parent identifiers resolve.
+ *
+ * @param plan - Valid plan and destination snapshot from this transaction
+ * @param ids - Parent identifiers resolved while writing the authorization graph
+ * @returns Planned result with any newly generated one-time client credentials
+ */
+async function applyUserAndClientRecords(plan, ids) {
+    const credentials = [];
+    for (const record of plan.manifest.users) {
+        const naturalKey = { organization_slug: record.organization_slug, email: record.email };
+        const action = plannedAction(plan, 'users', naturalKey);
+        if (action === 'skipped')
+            continue;
+        const orgKey = normalizedSlug(record.organization_slug);
+        const organizationId = ids.organizationIds.get(orgKey);
+        if (organizationId === undefined)
+            throw new Error('Resolved organization is missing');
+        const userKey = key(orgKey, normalizedEmail(record.email));
+        const id = await writePortabilityUser(record, organizationId, ids.userIds.get(userKey) ?? null);
+        ids.userIds.set(userKey, id);
+    }
+    for (const record of plan.manifest.user_role_assignments) {
+        const naturalKey = {
+            organization_slug: record.organization_slug,
+            email: record.email,
+            application_slug: record.application_slug,
+            role_slug: record.role_slug,
+        };
+        if (plannedAction(plan, 'user_role_assignments', naturalKey) === 'skipped')
+            continue;
+        const userId = ids.userIds.get(key(normalizedSlug(record.organization_slug), normalizedEmail(record.email)));
+        const roleId = ids.roleIds.get(key(normalizedSlug(record.application_slug), normalizedRbac(record.role_slug)));
+        if (userId === undefined || roleId === undefined)
+            throw new Error('Resolved assignment parent is missing');
+        await writePortabilityUserRole(userId, roleId);
+    }
+    for (const record of plan.manifest.user_claim_values) {
+        const naturalKey = {
+            organization_slug: record.organization_slug,
+            email: record.email,
+            application_slug: record.application_slug,
+            claim_name: record.claim_name,
+        };
+        if (plannedAction(plan, 'user_claim_values', naturalKey) === 'skipped')
+            continue;
+        const userId = ids.userIds.get(key(normalizedSlug(record.organization_slug), normalizedEmail(record.email)));
+        const claimId = ids.claimIds.get(key(normalizedSlug(record.application_slug), record.claim_name));
+        if (userId === undefined || claimId === undefined)
+            throw new Error('Resolved claim-value parent is missing');
+        await writePortabilityUserClaimValue(userId, claimId, record.value);
+    }
+    for (const record of plan.manifest.clients) {
+        const action = plannedAction(plan, 'clients', { client_id: record.client_id });
+        if (action === 'skipped')
+            continue;
+        const organizationId = ids.organizationIds.get(normalizedSlug(record.organization_slug));
+        const applicationId = ids.applicationIds.get(normalizedSlug(record.application_slug));
+        if (organizationId === undefined || applicationId === undefined)
+            throw new Error('Resolved client parent is missing');
+        const written = await writePortabilityClient(record, organizationId, applicationId, ids.clientIds.get(record.client_id) ?? null);
+        ids.clientIds.set(record.client_id, written.id);
+        if (written.credential !== undefined)
+            credentials.push(written.credential);
+    }
+    return credentials.length === 0 ? plan.result : { ...plan.result, credentials };
+}
+/**
+ * Validate and atomically apply one portability manifest.
+ *
+ * It applies every selected portable collection in dependency order, writes one content-free
+ * audit row, and returns the safe result only after the transaction commits.
+ *
+ * @param manifest - Complete manifest received from an import request
+ * @param mode - Keep-existing or update-existing behavior
+ * @param actor - Authenticated actor retained for the transaction audit
+ * @returns Ordered committed result
+ */
+export async function applyPortabilityManifest(manifest, mode, actor) {
+    try {
+        return await runDatabaseTransaction(async () => {
+            const plan = await buildResolvedPortabilityPlan(manifest, mode);
+            if (plan.result.errors.length > 0) {
+                throw new PortabilityError(409, 'import_plan_rejected', 'Import plan rejected', plan.result);
+            }
+            const ids = await applyAuthorizationRecords(plan);
+            const result = await applyUserAndClientRecords(plan, ids);
+            await registerPortabilityCleanup(plan, ids);
+            const auditOrganizationId = plan.manifest.scope.kind === 'organization'
+                ? ids.organizationIds.get(normalizedSlug(plan.manifest.scope.organization_slug))
+                : actor.controlPlaneOrganizationId;
+            if (auditOrganizationId === undefined) {
+                throw new Error('Resolved import organization is unavailable for audit ownership');
+            }
+            await writeAuditLogInTransaction(getPool(), {
+                organizationId: auditOrganizationId,
+                actorId: actor.userId,
+                eventType: 'admin.import',
+                eventCategory: 'admin',
+                metadata: {
+                    manifest_version: plan.manifest.version,
+                    sha256_digest: createHash('sha256').update(JSON.stringify(plan.manifest)).digest('hex'),
+                    mode,
+                    categories: plan.manifest.categories,
+                    record_counts: plan.result.summary,
+                },
+            });
+            return result;
+        });
+    }
+    catch (error) {
+        if (error instanceof PortabilityError)
+            throw error;
+        throw new PortabilityError(503, 'import_execution_failed', 'Import failed');
+    }
+}
+//# sourceMappingURL=apply.js.map

package/dist/portability/apply.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply.js","sourceRoot":"","sources":["../../src/portability/apply.ts"],"names":[],"mappings":"AAAA,yDAAyD;AAEzD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAA4B,MAAM,cAAc,CAAC;AACpF,OAAO,EACL,2BAA2B,EAC3B,+BAA+B,EAC/B,sBAAsB,EACtB,4BAA4B,EAC5B,0BAA0B,EAC1B,oBAAoB,EACpB,+BAA+B,GAChC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,4BAA4B,EAAgC,MAAM,WAAW,CAAC;AACvF,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACzF,OAAO,EACL,gBAAgB,GASjB,MAAM,YAAY,CAAC;AAEpB;;;;;GAKG;AACH,SAAS,aAAa,CACpB,IAA6B,EAC7B,UAAiC,EACjC,UAAiC;IAEjC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CACjC,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,WAAW,KAAK,UAAU,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,OAAO,CAC5F,CAAC;IACF,IAAI,IAAI,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IACtF,OAAO,IAAI,CAAC,MAAM,CAAC;AACrB,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CACjB,IAAoB,EACpB,SAA+B,EAC/B,UAAkB;IAElB,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,UAAU,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC;AACvE,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,yBAAyB,CACtC,IAA6B;IAE7B,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IACpC,MAAM,eAAe,GAAG,IAAI,GAAG,CAC7B,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CACxE,CAAC;IACF,MAAM,cAAc,GAAG,IAAI,GAAG,CAC5B,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CACvE,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,GAAG,CACvB,QAAQ,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;QACvC,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnE,GAAG,CAAC,EAAE;KACP,CAAC,CACH,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;QAC1B,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnE,GAAG,CAAC,EAAE;KACP,CAAC,CACH,CAAC;IACF,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;QAChC,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnE,GAAG,CAAC,EAAE;KACP,CAAC,CACH,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,QAAQ,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;QACrC,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC;QACzD,GAAG,CAAC,EAAE;KACP,CAAC,CACH,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;QAC1B,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtE,GAAG,CAAC,EAAE;KACP,CAAC,CACH,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAElF,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;QAC5C,MAAM,UAAU,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;QAChE,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,MAAM,aAAa,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,EAAE,GAAG,MAAM,4BAA4B,CAC3C,MAAM,EACN,eAAe,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI,EAC1C,IAAI,GAAG,CACL,QAAQ,CAAC,cAAc;aACpB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,iBAAiB,CAAC,KAAK,aAAa,CAAC;aAC5E,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CACpC,CACF,CAAC;QACF,eAAe,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC3C,MAAM,UAAU,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC;QAC/D,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,MAAM,aAAa,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,EAAE,GAAG,MAAM,2BAA2B,CAAC,MAAM,EAAE,cAAc,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,CAAC;QAChG,cAAc,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,mBAAmB,EAAE,CAAC;QAClD,MAAM,UAAU,GAAG,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QACpF,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,qBAAqB,EAAE,UAAU,CAAC,CAAC;QACtE,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAClF,IAAI,aAAa,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACpF,MAAM,aAAa,GAAG,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAChG,MAAM,EAAE,GAAG,MAAM,sBAAsB,CACrC,MAAM,EACN,aAAa,EACb,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI,CACrC,CAAC;QACF,SAAS,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QACpF,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;QACxD,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAClF,IAAI,aAAa,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACpF,MAAM,aAAa,GAAG,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAChG,MAAM,EAAE,GAAG,MAAM,oBAAoB,CACnC,MAAM,EACN,aAAa,EACb,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI,CACnC,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,UAAU,GAAG,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QACpF,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC;QAC9D,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACvD,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,aAAa,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACpF,MAAM,QAAQ,GACZ,MAAM,CAAC,WAAW,KAAK,IAAI;YACzB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;QAC/E,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/D,MAAM,EAAE,GAAG,MAAM,0BAA0B,CACzC,MAAM,EACN,aAAa,EACb,QAAQ,EACR,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI,CACzC,CAAC;QACF,aAAa,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QAChD,MAAM,UAAU,GAAG,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;QAChG,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,mBAAmB,EAAE,UAAU,CAAC,CAAC;QACpE,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACvD,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,aAAa,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACpF,MAAM,aAAa,GAAG,UAAU,CAC9B,QAAQ,CAAC,gBAAgB,EACzB,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,EAClE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,CAC/B,CAAC;QACF,MAAM,EAAE,GAAG,MAAM,+BAA+B,CAAC,MAAM,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC;QACvF,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,wBAAwB,EAAE,CAAC;QACvD,MAAM,UAAU,GAAG,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;QAC9F,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,0BAA0B,EAAE,UAAU,CAAC,CAAC;QAC3E,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC1E,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QACtE,MAAM,mBAAmB,GAAG,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YAC/D,MAAM,YAAY,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC1E,IAAI,YAAY,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YAClF,OAAO,YAAY,CAAC;QACtB,CAAC,CAAC,CAAC;QACH,MAAM,+BAA+B,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AACpF,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,yBAAyB,CACtC,IAA6B,EAC7B,GAAwB;IAExB,MAAM,WAAW,GAA4B,EAAE,CAAC;IAEhD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACzC,MAAM,UAAU,GAAG,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QACxF,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;QACxD,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACxD,MAAM,cAAc,GAAG,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,cAAc,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtF,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3D,MAAM,EAAE,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,cAAc,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC;QAChG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,CAAC;QACzD,MAAM,UAAU,GAAG;YACjB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC;QACF,IAAI,aAAa,CAAC,IAAI,EAAE,uBAAuB,EAAE,UAAU,CAAC,KAAK,SAAS;YAAE,SAAS;QACrF,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAC5B,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAC7E,CAAC;QACF,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAC5B,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAC/E,CAAC;QACF,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS;YAC9C,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,MAAM,wBAAwB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QACrD,MAAM,UAAU,GAAG;YACjB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAC;QACF,IAAI,aAAa,CAAC,IAAI,EAAE,mBAAmB,EAAE,UAAU,CAAC,KAAK,SAAS;YAAE,SAAS;QACjF,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAC5B,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAC7E,CAAC;QACF,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAC9B,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,CAChE,CAAC;QACF,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;YAC/C,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,MAAM,8BAA8B,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QAC/E,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,MAAM,cAAc,GAAG,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACzF,MAAM,aAAa,GAAG,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACtF,IAAI,cAAc,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS;YAC7D,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAC1C,MAAM,EACN,cAAc,EACd,aAAa,EACb,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,IAAI,CAC5C,CAAC;QACF,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QAChD,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;YAAE,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC7E,CAAC;IAED,OAAO,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC;AAClF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,QAA6B,EAC7B,IAA+C,EAC/C,KAAuB;IAEvB,IAAI,CAAC;QACH,OAAO,MAAM,sBAAsB,CAAC,KAAK,IAAI,EAAE;YAC7C,MAAM,IAAI,GAAG,MAAM,4BAA4B,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAChE,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,gBAAgB,CACxB,GAAG,EACH,sBAAsB,EACtB,sBAAsB,EACtB,IAAI,CAAC,MAAM,CACZ,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,CAAC;YAClD,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC1D,MAAM,0BAA0B,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC5C,MAAM,mBAAmB,GACvB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc;gBACzC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBAChF,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC;YACvC,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;gBACtC,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;YACrF,CAAC;YACD,MAAM,0BAA0B,CAAC,OAAO,EAAE,EAAE;gBAC1C,cAAc,EAAE,mBAAmB;gBACnC,OAAO,EAAE,KAAK,CAAC,MAAM;gBACrB,SAAS,EAAE,cAAc;gBACzB,aAAa,EAAE,OAAO;gBACtB,QAAQ,EAAE;oBACR,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO;oBACvC,aAAa,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;oBACvF,IAAI;oBACJ,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU;oBACpC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;iBACnC;aACF,CAAC,CAAC;YACH,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,gBAAgB;YAAE,MAAM,KAAK,CAAC;QACnD,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,yBAAyB,EAAE,eAAe,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC"}

package/dist/portability/authorization.d.ts

@@ -0,0 +1,30 @@
+/** Closed authorization rules for manifest export, preview, and apply. */
+import type { Context, Middleware } from 'koa';
+import { type AdminPermission } from '../lib/admin-permissions.js';
+import type { PortabilityCategory } from './types.js';
+/** Portability operation whose base permission and category matrix are evaluated. */
+type PortabilityOperation = 'export' | 'import';
+/**
+ * Calculate the de-duplicated closed permission union for selected categories.
+ *
+ * The operation's base permission is always first. Remaining permissions retain category-matrix
+ * order so audit and test output stays deterministic.
+ *
+ * @param operation - Export or import operation
+ * @param categories - Validated selected categories
+ * @returns Exact permissions required for the request
+ */
+export declare function requiredPortabilityPermissions(operation: PortabilityOperation, categories: readonly PortabilityCategory[]): readonly AdminPermission[];
+/**
+ * Require every permission selected by a portability request and exact environment authority.
+ *
+ * This middleware runs after strict request parsing. Import routes separately enforce the base
+ * import permission before their larger route-local body parser.
+ *
+ * @param operation - Export or import operation
+ * @param readCategories - Reads validated categories from the route context
+ * @returns Koa middleware enforcing the closed permission boundary
+ */
+export declare function requirePortabilityAuthorization(operation: PortabilityOperation, readCategories: (context: Context) => readonly PortabilityCategory[] | undefined): Middleware;
+export {};
+//# sourceMappingURL=authorization.d.ts.map

package/dist/portability/authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../../src/portability/authorization.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAE1E,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAC/C,OAAO,EAGL,KAAK,eAAe,EACrB,MAAM,6BAA6B,CAAC;AAGrC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,qFAAqF;AACrF,KAAK,oBAAoB,GAAG,QAAQ,GAAG,QAAQ,CAAC;AA+EhD;;;;;;;;;GASG;AACH,wBAAgB,8BAA8B,CAC5C,SAAS,EAAE,oBAAoB,EAC/B,UAAU,EAAE,SAAS,mBAAmB,EAAE,GACzC,SAAS,eAAe,EAAE,CAM5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,+BAA+B,CAC7C,SAAS,EAAE,oBAAoB,EAC/B,cAAc,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,SAAS,mBAAmB,EAAE,GAAG,SAAS,GAC/E,UAAU,CA+BZ"}

package/dist/portability/authorization.js

@@ -0,0 +1,130 @@
+/** Closed authorization rules for manifest export, preview, and apply. */
+import { ADMIN_PERMISSIONS, SUPER_ADMIN_ROLE_SLUG, } from '../lib/admin-permissions.js';
+import { requirePermission } from '../middleware/require-permission.js';
+import { recordSecurityDecision } from '../security/decision-context.js';
+/** Category-specific permissions added to the operation's base permission. */
+const CATEGORY_PERMISSIONS = {
+    organizations: {
+        export: [ADMIN_PERMISSIONS.ORG_READ],
+        import: [
+            ADMIN_PERMISSIONS.ORG_CREATE,
+            ADMIN_PERMISSIONS.ORG_UPDATE,
+            ADMIN_PERMISSIONS.ORG_SUSPEND,
+        ],
+    },
+    applications_authorization: {
+        export: [
+            ADMIN_PERMISSIONS.APP_READ,
+            ADMIN_PERMISSIONS.ROLE_READ,
+            ADMIN_PERMISSIONS.PERMISSION_READ,
+            ADMIN_PERMISSIONS.CLAIM_READ,
+        ],
+        import: [
+            ADMIN_PERMISSIONS.APP_CREATE,
+            ADMIN_PERMISSIONS.APP_UPDATE,
+            ADMIN_PERMISSIONS.ROLE_CREATE,
+            ADMIN_PERMISSIONS.ROLE_UPDATE,
+            ADMIN_PERMISSIONS.PERMISSION_CREATE,
+            ADMIN_PERMISSIONS.PERMISSION_UPDATE,
+            ADMIN_PERMISSIONS.CLAIM_CREATE,
+            ADMIN_PERMISSIONS.CLAIM_UPDATE,
+        ],
+    },
+    users_assignments: {
+        export: [
+            ADMIN_PERMISSIONS.USER_READ,
+            ADMIN_PERMISSIONS.ROLE_READ,
+            ADMIN_PERMISSIONS.CLAIM_READ,
+        ],
+        import: [
+            ADMIN_PERMISSIONS.USER_CREATE,
+            ADMIN_PERMISSIONS.USER_UPDATE,
+            ADMIN_PERMISSIONS.USER_LIFECYCLE,
+            ADMIN_PERMISSIONS.ROLE_ASSIGN,
+            ADMIN_PERMISSIONS.CLAIM_UPDATE,
+        ],
+    },
+    oidc_clients: {
+        export: [ADMIN_PERMISSIONS.CLIENT_READ, ADMIN_PERMISSIONS.APP_READ],
+        import: [ADMIN_PERMISSIONS.CLIENT_CREATE, ADMIN_PERMISSIONS.CLIENT_UPDATE],
+    },
+};
+/** Return the base permission for a portability operation. */
+function basePermission(operation) {
+    return operation === 'export' ? ADMIN_PERMISSIONS.EXPORT_READ : ADMIN_PERMISSIONS.IMPORT_WRITE;
+}
+/** Return whether a value is a plain object that can be inspected safely. */
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/** Read the already-validated scope from an operation request body. */
+function hasEnvironmentScope(body, operation) {
+    if (!isRecord(body))
+        return false;
+    const scope = operation === 'export' ? body.scope : isRecord(body.manifest) ? body.manifest.scope : undefined;
+    return isRecord(scope) && scope.kind === 'environment';
+}
+/** Write the fixed validation response used when categories are unavailable. */
+function rejectUnavailableCategories(context, operation) {
+    context.status = 400;
+    context.body =
+        operation === 'export'
+            ? { error: 'Invalid export request', code: 'export_request_invalid' }
+            : { error: 'Invalid import manifest', code: 'import_manifest_invalid' };
+}
+/**
+ * Calculate the de-duplicated closed permission union for selected categories.
+ *
+ * The operation's base permission is always first. Remaining permissions retain category-matrix
+ * order so audit and test output stays deterministic.
+ *
+ * @param operation - Export or import operation
+ * @param categories - Validated selected categories
+ * @returns Exact permissions required for the request
+ */
+export function requiredPortabilityPermissions(operation, categories) {
+    const permissions = new Set([basePermission(operation)]);
+    for (const category of categories) {
+        for (const permission of CATEGORY_PERMISSIONS[category][operation])
+            permissions.add(permission);
+    }
+    return [...permissions];
+}
+/**
+ * Require every permission selected by a portability request and exact environment authority.
+ *
+ * This middleware runs after strict request parsing. Import routes separately enforce the base
+ * import permission before their larger route-local body parser.
+ *
+ * @param operation - Export or import operation
+ * @param readCategories - Reads validated categories from the route context
+ * @returns Koa middleware enforcing the closed permission boundary
+ */
+export function requirePortabilityAuthorization(operation, readCategories) {
+    return async (context, next) => {
+        const categories = readCategories(context);
+        if (categories === undefined) {
+            rejectUnavailableCategories(context, operation);
+            return;
+        }
+        const permissionMiddleware = requirePermission(...requiredPortabilityPermissions(operation, categories));
+        await permissionMiddleware(context, async () => {
+            if (hasEnvironmentScope(context.request.body, operation) &&
+                !context.state.adminUser?.roles.includes(SUPER_ADMIN_ROLE_SLUG)) {
+                recordSecurityDecision(context, {
+                    decisionPoint: 'permission',
+                    reasonCode: 'permission-required',
+                    outcome: 'deny',
+                });
+                context.status = 403;
+                context.body = {
+                    error: 'Forbidden',
+                    message: 'The requested operation is not permitted',
+                };
+                return;
+            }
+            await next();
+        });
+    };
+}
+//# sourceMappingURL=authorization.js.map

package/dist/portability/authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.js","sourceRoot":"","sources":["../../src/portability/authorization.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAG1E,OAAO,EACL,iBAAiB,EACjB,qBAAqB,GAEtB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAMzE,8EAA8E;AAC9E,MAAM,oBAAoB,GAEtB;IACF,aAAa,EAAE;QACb,MAAM,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC;QACpC,MAAM,EAAE;YACN,iBAAiB,CAAC,UAAU;YAC5B,iBAAiB,CAAC,UAAU;YAC5B,iBAAiB,CAAC,WAAW;SAC9B;KACF;IACD,0BAA0B,EAAE;QAC1B,MAAM,EAAE;YACN,iBAAiB,CAAC,QAAQ;YAC1B,iBAAiB,CAAC,SAAS;YAC3B,iBAAiB,CAAC,eAAe;YACjC,iBAAiB,CAAC,UAAU;SAC7B;QACD,MAAM,EAAE;YACN,iBAAiB,CAAC,UAAU;YAC5B,iBAAiB,CAAC,UAAU;YAC5B,iBAAiB,CAAC,WAAW;YAC7B,iBAAiB,CAAC,WAAW;YAC7B,iBAAiB,CAAC,iBAAiB;YACnC,iBAAiB,CAAC,iBAAiB;YACnC,iBAAiB,CAAC,YAAY;YAC9B,iBAAiB,CAAC,YAAY;SAC/B;KACF;IACD,iBAAiB,EAAE;QACjB,MAAM,EAAE;YACN,iBAAiB,CAAC,SAAS;YAC3B,iBAAiB,CAAC,SAAS;YAC3B,iBAAiB,CAAC,UAAU;SAC7B;QACD,MAAM,EAAE;YACN,iBAAiB,CAAC,WAAW;YAC7B,iBAAiB,CAAC,WAAW;YAC7B,iBAAiB,CAAC,cAAc;YAChC,iBAAiB,CAAC,WAAW;YAC7B,iBAAiB,CAAC,YAAY;SAC/B;KACF;IACD,YAAY,EAAE;QACZ,MAAM,EAAE,CAAC,iBAAiB,CAAC,WAAW,EAAE,iBAAiB,CAAC,QAAQ,CAAC;QACnE,MAAM,EAAE,CAAC,iBAAiB,CAAC,aAAa,EAAE,iBAAiB,CAAC,aAAa,CAAC;KAC3E;CACF,CAAC;AAEF,8DAA8D;AAC9D,SAAS,cAAc,CAAC,SAA+B;IACrD,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC,iBAAiB,CAAC,YAAY,CAAC;AACjG,CAAC;AAED,6EAA6E;AAC7E,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,uEAAuE;AACvE,SAAS,mBAAmB,CAAC,IAAa,EAAE,SAA+B;IACzE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAClC,MAAM,KAAK,GACT,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAClG,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,CAAC;AACzD,CAAC;AAED,gFAAgF;AAChF,SAAS,2BAA2B,CAAC,OAAgB,EAAE,SAA+B;IACpF,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC;IACrB,OAAO,CAAC,IAAI;QACV,SAAS,KAAK,QAAQ;YACpB,CAAC,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,IAAI,EAAE,wBAAwB,EAAE;YACrE,CAAC,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC;AAC9E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,8BAA8B,CAC5C,SAA+B,EAC/B,UAA0C;IAE1C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAkB,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC1E,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;QAClC,KAAK,MAAM,UAAU,IAAI,oBAAoB,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC;YAAE,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,CAAC,GAAG,WAAW,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,+BAA+B,CAC7C,SAA+B,EAC/B,cAAgF;IAEhF,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,2BAA2B,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QAED,MAAM,oBAAoB,GAAG,iBAAiB,CAC5C,GAAG,8BAA8B,CAAC,SAAS,EAAE,UAAU,CAAC,CACzD,CAAC;QACF,MAAM,oBAAoB,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;YAC7C,IACE,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;gBACpD,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAC/D,CAAC;gBACD,sBAAsB,CAAC,OAAO,EAAE;oBAC9B,aAAa,EAAE,YAAY;oBAC3B,UAAU,EAAE,qBAAqB;oBACjC,OAAO,EAAE,MAAM;iBAChB,CAAC,CAAC;gBACH,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC;gBACrB,OAAO,CAAC,IAAI,GAAG;oBACb,KAAK,EAAE,WAAW;oBAClB,OAAO,EAAE,0CAA0C;iBACpD,CAAC;gBACF,OAAO;YACT,CAAC;YACD,MAAM,IAAI,EAAE,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}

package/dist/portability/cleanup.d.ts

@@ -0,0 +1,29 @@
+/** Targeted cache and authority cleanup for committed portability imports. */
+import type { ResolvedPortabilityPlan } from './plan.js';
+/** Destination identifiers resolved while applying the portable graph. */
+export interface PortabilityWriteIds {
+    /** Organization slug to destination UUID. */
+    readonly organizationIds: Map<string, string>;
+    /** Application slug to destination UUID. */
+    readonly applicationIds: Map<string, string>;
+    /** Application and role slug to destination UUID. */
+    readonly roleIds: Map<string, string>;
+    /** Application and claim name to destination UUID. */
+    readonly claimIds: Map<string, string>;
+    /** Organization and email to destination UUID. */
+    readonly userIds: Map<string, string>;
+    /** Public client ID to destination UUID. */
+    readonly clientIds: Map<string, string>;
+}
+/**
+ * Register exact cache invalidation and affected-user revocation for the commit boundary.
+ *
+ * The authority callback starts only after the import commits. Its short PostgreSQL transaction
+ * revokes durable sessions and grant rows, then the existing cleanup helper schedules Redis work
+ * without keeping a PostgreSQL transaction open for Redis.
+ *
+ * @param plan - Valid plan and destination snapshot used by the apply transaction
+ * @param ids - Destination identifiers resolved by successful writes
+ */
+export declare function registerPortabilityCleanup(plan: ResolvedPortabilityPlan, ids: PortabilityWriteIds): Promise<void>;
+//# sourceMappingURL=cleanup.d.ts.map

package/dist/portability/cleanup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cleanup.d.ts","sourceRoot":"","sources":["../../src/portability/cleanup.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAW9E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAIzD,0EAA0E;AAC1E,MAAM,WAAW,mBAAmB;IAClC,6CAA6C;IAC7C,QAAQ,CAAC,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,4CAA4C;IAC5C,QAAQ,CAAC,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C,qDAAqD;IACrD,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,sDAAsD;IACtD,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,kDAAkD;IAClD,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,4CAA4C;IAC5C,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC;AA0ID;;;;;;;;;GASG;AACH,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,uBAAuB,EAC7B,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,IAAI,CAAC,CAgBf"}