@rubytech/create-maxy-code 0.1.436 → 0.1.438
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +1 -1
- package/payload/platform/lib/active-rules/dist/index.d.ts +14 -0
- package/payload/platform/lib/active-rules/dist/index.d.ts.map +1 -1
- package/payload/platform/lib/active-rules/dist/index.js +56 -9
- package/payload/platform/lib/active-rules/dist/index.js.map +1 -1
- package/payload/platform/lib/active-rules/src/index.test.ts +106 -0
- package/payload/platform/lib/active-rules/src/index.ts +98 -9
- package/payload/platform/lib/admin-access-password/__tests__/index.test.ts +31 -0
- package/payload/platform/lib/admin-access-password/dist/index.d.ts +8 -0
- package/payload/platform/lib/admin-access-password/dist/index.d.ts.map +1 -1
- package/payload/platform/lib/admin-access-password/dist/index.js +5 -1
- package/payload/platform/lib/admin-access-password/dist/index.js.map +1 -1
- package/payload/platform/lib/admin-access-password/src/index.ts +14 -1
- package/payload/platform/lib/admins-write/__tests__/index.test.ts +27 -0
- package/payload/platform/lib/admins-write/dist/index.d.ts +8 -0
- package/payload/platform/lib/admins-write/dist/index.d.ts.map +1 -1
- package/payload/platform/lib/admins-write/dist/index.js +5 -1
- package/payload/platform/lib/admins-write/dist/index.js.map +1 -1
- package/payload/platform/lib/admins-write/src/index.ts +14 -1
- package/payload/platform/plugins/admin/.claude-plugin/plugin.json +1 -1
- package/payload/platform/plugins/admin/PLUGIN.md +4 -2
- package/payload/platform/plugins/admin/mcp/dist/credential-identity.d.ts +23 -0
- package/payload/platform/plugins/admin/mcp/dist/credential-identity.d.ts.map +1 -0
- package/payload/platform/plugins/admin/mcp/dist/credential-identity.js +35 -0
- package/payload/platform/plugins/admin/mcp/dist/credential-identity.js.map +1 -0
- package/payload/platform/plugins/admin/mcp/dist/index.js +110 -57
- package/payload/platform/plugins/admin/mcp/dist/index.js.map +1 -1
- package/payload/platform/plugins/admin/mcp/dist/tools/account-lifecycle.d.ts +22 -0
- package/payload/platform/plugins/admin/mcp/dist/tools/account-lifecycle.d.ts.map +1 -1
- package/payload/platform/plugins/admin/mcp/dist/tools/account-lifecycle.js +62 -2
- package/payload/platform/plugins/admin/mcp/dist/tools/account-lifecycle.js.map +1 -1
- package/payload/platform/plugins/admin/skills/platform-architecture/SKILL.md +6 -6
- package/payload/platform/plugins/docs/references/admin-identity-gate.md +40 -0
- package/payload/platform/plugins/docs/references/admin-session.md +2 -0
- package/payload/platform/plugins/docs/references/admin-ui.md +2 -2
- package/payload/platform/plugins/docs/references/internals.md +3 -3
- package/payload/platform/plugins/linkedin-import/skills/linkedin-import/references/profile.md +1 -1
- package/payload/platform/plugins/memory/mcp/dist/index.js +12 -3
- package/payload/platform/plugins/memory/mcp/dist/index.js.map +1 -1
- package/payload/platform/plugins/memory/mcp/dist/tools/__tests__/memory-archive-write-progress.test.d.ts +2 -0
- package/payload/platform/plugins/memory/mcp/dist/tools/__tests__/memory-archive-write-progress.test.d.ts.map +1 -0
- package/payload/platform/plugins/memory/mcp/dist/tools/__tests__/memory-archive-write-progress.test.js +79 -0
- package/payload/platform/plugins/memory/mcp/dist/tools/__tests__/memory-archive-write-progress.test.js.map +1 -0
- package/payload/platform/plugins/memory/mcp/dist/tools/__tests__/memory-ingest-write-phase-progress.test.d.ts +2 -0
- package/payload/platform/plugins/memory/mcp/dist/tools/__tests__/memory-ingest-write-phase-progress.test.d.ts.map +1 -0
- package/payload/platform/plugins/memory/mcp/dist/tools/__tests__/memory-ingest-write-phase-progress.test.js +50 -0
- package/payload/platform/plugins/memory/mcp/dist/tools/__tests__/memory-ingest-write-phase-progress.test.js.map +1 -0
- package/payload/platform/plugins/memory/mcp/dist/tools/__tests__/memory-reindex-progress.test.d.ts +2 -0
- package/payload/platform/plugins/memory/mcp/dist/tools/__tests__/memory-reindex-progress.test.d.ts.map +1 -0
- package/payload/platform/plugins/memory/mcp/dist/tools/__tests__/memory-reindex-progress.test.js +114 -0
- package/payload/platform/plugins/memory/mcp/dist/tools/__tests__/memory-reindex-progress.test.js.map +1 -0
- package/payload/platform/plugins/memory/mcp/dist/tools/__tests__/profile-read-active-rules.test.js +5 -0
- package/payload/platform/plugins/memory/mcp/dist/tools/__tests__/profile-read-active-rules.test.js.map +1 -1
- package/payload/platform/plugins/memory/mcp/dist/tools/memory-archive-write.d.ts +15 -0
- package/payload/platform/plugins/memory/mcp/dist/tools/memory-archive-write.d.ts.map +1 -1
- package/payload/platform/plugins/memory/mcp/dist/tools/memory-archive-write.js +17 -17
- package/payload/platform/plugins/memory/mcp/dist/tools/memory-archive-write.js.map +1 -1
- package/payload/platform/plugins/memory/mcp/dist/tools/memory-ingest.js +21 -1
- package/payload/platform/plugins/memory/mcp/dist/tools/memory-ingest.js.map +1 -1
- package/payload/platform/plugins/memory/mcp/dist/tools/memory-reindex.d.ts +1 -1
- package/payload/platform/plugins/memory/mcp/dist/tools/memory-reindex.d.ts.map +1 -1
- package/payload/platform/plugins/memory/mcp/dist/tools/memory-reindex.js +19 -4
- package/payload/platform/plugins/memory/mcp/dist/tools/memory-reindex.js.map +1 -1
- package/payload/platform/plugins/memory/mcp/dist/tools/profile-read.d.ts.map +1 -1
- package/payload/platform/plugins/memory/mcp/dist/tools/profile-read.js +4 -2
- package/payload/platform/plugins/memory/mcp/dist/tools/profile-read.js.map +1 -1
- package/payload/platform/scripts/remediate-glsmith-identity.sh +500 -0
- package/payload/platform/scripts/seed-neo4j.sh +77 -12
- package/payload/platform/services/claude-session-manager/dist/http-server.d.ts.map +1 -1
- package/payload/platform/services/claude-session-manager/dist/http-server.js +36 -10
- package/payload/platform/services/claude-session-manager/dist/http-server.js.map +1 -1
- package/payload/platform/services/claude-session-manager/dist/identity-audit.d.ts +51 -0
- package/payload/platform/services/claude-session-manager/dist/identity-audit.d.ts.map +1 -0
- package/payload/platform/services/claude-session-manager/dist/identity-audit.js +103 -0
- package/payload/platform/services/claude-session-manager/dist/identity-audit.js.map +1 -0
- package/payload/platform/services/claude-session-manager/dist/index.js +33 -0
- package/payload/platform/services/claude-session-manager/dist/index.js.map +1 -1
- package/payload/platform/services/claude-session-manager/dist/jsonl-enumerator.d.ts +7 -0
- package/payload/platform/services/claude-session-manager/dist/jsonl-enumerator.d.ts.map +1 -1
- package/payload/platform/services/claude-session-manager/dist/jsonl-enumerator.js +9 -0
- package/payload/platform/services/claude-session-manager/dist/jsonl-enumerator.js.map +1 -1
- package/payload/platform/services/claude-session-manager/dist/mcp-user-binding.d.ts +25 -0
- package/payload/platform/services/claude-session-manager/dist/mcp-user-binding.d.ts.map +1 -0
- package/payload/platform/services/claude-session-manager/dist/mcp-user-binding.js +42 -0
- package/payload/platform/services/claude-session-manager/dist/mcp-user-binding.js.map +1 -0
- package/payload/platform/services/claude-session-manager/dist/preference-reconciliation-audit.d.ts +4 -1
- package/payload/platform/services/claude-session-manager/dist/preference-reconciliation-audit.d.ts.map +1 -1
- package/payload/platform/services/claude-session-manager/dist/preference-reconciliation-audit.js.map +1 -1
- package/payload/platform/services/claude-session-manager/dist/redundant-operator-seat-audit.d.ts +44 -0
- package/payload/platform/services/claude-session-manager/dist/redundant-operator-seat-audit.d.ts.map +1 -0
- package/payload/platform/services/claude-session-manager/dist/redundant-operator-seat-audit.js +127 -0
- package/payload/platform/services/claude-session-manager/dist/redundant-operator-seat-audit.js.map +1 -0
- package/payload/server/{chunk-LMLVOZ6G.js → chunk-UGPQCVIW.js} +11 -38
- package/payload/server/maxy-edge.js +1 -1
- package/payload/server/public/assets/{AdminLoginScreens-CMh1pdOp.js → AdminLoginScreens-DeR71H29.js} +1 -1
- package/payload/server/public/assets/AdminShell-DlAVQUda.js +2 -0
- package/payload/server/public/assets/{Checkbox-OCfZCTCO.js → Checkbox-B629mOPp.js} +1 -1
- package/payload/server/public/assets/{admin-Bi2uYnAg.js → admin-C15h-NL0.js} +1 -1
- package/payload/server/public/assets/{arc-Bm9oSOth.js → arc-qKfXIt8v.js} +1 -1
- package/payload/server/public/assets/architecture-YZFGNWBL-FPHT7s-C.js +1 -0
- package/payload/server/public/assets/{architectureDiagram-Q4EWVU46-C2dK88g3.js → architectureDiagram-Q4EWVU46-DkVrGn7G.js} +1 -1
- package/payload/server/public/assets/{blockDiagram-DXYQGD6D-DfLSsjCJ.js → blockDiagram-DXYQGD6D-DqavswGH.js} +1 -1
- package/payload/server/public/assets/browser-B7xQLIRK.js +1 -0
- package/payload/server/public/assets/{c4Diagram-AHTNJAMY-Bxkmp6OL.js → c4Diagram-AHTNJAMY-B7fyKiXe.js} +1 -1
- package/payload/server/public/assets/calendar-A-vGm6pL.js +1 -0
- package/payload/server/public/assets/channel-j70eMvcL.js +1 -0
- package/payload/server/public/assets/chat-DAae6Z51.js +1 -0
- package/payload/server/public/assets/chevron-left-u4tjq7fI.js +1 -0
- package/payload/server/public/assets/{chunk-2KRD3SAO-BVNDFwNH.js → chunk-2KRD3SAO-DsgMtGkv.js} +1 -1
- package/payload/server/public/assets/{chunk-336JU56O-Daz6nMta.js → chunk-336JU56O-CkdISfNt.js} +2 -2
- package/payload/server/public/assets/chunk-426QAEUC-D-NcAlTW.js +1 -0
- package/payload/server/public/assets/{chunk-4BX2VUAB-DTldfvwP.js → chunk-4BX2VUAB-CYpiF2bl.js} +1 -1
- package/payload/server/public/assets/{chunk-4TB4RGXK-DhM8pwRG.js → chunk-4TB4RGXK-CWyc_F7v.js} +1 -1
- package/payload/server/public/assets/{chunk-55IACEB6-CzTsbIHo.js → chunk-55IACEB6-BbzKMw2Z.js} +1 -1
- package/payload/server/public/assets/{chunk-5FUZZQ4R-BrcObZhe.js → chunk-5FUZZQ4R-u19Nai9e.js} +1 -1
- package/payload/server/public/assets/{chunk-5PVQY5BW-SFqTuS11.js → chunk-5PVQY5BW-Ba8by6Uy.js} +1 -1
- package/payload/server/public/assets/{chunk-67CJDMHE-EIbrSGOo.js → chunk-67CJDMHE-BwUuxtyb.js} +1 -1
- package/payload/server/public/assets/{chunk-7N4EOEYR-B1D4Jorr.js → chunk-7N4EOEYR-BRH9iM9L.js} +1 -1
- package/payload/server/public/assets/{chunk-AA7GKIK3-BKHiX4cC.js → chunk-AA7GKIK3-BGoztgLL.js} +1 -1
- package/payload/server/public/assets/{chunk-BSJP7CBP-xBzu29m7.js → chunk-BSJP7CBP-C5GDAZTl.js} +1 -1
- package/payload/server/public/assets/{chunk-CIAEETIT-x2x0gMpL.js → chunk-CIAEETIT-ChY32VPS.js} +1 -1
- package/payload/server/public/assets/{chunk-EDXVE4YY-D5UkD28M.js → chunk-EDXVE4YY-CPSD3p6p.js} +1 -1
- package/payload/server/public/assets/{chunk-ENJZ2VHE-Dbz67a7E.js → chunk-ENJZ2VHE-D1oL-iUr.js} +1 -1
- package/payload/server/public/assets/{chunk-FMBD7UC4-XfWvuu2F.js → chunk-FMBD7UC4-CPvYEr54.js} +1 -1
- package/payload/server/public/assets/{chunk-FOC6F5B3-DfOEDS4q.js → chunk-FOC6F5B3-9Yyj7Vbz.js} +1 -1
- package/payload/server/public/assets/{chunk-ICPOFSXX-D_WEZZvg.js → chunk-ICPOFSXX-BaYgh8FR.js} +2 -2
- package/payload/server/public/assets/{chunk-K5T4RW27-7O627Xi1.js → chunk-K5T4RW27-5ucpeRvm.js} +1 -1
- package/payload/server/public/assets/{chunk-KGLVRYIC-BXI3XDP9.js → chunk-KGLVRYIC-DW-FHk7T.js} +1 -1
- package/payload/server/public/assets/{chunk-LIHQZDEY-B9cFNN0l.js → chunk-LIHQZDEY-CGGVfAyG.js} +1 -1
- package/payload/server/public/assets/{chunk-ORNJ4GCN-BR3UNDTn.js → chunk-ORNJ4GCN-Bv8EUa5d.js} +1 -1
- package/payload/server/public/assets/{chunk-OYMX7WX6-2wKIEtFZ.js → chunk-OYMX7WX6-C1mXJnyw.js} +1 -1
- package/payload/server/public/assets/chunk-QZHKN3VN-CAwbQBtf.js +1 -0
- package/payload/server/public/assets/{chunk-U2HBQHQK-augM3AXB.js → chunk-U2HBQHQK-PwSQz6EP.js} +1 -1
- package/payload/server/public/assets/{chunk-X2U36JSP-BAM9q9ZQ.js → chunk-X2U36JSP--NPHTBlU.js} +1 -1
- package/payload/server/public/assets/{chunk-XPW4576I-DxPpji5P.js → chunk-XPW4576I-Bbc7Da32.js} +1 -1
- package/payload/server/public/assets/{chunk-YZCP3GAM-BD3ClFXP.js → chunk-YZCP3GAM-D-9v8e--.js} +1 -1
- package/payload/server/public/assets/{chunk-ZZ45TVLE-CqxhLPep.js → chunk-ZZ45TVLE-CMPg670Q.js} +1 -1
- package/payload/server/public/assets/classDiagram-6PBFFD2Q-Ct6Rn0vt.js +1 -0
- package/payload/server/public/assets/classDiagram-v2-HSJHXN6E-B_2XCIFv.js +1 -0
- package/payload/server/public/assets/clone-DjPWA_NH.js +1 -0
- package/payload/server/public/assets/{cose-bilkent-S5V4N54A-xywWX-9i.js → cose-bilkent-S5V4N54A-NVSb1Bhy.js} +1 -1
- package/payload/server/public/assets/{dagre-KV5264BT-ChRpqqiH.js → dagre-KV5264BT-V2Ai1DFl.js} +1 -1
- package/payload/server/public/assets/{dagre-BaHjDQ-8.js → dagre-QfLcO-1j.js} +1 -1
- package/payload/server/public/assets/data-BNWpKx1d.js +1 -0
- package/payload/server/public/assets/{diagram-5BDNPKRD-KjwTpyBi.js → diagram-5BDNPKRD-Caw21693.js} +1 -1
- package/payload/server/public/assets/{diagram-G4DWMVQ6-DZO9njAF.js → diagram-G4DWMVQ6-CgwVkT2q.js} +1 -1
- package/payload/server/public/assets/{diagram-MMDJMWI5-Bus-U-TI.js → diagram-MMDJMWI5-DFUrLZhs.js} +1 -1
- package/payload/server/public/assets/{diagram-TYMM5635-CfJodFgq.js → diagram-TYMM5635-CEEiEuZJ.js} +1 -1
- package/payload/server/public/assets/{erDiagram-SMLLAGMA-Bt5zqWiW.js → erDiagram-SMLLAGMA-CG10NrT3.js} +1 -1
- package/payload/server/public/assets/file-download-4mKJxUi-.js +1 -0
- package/payload/server/public/assets/{flatten-Bpu1L63d.js → flatten-DAO0sfCM.js} +1 -1
- package/payload/server/public/assets/{flowDiagram-DWJPFMVM-B64Q590S.js → flowDiagram-DWJPFMVM-BqkV9Okv.js} +1 -1
- package/payload/server/public/assets/{ganttDiagram-T4ZO3ILL-BWdgCEpH.js → ganttDiagram-T4ZO3ILL-DRiCDQF6.js} +1 -1
- package/payload/server/public/assets/gitGraph-7Q5UKJZL-B8Hx7f-D.js +1 -0
- package/payload/server/public/assets/{gitGraphDiagram-UUTBAWPF-Djq2B0WT.js → gitGraphDiagram-UUTBAWPF-BZV2voyy.js} +1 -1
- package/payload/server/public/assets/{graph-CrJ-itbq.js → graph-D0orIRAh.js} +3 -3
- package/payload/server/public/assets/{graph-labels-CmCWaKJT.js → graph-labels-B8YAdo3Z.js} +1 -1
- package/payload/server/public/assets/{graphlib-CNJh9_lx.js → graphlib-DGPThX8M.js} +1 -1
- package/payload/server/public/assets/info-OMHHGYJF-BicCJTqU.js +1 -0
- package/payload/server/public/assets/infoDiagram-42DDH7IO-tf-8rOez.js +2 -0
- package/payload/server/public/assets/{isEmpty-DkDEVnMZ.js → isEmpty-Cb_U81C6.js} +1 -1
- package/payload/server/public/assets/{ishikawaDiagram-UXIWVN3A-V3ACkWCW.js → ishikawaDiagram-UXIWVN3A-BKsAxSvp.js} +1 -1
- package/payload/server/public/assets/{journeyDiagram-VCZTEJTY-9T0qZeH3.js → journeyDiagram-VCZTEJTY-CmliuOd-.js} +1 -1
- package/payload/server/public/assets/{kanban-definition-6JOO6SKY-CxZ0ukx3.js → kanban-definition-6JOO6SKY-DAlElMb-.js} +1 -1
- package/payload/server/public/assets/{line-DUHKCQZT.js → line-DKZqLKAC.js} +1 -1
- package/payload/server/public/assets/{linear-BgIBblun.js → linear-CbSGdh1x.js} +1 -1
- package/payload/server/public/assets/{maximize-2-_cJWIgx2.js → maximize-2-CxstTgoK.js} +1 -1
- package/payload/server/public/assets/{mermaid-parser.core-CyHygs0-.js → mermaid-parser.core-DFvbao9C.js} +2 -2
- package/payload/server/public/assets/{mermaid.core-L55fJBSx.js → mermaid.core-C0vEBxDm.js} +3 -3
- package/payload/server/public/assets/{mindmap-definition-QFDTVHPH-DczaUX_E.js → mindmap-definition-QFDTVHPH-CShASUKd.js} +1 -1
- package/payload/server/public/assets/operator-DZzuotDB.js +1 -0
- package/payload/server/public/assets/{ordinal-DK3QISRR.js → ordinal-H0tVmBDP.js} +1 -1
- package/payload/server/public/assets/packet-4T2RLAQJ-Ckn_5hq0.js +1 -0
- package/payload/server/public/assets/{page-DbUaFfk6.js → page-3g0A19Rv.js} +6 -6
- package/payload/server/public/assets/page-Ck_pLhAk.js +1 -0
- package/payload/server/public/assets/{pdf-render-COLA4aPx.js → pdf-render-jAQU0nXt.js} +1 -1
- package/payload/server/public/assets/pie-ZZUOXDRM-DzlGQW3J.js +1 -0
- package/payload/server/public/assets/{pieDiagram-DEJITSTG-Da5TdnNt.js → pieDiagram-DEJITSTG-CBZHpDAJ.js} +1 -1
- package/payload/server/public/assets/{public-CYhDdDJd.js → public-WFUQw9AD.js} +1 -1
- package/payload/server/public/assets/{quadrantDiagram-34T5L4WZ-DX7J81uh.js → quadrantDiagram-34T5L4WZ-n3bB3K91.js} +1 -1
- package/payload/server/public/assets/radar-PYXPWWZC-BHo2YD8b.js +1 -0
- package/payload/server/public/assets/{reduce-uzWdoyL7.js → reduce-DAvwat-a.js} +1 -1
- package/payload/server/public/assets/{requirementDiagram-MS252O5E-DJQGrZPG.js → requirementDiagram-MS252O5E-DiDvQK3c.js} +1 -1
- package/payload/server/public/assets/rotate-ccw-COGQTi7n.js +1 -0
- package/payload/server/public/assets/{sankeyDiagram-XADWPNL6-Ba8fGz96.js → sankeyDiagram-XADWPNL6-DWDQQZmd.js} +1 -1
- package/payload/server/public/assets/{sequenceDiagram-FGHM5R23-BmDPC7qx.js → sequenceDiagram-FGHM5R23-DmAqRlBT.js} +1 -1
- package/payload/server/public/assets/{stateDiagram-FHFEXIEX-1VkptYFz.js → stateDiagram-FHFEXIEX-D4R-n6bZ.js} +1 -1
- package/payload/server/public/assets/stateDiagram-v2-QKLJ7IA2-BcFRbGRu.js +1 -0
- package/payload/server/public/assets/tasks-B97VpwEJ.js +1 -0
- package/payload/server/public/assets/{time-entry-format-D477WAes.js → time-entry-format-C09rDHo9.js} +1 -1
- package/payload/server/public/assets/{timeline-definition-GMOUNBTQ-B92U3T_f.js → timeline-definition-GMOUNBTQ-CjiHGP4l.js} +1 -1
- package/payload/server/public/assets/treeView-SZITEDCU-BtRr5vXp.js +1 -0
- package/payload/server/public/assets/treemap-W4RFUUIX-D8p0sbyo.js +1 -0
- package/payload/server/public/assets/useCopyFeedback-CSk9KjhY.js +1 -0
- package/payload/server/public/assets/useSubAccountSwitcher-DLJFISqf.js +9 -0
- package/payload/server/public/assets/{useSubAccountSwitcher-BKCWKo97.css → useSubAccountSwitcher-Dzmd7Aip.css} +1 -1
- package/payload/server/public/assets/{useVoiceRecorder-CZPtVpM-.js → useVoiceRecorder-DCyJQkFK.js} +2 -2
- package/payload/server/public/assets/{vennDiagram-DHZGUBPP-Y6Wkihrs.js → vennDiagram-DHZGUBPP-CBdDQ7c-.js} +1 -1
- package/payload/server/public/assets/wardley-RL74JXVD-DgMn-9ZJ.js +1 -0
- package/payload/server/public/assets/{wardleyDiagram-NUSXRM2D-iJpfal2z.js → wardleyDiagram-NUSXRM2D-BlIQPKLb.js} +1 -1
- package/payload/server/public/assets/{xychartDiagram-5P7HB3ND-S0bv7oH0.js → xychartDiagram-5P7HB3ND-CslKgh9B.js} +1 -1
- package/payload/server/public/browser.html +5 -5
- package/payload/server/public/calendar.html +6 -6
- package/payload/server/public/chat.html +13 -12
- package/payload/server/public/data.html +11 -11
- package/payload/server/public/graph.html +11 -10
- package/payload/server/public/index.html +14 -14
- package/payload/server/public/operator.html +15 -14
- package/payload/server/public/public.html +13 -12
- package/payload/server/public/tasks.html +5 -4
- package/payload/server/server.js +703 -555
- package/payload/server/public/assets/AdminShell-X9Bg3AKc.js +0 -2
- package/payload/server/public/assets/architecture-YZFGNWBL-Bbnxm4F4.js +0 -1
- package/payload/server/public/assets/browser-B0ieZy-b.js +0 -1
- package/payload/server/public/assets/calendar-CRL2_9Fl.js +0 -1
- package/payload/server/public/assets/channel-CatPTq-5.js +0 -1
- package/payload/server/public/assets/chat-DUc7bt5W.js +0 -1
- package/payload/server/public/assets/chevron-left-B2DKUxLk.js +0 -1
- package/payload/server/public/assets/chunk-426QAEUC-CqLMwOdA.js +0 -1
- package/payload/server/public/assets/chunk-QZHKN3VN-CjWy8NJ7.js +0 -1
- package/payload/server/public/assets/classDiagram-6PBFFD2Q-DHhR5rdN.js +0 -1
- package/payload/server/public/assets/classDiagram-v2-HSJHXN6E-DH4pAdfu.js +0 -1
- package/payload/server/public/assets/clone-DCKzwjWW.js +0 -1
- package/payload/server/public/assets/data-C1ftMulP.js +0 -1
- package/payload/server/public/assets/file-download-CHTyUQqS.js +0 -1
- package/payload/server/public/assets/gitGraph-7Q5UKJZL-Ps5HDzLh.js +0 -1
- package/payload/server/public/assets/info-OMHHGYJF-gtlpwIig.js +0 -1
- package/payload/server/public/assets/infoDiagram-42DDH7IO-CPrWlrsa.js +0 -2
- package/payload/server/public/assets/operator-B3Mi3TW0.js +0 -1
- package/payload/server/public/assets/packet-4T2RLAQJ-DrSn1e0n.js +0 -1
- package/payload/server/public/assets/page-C1G57kPZ.js +0 -1
- package/payload/server/public/assets/pie-ZZUOXDRM-C09i6N-g.js +0 -1
- package/payload/server/public/assets/radar-PYXPWWZC-CMZN2KQH.js +0 -1
- package/payload/server/public/assets/stateDiagram-v2-QKLJ7IA2-BdgkPHuh.js +0 -1
- package/payload/server/public/assets/tasks-0OcRiBdQ.js +0 -1
- package/payload/server/public/assets/treeView-SZITEDCU-CeuUM5oL.js +0 -1
- package/payload/server/public/assets/treemap-W4RFUUIX-C--fAaJv.js +0 -1
- package/payload/server/public/assets/useCopyFeedback-CpfVOO26.js +0 -1
- package/payload/server/public/assets/useSubAccountSwitcher-Bo7bnFtC.js +0 -9
- package/payload/server/public/assets/wardley-RL74JXVD-4WPJ2UA9.js +0 -1
- /package/payload/server/public/assets/{_baseFor-Q4DeIqQC.js → _baseFor-D3BqAOBr.js} +0 -0
- /package/payload/server/public/assets/{array-WaOTgZu7.js → array-iYP9fzJp.js} +0 -0
- /package/payload/server/public/assets/{cytoscape.esm-CMmjo4hO.js → cytoscape.esm-BQSBzPsB.js} +0 -0
- /package/payload/server/public/assets/{defaultLocale-BxqJVxq5.js → defaultLocale-BrdA1gDi.js} +0 -0
- /package/payload/server/public/assets/{dist-Dx-cpU53.js → dist-Cvgxm7qv.js} +0 -0
- /package/payload/server/public/assets/{init-DX7c5Edh.js → init-Bx0S6pkp.js} +0 -0
- /package/payload/server/public/assets/{katex-B2dtGfSp.js → katex-BsiH_a6d.js} +0 -0
- /package/payload/server/public/assets/{path-CnSyroar.js → path-BLSgTy3w.js} +0 -0
- /package/payload/server/public/assets/{preload-helper-DqboRNgS.js → preload-helper-ClBMtM1g.js} +0 -0
- /package/payload/server/public/assets/{rough.esm-eLccZ4OJ.js → rough.esm-BMOtDaaS.js} +0 -0
- /package/payload/server/public/assets/{src-Dqs1wlnb.js → src-DV4LKv2E.js} +0 -0
package/package.json
CHANGED
|
@@ -29,7 +29,21 @@ interface MinimalSession {
|
|
|
29
29
|
}>;
|
|
30
30
|
}>;
|
|
31
31
|
}
|
|
32
|
+
export type ActiveRuleSource = "owner" | "no-owner" | "owner-error";
|
|
33
|
+
export type InjectionSource = ActiveRuleSource | "fetch-error";
|
|
34
|
+
export interface ActiveRuleResolution {
|
|
35
|
+
rules: ActiveRule[];
|
|
36
|
+
ownerUserId: string | null;
|
|
37
|
+
source: ActiveRuleSource;
|
|
38
|
+
}
|
|
39
|
+
export interface StandingRulesInjection {
|
|
40
|
+
block: string;
|
|
41
|
+
ownerUserId: string | null;
|
|
42
|
+
source: InjectionSource;
|
|
43
|
+
}
|
|
44
|
+
export declare function resolveOwnerUserId(session: MinimalSession, accountId: string): Promise<string | null>;
|
|
32
45
|
export declare function queryActiveRuleCandidates(session: MinimalSession, accountId: string): Promise<RuleCandidate[]>;
|
|
46
|
+
export declare function resolveActiveRules(session: MinimalSession, accountId: string, cap?: number): Promise<ActiveRuleResolution>;
|
|
33
47
|
export declare function activeRuleSet(session: MinimalSession, accountId: string, cap?: number): Promise<ActiveRule[]>;
|
|
34
48
|
export {};
|
|
35
49
|
//# sourceMappingURL=index.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,mBAAmB,OAAO,CAAC;AACxC,eAAO,MAAM,kBAAkB,KAAK,CAAC;AACrC,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAC1C,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAEzC,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,UAAU;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,CAYvD;AAOD,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,aAAa,EAAE,EACxB,eAAe,GAAE,MAA4B,GAC5C,UAAU,EAAE,CAgBd;AAED,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,UAAU,EAAE,EACnB,GAAG,GAAE,MAA2B,GAC/B,MAAM,CAIR;AAED,UAAU,cAAc;IACtB,GAAG,EAAE,CACH,CAAC,EAAE,MAAM,EACT,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KACvB,OAAO,CAAC;QAAE,OAAO,EAAE,KAAK,CAAC;YAAE,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC,CAAC;CAC/D;AAOD,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,aAAa,EAAE,CAAC,
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,mBAAmB,OAAO,CAAC;AACxC,eAAO,MAAM,kBAAkB,KAAK,CAAC;AACrC,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAC1C,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAEzC,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,UAAU;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,CAYvD;AAOD,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,aAAa,EAAE,EACxB,eAAe,GAAE,MAA4B,GAC5C,UAAU,EAAE,CAgBd;AAED,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,UAAU,EAAE,EACnB,GAAG,GAAE,MAA2B,GAC/B,MAAM,CAIR;AAED,UAAU,cAAc;IACtB,GAAG,EAAE,CACH,CAAC,EAAE,MAAM,EACT,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KACvB,OAAO,CAAC;QAAE,OAAO,EAAE,KAAK,CAAC;YAAE,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC,CAAC;CAC/D;AAMD,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,UAAU,GAAG,aAAa,CAAC;AACpE,MAAM,MAAM,eAAe,GAAG,gBAAgB,GAAG,aAAa,CAAC;AAE/D,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AAID,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,eAAe,CAAC;CACzB;AAOD,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAaxB;AAoED,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,aAAa,EAAE,CAAC,CAE1B;AAGD,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,MAAM,EACjB,GAAG,GAAE,MAA2B,GAC/B,OAAO,CAAC,oBAAoB,CAAC,CAG/B;AAID,wBAAsB,aAAa,CACjC,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,MAAM,EACjB,GAAG,GAAE,MAA2B,GAC/B,OAAO,CAAC,UAAU,EAAE,CAAC,CAEvB"}
|
|
@@ -9,7 +9,9 @@ exports.ACTIVE_CANDIDATE_LIMIT = exports.ACTIVE_CANDIDATE_FLOOR = exports.INJECT
|
|
|
9
9
|
exports.cosine = cosine;
|
|
10
10
|
exports.deconflictBySubject = deconflictBySubject;
|
|
11
11
|
exports.formatStandingRulesBlock = formatStandingRulesBlock;
|
|
12
|
+
exports.resolveOwnerUserId = resolveOwnerUserId;
|
|
12
13
|
exports.queryActiveRuleCandidates = queryActiveRuleCandidates;
|
|
14
|
+
exports.resolveActiveRules = resolveActiveRules;
|
|
13
15
|
exports.activeRuleSet = activeRuleSet;
|
|
14
16
|
exports.SAME_SUBJECT_COSINE = 0.85;
|
|
15
17
|
exports.INJECTION_RULE_CAP = 12;
|
|
@@ -55,19 +57,36 @@ function formatStandingRulesBlock(rules, cap = exports.INJECTION_RULE_CAP) {
|
|
|
55
57
|
const lines = rules.slice(0, cap).map((r) => `- ${r.value}`);
|
|
56
58
|
return `## Standing rules\n${lines.join("\n")}`;
|
|
57
59
|
}
|
|
58
|
-
// The
|
|
59
|
-
//
|
|
60
|
-
//
|
|
61
|
-
//
|
|
60
|
+
// The account's owner identity (Task 1461). One `AdminUser {role:'owner'}` is
|
|
61
|
+
// seeded per account (Task 1359); `null` when absent (a pre-seeding legacy
|
|
62
|
+
// account). Mirrors the memory plugin's resolve-owner-userid.ts, but takes a
|
|
63
|
+
// session so this lib stays dependency-free (no neo4j-driver) — the same
|
|
64
|
+
// cross-process lockstep as the duplicated literals elsewhere in this tree.
|
|
65
|
+
async function resolveOwnerUserId(session, accountId) {
|
|
66
|
+
const res = await session.run(`
|
|
67
|
+
MATCH (au:AdminUser {accountId: $accountId, role: 'owner'})
|
|
68
|
+
RETURN au.userId AS userId
|
|
69
|
+
ORDER BY au.createdAt ASC
|
|
70
|
+
LIMIT 1
|
|
71
|
+
`, { accountId });
|
|
72
|
+
const rec = res.records[0];
|
|
73
|
+
const userId = rec ? rec.get("userId") : null;
|
|
74
|
+
return typeof userId === "string" && userId.length > 0 ? userId : null;
|
|
75
|
+
}
|
|
76
|
+
// The owner's admin-scope candidates, selected through the owner's
|
|
77
|
+
// `UserProfile` and pinned to the resolved owner userId so the prefs selected
|
|
78
|
+
// and the owner logged are one identity. Not trashed, not a "does not apply"
|
|
79
|
+
// declination, above the injection floor, ordered so the highest-confidence /
|
|
80
|
+
// most-recent wins de-confliction. The trashed predicate mirrors graph-trash's
|
|
62
81
|
// `notTrashed()` exactly (label + deletedAt) so this lib stays dependency-free.
|
|
63
|
-
async function
|
|
82
|
+
async function queryOwnerCandidates(session, accountId, ownerUserId) {
|
|
64
83
|
// ACTIVE_CANDIDATE_LIMIT is inlined as a Cypher literal rather than bound as a
|
|
65
84
|
// param: a plain JS number bound to `LIMIT $p` serializes as a FLOAT and Neo4j
|
|
66
85
|
// rejects it ("not a valid value. Must be a non-negative integer"). This lib
|
|
67
86
|
// is dependency-free (no neo4j-driver), so it cannot call `neo4j.int()`; the
|
|
68
87
|
// constant is a hardcoded integer, so inlining it is safe and gate-clean.
|
|
69
88
|
const result = await session.run(`
|
|
70
|
-
MATCH (
|
|
89
|
+
MATCH (up:UserProfile {accountId: $accountId, userId: $ownerUserId})-[:HAS_PREFERENCE]->(pref:Preference {scope: 'admin'})
|
|
71
90
|
WHERE NOT pref:Trashed AND pref.deletedAt IS NULL
|
|
72
91
|
AND coalesce(pref.notApplicable, false) = false
|
|
73
92
|
AND pref.confidence >= $floor
|
|
@@ -76,7 +95,7 @@ async function queryActiveRuleCandidates(session, accountId) {
|
|
|
76
95
|
pref.observedAt AS observedAt, pref.embedding AS embedding
|
|
77
96
|
ORDER BY pref.confidence DESC, pref.observedAt DESC
|
|
78
97
|
LIMIT ${exports.ACTIVE_CANDIDATE_LIMIT}
|
|
79
|
-
`, { accountId, floor: exports.ACTIVE_CANDIDATE_FLOOR });
|
|
98
|
+
`, { accountId, ownerUserId, floor: exports.ACTIVE_CANDIDATE_FLOOR });
|
|
80
99
|
return result.records.map((r) => ({
|
|
81
100
|
preferenceId: r.get("preferenceId"),
|
|
82
101
|
category: r.get("category"),
|
|
@@ -87,8 +106,36 @@ async function queryActiveRuleCandidates(session, accountId) {
|
|
|
87
106
|
embedding: r.get("embedding") ?? null,
|
|
88
107
|
}));
|
|
89
108
|
}
|
|
109
|
+
// Resolve the owner then select. Injection has exactly one selection rule — the
|
|
110
|
+
// owner's prefs. No owner (or an owner-resolution error) yields no candidates
|
|
111
|
+
// rather than falling back to a different selection key. An owner-resolution
|
|
112
|
+
// error is caught here and degrades to empty; it never throws.
|
|
113
|
+
async function resolveCandidates(session, accountId) {
|
|
114
|
+
let ownerUserId;
|
|
115
|
+
try {
|
|
116
|
+
ownerUserId = await resolveOwnerUserId(session, accountId);
|
|
117
|
+
}
|
|
118
|
+
catch {
|
|
119
|
+
return { candidates: [], ownerUserId: null, source: "owner-error" };
|
|
120
|
+
}
|
|
121
|
+
if (!ownerUserId)
|
|
122
|
+
return { candidates: [], ownerUserId: null, source: "no-owner" };
|
|
123
|
+
const candidates = await queryOwnerCandidates(session, accountId, ownerUserId);
|
|
124
|
+
return { candidates, ownerUserId, source: "owner" };
|
|
125
|
+
}
|
|
126
|
+
// Owner-scoped candidates for a downstream reader that only needs the rows
|
|
127
|
+
// (the standing preference-reconciliation audit). Signature unchanged.
|
|
128
|
+
async function queryActiveRuleCandidates(session, accountId) {
|
|
129
|
+
return (await resolveCandidates(session, accountId)).candidates;
|
|
130
|
+
}
|
|
131
|
+
// The account's active, de-conflicted, bounded rule-set plus its provenance.
|
|
132
|
+
async function resolveActiveRules(session, accountId, cap = exports.INJECTION_RULE_CAP) {
|
|
133
|
+
const { candidates, ownerUserId, source } = await resolveCandidates(session, accountId);
|
|
134
|
+
return { rules: deconflictBySubject(candidates).slice(0, cap), ownerUserId, source };
|
|
135
|
+
}
|
|
136
|
+
// The rule array alone — the unchanged call boundary for profile-read and the
|
|
137
|
+
// ui/server injection wrapper.
|
|
90
138
|
async function activeRuleSet(session, accountId, cap = exports.INJECTION_RULE_CAP) {
|
|
91
|
-
|
|
92
|
-
return deconflictBySubject(candidates).slice(0, cap);
|
|
139
|
+
return (await resolveActiveRules(session, accountId, cap)).rules;
|
|
93
140
|
}
|
|
94
141
|
//# sourceMappingURL=index.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,uEAAuE;AACvE,sEAAsE;AACtE,gFAAgF;AAChF,8EAA8E;AAC9E,cAAc;;;AA0Bd,wBAYC;AAOD,kDAmBC;AAED,4DAOC;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,uEAAuE;AACvE,sEAAsE;AACtE,gFAAgF;AAChF,8EAA8E;AAC9E,cAAc;;;AA0Bd,wBAYC;AAOD,kDAmBC;AAED,4DAOC;AAmCD,gDAgBC;AAoED,8DAKC;AAGD,gDAOC;AAID,sCAMC;AAvNY,QAAA,mBAAmB,GAAG,IAAI,CAAC;AAC3B,QAAA,kBAAkB,GAAG,EAAE,CAAC;AACxB,QAAA,sBAAsB,GAAG,GAAG,CAAC;AAC7B,QAAA,sBAAsB,GAAG,EAAE,CAAC;AAqBzC,SAAgB,MAAM,CAAC,CAAW,EAAE,CAAW;IAC7C,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC;IAC9D,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnB,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAClB,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IACD,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACnC,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,0EAA0E;AAC1E,uEAAuE;AACvE,8EAA8E;AAC9E,gFAAgF;AAChF,mBAAmB;AACnB,SAAgB,mBAAmB,CACjC,OAAwB,EACxB,kBAA0B,2BAAmB;IAE7C,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,CAAC,CAAC,SAAS,CAAC;QACxB,MAAM,KAAK,GACT,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAClB,GAAG,CAAC,MAAM,GAAG,CAAC;YACd,OAAO,CAAC,IAAI,CACV,CAAC,CAAC,EAAE,EAAE,CACJ,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC1B,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;gBACtB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,eAAe,CAC9C,CAAC;QACJ,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;AACnE,CAAC;AAED,SAAgB,wBAAwB,CACtC,KAAmB,EACnB,MAAc,0BAAkB;IAEhC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC7D,OAAO,sBAAsB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAClD,CAAC;AA8BD,8EAA8E;AAC9E,2EAA2E;AAC3E,6EAA6E;AAC7E,yEAAyE;AACzE,4EAA4E;AACrE,KAAK,UAAU,kBAAkB,CACtC,OAAuB,EACvB,SAAiB;IAEjB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAC3B;;;;;KAKC,EACD,EAAE,SAAS,EAAE,CACd,CAAC;IACF,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACzE,CAAC;AAED,mEAAmE;AACnE,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,+EAA+E;AAC/E,gFAAgF;AAChF,KAAK,UAAU,oBAAoB,CACjC,OAAuB,EACvB,SAAiB,EACjB,WAAmB;IAEnB,+EAA+E;IAC/E,+EAA+E;IAC/E,6EAA6E;IAC7E,6EAA6E;IAC7E,0EAA0E;IAC1E,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B;;;;;;;;;YASQ,8BAAsB;KAC7B,EACD,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,8BAAsB,EAAE,CAC1D,CAAC;IACF,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChC,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,cAAc,CAAW;QAC7C,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAW;QACrC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAW;QAC3B,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAW;QAC/B,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,CAAW;QACzC,UAAU,EAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAY,IAAI,EAAE;QACjD,SAAS,EAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAqB,IAAI,IAAI;KAC3D,CAAC,CAAC,CAAC;AACN,CAAC;AAED,gFAAgF;AAChF,8EAA8E;AAC9E,6EAA6E;AAC7E,+DAA+D;AAC/D,KAAK,UAAU,iBAAiB,CAC9B,OAAuB,EACvB,SAAiB;IAMjB,IAAI,WAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACtE,CAAC;IACD,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACnF,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IAC/E,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AACtD,CAAC;AAED,2EAA2E;AAC3E,uEAAuE;AAChE,KAAK,UAAU,yBAAyB,CAC7C,OAAuB,EACvB,SAAiB;IAEjB,OAAO,CAAC,MAAM,iBAAiB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;AAClE,CAAC;AAED,6EAA6E;AACtE,KAAK,UAAU,kBAAkB,CACtC,OAAuB,EACvB,SAAiB,EACjB,MAAc,0BAAkB;IAEhC,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACxF,OAAO,EAAE,KAAK,EAAE,mBAAmB,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;AACvF,CAAC;AAED,8EAA8E;AAC9E,+BAA+B;AACxB,KAAK,UAAU,aAAa,CACjC,OAAuB,EACvB,SAAiB,EACjB,MAAc,0BAAkB;IAEhC,OAAO,CAAC,MAAM,kBAAkB,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;AACnE,CAAC"}
|
|
@@ -3,6 +3,9 @@ import {
|
|
|
3
3
|
cosine,
|
|
4
4
|
deconflictBySubject,
|
|
5
5
|
formatStandingRulesBlock,
|
|
6
|
+
resolveActiveRules,
|
|
7
|
+
activeRuleSet,
|
|
8
|
+
queryActiveRuleCandidates,
|
|
6
9
|
INJECTION_RULE_CAP,
|
|
7
10
|
type RuleCandidate,
|
|
8
11
|
} from "./index.js";
|
|
@@ -68,6 +71,109 @@ describe("deconflictBySubject", () => {
|
|
|
68
71
|
});
|
|
69
72
|
});
|
|
70
73
|
|
|
74
|
+
// A fake Neo4j session that dispatches on query text: the owner-resolution
|
|
75
|
+
// query (matches `role: 'owner'`) returns a configurable owner userId or none;
|
|
76
|
+
// the candidate query (matches HAS_PREFERENCE) returns configurable pref rows
|
|
77
|
+
// and asserts it was pinned to the resolved owner userId.
|
|
78
|
+
function fakeSession(opts: {
|
|
79
|
+
ownerId?: string | null;
|
|
80
|
+
ownerThrows?: boolean;
|
|
81
|
+
prefRows?: Array<Record<string, unknown>>;
|
|
82
|
+
}) {
|
|
83
|
+
return {
|
|
84
|
+
calls: [] as string[],
|
|
85
|
+
candidateRuns: 0,
|
|
86
|
+
async run(q: string, p: Record<string, unknown>) {
|
|
87
|
+
this.calls.push(q);
|
|
88
|
+
if (/role:\s*'owner'/.test(q)) {
|
|
89
|
+
if (opts.ownerThrows) throw new Error("neo4j down");
|
|
90
|
+
const recs = opts.ownerId
|
|
91
|
+
? [{ get: (_k: string) => opts.ownerId }]
|
|
92
|
+
: [];
|
|
93
|
+
return { records: recs };
|
|
94
|
+
}
|
|
95
|
+
// candidate query — must be pinned to the resolved owner userId
|
|
96
|
+
this.candidateRuns++;
|
|
97
|
+
expect(p.ownerUserId).toBe(opts.ownerId);
|
|
98
|
+
return {
|
|
99
|
+
records: (opts.prefRows ?? []).map((r) => ({
|
|
100
|
+
get: (k: string) => r[k],
|
|
101
|
+
})),
|
|
102
|
+
};
|
|
103
|
+
},
|
|
104
|
+
};
|
|
105
|
+
}
|
|
106
|
+
|
|
107
|
+
const prefRow = (over: Partial<RuleCandidate>): Record<string, unknown> => ({
|
|
108
|
+
preferenceId: "p",
|
|
109
|
+
category: "communication",
|
|
110
|
+
key: "k",
|
|
111
|
+
value: "v",
|
|
112
|
+
confidence: 0.6,
|
|
113
|
+
observedAt: "2026-07-01T00:00:00Z",
|
|
114
|
+
embedding: null,
|
|
115
|
+
...over,
|
|
116
|
+
});
|
|
117
|
+
|
|
118
|
+
describe("resolveActiveRules — owner-scoped selection", () => {
|
|
119
|
+
it("returns the owner's prefs with source=owner when an owner exists", async () => {
|
|
120
|
+
const s = fakeSession({
|
|
121
|
+
ownerId: "owner-35fed05e",
|
|
122
|
+
prefRows: [
|
|
123
|
+
prefRow({ preferenceId: "a", value: "brand", confidence: 0.9 }),
|
|
124
|
+
prefRow({ preferenceId: "b", value: "pricing", confidence: 0.7 }),
|
|
125
|
+
prefRow({ preferenceId: "c", value: "tender", confidence: 0.5 }),
|
|
126
|
+
],
|
|
127
|
+
});
|
|
128
|
+
const res = await resolveActiveRules(s, "acct-1");
|
|
129
|
+
expect(res.source).toBe("owner");
|
|
130
|
+
expect(res.ownerUserId).toBe("owner-35fed05e");
|
|
131
|
+
expect(res.rules.map((r) => r.preferenceId)).toEqual(["a", "b", "c"]);
|
|
132
|
+
expect(s.candidateRuns).toBe(1);
|
|
133
|
+
});
|
|
134
|
+
|
|
135
|
+
it("returns empty with source=no-owner and never runs the candidate query", async () => {
|
|
136
|
+
const s = fakeSession({ ownerId: null });
|
|
137
|
+
const res = await resolveActiveRules(s, "acct-1");
|
|
138
|
+
expect(res.source).toBe("no-owner");
|
|
139
|
+
expect(res.ownerUserId).toBeNull();
|
|
140
|
+
expect(res.rules).toEqual([]);
|
|
141
|
+
expect(s.candidateRuns).toBe(0);
|
|
142
|
+
});
|
|
143
|
+
|
|
144
|
+
it("returns empty with source=owner when the owner has zero prefs", async () => {
|
|
145
|
+
const s = fakeSession({ ownerId: "owner-x", prefRows: [] });
|
|
146
|
+
const res = await resolveActiveRules(s, "acct-1");
|
|
147
|
+
expect(res.source).toBe("owner");
|
|
148
|
+
expect(res.ownerUserId).toBe("owner-x");
|
|
149
|
+
expect(res.rules).toEqual([]);
|
|
150
|
+
expect(s.candidateRuns).toBe(1);
|
|
151
|
+
});
|
|
152
|
+
|
|
153
|
+
it("degrades to empty with source=owner-error on an owner-resolution failure (never throws)", async () => {
|
|
154
|
+
const s = fakeSession({ ownerThrows: true });
|
|
155
|
+
const res = await resolveActiveRules(s, "acct-1");
|
|
156
|
+
expect(res.source).toBe("owner-error");
|
|
157
|
+
expect(res.ownerUserId).toBeNull();
|
|
158
|
+
expect(res.rules).toEqual([]);
|
|
159
|
+
expect(s.candidateRuns).toBe(0);
|
|
160
|
+
});
|
|
161
|
+
|
|
162
|
+
it("activeRuleSet returns just the owner's rule array", async () => {
|
|
163
|
+
const s = fakeSession({
|
|
164
|
+
ownerId: "owner-1",
|
|
165
|
+
prefRows: [prefRow({ preferenceId: "a" })],
|
|
166
|
+
});
|
|
167
|
+
const rules = await activeRuleSet(s, "acct-1");
|
|
168
|
+
expect(rules.map((r) => r.preferenceId)).toEqual(["a"]);
|
|
169
|
+
});
|
|
170
|
+
|
|
171
|
+
it("queryActiveRuleCandidates stays owner-scoped (empty on no owner)", async () => {
|
|
172
|
+
const s = fakeSession({ ownerId: null });
|
|
173
|
+
expect(await queryActiveRuleCandidates(s, "acct-1")).toEqual([]);
|
|
174
|
+
});
|
|
175
|
+
});
|
|
176
|
+
|
|
71
177
|
describe("formatStandingRulesBlock", () => {
|
|
72
178
|
it("returns empty string for no rules", () => {
|
|
73
179
|
expect(formatStandingRulesBlock([], INJECTION_RULE_CAP)).toBe("");
|
|
@@ -84,14 +84,60 @@ interface MinimalSession {
|
|
|
84
84
|
) => Promise<{ records: Array<{ get(k: string): unknown }> }>;
|
|
85
85
|
}
|
|
86
86
|
|
|
87
|
-
//
|
|
88
|
-
//
|
|
89
|
-
//
|
|
90
|
-
// the
|
|
87
|
+
// Task 1564 — which admin `AdminUser`/`UserProfile` owns a preference now
|
|
88
|
+
// decides whether it is injected. `source` records how the rule-set was
|
|
89
|
+
// selected; `InjectionSource` widens it with `fetch-error`, produced only by
|
|
90
|
+
// the ui/server never-throw catch (a hard Neo4j failure), never by this lib.
|
|
91
|
+
export type ActiveRuleSource = "owner" | "no-owner" | "owner-error";
|
|
92
|
+
export type InjectionSource = ActiveRuleSource | "fetch-error";
|
|
93
|
+
|
|
94
|
+
export interface ActiveRuleResolution {
|
|
95
|
+
rules: ActiveRule[];
|
|
96
|
+
ownerUserId: string | null;
|
|
97
|
+
source: ActiveRuleSource;
|
|
98
|
+
}
|
|
99
|
+
|
|
100
|
+
// The per-turn injection payload the UI hands each channel gateway: the
|
|
101
|
+
// formatted `## Standing rules` block plus the provenance the gateway logs.
|
|
102
|
+
export interface StandingRulesInjection {
|
|
103
|
+
block: string;
|
|
104
|
+
ownerUserId: string | null;
|
|
105
|
+
source: InjectionSource;
|
|
106
|
+
}
|
|
107
|
+
|
|
108
|
+
// The account's owner identity (Task 1461). One `AdminUser {role:'owner'}` is
|
|
109
|
+
// seeded per account (Task 1359); `null` when absent (a pre-seeding legacy
|
|
110
|
+
// account). Mirrors the memory plugin's resolve-owner-userid.ts, but takes a
|
|
111
|
+
// session so this lib stays dependency-free (no neo4j-driver) — the same
|
|
112
|
+
// cross-process lockstep as the duplicated literals elsewhere in this tree.
|
|
113
|
+
export async function resolveOwnerUserId(
|
|
114
|
+
session: MinimalSession,
|
|
115
|
+
accountId: string,
|
|
116
|
+
): Promise<string | null> {
|
|
117
|
+
const res = await session.run(
|
|
118
|
+
`
|
|
119
|
+
MATCH (au:AdminUser {accountId: $accountId, role: 'owner'})
|
|
120
|
+
RETURN au.userId AS userId
|
|
121
|
+
ORDER BY au.createdAt ASC
|
|
122
|
+
LIMIT 1
|
|
123
|
+
`,
|
|
124
|
+
{ accountId },
|
|
125
|
+
);
|
|
126
|
+
const rec = res.records[0];
|
|
127
|
+
const userId = rec ? rec.get("userId") : null;
|
|
128
|
+
return typeof userId === "string" && userId.length > 0 ? userId : null;
|
|
129
|
+
}
|
|
130
|
+
|
|
131
|
+
// The owner's admin-scope candidates, selected through the owner's
|
|
132
|
+
// `UserProfile` and pinned to the resolved owner userId so the prefs selected
|
|
133
|
+
// and the owner logged are one identity. Not trashed, not a "does not apply"
|
|
134
|
+
// declination, above the injection floor, ordered so the highest-confidence /
|
|
135
|
+
// most-recent wins de-confliction. The trashed predicate mirrors graph-trash's
|
|
91
136
|
// `notTrashed()` exactly (label + deletedAt) so this lib stays dependency-free.
|
|
92
|
-
|
|
137
|
+
async function queryOwnerCandidates(
|
|
93
138
|
session: MinimalSession,
|
|
94
139
|
accountId: string,
|
|
140
|
+
ownerUserId: string,
|
|
95
141
|
): Promise<RuleCandidate[]> {
|
|
96
142
|
// ACTIVE_CANDIDATE_LIMIT is inlined as a Cypher literal rather than bound as a
|
|
97
143
|
// param: a plain JS number bound to `LIMIT $p` serializes as a FLOAT and Neo4j
|
|
@@ -100,7 +146,7 @@ export async function queryActiveRuleCandidates(
|
|
|
100
146
|
// constant is a hardcoded integer, so inlining it is safe and gate-clean.
|
|
101
147
|
const result = await session.run(
|
|
102
148
|
`
|
|
103
|
-
MATCH (
|
|
149
|
+
MATCH (up:UserProfile {accountId: $accountId, userId: $ownerUserId})-[:HAS_PREFERENCE]->(pref:Preference {scope: 'admin'})
|
|
104
150
|
WHERE NOT pref:Trashed AND pref.deletedAt IS NULL
|
|
105
151
|
AND coalesce(pref.notApplicable, false) = false
|
|
106
152
|
AND pref.confidence >= $floor
|
|
@@ -110,7 +156,7 @@ export async function queryActiveRuleCandidates(
|
|
|
110
156
|
ORDER BY pref.confidence DESC, pref.observedAt DESC
|
|
111
157
|
LIMIT ${ACTIVE_CANDIDATE_LIMIT}
|
|
112
158
|
`,
|
|
113
|
-
{ accountId, floor: ACTIVE_CANDIDATE_FLOOR },
|
|
159
|
+
{ accountId, ownerUserId, floor: ACTIVE_CANDIDATE_FLOOR },
|
|
114
160
|
);
|
|
115
161
|
return result.records.map((r) => ({
|
|
116
162
|
preferenceId: r.get("preferenceId") as string,
|
|
@@ -123,11 +169,54 @@ export async function queryActiveRuleCandidates(
|
|
|
123
169
|
}));
|
|
124
170
|
}
|
|
125
171
|
|
|
172
|
+
// Resolve the owner then select. Injection has exactly one selection rule — the
|
|
173
|
+
// owner's prefs. No owner (or an owner-resolution error) yields no candidates
|
|
174
|
+
// rather than falling back to a different selection key. An owner-resolution
|
|
175
|
+
// error is caught here and degrades to empty; it never throws.
|
|
176
|
+
async function resolveCandidates(
|
|
177
|
+
session: MinimalSession,
|
|
178
|
+
accountId: string,
|
|
179
|
+
): Promise<{
|
|
180
|
+
candidates: RuleCandidate[];
|
|
181
|
+
ownerUserId: string | null;
|
|
182
|
+
source: ActiveRuleSource;
|
|
183
|
+
}> {
|
|
184
|
+
let ownerUserId: string | null;
|
|
185
|
+
try {
|
|
186
|
+
ownerUserId = await resolveOwnerUserId(session, accountId);
|
|
187
|
+
} catch {
|
|
188
|
+
return { candidates: [], ownerUserId: null, source: "owner-error" };
|
|
189
|
+
}
|
|
190
|
+
if (!ownerUserId) return { candidates: [], ownerUserId: null, source: "no-owner" };
|
|
191
|
+
const candidates = await queryOwnerCandidates(session, accountId, ownerUserId);
|
|
192
|
+
return { candidates, ownerUserId, source: "owner" };
|
|
193
|
+
}
|
|
194
|
+
|
|
195
|
+
// Owner-scoped candidates for a downstream reader that only needs the rows
|
|
196
|
+
// (the standing preference-reconciliation audit). Signature unchanged.
|
|
197
|
+
export async function queryActiveRuleCandidates(
|
|
198
|
+
session: MinimalSession,
|
|
199
|
+
accountId: string,
|
|
200
|
+
): Promise<RuleCandidate[]> {
|
|
201
|
+
return (await resolveCandidates(session, accountId)).candidates;
|
|
202
|
+
}
|
|
203
|
+
|
|
204
|
+
// The account's active, de-conflicted, bounded rule-set plus its provenance.
|
|
205
|
+
export async function resolveActiveRules(
|
|
206
|
+
session: MinimalSession,
|
|
207
|
+
accountId: string,
|
|
208
|
+
cap: number = INJECTION_RULE_CAP,
|
|
209
|
+
): Promise<ActiveRuleResolution> {
|
|
210
|
+
const { candidates, ownerUserId, source } = await resolveCandidates(session, accountId);
|
|
211
|
+
return { rules: deconflictBySubject(candidates).slice(0, cap), ownerUserId, source };
|
|
212
|
+
}
|
|
213
|
+
|
|
214
|
+
// The rule array alone — the unchanged call boundary for profile-read and the
|
|
215
|
+
// ui/server injection wrapper.
|
|
126
216
|
export async function activeRuleSet(
|
|
127
217
|
session: MinimalSession,
|
|
128
218
|
accountId: string,
|
|
129
219
|
cap: number = INJECTION_RULE_CAP,
|
|
130
220
|
): Promise<ActiveRule[]> {
|
|
131
|
-
|
|
132
|
-
return deconflictBySubject(candidates).slice(0, cap);
|
|
221
|
+
return (await resolveActiveRules(session, accountId, cap)).rules;
|
|
133
222
|
}
|
|
@@ -247,3 +247,34 @@ describe('users-audit emission', () => {
|
|
|
247
247
|
expect(readAudit(logFile)).toHaveLength(1)
|
|
248
248
|
})
|
|
249
249
|
})
|
|
250
|
+
|
|
251
|
+
describe('users-audit target attribution (Task 1573)', () => {
|
|
252
|
+
it('emits target and explicitUserId on a set-access write when the audit carries them', async () => {
|
|
253
|
+
const root = mkdtempSync(join(tmpdir(), 'aap-tgt-'))
|
|
254
|
+
const usersFile = join(root, 'users.json')
|
|
255
|
+
const logFile = join(root, 'users-audit.log')
|
|
256
|
+
writeFileSync(usersFile, JSON.stringify([{ userId: 'bbbbbbbb-2222', pin: 'x' }]))
|
|
257
|
+
await setAccessPassword('bbbbbbbb-2222', 'Sw0rdfish!', usersFile, {
|
|
258
|
+
actor: 'aaaaaaaa-1111',
|
|
259
|
+
target: 'bbbbbbbb-2222',
|
|
260
|
+
explicitUserId: true,
|
|
261
|
+
logFile,
|
|
262
|
+
})
|
|
263
|
+
const line = readAudit(logFile)[0]
|
|
264
|
+
expect(line).toContain('action=set-access')
|
|
265
|
+
expect(line).toContain('actor=aaaaaaaa')
|
|
266
|
+
expect(line).toContain('target=bbbbbbbb')
|
|
267
|
+
expect(line).toContain('explicitUserId=true')
|
|
268
|
+
})
|
|
269
|
+
|
|
270
|
+
it('omits target fields for a self write with no target set', async () => {
|
|
271
|
+
const root = mkdtempSync(join(tmpdir(), 'aap-self-'))
|
|
272
|
+
const usersFile = join(root, 'users.json')
|
|
273
|
+
const logFile = join(root, 'users-audit.log')
|
|
274
|
+
writeFileSync(usersFile, JSON.stringify([{ userId: 'aaaaaaaa-1111', pin: 'x' }]))
|
|
275
|
+
await setAccessPassword('aaaaaaaa-1111', 'Sw0rdfish!', usersFile, { actor: 'aaaaaaaa-1111', logFile })
|
|
276
|
+
const line = readAudit(logFile)[0]
|
|
277
|
+
expect(line).not.toContain('target=')
|
|
278
|
+
expect(line).not.toContain('explicitUserId=')
|
|
279
|
+
})
|
|
280
|
+
})
|
|
@@ -19,6 +19,14 @@ export interface AuditContext {
|
|
|
19
19
|
actor: string;
|
|
20
20
|
session?: string;
|
|
21
21
|
logFile: string;
|
|
22
|
+
/** Task 1573 — the row being written, recorded on every credential write so
|
|
23
|
+
* `actor != target` is the standing cross-identity signature. Omitted =>
|
|
24
|
+
* the line carries no target field (a self write not routed through the
|
|
25
|
+
* identity-resolving tools). */
|
|
26
|
+
target?: string;
|
|
27
|
+
/** Task 1573 — true when the caller passed an explicit `userId` (a deliberate
|
|
28
|
+
* cross-identity or self write); false/absent for an implicit self write. */
|
|
29
|
+
explicitUserId?: boolean;
|
|
22
30
|
}
|
|
23
31
|
export declare function hashAccessPassword(password: string): Promise<string>;
|
|
24
32
|
declare function matchesHash(password: string, stored: string): Promise<boolean>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CACrB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CACrB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf;;;qCAGiC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;kFAC8E;IAC9E,cAAc,CAAC,EAAE,OAAO,CAAA;CACzB;AAoDD,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAI1E;AAED,iBAAe,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAS7E;AAiBD;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAa/H;AAED;wEACwE;AACxE,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,IAAI,CAYhG;AAED,2DAA2D;AAC3D,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAStG;AAED;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,OAAO,CAAC,CAUlB;AAED,2DAA2D;AAC3D,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAItE;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAGhE;AAED,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,gBAAgB,GAAG,eAAe,GAAG,qBAAqB,CAAA;AAEnG;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,YAAY,GAClB,aAAa,CAkBf;AAED;kEACkE;AAClE,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAItE;AAED,OAAO,EAAE,WAAW,IAAI,mBAAmB,EAAE,CAAA"}
|
|
@@ -37,7 +37,11 @@ function appendUsersAuditLine(audit, fields) {
|
|
|
37
37
|
// userIds are uuids (shortened to id8); sentinels (boot|install|onboarding|
|
|
38
38
|
// unknown) carry no dash and are written whole so attribution stays readable.
|
|
39
39
|
const actor = audit.actor.includes('-') ? id8(audit.actor) : audit.actor;
|
|
40
|
-
const
|
|
40
|
+
const targetFields = audit.target !== undefined
|
|
41
|
+
? ` target=${audit.target.includes('-') ? id8(audit.target) : audit.target}` +
|
|
42
|
+
` explicitUserId=${audit.explicitUserId ? 'true' : 'false'}`
|
|
43
|
+
: '';
|
|
44
|
+
const line = `[users-audit] action=${fields.action} actor=${actor}${targetFields}${sess} ` +
|
|
41
45
|
`field=${fields.field} rowsBefore=${fields.rowsBefore} rowsAfter=${fields.rowsAfter} ` +
|
|
42
46
|
`ts=${new Date().toISOString()}\n`;
|
|
43
47
|
try {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;AA8FA,gDAIC;AAmCD,8CAaC;AAID,kDAYC;AAGD,oDASC;AAUD,wDAcC;AAGD,kEAIC;AASD,sDAGC;AAYD,kEAuBC;AAID,oDAIC;AAEuB,0CAAmB;AAtQ3C,4EAA4E;AAC5E,0EAA0E;AAC1E,+DAA+D;AAC/D,6CAAkE;AAClE,qCAAoH;AACpH,yCAAmC;AAEnC,MAAM,QAAQ,GAAG,KAAK,CAAA;AACtB,MAAM,QAAQ,GAAG,CAAC,CAAA;AAClB,MAAM,QAAQ,GAAG,CAAC,CAAA;AAClB,MAAM,aAAa,GAAG,EAAE,CAAA;AAkCxB,yEAAyE;AACzE,SAAS,GAAG,CAAC,KAAa;IACxB,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;AAC1B,CAAC;AAED,SAAS,MAAM,CAAC,KAAwB;IACtC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAChD,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAC3B,KAAmB,EACnB,MAAgF;IAEhF,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAClE,4EAA4E;IAC5E,8EAA8E;IAC9E,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAA;IACxE,MAAM,YAAY,GAChB,KAAK,CAAC,MAAM,KAAK,SAAS;QACxB,CAAC,CAAC,WAAW,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE;YAC1E,mBAAmB,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE;QAC9D,CAAC,CAAC,EAAE,CAAA;IACR,MAAM,IAAI,GACR,wBAAwB,MAAM,CAAC,MAAM,UAAU,KAAK,GAAG,YAAY,GAAG,IAAI,GAAG;QAC7E,SAAS,MAAM,CAAC,KAAK,eAAe,MAAM,CAAC,UAAU,cAAc,MAAM,CAAC,SAAS,GAAG;QACtF,MAAM,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,CAAA;IACpC,IAAI,CAAC;QACH,IAAA,mBAAS,EAAC,IAAA,mBAAO,EAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACnE,IAAA,wBAAc,EAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACtD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CACX,yCAAyC,KAAK,CAAC,OAAO,UAAU,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACnH,CAAA;IACH,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB,EAAE,IAAY;IACjD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAA,oBAAM,EAAC,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC5F,IAAI,GAAG;gBAAE,MAAM,CAAC,GAAG,CAAC,CAAA;;gBACf,OAAO,CAAC,GAAG,CAAC,CAAA;QACnB,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAEM,KAAK,UAAU,kBAAkB,CAAC,QAAgB;IACvD,MAAM,IAAI,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAA;IAC5B,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IAC9C,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAA;AAC1D,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,QAAgB,EAAE,MAAc;IACzD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CAAA;IACvD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IAC9D,IAAI,UAAU,CAAC,MAAM,KAAK,aAAa;QAAE,OAAO,KAAK,CAAA;IACrD,IAAI,QAAgB,CAAA;IACpB,IAAI,CAAC;QAAC,QAAQ,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAA;IAAC,CAAC;IAC3E,OAAO,IAAA,6BAAe,EAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;AAC9C,CAAC;AAED,SAAS,SAAS,CAAC,SAAiB;IAClC,IAAI,CAAC,IAAA,oBAAU,EAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAA;IACrC,MAAM,GAAG,GAAG,IAAA,sBAAY,EAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;IACnD,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAA;IACnB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;IACzE,OAAO,MAA2B,CAAA;AACpC,CAAC;AAED,SAAS,gBAAgB,CAAC,SAAiB,EAAE,KAAwB;IACnE,MAAM,GAAG,GAAG,GAAG,SAAS,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAA;IAC7C,IAAA,uBAAa,EAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC1E,IAAA,oBAAU,EAAC,GAAG,EAAE,SAAS,CAAC,CAAA;AAC5B,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,iBAAiB,CAAC,MAAc,EAAE,QAAgB,EAAE,SAAiB,EAAE,KAAmB;IAC9G,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;IAClC,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAA;IACrD,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,MAAM,EAAE,CAAC,CAAA;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,IAAI,MAAM,sBAAsB,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAA;IACnF,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IAC1B,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAA;IAC9E,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;IAClC,oBAAoB,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;AAC/G,CAAC;AAED;wEACwE;AACxE,SAAgB,mBAAmB,CAAC,MAAc,EAAE,SAAiB,EAAE,KAAmB;IACxF,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;IAClC,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAA;IACrD,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAM;IACtB,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,UAAU,CAAA;IACtC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAM;IACjE,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IAC1B,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAA;IAC1C,KAAK,UAAU,CAAA;IACf,KAAK,CAAC,GAAG,CAAC,GAAG,IAAuB,CAAA;IACpC,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;IAClC,oBAAoB,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;AACjH,CAAC;AAED,2DAA2D;AACpD,KAAK,UAAU,oBAAoB,CAAC,QAAgB,EAAE,SAAiB;IAC5E,IAAI,KAAwB,CAAA;IAC5B,IAAI,CAAC;QAAC,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAA;IAAC,CAAC;IAC1D,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YACpF,OAAO,CAAC,CAAC,MAAM,CAAA;QACjB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,sBAAsB,CAC1C,QAAgB,EAChB,SAAiB,EACjB,aAAqB;IAErB,IAAI,KAAwB,CAAA;IAC5B,IAAI,CAAC;QAAC,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAA;IAAC,CAAC;IAC3D,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,MAAM,KAAK,aAAa;YAAE,SAAQ;QACxC,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YACpF,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,2DAA2D;AAC3D,SAAgB,2BAA2B,CAAC,SAAiB;IAC3D,IAAI,KAAwB,CAAA;IAC5B,IAAI,CAAC;QAAC,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAA;IAAC,CAAC;IAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;AACrF,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,qBAAqB,CAAC,SAAiB;IACrD,IAAI,CAAC,IAAA,oBAAU,EAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAA;IACxC,IAAI,CAAC;QAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAAC,OAAO,KAAK,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAA;IAAC,CAAC;AAClE,CAAC;AAID;;;;;;;GAOG;AACH,SAAgB,2BAA2B,CACzC,SAAiB,EACjB,UAAkB,EAClB,WAAmB,EACnB,KAAmB;IAEnB,IAAI,CAAC,IAAA,oBAAU,EAAC,UAAU,CAAC;QAAE,OAAO,gBAAgB,CAAA;IACpD,MAAM,MAAM,GAAG,IAAA,sBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;IACvD,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;IAClC,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAA;IAC1D,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,eAAe,CAAA;IACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,UAAU,CAAA;IACtC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,IAAA,oBAAU,EAAC,UAAU,CAAC,CAAA;QACtB,OAAO,qBAAqB,CAAA;IAC9B,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAAC,IAAA,oBAAU,EAAC,UAAU,CAAC,CAAC;QAAC,OAAO,gBAAgB,CAAA;IAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IAC1B,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAA;IAClD,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;IAClC,IAAA,oBAAU,EAAC,UAAU,CAAC,CAAA;IACtB,oBAAoB,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC1G,OAAO,UAAU,CAAA;AACnB,CAAC;AAED;kEACkE;AAClE,SAAgB,oBAAoB,CAAC,UAAkB;IACrD,IAAI,CAAC,IAAA,oBAAU,EAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAA;IACxC,MAAM,GAAG,GAAG,IAAA,sBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;IACpD,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;AACvC,CAAC"}
|
|
@@ -32,6 +32,14 @@ export interface AuditContext {
|
|
|
32
32
|
actor: string
|
|
33
33
|
session?: string
|
|
34
34
|
logFile: string
|
|
35
|
+
/** Task 1573 — the row being written, recorded on every credential write so
|
|
36
|
+
* `actor != target` is the standing cross-identity signature. Omitted =>
|
|
37
|
+
* the line carries no target field (a self write not routed through the
|
|
38
|
+
* identity-resolving tools). */
|
|
39
|
+
target?: string
|
|
40
|
+
/** Task 1573 — true when the caller passed an explicit `userId` (a deliberate
|
|
41
|
+
* cross-identity or self write); false/absent for an implicit self write. */
|
|
42
|
+
explicitUserId?: boolean
|
|
35
43
|
}
|
|
36
44
|
|
|
37
45
|
/** First 8 chars — the short-id convention used across the auth logs. */
|
|
@@ -56,8 +64,13 @@ function appendUsersAuditLine(
|
|
|
56
64
|
// userIds are uuids (shortened to id8); sentinels (boot|install|onboarding|
|
|
57
65
|
// unknown) carry no dash and are written whole so attribution stays readable.
|
|
58
66
|
const actor = audit.actor.includes('-') ? id8(audit.actor) : audit.actor
|
|
67
|
+
const targetFields =
|
|
68
|
+
audit.target !== undefined
|
|
69
|
+
? ` target=${audit.target.includes('-') ? id8(audit.target) : audit.target}` +
|
|
70
|
+
` explicitUserId=${audit.explicitUserId ? 'true' : 'false'}`
|
|
71
|
+
: ''
|
|
59
72
|
const line =
|
|
60
|
-
`[users-audit] action=${fields.action} actor=${actor}${sess} ` +
|
|
73
|
+
`[users-audit] action=${fields.action} actor=${actor}${targetFields}${sess} ` +
|
|
61
74
|
`field=${fields.field} rowsBefore=${fields.rowsBefore} rowsAfter=${fields.rowsAfter} ` +
|
|
62
75
|
`ts=${new Date().toISOString()}\n`
|
|
63
76
|
try {
|
|
@@ -180,3 +180,30 @@ describe('admins-write — computeAdminStoreDivergence', () => {
|
|
|
180
180
|
void dirname
|
|
181
181
|
})
|
|
182
182
|
})
|
|
183
|
+
|
|
184
|
+
describe('users-audit target attribution (Task 1573)', () => {
|
|
185
|
+
it('emits target and explicitUserId when a cross-identity write is logged', () => {
|
|
186
|
+
const root = mkdtempSync(join(tmpdir(), 'auditctx-'))
|
|
187
|
+
const logFile = join(root, 'users-audit.log')
|
|
188
|
+
logUsersAudit(
|
|
189
|
+
{ actor: 'aaaaaaaa-1111', target: 'bbbbbbbb-2222', explicitUserId: true, logFile },
|
|
190
|
+
{ action: 'set-pin', field: 'pin', rowsBefore: 'aaaaaaaa', rowsAfter: 'aaaaaaaa' },
|
|
191
|
+
)
|
|
192
|
+
const line = readFileSync(logFile, 'utf-8')
|
|
193
|
+
expect(line).toContain('actor=aaaaaaaa')
|
|
194
|
+
expect(line).toContain('target=bbbbbbbb')
|
|
195
|
+
expect(line).toContain('explicitUserId=true')
|
|
196
|
+
})
|
|
197
|
+
|
|
198
|
+
it('omits target fields for a self write with no target set', () => {
|
|
199
|
+
const root = mkdtempSync(join(tmpdir(), 'auditctx-'))
|
|
200
|
+
const logFile = join(root, 'users-audit.log')
|
|
201
|
+
logUsersAudit(
|
|
202
|
+
{ actor: 'aaaaaaaa-1111', logFile },
|
|
203
|
+
{ action: 'set-pin', field: 'pin', rowsBefore: 'aaaaaaaa', rowsAfter: 'aaaaaaaa' },
|
|
204
|
+
)
|
|
205
|
+
const line = readFileSync(logFile, 'utf-8')
|
|
206
|
+
expect(line).not.toContain('target=')
|
|
207
|
+
expect(line).not.toContain('explicitUserId=')
|
|
208
|
+
})
|
|
209
|
+
})
|
|
@@ -16,6 +16,14 @@ export interface AuditContext {
|
|
|
16
16
|
actor: string;
|
|
17
17
|
session?: string;
|
|
18
18
|
logFile: string;
|
|
19
|
+
/** Task 1573 — the row being written, recorded on every credential write so
|
|
20
|
+
* `actor != target` is the standing cross-identity signature. Omitted =>
|
|
21
|
+
* the line carries no target field (a self write not routed through the
|
|
22
|
+
* identity-resolving tools). */
|
|
23
|
+
target?: string;
|
|
24
|
+
/** Task 1573 — true when the caller passed an explicit `userId` (a deliberate
|
|
25
|
+
* cross-identity or self write); false/absent for an implicit self write. */
|
|
26
|
+
explicitUserId?: boolean;
|
|
19
27
|
}
|
|
20
28
|
/** Format a userId list as the comma-joined short-id set used in audit lines.
|
|
21
29
|
* Exported for direct users.json writers that do not route through
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAwBA,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAwBA,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB;;;qCAGiC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;kFAC8E;IAC9E,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAOD;;uDAEuD;AACvD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAE3D;AAkCD;;mEAEmE;AACnE,wBAAgB,aAAa,CAC3B,KAAK,EAAE,YAAY,EACnB,MAAM,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC/E,IAAI,CAEN;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,YAAY,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,eAAe,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;IACxC,iBAAiB,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;IAC1C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAmBD;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,eAAe,GAAG,gBAAgB,CAiExE;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,YAAY,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,iBAAiB,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;IAC1C,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,gBAAgB,GAAG,iBAAiB,CAuCjF;AAED,MAAM,WAAW,mBAAmB;IAClC,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,WAAW,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,GAAG,EAAE,mBAAmB,GAAG,iBAAiB,CAAC;CAC9C;AAED,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,mBAAmB,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/D,sEAAsE;IACtE,mBAAmB,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChD;AAED,yEAAyE;AACzE,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,mBAAmB,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/D,sEAAsE;IACtE,mBAAmB,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,+EAA+E;IAC/E,MAAM,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACnD;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,gBAAgB,CAoE/G;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,mBAAmB,GAAG,oBAAoB,CAiBxF"}
|