@sixb/core 0.1.19 → 0.1.21

package/src/artifacts/workbook.ts

@@ -0,0 +1,315 @@
+import { ARTIFACT_LIMITS } from "./limits"
+
+/**
+ * A sheet artifact is `workbook.json` and one CSV per sheet under `sheets/`. The CSV holds the
+ * values; the workbook holds what CSV can't: sheet order, column types and formats, frozen rows
+ * and columns, widths, and charts drawn from the sheets. Formulas belong in an `.xlsx` file.
+ */
+export const WORKBOOK_FILE = "workbook.json"
+
+export const SHEET_COLUMN_TYPES = [
+  "text",
+  "number",
+  "currency",
+  "percent",
+  "date",
+  "link",
+  "image",
+] as const
+export type SheetColumnType = (typeof SHEET_COLUMN_TYPES)[number]
+
+/** Column types whose cells are numbers, so a chart can plot them and a range can sum them. */
+export const NUMERIC_COLUMN_TYPES: readonly SheetColumnType[] = ["number", "currency", "percent"]
+
+export const SHEET_CHART_TYPES = ["bar", "line", "area", "pie"] as const
+export type SheetChartType = (typeof SHEET_CHART_TYPES)[number]
+
+export interface SheetColumnFormat {
+  readonly type: SheetColumnType
+  /** An ISO 4217 code, for a currency column. */
+  readonly currency?: string
+  /** Digits after the decimal point, for numbers, currencies, and percents. */
+  readonly decimals?: number
+}
+
+export interface WorkbookSheet {
+  readonly name: string
+  /** Rows that stay in view as the sheet scrolls, the header row included. */
+  readonly frozenRows: number
+  /** Columns that stay in view as the sheet scrolls sideways. */
+  readonly frozenColumns: number
+  /** Formats by column name; a column not named here is text. */
+  readonly columns: Readonly<Record<string, SheetColumnFormat>>
+  /** Widths in pixels by column name. */
+  readonly widths: Readonly<Record<string, number>>
+}
+
+export interface WorkbookChart {
+  /** What `#chart=<name>` names in an address; lowercase letters, digits, and hyphens. */
+  readonly name: string
+  readonly type: SheetChartType
+  readonly sheet: string
+  /** The column along the x axis, or a pie's slice labels. */
+  readonly x: string
+  /** The plotted columns: one series each, or a pie's one value column. */
+  readonly y: readonly string[]
+  readonly title?: string
+  /** Stack a bar or area chart's series. */
+  readonly stacked: boolean
+}
+
+export interface Workbook {
+  readonly sheets: readonly WorkbookSheet[]
+  readonly charts: readonly WorkbookChart[]
+}
+
+/** Where a sheet's values are, in the artifact. */
+export function sheetFilePath(sheetName: string): string {
+  return `sheets/${sheetName}.csv`
+}
+
+/**
+ * Reads `workbook.json` into its full form: `"Revenue": "currency"` becomes
+ * `{ type: "currency" }`, a single `y` becomes a list, and defaults are filled. Returns what is
+ * wrong in words the author can act on. Whether the columns exist is checked against the CSVs.
+ */
+export function parseWorkbook(
+  text: string
+): { readonly workbook: Workbook } | { readonly error: string } {
+  let value: unknown
+  try {
+    value = JSON.parse(text)
+  } catch {
+    return { error: `${WORKBOOK_FILE} is not valid JSON.` }
+  }
+  try {
+    return { workbook: readWorkbook(value) }
+  } catch (error) {
+    if (error instanceof WorkbookError) return { error: `${WORKBOOK_FILE}: ${error.message}` }
+    throw error
+  }
+}
+
+/** A number as a sheet stores it: plain digits, an optional sign, decimals, and exponent. */
+export function parseSheetNumber(value: string): number | undefined {
+  const trimmed = value.trim()
+  if (!/^[-+]?(\d+\.?\d*|\.\d+)(e[-+]?\d+)?$/i.test(trimmed)) return undefined
+  const number = Number(trimmed)
+  return Number.isFinite(number) ? number : undefined
+}
+
+/** A date as a sheet stores it: `YYYY-MM-DD`, optionally with an ISO 8601 time. */
+export function parseSheetDate(value: string): Date | undefined {
+  const trimmed = value.trim()
+  if (!/^\d{4}-\d{2}-\d{2}(T\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[-+]\d{2}:\d{2})?)?$/.test(trimmed)) {
+    return undefined
+  }
+  const date = new Date(trimmed.length === 10 ? `${trimmed}T00:00:00Z` : trimmed)
+  return Number.isNaN(date.getTime()) ? undefined : date
+}
+
+class WorkbookError extends Error {}
+
+const SHEET_NAME_MAX = 60
+const CHART_NAME = /^[a-z0-9][a-z0-9-]{0,39}$/
+const CONTROL = /[\u0000-\u001f\u007f]/
+
+function readWorkbook(value: unknown): Workbook {
+  const input = record(value, "the workbook", ["sheets", "charts"])
+  if (!Array.isArray(input.sheets) || input.sheets.length === 0) {
+    throw new WorkbookError('"sheets" must list at least one sheet.')
+  }
+  if (input.sheets.length > ARTIFACT_LIMITS.maxSheets) {
+    throw new WorkbookError(
+      `a workbook holds at most ${ARTIFACT_LIMITS.maxSheets} sheets; this one has ${input.sheets.length}.`
+    )
+  }
+  const sheets = input.sheets.map((sheet, index) => readSheet(sheet, index))
+  const names = new Set<string>()
+  for (const sheet of sheets) {
+    const key = sheet.name.toLowerCase()
+    if (names.has(key)) throw new WorkbookError(`two sheets are named '${sheet.name}'.`)
+    names.add(key)
+  }
+
+  const chartsInput = input.charts ?? []
+  if (!Array.isArray(chartsInput)) throw new WorkbookError('"charts" must be a list.')
+  if (chartsInput.length > ARTIFACT_LIMITS.maxCharts) {
+    throw new WorkbookError(
+      `a workbook holds at most ${ARTIFACT_LIMITS.maxCharts} charts; this one has ${chartsInput.length}.`
+    )
+  }
+  const charts = chartsInput.map((chart, index) => readChart(chart, index, sheets))
+  const chartNames = new Set<string>()
+  for (const chart of charts) {
+    if (chartNames.has(chart.name)) throw new WorkbookError(`two charts are named '${chart.name}'.`)
+    chartNames.add(chart.name)
+  }
+  return { sheets, charts }
+}
+
+function readSheet(value: unknown, index: number): WorkbookSheet {
+  const at = `sheet ${index + 1}`
+  const input = record(value, at, ["name", "frozenRows", "frozenColumns", "columns", "widths"])
+  const name = typeof input.name === "string" ? input.name.trim() : ""
+  if (
+    !name ||
+    name.length > SHEET_NAME_MAX ||
+    CONTROL.test(name) ||
+    /[/\\]/.test(name) ||
+    name === "." ||
+    name === ".."
+  ) {
+    throw new WorkbookError(
+      `${at} needs a "name" of at most ${SHEET_NAME_MAX} characters without / or \\; its values go in sheets/<name>.csv.`
+    )
+  }
+  const sheetAt = `sheet '${name}'`
+  const columns: Record<string, SheetColumnFormat> = {}
+  for (const [column, format] of Object.entries(
+    record(input.columns ?? {}, `${sheetAt} "columns"`, null)
+  )) {
+    columns[column] = readColumnFormat(format, `${sheetAt} column '${column}'`)
+  }
+  const widths: Record<string, number> = {}
+  for (const [column, width] of Object.entries(
+    record(input.widths ?? {}, `${sheetAt} "widths"`, null)
+  )) {
+    if (typeof width !== "number" || !Number.isInteger(width) || width < 40 || width > 800) {
+      throw new WorkbookError(
+        `${sheetAt} gives column '${column}' a width of ${String(width)}; use 40 to 800 pixels.`
+      )
+    }
+    widths[column] = width
+  }
+  return {
+    name,
+    frozenRows: integer(input.frozenRows, 1, 0, 10, `${sheetAt} "frozenRows"`),
+    frozenColumns: integer(input.frozenColumns, 0, 0, 5, `${sheetAt} "frozenColumns"`),
+    columns,
+    widths,
+  }
+}
+
+function readColumnFormat(value: unknown, at: string): SheetColumnFormat {
+  if (typeof value === "string") return { type: columnType(value, at) }
+  const input = record(value, at, ["type", "currency", "decimals"])
+  const type = columnType(input.type, at)
+  if (input.currency !== undefined) {
+    if (type !== "currency")
+      throw new WorkbookError(`${at} sets "currency" but is not a currency column.`)
+    if (typeof input.currency !== "string" || !/^[A-Z]{3}$/.test(input.currency)) {
+      throw new WorkbookError(`${at} "currency" must be an ISO 4217 code such as "USD".`)
+    }
+  }
+  if (input.decimals !== undefined && !["number", "currency", "percent"].includes(type)) {
+    throw new WorkbookError(
+      `${at} sets "decimals" but is not a number, currency, or percent column.`
+    )
+  }
+  return {
+    type,
+    ...(typeof input.currency === "string" ? { currency: input.currency } : {}),
+    ...(input.decimals === undefined
+      ? {}
+      : { decimals: integer(input.decimals, 0, 0, 6, `${at} "decimals"`) }),
+  }
+}
+
+function columnType(value: unknown, at: string): SheetColumnType {
+  if (typeof value === "string" && (SHEET_COLUMN_TYPES as readonly string[]).includes(value)) {
+    return value as SheetColumnType
+  }
+  throw new WorkbookError(
+    `${at} has type ${JSON.stringify(value)}; use one of ${SHEET_COLUMN_TYPES.join(", ")}.`
+  )
+}
+
+function readChart(value: unknown, index: number, sheets: readonly WorkbookSheet[]): WorkbookChart {
+  const input = record(value, `chart ${index + 1}`, [
+    "name",
+    "type",
+    "sheet",
+    "x",
+    "y",
+    "title",
+    "stacked",
+  ])
+  if (typeof input.name !== "string" || !CHART_NAME.test(input.name)) {
+    throw new WorkbookError(
+      `chart ${index + 1} needs a "name" of lowercase letters, digits, and hyphens, such as "revenue".`
+    )
+  }
+  const at = `chart '${input.name}'`
+  if (!(SHEET_CHART_TYPES as readonly unknown[]).includes(input.type)) {
+    throw new WorkbookError(
+      `${at} has type ${JSON.stringify(input.type)}; use one of ${SHEET_CHART_TYPES.join(", ")}.`
+    )
+  }
+  const type = input.type as SheetChartType
+  if (typeof input.sheet !== "string" || !sheets.some((sheet) => sheet.name === input.sheet)) {
+    throw new WorkbookError(
+      `${at} names sheet ${JSON.stringify(input.sheet)}, which the workbook does not have.`
+    )
+  }
+  if (typeof input.x !== "string" || !input.x) throw new WorkbookError(`${at} needs an "x" column.`)
+  const y = typeof input.y === "string" ? [input.y] : input.y
+  if (
+    !Array.isArray(y) ||
+    y.length === 0 ||
+    !y.every((column) => typeof column === "string" && column)
+  ) {
+    throw new WorkbookError(`${at} needs a "y" column, or a list of them.`)
+  }
+  if (y.length > ARTIFACT_LIMITS.maxChartSeries) {
+    throw new WorkbookError(
+      `${at} plots ${y.length} columns; a chart reads well with at most ${ARTIFACT_LIMITS.maxChartSeries}. Split it, or chart the ones that matter.`
+    )
+  }
+  if (type === "pie" && y.length !== 1)
+    throw new WorkbookError(`${at} is a pie: give it one "y" column.`)
+  if (input.stacked !== undefined && typeof input.stacked !== "boolean") {
+    throw new WorkbookError(`${at} "stacked" must be true or false.`)
+  }
+  if (input.stacked === true && type !== "bar" && type !== "area") {
+    throw new WorkbookError(`${at} is a ${type} chart; only bar and area charts stack.`)
+  }
+  if (input.title !== undefined && (typeof input.title !== "string" || input.title.length > 120)) {
+    throw new WorkbookError(`${at} "title" must be text of at most 120 characters.`)
+  }
+  return {
+    name: input.name,
+    type,
+    sheet: input.sheet,
+    x: input.x,
+    y: y as string[],
+    ...(typeof input.title === "string" && input.title.trim() ? { title: input.title.trim() } : {}),
+    stacked: input.stacked === true,
+  }
+}
+
+function record(
+  value: unknown,
+  at: string,
+  keys: readonly string[] | null
+): Record<string, unknown> {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new WorkbookError(`${at} must be an object.`)
+  }
+  const input = value as Record<string, unknown>
+  const unknownKey = keys && Object.keys(input).find((key) => !keys.includes(key))
+  if (unknownKey) {
+    throw new WorkbookError(
+      `${at} has '${unknownKey}'; it takes ${keys.map((key) => `"${key}"`).join(", ")}.`
+    )
+  }
+  return input
+}
+
+function integer(value: unknown, fallback: number, min: number, max: number, at: string): number {
+  if (value === undefined) return fallback
+  if (typeof value !== "number" || !Number.isInteger(value) || value < min || value > max) {
+    throw new WorkbookError(`${at} must be a whole number from ${min} to ${max}.`)
+  }
+  return value
+}

package/src/auth/cookies.ts

@@ -1,9 +1,8 @@
-import type { AuthSessionAudience } from "./audience"
-import { DEFAULT_AUTH_SESSION_AUDIENCE, resolveAuthSessionAudience } from "./audience"
 import type { AuthCookieOptions } from "./types"
 
-export const DEFAULT_SESSION_COOKIE_NAME = "sixb_session"
-export const DEFAULT_CSRF_COOKIE_NAME = "sixb_csrf"
+// The names the app's cookies had beside Atlas's, so its sessions survived Atlas leaving.
+export const DEFAULT_SESSION_COOKIE_NAME = "sixb_session_app"
+export const DEFAULT_CSRF_COOKIE_NAME = "sixb_csrf_app"
 
 export interface ResolvedAuthCookieOptions {
   readonly sessionCookieName: string
@@ -41,22 +40,6 @@ export function resolveAuthCookieOptions(
   return resolved
 }
 
-export function resolveAuthCookieOptionsForAudience(
-  options: ResolvedAuthCookieOptions,
-  audience: AuthSessionAudience | undefined
-): ResolvedAuthCookieOptions {
-  const resolvedAudience = resolveAuthSessionAudience(audience)
-  if (resolvedAudience === DEFAULT_AUTH_SESSION_AUDIENCE) {
-    return options
-  }
-
-  return {
-    ...options,
-    sessionCookieName: `${options.sessionCookieName}_${resolvedAudience}`,
-    csrfCookieName: `${options.csrfCookieName}_${resolvedAudience}`,
-  }
-}
-
 export function parseCookieHeader(header: string | null): ReadonlyMap<string, string> {
   const cookies = new Map<string, string>()
   if (!header) {

package/src/auth/index.ts

@@ -9,12 +9,6 @@ export {
   parseAccessTokenValue,
   SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX,
 } from "./access-tokens"
-export type { AuthSessionAudience, AuthSessionAudienceOptions } from "./audience"
-export {
-  DEFAULT_AUTH_SESSION_AUDIENCE,
-  isValidAuthSessionAudience,
-  resolveAuthSessionAudience,
-} from "./audience"
 export { getRequestClientAddress, setRequestClientAddress } from "./client-address"
 export {
   clearCsrfCookieHeader,

package/src/auth/runtime.ts

@@ -1,9 +1,5 @@
 import { randomUUID } from "node:crypto"
-import {
-  type AuthorizationContext,
-  canAccessApplication,
-  resolveAuthorizationContext,
-} from "../authorization"
+import { type AuthorizationContext, resolveAuthorizationContext } from "../authorization"
 import {
   canPerformMembershipOperation,
   type GroupReference,
@@ -33,13 +29,8 @@ import {
   hashAccessTokenSecret,
   parseAccessTokenValue,
 } from "./access-tokens"
-import { type AuthSessionAudience, DEFAULT_AUTH_SESSION_AUDIENCE } from "./audience"
 import { getRequestClientAddress } from "./client-address"
-import {
-  getCookie,
-  type ResolvedAuthCookieOptions,
-  resolveAuthCookieOptionsForAudience,
-} from "./cookies"
+import { getCookie, type ResolvedAuthCookieOptions } from "./cookies"
 import { AuthRuntimeError } from "./errors"
 import { SessionCache } from "./session-cache"
 import {
@@ -108,7 +99,6 @@ import {
   isInvitationDeliveryAuthStrategy,
   normalizePagination,
   resolveAuthConfig,
-  resolveAuthSessionAudience,
   resolveInvitationExpiresAt,
 } from "./validation"
 
@@ -184,8 +174,8 @@ export class AuthRuntime {
     }
   }
 
-  getCookieOptions(options: AuthSessionResolutionOptions = {}): ResolvedAuthCookieOptions {
-    return resolveAuthCookieOptionsForAudience(this.config.cookies, options.audience)
+  getCookieOptions(): ResolvedAuthCookieOptions {
+    return this.config.cookies
   }
 
   assertCanServeHttp(params: { readonly production: boolean }): void {
@@ -240,8 +230,6 @@ export class AuthRuntime {
       return { authenticated: false, reason: "auth_disabled" }
     }
 
-    const audience = resolveAuthSessionAudience(options.audience)
-
     if (options.credentialSource === "any") {
       const tokenValue = getBearerAccessTokenValue(request)
       if (tokenValue?.startsWith(SESSION_ACCESS_TOKEN_PREFIX)) {
@@ -257,15 +245,14 @@ export class AuthRuntime {
       }
     }
 
-    return this.resolveCookieSession(request, audience, options.sessionActivity)
+    return this.resolveCookieSession(request, options.sessionActivity)
   }
 
   private async resolveCookieSession(
     request: Request,
-    audience: ReturnType<typeof resolveAuthSessionAudience>,
     activity: AuthSessionResolutionOptions["sessionActivity"]
   ): Promise<AuthSessionResult> {
-    const cookieOptions = this.getCookieOptions({ audience })
+    const cookieOptions = this.getCookieOptions()
     const cookieValue = getCookie(request, cookieOptions.sessionCookieName)
     if (!cookieValue) {
       return { authenticated: false, reason: "missing_cookie" }
@@ -283,7 +270,6 @@ export class AuthRuntime {
       sessionId: parts.sessionId,
       tokenHash,
       transport: "cookie",
-      audience,
       nowMs,
     })
     if (cached) {
@@ -298,7 +284,6 @@ export class AuthRuntime {
     let session = await storage.sessions.findValidByTokenHash({
       projectId: this.projectId,
       id: parts.sessionId,
-      audience,
       tokenHash,
       now,
     })
@@ -312,7 +297,6 @@ export class AuthRuntime {
       const renewed = await storage.sessions.renewIfValid({
         projectId: this.projectId,
         id: parts.sessionId,
-        audience,
         tokenHash,
         now,
         expiresAt: this.getRenewedSessionExpiresAt(session, nowMs),
@@ -388,7 +372,6 @@ export class AuthRuntime {
     this.sessionCache?.set({
       sessionId: session.id,
       tokenHash,
-      audience: session.audience,
       session: result,
       nowMs: now.getTime(),
       sessionExpiresAtMs: session.expiresAt.getTime(),
@@ -418,8 +401,6 @@ export class AuthRuntime {
         projectId: this.projectId,
         userId: input.userId,
         strategyId: "device",
-        // A native session belongs to no web app. The column needs a value; nothing reads it.
-        audience: DEFAULT_AUTH_SESSION_AUDIENCE,
         tokenHash: tokens.tokenHash,
         createdAt: input.now,
         ...this.createSessionDeadlines(input.now),
@@ -712,6 +693,11 @@ export class AuthRuntime {
     caller: AuthenticatedUserRequestSession
   ): Promise<ListServiceAccountsResult> {
     const storage = this.requireAuthStorage()
+    const scope = this.resolveMembershipPolicyScopeForUser(caller.groupIds)
+    if (scope.operations.serviceAccounts.policyIds.length === 0) {
+      return { serviceAccounts: [] }
+    }
+
     const result = await storage.serviceAccounts.list({
       projectId: this.projectId,
       order: "desc",
@@ -724,11 +710,11 @@ export class AuthRuntime {
       }))
     )
 
-    // A caller only sees the service accounts it is allowed to manage, so
-    // listing never leaks the groups of more-privileged accounts.
+    // A caller only sees the service accounts its membership policies cover, so
+    // listing never leaks the groups of accounts outside its scope.
     return {
       serviceAccounts: withGroups.filter(({ groupIds }) =>
-        callerCanManageServiceAccount(caller.groupIds, groupIds)
+        canPerformMembershipOperation(scope, "serviceAccounts", groupIds)
       ),
     }
   }
@@ -738,11 +724,9 @@ export class AuthRuntime {
     input: CreateServiceAccountInput
   ): Promise<CreateServiceAccountResult> {
     const storage = this.requireAuthStorage()
-    // A caller can only place a service account in groups it itself belongs to.
-    const groupIds =
-      constrainRequestedGroupIds(input.groupIds, caller.groupIds, {
-        subject: "service account",
-      }) ?? []
+    // A caller can only place a service account in groups its `serviceAccounts` policies cover.
+    const groupIds = normalizeRequestedGroupIds(input.groupIds) ?? []
+    this.assertCanManageServiceAccountGroups(caller.groupIds, groupIds)
     const now = new Date()
     const serviceAccount = await storage.serviceAccounts.create({
       id: input.id ?? `svc_${randomUUID()}`,
@@ -829,8 +813,8 @@ export class AuthRuntime {
     }
 
     // The token can only carry groups the service account already holds; the
-    // manageability check above guarantees those are a subset of the caller's
-    // own groups, so the caller can never mint privileges it lacks.
+    // manageability check above guarantees those are within the caller's
+    // `serviceAccounts` scope, so the token never reaches past that scope.
     const groupIds = constrainRequestedGroupIds(input.groupIds, serviceAccountGroupIds, {
       subject: "service account token",
     })
@@ -888,12 +872,10 @@ export class AuthRuntime {
   /**
    * Resolve a service account the caller is allowed to manage.
    *
-   * A caller may manage a service account only when it belongs to every group
-   * the account is in ("you can manage what you could have created"). This
-   * confines token minting, disabling, and revocation to privileges the caller
-   * already holds and prevents a service-account token from outliving the
-   * caller's own access. Missing and non-manageable accounts raise the same
-   * error so callers cannot probe which privileged accounts exist.
+   * A caller needs a membership policy with the `serviceAccounts` operation whose scope covers every
+   * group the account is in ("you can manage what you could have created"). This confines token
+   * minting, disabling, and revocation to the groups the project's policies hand out. Missing and
+   * out-of-scope accounts raise the same error so callers cannot probe which accounts exist.
    */
   private async requireManageableServiceAccount(
     storage: AuthStorage,
@@ -903,6 +885,11 @@ export class AuthRuntime {
     readonly serviceAccount: ServiceAccountRecord
     readonly groupIds: readonly string[]
   }> {
+    const scope = this.resolveMembershipPolicyScopeForUser(callerGroupIds)
+    if (scope.operations.serviceAccounts.policyIds.length === 0) {
+      throw missingServiceAccountsPolicyError()
+    }
+
     const serviceAccount = await storage.serviceAccounts.getById({
       projectId: this.projectId,
       id: serviceAccountId,
@@ -911,7 +898,7 @@ export class AuthRuntime {
       ? await this.listServiceAccountGroupIds(storage, serviceAccountId)
       : []
 
-    if (!serviceAccount || !callerCanManageServiceAccount(callerGroupIds, groupIds)) {
+    if (!serviceAccount || !canPerformMembershipOperation(scope, "serviceAccounts", groupIds)) {
       throw new AuthStorageError(
         "missing_service_account",
         `[Sixb] Service account '${serviceAccountId}' not found for project '${this.projectId}'.`
@@ -975,6 +962,7 @@ export class AuthRuntime {
     return {
       // The member-admin edit-groups dialog assigns from the `assignGroups` scope.
       groups: this.scopedGroupOptions(scope.operations.assignGroups.groupIds),
+      serviceAccountGroups: this.scopedGroupOptions(scope.operations.serviceAccounts.groupIds),
       capabilities: membershipCapabilities(scope).holds,
     }
   }
@@ -1163,7 +1151,7 @@ export class AuthRuntime {
     return { user: reactivated, groupIds, managedGroupIds }
   }
 
-  /** The caller's active sessions across every audience, most recently active first. */
+  /** The caller's active sessions, most recently active first. */
   async listSessions(caller: AuthenticatedUserRequestSession): Promise<readonly SessionRecord[]> {
     return this.requireAuthStorage().sessions.listActiveByUserId({
       projectId: this.projectId,
@@ -1195,7 +1183,7 @@ export class AuthRuntime {
     return true
   }
 
-  /** End every active session of the caller, across audiences. Returns how many ended. */
+  /** End every active session of the caller. Returns how many ended. */
   async revokeAllSessions(caller: AuthenticatedUserRequestSession): Promise<number> {
     const revoked = await this.requireAuthStorage().sessions.revokeActiveForUser({
       projectId: this.projectId,
@@ -1284,7 +1272,6 @@ export class AuthRuntime {
     }
 
     await this.assertCanInviteRecipient(strategy, authStorage, input.email, now)
-    this.assertInvitationApplicationAccess(groupIds, destination.audience)
 
     const invitation = await authStorage.invitations.createOrUpdateActive({
       id: `inv_${randomUUID()}`,
@@ -1304,7 +1291,6 @@ export class AuthRuntime {
         projectId: this.projectId,
         authStorage,
         invitation,
-        audience: destination.audience,
         returnTo: destination.returnTo,
         requestOrigin: destination.requestOrigin,
         revealLink: input.revealLink,
@@ -1451,27 +1437,6 @@ export class AuthRuntime {
     return { state: "enabled" }
   }
 
-  private assertInvitationApplicationAccess(
-    groupIds: readonly string[],
-    audience: AuthSessionAudience
-  ): void {
-    // Check only the groups this invitation assigns. Existing memberships may
-    // be outside the caller's policy scope and must not affect this response.
-    const roles = this.security.listResolvedRoles()
-    const authorization = resolveAuthorizationContext({
-      principal: { type: "user", id: "invited-user" },
-      groupIds,
-      roles,
-    })
-
-    if (canAccessApplication(authorization, roles, audience)) return
-
-    throw new AuthRuntimeError(
-      "authorization_denied",
-      `[Sixb] Invitation groups do not grant access to application '${audience}'.`
-    )
-  }
-
   private async assertCanInviteRecipient(
     strategy: InvitationDeliveryAuthStrategy,
     authStorage: AuthStorage,
@@ -1524,6 +1489,27 @@ export class AuthRuntime {
     )
   }
 
+  private assertCanManageServiceAccountGroups(
+    callerGroupIds: readonly string[],
+    groupIds: readonly string[]
+  ): void {
+    const scope = this.resolveMembershipPolicyScopeForUser(callerGroupIds)
+
+    if (canPerformMembershipOperation(scope, "serviceAccounts", groupIds)) {
+      return
+    }
+
+    if (scope.operations.serviceAccounts.policyIds.length === 0) {
+      throw missingServiceAccountsPolicyError()
+    }
+
+    const missing = missingMembershipGroupIds(scope, "serviceAccounts", groupIds)
+    throw new AuthRuntimeError(
+      "authorization_denied",
+      `[Sixb] The current user is not allowed to place service accounts in group(s): ${missing.join(", ")}.`
+    )
+  }
+
   private assertCanManageInvitationGroups(
     callerGroupIds: readonly string[],
     groupIds: readonly string[]
@@ -1590,15 +1576,11 @@ function constrainTokenGroupIds(
   return principalGroupIds.filter((groupId) => allowed.has(groupId))
 }
 
-// A caller may manage a service account only when it belongs to every group the
-// account is in, so managing it can never grant more than the caller already
-// has. An account with no groups is powerless and therefore freely manageable.
-function callerCanManageServiceAccount(
-  callerGroupIds: readonly string[],
-  serviceAccountGroupIds: readonly string[]
-): boolean {
-  const callerGroups = new Set(callerGroupIds)
-  return serviceAccountGroupIds.every((groupId) => callerGroups.has(groupId))
+function missingServiceAccountsPolicyError(): AuthRuntimeError {
+  return new AuthRuntimeError(
+    "authorization_denied",
+    "[Sixb] Managing service accounts needs a membership policy with the 'serviceAccounts' operation."
+  )
 }
 
 function missingAccessTokenError(tokenId: string, projectId: string): AuthStorageError {
@@ -1701,6 +1683,7 @@ function membershipCapabilities(scope: MembershipPolicyScope): MembershipCapabil
       invite: scope.operations.invite.policyIds.length > 0,
       assignGroups: scope.operations.assignGroups.policyIds.length > 0,
       suspend: scope.operations.suspend.policyIds.length > 0,
+      serviceAccounts: scope.operations.serviceAccounts.policyIds.length > 0,
     },
     assignableGroupIds: [...scope.operations.assignGroups.groupIds],
     covers: (operation, memberGroups) =>