@tearleads/client-sdk 0.0.0-stage → 0.1.11

package/workflows/organizations/listLocalOrganizations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"listLocalOrganizations.js","sourceRoot":"","sources":["listLocalOrganizations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,EAAE,+BAA+B,EAAE,MAAM,wEAAwE,CAAC;AACzH,OAAO,EACL,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EAAE,kCAAkC,EAAE,MAAM,0EAA0E,CAAC;AAC9H,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAEhF,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EACL,qCAAqC,EACrC,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,6CAA6C,EAAE,MAAM,0BAA0B,CAAC;AAoBzF,2EAA2E;AAC3E,wEAAwE;AACxE,gFAAgF;AAChF,sDAAsD;AACtD,KAAK,UAAU,gCAAgC,CAC7C,OAAgB,EAChB,eAAuB;IAEvB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,4BAA4B,CAAC;YAC7C,OAAO;YACP,OAAO,EAAE,eAAe;YACxB,WAAW,EAAE,uBAAuB;SACrC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,2BAA2B,CAChC,uBAAuB,CAAC,GAAG,CAAC,CAAC,gBAAgB,CAC9C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,KAAK,UAAU,yBAAyB,CACtC,OAAgB,EAChB,cAAsB,EACtB,sBAAkE,EAClE,iBAAgC;IAEhC,MAAM,SAAS,GAAG,MAAM,gCAAgC,CACtD,OAAO,EACP,qCAAqC,CAAC,EAAE,cAAc,EAAE,CAAC,CAC1D,CAAC;IACF,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,iBAAiB,EAAE,CAAC;QACtB,2EAA2E;QAC3E,mEAAmE;QACnE,MAAM,aAAa,GAAG,MAAM,uBAAuB,CACjD,OAAO,EACP,kBAAkB,EAClB,iBAAiB,CAClB,CAAC;QACF,MAAM,UAAU,GAAG,aAAa;YAC9B,CAAC,CAAC,MAAM,gCAAgC,CAAC,OAAO,EAAE,aAAa,CAAC;YAChE,CAAC,CAAC,IAAI,CAAC;QACT,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,OAAO,UAAU,CAAC;QACpB,CAAC;IACH,CAAC;IAED,MAAM,kBAAkB,GACtB,MAAM,6CAA6C,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC;IAC1E,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,IAAI,CACnD,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,KAAK,kBAAkB,CAC3D,CAAC;IACF,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,gBAAgB,GACpB,MAAM,uBAAuB,CAAC,iCAAiC,CAC7D,OAAO,EACP,iBAAiB,CAAC,EAAE,CACrB,CAAC;IACJ,KAAK,MAAM,eAAe,IAAI,gBAAgB,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,gCAAgC,CACjD,OAAO,EACP,eAAe,CAChB,CAAC;QACF,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAE5C;IACC,MAAM,UAAU,GAAG,MAAM,+BAA+B,CAAC,cAAc,CACrE,KAAK,CAAC,OAAO,CACd,CAAC;IACF,6EAA6E;IAC7E,qEAAqE;IACrE,MAAM,kCAAkC,GACtC,MAAM,kCAAkC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAC3D,GAAG,EAAE,CAAC,IAAI,GAAG,EAAkB,CAChC,CAAC;IAEJ,0EAA0E;IAC1E,4DAA4D;IAC5D,MAAM,0BAA0B,GAAG,IAAI,GAAG,EAGvC,CAAC;IACJ,KAAK,MAAM,EAAE,SAAS,EAAE,IAAI,UAAU,EAAE,CAAC;QACvC,MAAM,KAAK,GAAgC;YACzC,EAAE,EAAE,SAAS,CAAC,EAAE;YAChB,UAAU,EAAE,SAAS,CAAC,UAAU,IAAI,IAAI;SACzC,CAAC;QACF,MAAM,KAAK,GAAG,0BAA0B,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACvE,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;aAAM,CAAC;YACN,0BAA0B,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE;QACzD,IACE,SAAS,CAAC,QAAQ,KAAK,IAAI;YAC3B,SAAS,CAAC,UAAU;YACpB,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,EAClC,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IACH,cAAc,CAAC,IAAI,CACjB,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACd,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,aAAa,CACjD,KAAK,CAAC,SAAS,CAAC,cAAc,IAAI,EAAE,CACrC;QACD,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,aAAa,CACzC,KAAK,CAAC,SAAS,CAAC,cAAc,CAC/B;QACD,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CACtD,CAAC;IAEF,gFAAgF;IAChF,2EAA2E;IAC3E,2BAA2B;IAC3B,OAAO,OAAO,CAAC,GAAG,CAChB,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3C,IAAI,EAAE,MAAM,yBAAyB,CACnC,KAAK,CAAC,OAAO,EACb,SAAS,CAAC,cAAc,EACxB,0BAA0B,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,EAAE,EAC9D,kCAAkC,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC;YAC9D,IAAI,CACP;QACD,cAAc,EAAE,SAAS,CAAC,cAAc;QACxC,eAAe,EAAE,SAAS,CAAC,EAAE;KAC9B,CAAC,CAAC,CACJ,CAAC;AACJ,CAAC","sourcesContent":["import { readStoredDocumentState } from \"../../data/documents/documentKinds\";\nimport { sqlContainerContentsPersistence } from \"../../data/persistence/container-contents/containerContentsPersistence\";\nimport {\n  DOCUMENTS_APP_KIND,\n  sqlDocumentsPersistence,\n} from \"../../data/persistence/documents/documentsPersistence\";\nimport { loadOrganizationProfileDocumentIds } from \"../../data/persistence/organizations/organizationProfileDocumentPointers\";\nimport { findLocalIdByDocumentId } from \"../../data/sqlite/documentPersistence\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport { loadPersistedDocumentContent } from \"../documents/historyContent\";\nimport {\n  getOrganizationProfileDocumentLocalId,\n  readOrganizationProfileName,\n} from \"./organizationProfile\";\nimport { deriveOrganizationMetadataContainerSystemSlot } from \"./rosterProfileContainer\";\n\n// Just the container fields this module needs to locate an org's metadata\n// container among the locally-persisted containers.\ninterface LocalContainerForNameLookup {\n  id: string;\n  systemSlot: string | null;\n}\n\n/**\n * A locally-known organization the user belongs to, derived from its persisted\n * root container. `name` is the decrypted organization-profile display name when\n * one is stored locally, or null when it has not synced yet.\n */\nexport interface LocalOrganizationSummary {\n  name: string | null;\n  organizationId: string;\n  rootContainerId: string;\n}\n\n// Reads and decrypts the `name` field of the organization_profile document\n// persisted under `documentLocalId`, or null if it is absent, empty, or\n// unparseable. A single corrupt profile must not break the whole list, so every\n// failure collapses to a null (unnamed) organization.\nasync function readOrganizationNameFromDocument(\n  execSql: ExecSql,\n  documentLocalId: string,\n): Promise<string | null> {\n  try {\n    const doc = await loadPersistedDocumentContent({\n      execSql,\n      localId: documentLocalId,\n      persistence: sqlDocumentsPersistence,\n    });\n    if (!doc) {\n      return null;\n    }\n\n    return readOrganizationProfileName(\n      readStoredDocumentState(doc).structuredFields,\n    );\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Resolves an organization's decrypted display name from local state.\n *\n * The same organization_profile document is addressed by several different\n * local-id conventions depending on how it arrived, so one lookup by id is not\n * enough:\n *\n *  - The org's own **provisioner** (and any admin who later edits the name)\n *    writes the document under the deterministic alias\n *    `org-profile:<organizationId>` — resolved by the fast path below.\n *  - A **device that only synced it** — a member of another org, or this same\n *    user's freshly re-hydrated device after an identity restore — never runs\n *    that write. The sync ingest keys the document under the server documentId\n *    (there is no local alias to reuse — see `upsertDiscoveredDocumentWithExec`),\n *    so the alias lookup misses.\n *\n * Two fallbacks cover the synced case, in order of authority:\n *\n *  1. The **organization read model** records the org's `profileDocumentId`.\n *     That pointer is container-independent, so it resolves the name wherever\n *     the document happens to be linked — including a profile document created\n *     by an admin through the org-manager editor rather than by provisioning.\n *  2. Failing that, locate the org's metadata container by its deterministic\n *     system slot and read whichever profile document is linked there. Keying on\n *     the system slot (rather than the document kind) keeps it correct even\n *     before the projected document kind has been rebuilt from a freshly-synced\n *     snapshot, and it still works before the read model has been projected.\n */\nasync function readLocalOrganizationName(\n  execSql: ExecSql,\n  organizationId: string,\n  organizationContainers: ReadonlyArray<LocalContainerForNameLookup>,\n  profileDocumentId: string | null,\n): Promise<string | null> {\n  const aliasName = await readOrganizationNameFromDocument(\n    execSql,\n    getOrganizationProfileDocumentLocalId({ organizationId }),\n  );\n  if (aliasName !== null) {\n    return aliasName;\n  }\n\n  if (profileDocumentId) {\n    // Reach the row wherever it landed: a device that only synced the document\n    // keys it under the server documentId rather than any local alias.\n    const syncedLocalId = await findLocalIdByDocumentId(\n      execSql,\n      DOCUMENTS_APP_KIND,\n      profileDocumentId,\n    );\n    const syncedName = syncedLocalId\n      ? await readOrganizationNameFromDocument(execSql, syncedLocalId)\n      : null;\n    if (syncedName !== null) {\n      return syncedName;\n    }\n  }\n\n  const metadataSystemSlot =\n    await deriveOrganizationMetadataContainerSystemSlot({ organizationId });\n  const metadataContainer = organizationContainers.find(\n    (container) => container.systemSlot === metadataSystemSlot,\n  );\n  if (!metadataContainer) {\n    return null;\n  }\n\n  const documentLocalIds =\n    await sqlDocumentsPersistence.findDocumentLocalIdsByContainerId(\n      execSql,\n      metadataContainer.id,\n    );\n  for (const documentLocalId of documentLocalIds) {\n    const name = await readOrganizationNameFromDocument(\n      execSql,\n      documentLocalId,\n    );\n    if (name !== null) {\n      return name;\n    }\n  }\n  return null;\n}\n\n/**\n * Enumerates the organizations the user can manage from local state: one per\n * persisted root container. This is intentionally offline — the Explorer already\n * resolves files across organizations by effective permission, so listing the\n * organizations to manage needs no server round-trip.\n */\nexport async function listLocalOrganizations(input: {\n  execSql: ExecSql;\n}): Promise<LocalOrganizationSummary[]> {\n  const containers = await sqlContainerContentsPersistence.loadContainers(\n    input.execSql,\n  );\n  // A projected read model is not a precondition for listing organizations, so\n  // an unreadable one degrades to the container-derived lookups below.\n  const profileDocumentIdsByOrganizationId =\n    await loadOrganizationProfileDocumentIds(input.execSql).catch(\n      () => new Map<string, string>(),\n    );\n\n  // Group every persisted container by org so name resolution can locate an\n  // org's independent metadata root without a second DB scan.\n  const containersByOrganizationId = new Map<\n    string,\n    LocalContainerForNameLookup[]\n  >();\n  for (const { container } of containers) {\n    const entry: LocalContainerForNameLookup = {\n      id: container.id,\n      systemSlot: container.systemSlot ?? null,\n    };\n    const group = containersByOrganizationId.get(container.organizationId);\n    if (group) {\n      group.push(entry);\n    } else {\n      containersByOrganizationId.set(container.organizationId, [entry]);\n    }\n  }\n\n  const seen = new Set<string>();\n  const rootContainers = containers.filter(({ container }) => {\n    if (\n      container.parentId !== null ||\n      container.systemSlot ||\n      seen.has(container.organizationId)\n    ) {\n      return false;\n    }\n    seen.add(container.organizationId);\n    return true;\n  });\n  rootContainers.sort(\n    (left, right) =>\n      (left.container.localCreatedAt ?? \"\").localeCompare(\n        right.container.localCreatedAt ?? \"\",\n      ) ||\n      left.container.organizationId.localeCompare(\n        right.container.organizationId,\n      ) ||\n      left.container.id.localeCompare(right.container.id),\n  );\n\n  // Read each organization's profile name concurrently; readLocalOrganizationName\n  // already falls back to null per organization, so a single corrupt profile\n  // cannot reject the batch.\n  return Promise.all(\n    rootContainers.map(async ({ container }) => ({\n      name: await readLocalOrganizationName(\n        input.execSql,\n        container.organizationId,\n        containersByOrganizationId.get(container.organizationId) ?? [],\n        profileDocumentIdsByOrganizationId.get(container.organizationId) ??\n          null,\n      ),\n      organizationId: container.organizationId,\n      rootContainerId: container.id,\n    })),\n  );\n}\n"]}

package/workflows/organizations/loadPolicyHistoryDetails.js

@@ -0,0 +1,79 @@
+import { reportKeyingVerificationErrorInCauseChain } from "../../data/keyingProjectionVerification/error.js";
+import { loadPrincipalPolicyCheckpoint } from "../../data/persistence/keyingCheckpointPersistence.js";
+import { loadPrincipalPolicyBundle } from "../../data/persistence/principalPolicyPersistence.js";
+import { loadLocalOrganizationPolicyHistory } from "./localReadModelDetails.js";
+import { buildDetailedOrganizationPolicyHistory } from "./organizationPolicyHistoryDetails.js";
+import { captureOrganizationPresentationAccessAttempt, isOrganizationPresentationAccessAttemptCurrent, isOrganizationPresentationAccessReadable, } from "./organizationPresentationAccessState.js";
+import { isOrganizationPresentationAccessDeniedFailure } from "./organizationPresentationFailures.js";
+import { denyPolicyHistoryAccess } from "./policyHistoryAccessDenial.js";
+import { cachePolicyHistory, loadCachedPolicyHistory, } from "./policyHistoryCache.js";
+export async function loadPolicyHistoryDetails(input) {
+    const access = { ...input, requesterUserId: input.currentUserId };
+    const attempt = captureOrganizationPresentationAccessAttempt(access, "readModel");
+    const current = () => input.stillCurrent() &&
+        isOrganizationPresentationAccessAttemptCurrent(access, attempt) &&
+        isOrganizationPresentationAccessReadable(access, "readModel");
+    const bundle = await loadPrincipalPolicyBundle(input.execSql, "organization", input.organizationId);
+    if (!current())
+        return null;
+    if (!bundle ||
+        bundle.currentState.stateHash !== input.history.entries[0]?.stateHash) {
+        const latest = await loadLocalOrganizationPolicyHistory(input);
+        return current() ? latest : null;
+    }
+    const retain = async (history) => {
+        const latest = await loadLocalOrganizationPolicyHistory(input);
+        if (!current())
+            return null;
+        return latest?.entries[0]?.stateHash === bundle.currentState.stateHash
+            ? history
+            : latest;
+    };
+    const cached = loadCachedPolicyHistory({
+        domainScope: input.domainScope,
+        access,
+        stateHash: bundle.currentState.stateHash,
+    });
+    if (cached)
+        return retain(cached);
+    try {
+        const response = await input.apiClient.getOrganizationPolicyHistoryResult(input.organizationId, bundle.currentState.stateHash, { reportErrors: false });
+        if (!input.stillCurrent())
+            return null;
+        if (!response.ok) {
+            if (isOrganizationPresentationAccessDeniedFailure(response)) {
+                await denyPolicyHistoryAccess(access);
+                return null;
+            }
+            response.report();
+            return retain(input.history);
+        }
+        const history = await buildDetailedOrganizationPolicyHistory({
+            bundle,
+            evidence: response.data,
+            organizationId: input.organizationId,
+            localCheckpoint: await loadPrincipalPolicyCheckpoint(input.execSql, "organization", input.organizationId),
+            resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+        });
+        const retained = await retain(history);
+        if (retained === history)
+            cachePolicyHistory({
+                domainScope: input.domainScope,
+                access,
+                attempt,
+                history,
+            });
+        return retained;
+    }
+    catch (error) {
+        await reportKeyingVerificationErrorInCauseChain(error, input.reportSecurityIncident, {
+            objectId: input.organizationId,
+            objectKind: "principal",
+            operation: "organization.policy_history.load",
+            organizationId: input.organizationId,
+        });
+        input.logError("Failed to load verified organization policy history details", error);
+        return retain(input.history);
+    }
+}
+//# sourceMappingURL=loadPolicyHistoryDetails.js.map

package/workflows/organizations/loadPolicyHistoryDetails.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loadPolicyHistoryDetails.js","sourceRoot":"","sources":["loadPolicyHistoryDetails.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,yCAAyC,EAAE,MAAM,+CAA+C,CAAC;AAC1G,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,yBAAyB,EAAE,MAAM,mDAAmD,CAAC;AAI9F,OAAO,EAAE,kCAAkC,EAAE,MAAM,yBAAyB,CAAC;AAC7E,OAAO,EAAE,sCAAsC,EAAE,MAAM,oCAAoC,CAAC;AAC5F,OAAO,EACL,4CAA4C,EAC5C,8CAA8C,EAC9C,wCAAwC,GACzC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,6CAA6C,EAAE,MAAM,oCAAoC,CAAC;AACnG,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EACL,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAG9B,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAW9C;IACC,MAAM,MAAM,GAAG,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;IAClE,MAAM,OAAO,GAAG,4CAA4C,CAC1D,MAAM,EACN,WAAW,CACZ,CAAC;IACF,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,KAAK,CAAC,YAAY,EAAE;QACpB,8CAA8C,CAAC,MAAM,EAAE,OAAO,CAAC;QAC/D,wCAAwC,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAC5C,KAAK,CAAC,OAAO,EACb,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;IACF,IAAI,CAAC,OAAO,EAAE;QAAE,OAAO,IAAI,CAAC;IAC5B,IACE,CAAC,MAAM;QACP,MAAM,CAAC,YAAY,CAAC,SAAS,KAAK,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,EACrE,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,kCAAkC,CAAC,KAAK,CAAC,CAAC;QAC/D,OAAO,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACnC,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,EAAE,OAAkC,EAAE,EAAE;QAC1D,MAAM,MAAM,GAAG,MAAM,kCAAkC,CAAC,KAAK,CAAC,CAAC;QAC/D,IAAI,CAAC,OAAO,EAAE;YAAE,OAAO,IAAI,CAAC;QAC5B,OAAO,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,KAAK,MAAM,CAAC,YAAY,CAAC,SAAS;YACpE,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,MAAM,CAAC;IACb,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,uBAAuB,CAAC;QACrC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM;QACN,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,SAAS;KACzC,CAAC,CAAC;IACH,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,kCAAkC,CACvE,KAAK,CAAC,cAAc,EACpB,MAAM,CAAC,YAAY,CAAC,SAAS,EAC7B,EAAE,YAAY,EAAE,KAAK,EAAE,CACxB,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE;YAAE,OAAO,IAAI,CAAC;QACvC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,6CAA6C,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5D,MAAM,uBAAuB,CAAC,MAAM,CAAC,CAAC;gBACtC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,QAAQ,CAAC,MAAM,EAAE,CAAC;YAClB,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,sCAAsC,CAAC;YAC3D,MAAM;YACN,QAAQ,EAAE,QAAQ,CAAC,IAAI;YACvB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,eAAe,EAAE,MAAM,6BAA6B,CAClD,KAAK,CAAC,OAAO,EACb,cAAc,EACd,KAAK,CAAC,cAAc,CACrB;YACD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;SAC7D,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,QAAQ,KAAK,OAAO;YACtB,kBAAkB,CAAC;gBACjB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,MAAM;gBACN,OAAO;gBACP,OAAO;aACR,CAAC,CAAC;QACL,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,yCAAyC,CAC7C,KAAK,EACL,KAAK,CAAC,sBAAsB,EAC5B;YACE,QAAQ,EAAE,KAAK,CAAC,cAAc;YAC9B,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,kCAAkC;YAC7C,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CACF,CAAC;QACF,KAAK,CAAC,QAAQ,CACZ,6DAA6D,EAC7D,KAAK,CACN,CAAC;QACF,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport type { DomainScope } from \"../../data/domainScope\";\nimport { reportKeyingVerificationErrorInCauseChain } from \"../../data/keyingProjectionVerification/error\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../data/persistence/keyingCheckpointPersistence\";\nimport { loadPrincipalPolicyBundle } from \"../../data/persistence/principalPolicyPersistence\";\nimport type { SecurityIncidentReporter } from \"../../data/securityIncidents\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\nimport { loadLocalOrganizationPolicyHistory } from \"./localReadModelDetails\";\nimport { buildDetailedOrganizationPolicyHistory } from \"./organizationPolicyHistoryDetails\";\nimport {\n  captureOrganizationPresentationAccessAttempt,\n  isOrganizationPresentationAccessAttemptCurrent,\n  isOrganizationPresentationAccessReadable,\n} from \"./organizationPresentationAccessState\";\nimport { isOrganizationPresentationAccessDeniedFailure } from \"./organizationPresentationFailures\";\nimport { denyPolicyHistoryAccess } from \"./policyHistoryAccessDenial\";\nimport {\n  cachePolicyHistory,\n  loadCachedPolicyHistory,\n} from \"./policyHistoryCache\";\nimport type { OrganizationPolicyHistory } from \"./policyHistoryTypes\";\n\nexport async function loadPolicyHistoryDetails(input: {\n  apiClient: Pick<ApiClient, \"getOrganizationPolicyHistoryResult\">;\n  currentUserId: string;\n  domainScope: DomainScope;\n  execSql: ExecSql;\n  organizationId: string;\n  history: OrganizationPolicyHistory;\n  resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  stillCurrent: () => boolean;\n  reportSecurityIncident?: SecurityIncidentReporter | undefined;\n  logError: (message: string | Error, cause?: unknown) => void;\n}): Promise<OrganizationPolicyHistory | null> {\n  const access = { ...input, requesterUserId: input.currentUserId };\n  const attempt = captureOrganizationPresentationAccessAttempt(\n    access,\n    \"readModel\",\n  );\n  const current = () =>\n    input.stillCurrent() &&\n    isOrganizationPresentationAccessAttemptCurrent(access, attempt) &&\n    isOrganizationPresentationAccessReadable(access, \"readModel\");\n  const bundle = await loadPrincipalPolicyBundle(\n    input.execSql,\n    \"organization\",\n    input.organizationId,\n  );\n  if (!current()) return null;\n  if (\n    !bundle ||\n    bundle.currentState.stateHash !== input.history.entries[0]?.stateHash\n  ) {\n    const latest = await loadLocalOrganizationPolicyHistory(input);\n    return current() ? latest : null;\n  }\n  const retain = async (history: OrganizationPolicyHistory) => {\n    const latest = await loadLocalOrganizationPolicyHistory(input);\n    if (!current()) return null;\n    return latest?.entries[0]?.stateHash === bundle.currentState.stateHash\n      ? history\n      : latest;\n  };\n  const cached = loadCachedPolicyHistory({\n    domainScope: input.domainScope,\n    access,\n    stateHash: bundle.currentState.stateHash,\n  });\n  if (cached) return retain(cached);\n  try {\n    const response = await input.apiClient.getOrganizationPolicyHistoryResult(\n      input.organizationId,\n      bundle.currentState.stateHash,\n      { reportErrors: false },\n    );\n    if (!input.stillCurrent()) return null;\n    if (!response.ok) {\n      if (isOrganizationPresentationAccessDeniedFailure(response)) {\n        await denyPolicyHistoryAccess(access);\n        return null;\n      }\n      response.report();\n      return retain(input.history);\n    }\n    const history = await buildDetailedOrganizationPolicyHistory({\n      bundle,\n      evidence: response.data,\n      organizationId: input.organizationId,\n      localCheckpoint: await loadPrincipalPolicyCheckpoint(\n        input.execSql,\n        \"organization\",\n        input.organizationId,\n      ),\n      resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    });\n    const retained = await retain(history);\n    if (retained === history)\n      cachePolicyHistory({\n        domainScope: input.domainScope,\n        access,\n        attempt,\n        history,\n      });\n    return retained;\n  } catch (error) {\n    await reportKeyingVerificationErrorInCauseChain(\n      error,\n      input.reportSecurityIncident,\n      {\n        objectId: input.organizationId,\n        objectKind: \"principal\",\n        operation: \"organization.policy_history.load\",\n        organizationId: input.organizationId,\n      },\n    );\n    input.logError(\n      \"Failed to load verified organization policy history details\",\n      error,\n    );\n    return retain(input.history);\n  }\n}\n"]}

package/workflows/organizations/localReadModelDetails.d.ts

@@ -0,0 +1,25 @@
+import type { ReferencedPrincipalStateResponse } from "../../internal/validators/response/index.js";
+import type { ExecSql } from "../../data/sqlite/sqlSchema.js";
+import type { OrganizationContainerGrants, OrganizationGroupContainers, OrganizationGroupPolicyHistory, OrganizationPolicyHistory, OrganizationUserDetail } from "./readModel.js";
+interface LocalReadModelInput {
+    readonly currentUserId: string;
+    readonly execSql: ExecSql;
+    readonly organizationId: string;
+}
+type PolicyPrincipalType = ReferencedPrincipalStateResponse["principalType"];
+export declare function loadLocalOrganizationContainerGrants(input: LocalReadModelInput): Promise<OrganizationContainerGrants | null>;
+export declare function loadLocalOrganizationGroupContainers(input: LocalReadModelInput & {
+    readonly groupId: string;
+}): Promise<OrganizationGroupContainers | null>;
+export declare function loadLocalOrganizationGroupPolicyHistory(input: LocalReadModelInput & {
+    readonly groupId: string;
+}): Promise<OrganizationGroupPolicyHistory | null>;
+export declare function loadLocalOrganizationPolicyHistory(input: LocalReadModelInput): Promise<OrganizationPolicyHistory | null>;
+export declare function loadLocalOrganizationPolicyReference(input: LocalReadModelInput & {
+    readonly principalId: string;
+    readonly principalType: PolicyPrincipalType;
+}): Promise<ReferencedPrincipalStateResponse | null>;
+export declare function loadLocalOrganizationUserDetail(input: LocalReadModelInput & {
+    readonly userId: string;
+}): Promise<OrganizationUserDetail | null>;
+export {};

package/workflows/organizations/localReadModelDetails.js

@@ -0,0 +1,182 @@
+import { loadContainerDisplayNamesByIds } from "../../data/persistence/containers/containerPersistence.js";
+import { loadOrganizationGroupDisplayNames } from "../../data/persistence/organizations/organizationGroupNamePersistence.js";
+import { loadOrganizationReadModelProjection } from "../../data/persistence/organizations/organizationReadModelPersistence.js";
+import { loadPrincipalPolicyBundle } from "../../data/persistence/principalPolicyPersistence.js";
+import { loadVerifiedOrganizationGroupRoles } from "../../data/principals/organizationGroupRoles.js";
+import { runOrganizationPresentationRead } from "./organizationPresentationAccessState.js";
+import { buildOrganizationGroupPolicyHistory, buildOrganizationPolicyHistory, } from "./policyHistoryReadModel.js";
+const DISPLAY_NAME_BATCH_SIZE = 400;
+function uniqueContainerIds(grants) {
+    return [...new Set(grants.map((grant) => grant.containerId))];
+}
+async function enrichGrants(execSql, grants, organizationId) {
+    const containerIds = uniqueContainerIds(grants);
+    const groupNames = await loadOrganizationGroupDisplayNames(execSql, organizationId);
+    const groupRoles = await loadVerifiedOrganizationGroupRoles(execSql, organizationId);
+    const displayNames = new Map();
+    for (let index = 0; index < containerIds.length; index += DISPLAY_NAME_BATCH_SIZE) {
+        const batch = await loadContainerDisplayNamesByIds(execSql, containerIds.slice(index, index + DISPLAY_NAME_BATCH_SIZE));
+        for (const [containerId, displayName] of batch) {
+            displayNames.set(containerId, displayName);
+        }
+    }
+    return grants.map((grant) => ({
+        ...grant,
+        containerDisplayName: displayNames.get(grant.containerId) ?? null,
+        groupName: grant.subjectType === "group"
+            ? (groupRoles.get(grant.subjectId) ??
+                groupNames.get(grant.subjectId) ??
+                null)
+            : null,
+    }));
+}
+function toGroupContainer(grant) {
+    return {
+        accessLevel: grant.accessLevel,
+        containerId: grant.containerId,
+        containerDisplayName: grant.containerDisplayName,
+        createdAt: grant.createdAt,
+        depth: grant.depth,
+        isBuiltin: grant.isBuiltin,
+        metadataAccessEpoch: grant.metadataAccessEpoch,
+        metadataAccessStateHash: grant.metadataAccessStateHash,
+        metadataDocumentId: grant.metadataDocumentId,
+        parentId: grant.parentId,
+        updatedAt: grant.updatedAt,
+    };
+}
+/**
+ * The groups a user belongs to is exactly the set naming them as a member.
+ *
+ * This used to be a breadth-first walk over group-in-group edges. Groups
+ * contain only users now, so the walk had no second level to visit.
+ */
+function reachableGroupIds(input) {
+    return new Set(input.edges
+        .filter((edge) => edge.userId === input.userId)
+        .map((edge) => edge.groupId));
+}
+export async function loadLocalOrganizationContainerGrants(input) {
+    return runOrganizationPresentationRead({ ...input, requesterUserId: input.currentUserId }, "readModel", async () => {
+        const projection = await loadOrganizationReadModelProjection(input.execSql, input.organizationId, input.currentUserId);
+        if (!projection?.requester) {
+            return null;
+        }
+        return {
+            organizationId: input.organizationId,
+            grants: await enrichGrants(input.execSql, projection.grants.grants, input.organizationId),
+        };
+    });
+}
+export async function loadLocalOrganizationGroupContainers(input) {
+    return runOrganizationPresentationRead({ ...input, requesterUserId: input.currentUserId }, "readModel", async () => {
+        const projection = await loadOrganizationReadModelProjection(input.execSql, input.organizationId, input.currentUserId);
+        if (!projection?.requester) {
+            return null;
+        }
+        const groupIsInOrganization = input.groupId === projection.groups.memberGroupId ||
+            projection.groups.groups.some((group) => group.groupId === input.groupId);
+        if (!groupIsInOrganization) {
+            return null;
+        }
+        const grants = projection.grants.grants.filter((grant) => grant.subjectType === "group" && grant.subjectId === input.groupId);
+        return {
+            organizationId: input.organizationId,
+            groupId: input.groupId,
+            containers: (await enrichGrants(input.execSql, grants, input.organizationId)).map(toGroupContainer),
+        };
+    });
+}
+export async function loadLocalOrganizationGroupPolicyHistory(input) {
+    return runOrganizationPresentationRead({ ...input, requesterUserId: input.currentUserId }, "readModel", async () => {
+        const projection = await loadOrganizationReadModelProjection(input.execSql, input.organizationId, input.currentUserId);
+        if (!projection?.requester) {
+            return null;
+        }
+        const projectedHead = projection.policyHeads.find((head) => head.principalType === "group" && head.principalId === input.groupId);
+        if (!projectedHead) {
+            return null;
+        }
+        const bundle = await loadPrincipalPolicyBundle(input.execSql, "group", input.groupId);
+        return policyBundleMatchesProjectedHead(bundle, projectedHead)
+            ? buildOrganizationGroupPolicyHistory(bundle, input.organizationId)
+            : null;
+    });
+}
+function policyBundleMatchesProjectedHead(bundle, projectedHead) {
+    const storedHead = bundle?.currentState;
+    return Boolean(storedHead &&
+        storedHead.principalType === projectedHead.principalType &&
+        storedHead.principalId === projectedHead.principalId &&
+        storedHead.stateHash === projectedHead.stateHash &&
+        storedHead.version === projectedHead.version &&
+        storedHead.keyEpoch === projectedHead.keyEpoch &&
+        storedHead.keyFingerprint === projectedHead.keyFingerprint &&
+        storedHead.memberCount === projectedHead.memberCount);
+}
+export async function loadLocalOrganizationPolicyHistory(input) {
+    return runOrganizationPresentationRead({ ...input, requesterUserId: input.currentUserId }, "readModel", async () => {
+        const projection = await loadOrganizationReadModelProjection(input.execSql, input.organizationId, input.currentUserId);
+        if (!projection?.requester) {
+            return null;
+        }
+        const projectedHead = projection.policyHeads.find((head) => head.principalType === "organization" &&
+            head.principalId === input.organizationId);
+        if (!projectedHead) {
+            return null;
+        }
+        const bundle = await loadPrincipalPolicyBundle(input.execSql, "organization", input.organizationId);
+        return policyBundleMatchesProjectedHead(bundle, projectedHead)
+            ? buildOrganizationPolicyHistory(bundle)
+            : null;
+    });
+}
+export async function loadLocalOrganizationPolicyReference(input) {
+    return runOrganizationPresentationRead({ ...input, requesterUserId: input.currentUserId }, "readModel", async () => {
+        const projection = await loadOrganizationReadModelProjection(input.execSql, input.organizationId, input.currentUserId);
+        if (!projection?.requester) {
+            return null;
+        }
+        const head = projection.policyHeads.find((candidate) => candidate.principalType === input.principalType &&
+            candidate.principalId === input.principalId);
+        return head
+            ? {
+                principalType: head.principalType,
+                principalId: head.principalId,
+                stateHash: head.stateHash,
+                version: head.version,
+                keyEpoch: head.keyEpoch,
+                keyFingerprint: head.keyFingerprint,
+            }
+            : null;
+    });
+}
+export async function loadLocalOrganizationUserDetail(input) {
+    return runOrganizationPresentationRead({ ...input, requesterUserId: input.currentUserId }, "readModel", async () => {
+        const projection = await loadOrganizationReadModelProjection(input.execSql, input.organizationId, input.currentUserId);
+        const user = projection?.directory.users.find((candidate) => candidate.userId === input.userId);
+        if (!projection?.requester || !user) {
+            return null;
+        }
+        const reachable = reachableGroupIds({
+            edges: projection.membershipEdges,
+            userId: input.userId,
+        });
+        const groups = projection.groups.groups
+            .filter((group) => reachable.has(group.groupId))
+            .map((group) => ({ ...group, nameUnreadable: false }));
+        const relevantGrants = projection.grants.grants.filter((grant) => (grant.subjectType === "user" && grant.subjectId === input.userId) ||
+            (grant.subjectType === "group" && reachable.has(grant.subjectId)));
+        const grants = await enrichGrants(input.execSql, relevantGrants, input.organizationId);
+        return {
+            organizationId: input.organizationId,
+            user,
+            groups,
+            grants: {
+                directGrants: grants.filter((grant) => grant.subjectType === "user" && grant.subjectId === input.userId),
+                groupGrants: grants.filter((grant) => grant.subjectType === "group" && reachable.has(grant.subjectId)),
+            },
+        };
+    });
+}
+//# sourceMappingURL=localReadModelDetails.js.map

package/workflows/organizations/localReadModelDetails.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"localReadModelDetails.js","sourceRoot":"","sources":["localReadModelDetails.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,8BAA8B,EAAE,MAAM,wDAAwD,CAAC;AACxG,OAAO,EAAE,iCAAiC,EAAE,MAAM,uEAAuE,CAAC;AAC1H,OAAO,EAAE,mCAAmC,EAAE,MAAM,uEAAuE,CAAC;AAC5H,OAAO,EAAE,yBAAyB,EAAE,MAAM,mDAAmD,CAAC;AAC9F,OAAO,EAAE,kCAAkC,EAAE,MAAM,8CAA8C,CAAC;AAElG,OAAO,EAAE,+BAA+B,EAAE,MAAM,uCAAuC,CAAC;AACxF,OAAO,EACL,mCAAmC,EACnC,8BAA8B,GAC/B,MAAM,0BAA0B,CAAC;AAmBlC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAEpC,SAAS,kBAAkB,CACzB,MAAqD;IAErD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,OAAgB,EAChB,MAAqD,EACrD,cAAsB;IAEtB,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,MAAM,iCAAiC,CACxD,OAAO,EACP,cAAc,CACf,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,kCAAkC,CACzD,OAAO,EACP,cAAc,CACf,CAAC;IACF,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC/C,KACE,IAAI,KAAK,GAAG,CAAC,EACb,KAAK,GAAG,YAAY,CAAC,MAAM,EAC3B,KAAK,IAAI,uBAAuB,EAChC,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,8BAA8B,CAChD,OAAO,EACP,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,uBAAuB,CAAC,CAC3D,CAAC;QACF,KAAK,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,IAAI,KAAK,EAAE,CAAC;YAC/C,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5B,GAAG,KAAK;QACR,oBAAoB,EAAE,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,IAAI;QACjE,SAAS,EACP,KAAK,CAAC,WAAW,KAAK,OAAO;YAC3B,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;gBAChC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;gBAC/B,IAAI,CAAC;YACP,CAAC,CAAC,IAAI;KACX,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAiC;IAEjC,OAAO;QACL,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,KAM1B;IACC,OAAO,IAAI,GAAG,CACZ,KAAK,CAAC,KAAK;SACR,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC;SAC9C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAC/B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAA0B;IAE1B,OAAO,+BAA+B,CACpC,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,EAClD,WAAW,EACX,KAAK,IAAI,EAAE;QACT,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAC1D,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,aAAa,CACpB,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,MAAM,EAAE,MAAM,YAAY,CACxB,KAAK,CAAC,OAAO,EACb,UAAU,CAAC,MAAM,CAAC,MAAM,EACxB,KAAK,CAAC,cAAc,CACrB;SACF,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAAyD;IAEzD,OAAO,+BAA+B,CACpC,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,EAClD,WAAW,EACX,KAAK,IAAI,EAAE;QACT,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAC1D,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,aAAa,CACpB,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,qBAAqB,GACzB,KAAK,CAAC,OAAO,KAAK,UAAU,CAAC,MAAM,CAAC,aAAa;YACjD,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAC3B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAC3C,CAAC;QACJ,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAC5C,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,OAAO,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,OAAO,CACrE,CAAC;QACF,OAAO;YACL,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU,EAAE,CACV,MAAM,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC,CAChE,CAAC,GAAG,CAAC,gBAAgB,CAAC;SACxB,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAC3D,KAAyD;IAEzD,OAAO,+BAA+B,CACpC,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,EAClD,WAAW,EACX,KAAK,IAAI,EAAE;QACT,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAC1D,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,aAAa,CACpB,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,aAAa,GAAG,UAAU,CAAC,WAAW,CAAC,IAAI,CAC/C,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,aAAa,KAAK,OAAO,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,OAAO,CACvE,CAAC;QACF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAC5C,KAAK,CAAC,OAAO,EACb,OAAO,EACP,KAAK,CAAC,OAAO,CACd,CAAC;QACF,OAAO,gCAAgC,CAAC,MAAM,EAAE,aAAa,CAAC;YAC5D,CAAC,CAAC,mCAAmC,CAAC,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC;YACnE,CAAC,CAAC,IAAI,CAAC;IACX,CAAC,CACF,CAAC;AACJ,CAAC;AAED,SAAS,gCAAgC,CACvC,MAA4C,EAC5C,aAQC;IAED,MAAM,UAAU,GAAG,MAAM,EAAE,YAAY,CAAC;IACxC,OAAO,OAAO,CACZ,UAAU;QACR,UAAU,CAAC,aAAa,KAAK,aAAa,CAAC,aAAa;QACxD,UAAU,CAAC,WAAW,KAAK,aAAa,CAAC,WAAW;QACpD,UAAU,CAAC,SAAS,KAAK,aAAa,CAAC,SAAS;QAChD,UAAU,CAAC,OAAO,KAAK,aAAa,CAAC,OAAO;QAC5C,UAAU,CAAC,QAAQ,KAAK,aAAa,CAAC,QAAQ;QAC9C,UAAU,CAAC,cAAc,KAAK,aAAa,CAAC,cAAc;QAC1D,UAAU,CAAC,WAAW,KAAK,aAAa,CAAC,WAAW,CACvD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,KAA0B;IAE1B,OAAO,+BAA+B,CACpC,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,EAClD,WAAW,EACX,KAAK,IAAI,EAAE;QACT,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAC1D,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,aAAa,CACpB,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,aAAa,GAAG,UAAU,CAAC,WAAW,CAAC,IAAI,CAC/C,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,aAAa,KAAK,cAAc;YACrC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc,CAC5C,CAAC;QACF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAC5C,KAAK,CAAC,OAAO,EACb,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,OAAO,gCAAgC,CAAC,MAAM,EAAE,aAAa,CAAC;YAC5D,CAAC,CAAC,8BAA8B,CAAC,MAAM,CAAC;YACxC,CAAC,CAAC,IAAI,CAAC;IACX,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAGC;IAED,OAAO,+BAA+B,CACpC,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,EAClD,WAAW,EACX,KAAK,IAAI,EAAE;QACT,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAC1D,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,aAAa,CACpB,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,UAAU,CAAC,WAAW,CAAC,IAAI,CACtC,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa;YAC/C,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAC9C,CAAC;QACF,OAAO,IAAI;YACT,CAAC,CAAC;gBACE,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,cAAc,EAAE,IAAI,CAAC,cAAc;aACpC;YACH,CAAC,CAAC,IAAI,CAAC;IACX,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KAAwD;IAExD,OAAO,+BAA+B,CACpC,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,EAClD,WAAW,EACX,KAAK,IAAI,EAAE;QACT,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAC1D,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,aAAa,CACpB,CAAC;QACF,MAAM,IAAI,GAAG,UAAU,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,CAC3C,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CACjD,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,SAAS,IAAI,CAAC,IAAI,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,SAAS,GAAG,iBAAiB,CAAC;YAClC,KAAK,EAAE,UAAU,CAAC,eAAe;YACjC,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM;aACpC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;aAC/C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACzD,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CACpD,CAAC,KAAK,EAAE,EAAE,CACR,CAAC,KAAK,CAAC,WAAW,KAAK,MAAM,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,MAAM,CAAC;YAClE,CAAC,KAAK,CAAC,WAAW,KAAK,OAAO,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CACpE,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,KAAK,CAAC,OAAO,EACb,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,OAAO;YACL,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,IAAI;YACJ,MAAM;YACN,MAAM,EAAE;gBACN,YAAY,EAAE,MAAM,CAAC,MAAM,CACzB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,MAAM,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,MAAM,CACnE;gBACD,WAAW,EAAE,MAAM,CAAC,MAAM,CACxB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,OAAO,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAClE;aACF;SACF,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  OrganizationContainerGrantResponse,\n  PrincipalPolicyBundleResponse,\n  ReferencedPrincipalStateResponse,\n} from \"@tearleads/validators/response\";\nimport { loadContainerDisplayNamesByIds } from \"../../data/persistence/containers/containerPersistence\";\nimport { loadOrganizationGroupDisplayNames } from \"../../data/persistence/organizations/organizationGroupNamePersistence\";\nimport { loadOrganizationReadModelProjection } from \"../../data/persistence/organizations/organizationReadModelPersistence\";\nimport { loadPrincipalPolicyBundle } from \"../../data/persistence/principalPolicyPersistence\";\nimport { loadVerifiedOrganizationGroupRoles } from \"../../data/principals/organizationGroupRoles\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport { runOrganizationPresentationRead } from \"./organizationPresentationAccessState\";\nimport {\n  buildOrganizationGroupPolicyHistory,\n  buildOrganizationPolicyHistory,\n} from \"./policyHistoryReadModel\";\nimport type {\n  OrganizationContainerGrant,\n  OrganizationContainerGrants,\n  OrganizationGroupContainer,\n  OrganizationGroupContainers,\n  OrganizationGroupPolicyHistory,\n  OrganizationPolicyHistory,\n  OrganizationUserDetail,\n} from \"./readModel\";\n\ninterface LocalReadModelInput {\n  readonly currentUserId: string;\n  readonly execSql: ExecSql;\n  readonly organizationId: string;\n}\n\ntype PolicyPrincipalType = ReferencedPrincipalStateResponse[\"principalType\"];\n\nconst DISPLAY_NAME_BATCH_SIZE = 400;\n\nfunction uniqueContainerIds(\n  grants: readonly OrganizationContainerGrantResponse[],\n): string[] {\n  return [...new Set(grants.map((grant) => grant.containerId))];\n}\n\nasync function enrichGrants(\n  execSql: ExecSql,\n  grants: readonly OrganizationContainerGrantResponse[],\n  organizationId: string,\n): Promise<OrganizationContainerGrant[]> {\n  const containerIds = uniqueContainerIds(grants);\n  const groupNames = await loadOrganizationGroupDisplayNames(\n    execSql,\n    organizationId,\n  );\n  const groupRoles = await loadVerifiedOrganizationGroupRoles(\n    execSql,\n    organizationId,\n  );\n  const displayNames = new Map<string, string>();\n  for (\n    let index = 0;\n    index < containerIds.length;\n    index += DISPLAY_NAME_BATCH_SIZE\n  ) {\n    const batch = await loadContainerDisplayNamesByIds(\n      execSql,\n      containerIds.slice(index, index + DISPLAY_NAME_BATCH_SIZE),\n    );\n    for (const [containerId, displayName] of batch) {\n      displayNames.set(containerId, displayName);\n    }\n  }\n  return grants.map((grant) => ({\n    ...grant,\n    containerDisplayName: displayNames.get(grant.containerId) ?? null,\n    groupName:\n      grant.subjectType === \"group\"\n        ? (groupRoles.get(grant.subjectId) ??\n          groupNames.get(grant.subjectId) ??\n          null)\n        : null,\n  }));\n}\n\nfunction toGroupContainer(\n  grant: OrganizationContainerGrant,\n): OrganizationGroupContainer {\n  return {\n    accessLevel: grant.accessLevel,\n    containerId: grant.containerId,\n    containerDisplayName: grant.containerDisplayName,\n    createdAt: grant.createdAt,\n    depth: grant.depth,\n    isBuiltin: grant.isBuiltin,\n    metadataAccessEpoch: grant.metadataAccessEpoch,\n    metadataAccessStateHash: grant.metadataAccessStateHash,\n    metadataDocumentId: grant.metadataDocumentId,\n    parentId: grant.parentId,\n    updatedAt: grant.updatedAt,\n  };\n}\n\n/**\n * The groups a user belongs to is exactly the set naming them as a member.\n *\n * This used to be a breadth-first walk over group-in-group edges. Groups\n * contain only users now, so the walk had no second level to visit.\n */\nfunction reachableGroupIds(input: {\n  readonly edges: ReadonlyArray<{\n    readonly groupId: string;\n    readonly userId: string;\n  }>;\n  readonly userId: string;\n}): Set<string> {\n  return new Set(\n    input.edges\n      .filter((edge) => edge.userId === input.userId)\n      .map((edge) => edge.groupId),\n  );\n}\n\nexport async function loadLocalOrganizationContainerGrants(\n  input: LocalReadModelInput,\n): Promise<OrganizationContainerGrants | null> {\n  return runOrganizationPresentationRead(\n    { ...input, requesterUserId: input.currentUserId },\n    \"readModel\",\n    async () => {\n      const projection = await loadOrganizationReadModelProjection(\n        input.execSql,\n        input.organizationId,\n        input.currentUserId,\n      );\n      if (!projection?.requester) {\n        return null;\n      }\n      return {\n        organizationId: input.organizationId,\n        grants: await enrichGrants(\n          input.execSql,\n          projection.grants.grants,\n          input.organizationId,\n        ),\n      };\n    },\n  );\n}\n\nexport async function loadLocalOrganizationGroupContainers(\n  input: LocalReadModelInput & { readonly groupId: string },\n): Promise<OrganizationGroupContainers | null> {\n  return runOrganizationPresentationRead(\n    { ...input, requesterUserId: input.currentUserId },\n    \"readModel\",\n    async () => {\n      const projection = await loadOrganizationReadModelProjection(\n        input.execSql,\n        input.organizationId,\n        input.currentUserId,\n      );\n      if (!projection?.requester) {\n        return null;\n      }\n      const groupIsInOrganization =\n        input.groupId === projection.groups.memberGroupId ||\n        projection.groups.groups.some(\n          (group) => group.groupId === input.groupId,\n        );\n      if (!groupIsInOrganization) {\n        return null;\n      }\n      const grants = projection.grants.grants.filter(\n        (grant) =>\n          grant.subjectType === \"group\" && grant.subjectId === input.groupId,\n      );\n      return {\n        organizationId: input.organizationId,\n        groupId: input.groupId,\n        containers: (\n          await enrichGrants(input.execSql, grants, input.organizationId)\n        ).map(toGroupContainer),\n      };\n    },\n  );\n}\n\nexport async function loadLocalOrganizationGroupPolicyHistory(\n  input: LocalReadModelInput & { readonly groupId: string },\n): Promise<OrganizationGroupPolicyHistory | null> {\n  return runOrganizationPresentationRead(\n    { ...input, requesterUserId: input.currentUserId },\n    \"readModel\",\n    async () => {\n      const projection = await loadOrganizationReadModelProjection(\n        input.execSql,\n        input.organizationId,\n        input.currentUserId,\n      );\n      if (!projection?.requester) {\n        return null;\n      }\n\n      const projectedHead = projection.policyHeads.find(\n        (head) =>\n          head.principalType === \"group\" && head.principalId === input.groupId,\n      );\n      if (!projectedHead) {\n        return null;\n      }\n\n      const bundle = await loadPrincipalPolicyBundle(\n        input.execSql,\n        \"group\",\n        input.groupId,\n      );\n      return policyBundleMatchesProjectedHead(bundle, projectedHead)\n        ? buildOrganizationGroupPolicyHistory(bundle, input.organizationId)\n        : null;\n    },\n  );\n}\n\nfunction policyBundleMatchesProjectedHead(\n  bundle: PrincipalPolicyBundleResponse | null,\n  projectedHead: {\n    readonly keyEpoch: number;\n    readonly keyFingerprint: string;\n    readonly memberCount: number;\n    readonly principalId: string;\n    readonly principalType: PolicyPrincipalType;\n    readonly stateHash: string;\n    readonly version: number;\n  },\n): bundle is PrincipalPolicyBundleResponse {\n  const storedHead = bundle?.currentState;\n  return Boolean(\n    storedHead &&\n      storedHead.principalType === projectedHead.principalType &&\n      storedHead.principalId === projectedHead.principalId &&\n      storedHead.stateHash === projectedHead.stateHash &&\n      storedHead.version === projectedHead.version &&\n      storedHead.keyEpoch === projectedHead.keyEpoch &&\n      storedHead.keyFingerprint === projectedHead.keyFingerprint &&\n      storedHead.memberCount === projectedHead.memberCount,\n  );\n}\n\nexport async function loadLocalOrganizationPolicyHistory(\n  input: LocalReadModelInput,\n): Promise<OrganizationPolicyHistory | null> {\n  return runOrganizationPresentationRead(\n    { ...input, requesterUserId: input.currentUserId },\n    \"readModel\",\n    async () => {\n      const projection = await loadOrganizationReadModelProjection(\n        input.execSql,\n        input.organizationId,\n        input.currentUserId,\n      );\n      if (!projection?.requester) {\n        return null;\n      }\n      const projectedHead = projection.policyHeads.find(\n        (head) =>\n          head.principalType === \"organization\" &&\n          head.principalId === input.organizationId,\n      );\n      if (!projectedHead) {\n        return null;\n      }\n      const bundle = await loadPrincipalPolicyBundle(\n        input.execSql,\n        \"organization\",\n        input.organizationId,\n      );\n      return policyBundleMatchesProjectedHead(bundle, projectedHead)\n        ? buildOrganizationPolicyHistory(bundle)\n        : null;\n    },\n  );\n}\n\nexport async function loadLocalOrganizationPolicyReference(\n  input: LocalReadModelInput & {\n    readonly principalId: string;\n    readonly principalType: PolicyPrincipalType;\n  },\n): Promise<ReferencedPrincipalStateResponse | null> {\n  return runOrganizationPresentationRead(\n    { ...input, requesterUserId: input.currentUserId },\n    \"readModel\",\n    async () => {\n      const projection = await loadOrganizationReadModelProjection(\n        input.execSql,\n        input.organizationId,\n        input.currentUserId,\n      );\n      if (!projection?.requester) {\n        return null;\n      }\n      const head = projection.policyHeads.find(\n        (candidate) =>\n          candidate.principalType === input.principalType &&\n          candidate.principalId === input.principalId,\n      );\n      return head\n        ? {\n            principalType: head.principalType,\n            principalId: head.principalId,\n            stateHash: head.stateHash,\n            version: head.version,\n            keyEpoch: head.keyEpoch,\n            keyFingerprint: head.keyFingerprint,\n          }\n        : null;\n    },\n  );\n}\n\nexport async function loadLocalOrganizationUserDetail(\n  input: LocalReadModelInput & { readonly userId: string },\n): Promise<OrganizationUserDetail | null> {\n  return runOrganizationPresentationRead(\n    { ...input, requesterUserId: input.currentUserId },\n    \"readModel\",\n    async () => {\n      const projection = await loadOrganizationReadModelProjection(\n        input.execSql,\n        input.organizationId,\n        input.currentUserId,\n      );\n      const user = projection?.directory.users.find(\n        (candidate) => candidate.userId === input.userId,\n      );\n      if (!projection?.requester || !user) {\n        return null;\n      }\n\n      const reachable = reachableGroupIds({\n        edges: projection.membershipEdges,\n        userId: input.userId,\n      });\n      const groups = projection.groups.groups\n        .filter((group) => reachable.has(group.groupId))\n        .map((group) => ({ ...group, nameUnreadable: false }));\n      const relevantGrants = projection.grants.grants.filter(\n        (grant) =>\n          (grant.subjectType === \"user\" && grant.subjectId === input.userId) ||\n          (grant.subjectType === \"group\" && reachable.has(grant.subjectId)),\n      );\n      const grants = await enrichGrants(\n        input.execSql,\n        relevantGrants,\n        input.organizationId,\n      );\n      return {\n        organizationId: input.organizationId,\n        user,\n        groups,\n        grants: {\n          directGrants: grants.filter(\n            (grant) =>\n              grant.subjectType === \"user\" && grant.subjectId === input.userId,\n          ),\n          groupGrants: grants.filter(\n            (grant) =>\n              grant.subjectType === \"group\" && reachable.has(grant.subjectId),\n          ),\n        },\n      };\n    },\n  );\n}\n"]}

package/workflows/organizations/organizationGroupDirectory.js

@@ -0,0 +1,147 @@
+import { buildPrincipalStateSigningInput, generateKemSeedAndKeyPair, normalizePrincipalProjectionMembers, signPrincipalState, toFingerprint, } from "../../internal/crypto/index.js";
+import { bytesToBase64 } from "../../internal/encoding/index.js";
+import { persistLocallyAcknowledgedPrincipalPolicyBundles } from "../../data/persistence/locallyAcknowledgedCheckpointPersistence.js";
+import { encodeOrganizationAuthorityDescriptor, normalizeOrganizationGroupHeads, } from "../../data/principals/organizationAuthorityDescriptor.js";
+import { assertGroupNameUniqueInDirectory } from "./groupNameUniqueness.js";
+import { acknowledgeGroupPolicyState, acknowledgeInitialGroupPolicy, buildAcknowledgedGroupPolicyBundle, } from "./groupPolicyMutationAcknowledgement.js";
+import { groupPolicyMutationHead } from "./groupPolicyMutationHead.js";
+import { rewrapProjectionMemberEnvelopes } from "./principalPolicyRecipients.js";
+import { projectionUserIds, resolveRequiredUserIdentities, } from "./trustedOrganizationUsers.js";
+function organizationGroupHead(head) {
+    if (head.principalType !== "group") {
+        throw new Error("Organization directory can contain only group heads");
+    }
+    return { ...head, principalType: "group" };
+}
+export function replaceOrganizationGroupHead(input) {
+    const nextHead = organizationGroupHead(input.nextHead);
+    return normalizeOrganizationGroupHeads([
+        ...input.descriptor.groupHeads.filter((head) => head.principalId !== nextHead.principalId),
+        nextHead,
+    ]);
+}
+export function removeOrganizationGroupHead(input) {
+    if (input.groupId === input.descriptor.adminGroupId ||
+        input.groupId === input.descriptor.memberGroupId) {
+        throw new Error("Built-in groups cannot be removed from the directory");
+    }
+    const groupHeads = input.descriptor.groupHeads.filter((head) => head.principalId !== input.groupId);
+    if (groupHeads.length === input.descriptor.groupHeads.length) {
+        throw new Error("Organization directory does not commit the deleted group");
+    }
+    return normalizeOrganizationGroupHeads(groupHeads);
+}
+export async function buildOrganizationGroupDirectoryPolicyRequest(input) {
+    const projection = normalizePrincipalProjectionMembers(input.adminProjection);
+    if (projection.length === 0 ||
+        projection.some((member) => member.role !== "admin")) {
+        throw new Error("Organization policy must mirror the Admins projection");
+    }
+    const organizationKem = generateKemSeedAndKeyPair();
+    const memberEnvelopes = await rewrapProjectionMemberEnvelopes({
+        projection,
+        secretKey: organizationKem.secretKey,
+        users: input.adminUsers,
+    });
+    const payloadCiphertext = encodeOrganizationAuthorityDescriptor({
+        ...input.descriptor,
+        groupHeads: input.groupHeads,
+    });
+    const state = await signPrincipalState(await buildPrincipalStateSigningInput({
+        principalType: "organization",
+        principalId: input.descriptor.organizationId,
+        version: input.currentPolicy.currentState.version + 1,
+        prevStateHash: input.currentPolicy.currentState.stateHash,
+        keyEpoch: input.currentPolicy.currentState.keyEpoch + 1,
+        encapsulationPublicKey: bytesToBase64(organizationKem.publicKey),
+        keyFingerprint: await toFingerprint(organizationKem.publicKey),
+        members: projection.map((member) => ({ userId: member.userId })),
+        memberEnvelopes,
+        projection,
+        grants: [],
+        payloadCiphertext,
+        externalAuthority: null,
+        signedAt: new Date().toISOString(),
+        signerUserId: input.signerUserId,
+        signerUserKeyFingerprint: input.signingFingerprint,
+    }), input.signingKeyPair.signingPrivateKey);
+    return {
+        encryptedPayload: {
+            cipherSuite: "aes-256-gcm",
+            ciphertext: payloadCiphertext,
+            ciphertextHash: state.payloadCiphertextHash,
+        },
+        grants: [],
+        memberEnvelopes,
+        projection,
+        state,
+    };
+}
+export async function commitCreatedGroupToDirectory(input) {
+    // Signed group names are unique per organization; refuse a collision before
+    // anything reaches the server.
+    await assertGroupNameUniqueInDirectory({
+        apiClient: input.apiClient,
+        descriptor: input.externalAdminPolicy.descriptor,
+        execSql: input.execSql,
+        externalAuthority: input.externalAdminPolicy.externalAuthority,
+        name: input.name,
+        readEncryptedName: input.readEncryptedName,
+        organizationId: input.organizationId,
+        reportSecurityIncident: input.reportSecurityIncident,
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+    });
+    const expectedHead = await groupPolicyMutationHead(input.request.initialGroupPolicy);
+    const adminProjection = input.externalAdminPolicy.adminBundle.currentProjection;
+    const adminUsers = await resolveRequiredUserIdentities({
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+        userIds: projectionUserIds(adminProjection),
+    });
+    const organizationRequest = await buildOrganizationGroupDirectoryPolicyRequest({
+        adminProjection,
+        adminUsers,
+        currentPolicy: input.externalAdminPolicy.bundle,
+        descriptor: input.externalAdminPolicy.descriptor,
+        groupHeads: [
+            ...input.externalAdminPolicy.descriptor.groupHeads,
+            organizationGroupHead(expectedHead),
+        ],
+        signerUserId: input.signerUserId,
+        signingFingerprint: input.signingFingerprint,
+        signingKeyPair: input.signingKeyPair,
+    });
+    const stored = await input.apiClient.createOrganizationGroup(input.organizationId, { ...input.request, organizationPolicy: organizationRequest });
+    if (!stored) {
+        throw new Error("Group could not be created");
+    }
+    const acknowledged = await acknowledgeInitialGroupPolicy({
+        organizationId: input.organizationId,
+        request: input.request,
+        response: stored.group,
+        stateHash: expectedHead.stateHash,
+    });
+    const organizationHead = await groupPolicyMutationHead(organizationRequest);
+    const organizationPolicy = await acknowledgeGroupPolicyState({
+        currentPolicy: input.externalAdminPolicy.bundle,
+        expectedHead: organizationHead,
+        request: organizationRequest,
+        response: stored.organizationPolicy.currentState,
+    });
+    const organizationBundle = buildAcknowledgedGroupPolicyBundle({
+        currentPolicy: input.externalAdminPolicy.bundle,
+        expectedHead: organizationHead,
+        request: organizationRequest,
+        response: stored.organizationPolicy,
+    });
+    await persistLocallyAcknowledgedPrincipalPolicyBundles({
+        entries: [
+            { bundle: acknowledged.bundle, policy: acknowledged.policy },
+            { bundle: organizationBundle, policy: organizationPolicy },
+        ],
+        execSql: input.execSql,
+        organizationId: input.organizationId,
+        updatedAt: new Date().toISOString(),
+    });
+    return { group: stored.group, head: expectedHead };
+}
+//# sourceMappingURL=organizationGroupDirectory.js.map

package/workflows/organizations/organizationGroupDirectory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizationGroupDirectory.js","sourceRoot":"","sources":["organizationGroupDirectory.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,EAC/B,yBAAyB,EACzB,mCAAmC,EAGnC,kBAAkB,EAClB,aAAa,GACd,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AASpD,OAAO,EAAE,gDAAgD,EAAE,MAAM,iEAAiE,CAAC;AACnI,OAAO,EACL,qCAAqC,EACrC,+BAA+B,GAGhC,MAAM,uDAAuD,CAAC;AAQ/D,OAAO,EAAE,gCAAgC,EAAE,MAAM,uBAAuB,CAAC;AACzE,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAC7B,kCAAkC,GACnC,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AAK9E,OAAO,EACL,iBAAiB,EACjB,6BAA6B,GAC9B,MAAM,4BAA4B,CAAC;AAEpC,SAAS,qBAAqB,CAC5B,IAA6B;IAE7B,IAAI,IAAI,CAAC,aAAa,KAAK,OAAO,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,KAG5C;IACC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvD,OAAO,+BAA+B,CAAC;QACrC,GAAG,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,CACnC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,CACpD;QACD,QAAQ;KACT,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAG3C;IACC,IACE,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,UAAU,CAAC,YAAY;QAC/C,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,UAAU,CAAC,aAAa,EAChD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,CACnD,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,OAAO,CAC7C,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,KAAK,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,+BAA+B,CAAC,UAAU,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4CAA4C,CAAC,KASlE;IACC,MAAM,UAAU,GAAG,mCAAmC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAC9E,IACE,UAAU,CAAC,MAAM,KAAK,CAAC;QACvB,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,EACpD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,eAAe,GAAG,yBAAyB,EAAE,CAAC;IACpD,MAAM,eAAe,GAAG,MAAM,+BAA+B,CAAC;QAC5D,UAAU;QACV,SAAS,EAAE,eAAe,CAAC,SAAS;QACpC,KAAK,EAAE,KAAK,CAAC,UAAU;KACxB,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,qCAAqC,CAAC;QAC9D,GAAG,KAAK,CAAC,UAAU;QACnB,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,kBAAkB,CACpC,MAAM,+BAA+B,CAAC;QACpC,aAAa,EAAE,cAAc;QAC7B,WAAW,EAAE,KAAK,CAAC,UAAU,CAAC,cAAc;QAC5C,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,OAAO,GAAG,CAAC;QACrD,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,SAAS;QACzD,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,QAAQ,GAAG,CAAC;QACvD,sBAAsB,EAAE,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC;QAChE,cAAc,EAAE,MAAM,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC;QAC9D,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAChE,eAAe;QACf,UAAU;QACV,MAAM,EAAE,EAAE;QACV,iBAAiB;QACjB,iBAAiB,EAAE,IAAI;QACvB,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,wBAAwB,EAAE,KAAK,CAAC,kBAAkB;KACnD,CAAC,EACF,KAAK,CAAC,cAAc,CAAC,iBAAiB,CACvC,CAAC;IAEF,OAAO;QACL,gBAAgB,EAAE;YAChB,WAAW,EAAE,aAAa;YAC1B,UAAU,EAAE,iBAAiB;YAC7B,cAAc,EAAE,KAAK,CAAC,qBAAqB;SAC5C;QACD,MAAM,EAAE,EAAE;QACV,eAAe;QACf,UAAU;QACV,KAAK;KACN,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAenD;IAIC,4EAA4E;IAC5E,+BAA+B;IAC/B,MAAM,gCAAgC,CAAC;QACrC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,mBAAmB,CAAC,UAAU;QAChD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,iBAAiB,EAAE,KAAK,CAAC,mBAAmB,CAAC,iBAAiB;QAC9D,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,MAAM,uBAAuB,CAChD,KAAK,CAAC,OAAO,CAAC,kBAAkB,CACjC,CAAC;IACF,MAAM,eAAe,GACnB,KAAK,CAAC,mBAAmB,CAAC,WAAW,CAAC,iBAAiB,CAAC;IAC1D,MAAM,UAAU,GAAG,MAAM,6BAA6B,CAAC;QACrD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,OAAO,EAAE,iBAAiB,CAAC,eAAe,CAAC;KAC5C,CAAC,CAAC;IACH,MAAM,mBAAmB,GACvB,MAAM,4CAA4C,CAAC;QACjD,eAAe;QACf,UAAU;QACV,aAAa,EAAE,KAAK,CAAC,mBAAmB,CAAC,MAAM;QAC/C,UAAU,EAAE,KAAK,CAAC,mBAAmB,CAAC,UAAU;QAChD,UAAU,EAAE;YACV,GAAG,KAAK,CAAC,mBAAmB,CAAC,UAAU,CAAC,UAAU;YAClD,qBAAqB,CAAC,YAAY,CAAC;SACpC;QACD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACL,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,uBAAuB,CAC1D,KAAK,CAAC,cAAc,EACpB,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,CAC9D,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,6BAA6B,CAAC;QACvD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,MAAM,CAAC,KAAK;QACtB,SAAS,EAAE,YAAY,CAAC,SAAS;KAClC,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,MAAM,uBAAuB,CAAC,mBAAmB,CAAC,CAAC;IAC5E,MAAM,kBAAkB,GAAG,MAAM,2BAA2B,CAAC;QAC3D,aAAa,EAAE,KAAK,CAAC,mBAAmB,CAAC,MAAM;QAC/C,YAAY,EAAE,gBAAgB;QAC9B,OAAO,EAAE,mBAAmB;QAC5B,QAAQ,EAAE,MAAM,CAAC,kBAAkB,CAAC,YAAY;KACjD,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,kCAAkC,CAAC;QAC5D,aAAa,EAAE,KAAK,CAAC,mBAAmB,CAAC,MAAM;QAC/C,YAAY,EAAE,gBAAgB;QAC9B,OAAO,EAAE,mBAAmB;QAC5B,QAAQ,EAAE,MAAM,CAAC,kBAAkB;KACpC,CAAC,CAAC;IACH,MAAM,gDAAgD,CAAC;QACrD,OAAO,EAAE;YACP,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE;YAC5D,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;SAC3D;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AACrD,CAAC","sourcesContent":["import {\n  buildPrincipalStateSigningInput,\n  generateKemSeedAndKeyPair,\n  normalizePrincipalProjectionMembers,\n  type ReferencedPrincipalHead,\n  type SigningKeyPair,\n  signPrincipalState,\n  toFingerprint,\n} from \"@tearleads/crypto\";\nimport { bytesToBase64 } from \"@tearleads/encoding\";\nimport type {\n  PrincipalProjectionMemberRequest,\n  PutPrincipalPolicyRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n  OrganizationGroupSummaryResponse,\n  PrincipalPolicyBundleResponse,\n} from \"@tearleads/validators/response\";\nimport { persistLocallyAcknowledgedPrincipalPolicyBundles } from \"../../data/persistence/locallyAcknowledgedCheckpointPersistence\";\nimport {\n  encodeOrganizationAuthorityDescriptor,\n  normalizeOrganizationGroupHeads,\n  type OrganizationAuthorityDescriptor,\n  type OrganizationGroupHead,\n} from \"../../data/principals/organizationAuthorityDescriptor\";\nimport type { SecurityIncidentReporter } from \"../../data/securityIncidents\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type {\n  TrustedUserIdentity,\n  TrustedUserIdentityResolver,\n} from \"../../data/trustedUserIdentity\";\nimport type { loadOrganizationExternalAdminPolicy } from \"../principals/externalAdminPolicy\";\nimport { assertGroupNameUniqueInDirectory } from \"./groupNameUniqueness\";\nimport {\n  acknowledgeGroupPolicyState,\n  acknowledgeInitialGroupPolicy,\n  buildAcknowledgedGroupPolicyBundle,\n} from \"./groupPolicyMutationAcknowledgement\";\nimport type { OrganizationPrincipalPolicyApi } from \"./groupPolicyMutationContext\";\nimport { groupPolicyMutationHead } from \"./groupPolicyMutationHead\";\nimport { rewrapProjectionMemberEnvelopes } from \"./principalPolicyRecipients\";\nimport type {\n  buildInitialGroupPolicyRequest,\n  GroupPolicyNameReader,\n} from \"./principalPolicyRequest\";\nimport {\n  projectionUserIds,\n  resolveRequiredUserIdentities,\n} from \"./trustedOrganizationUsers\";\n\nfunction organizationGroupHead(\n  head: ReferencedPrincipalHead,\n): OrganizationGroupHead {\n  if (head.principalType !== \"group\") {\n    throw new Error(\"Organization directory can contain only group heads\");\n  }\n  return { ...head, principalType: \"group\" };\n}\n\nexport function replaceOrganizationGroupHead(input: {\n  readonly descriptor: OrganizationAuthorityDescriptor;\n  readonly nextHead: ReferencedPrincipalHead;\n}): OrganizationGroupHead[] {\n  const nextHead = organizationGroupHead(input.nextHead);\n  return normalizeOrganizationGroupHeads([\n    ...input.descriptor.groupHeads.filter(\n      (head) => head.principalId !== nextHead.principalId,\n    ),\n    nextHead,\n  ]);\n}\n\nexport function removeOrganizationGroupHead(input: {\n  readonly descriptor: OrganizationAuthorityDescriptor;\n  readonly groupId: string;\n}): OrganizationGroupHead[] {\n  if (\n    input.groupId === input.descriptor.adminGroupId ||\n    input.groupId === input.descriptor.memberGroupId\n  ) {\n    throw new Error(\"Built-in groups cannot be removed from the directory\");\n  }\n  const groupHeads = input.descriptor.groupHeads.filter(\n    (head) => head.principalId !== input.groupId,\n  );\n  if (groupHeads.length === input.descriptor.groupHeads.length) {\n    throw new Error(\"Organization directory does not commit the deleted group\");\n  }\n  return normalizeOrganizationGroupHeads(groupHeads);\n}\n\nexport async function buildOrganizationGroupDirectoryPolicyRequest(input: {\n  readonly adminProjection: readonly PrincipalProjectionMemberRequest[];\n  readonly adminUsers: readonly TrustedUserIdentity[];\n  readonly currentPolicy: PrincipalPolicyBundleResponse;\n  readonly descriptor: OrganizationAuthorityDescriptor;\n  readonly groupHeads: readonly OrganizationGroupHead[];\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n}): Promise<PutPrincipalPolicyRequest> {\n  const projection = normalizePrincipalProjectionMembers(input.adminProjection);\n  if (\n    projection.length === 0 ||\n    projection.some((member) => member.role !== \"admin\")\n  ) {\n    throw new Error(\"Organization policy must mirror the Admins projection\");\n  }\n  const organizationKem = generateKemSeedAndKeyPair();\n  const memberEnvelopes = await rewrapProjectionMemberEnvelopes({\n    projection,\n    secretKey: organizationKem.secretKey,\n    users: input.adminUsers,\n  });\n  const payloadCiphertext = encodeOrganizationAuthorityDescriptor({\n    ...input.descriptor,\n    groupHeads: input.groupHeads,\n  });\n  const state = await signPrincipalState(\n    await buildPrincipalStateSigningInput({\n      principalType: \"organization\",\n      principalId: input.descriptor.organizationId,\n      version: input.currentPolicy.currentState.version + 1,\n      prevStateHash: input.currentPolicy.currentState.stateHash,\n      keyEpoch: input.currentPolicy.currentState.keyEpoch + 1,\n      encapsulationPublicKey: bytesToBase64(organizationKem.publicKey),\n      keyFingerprint: await toFingerprint(organizationKem.publicKey),\n      members: projection.map((member) => ({ userId: member.userId })),\n      memberEnvelopes,\n      projection,\n      grants: [],\n      payloadCiphertext,\n      externalAuthority: null,\n      signedAt: new Date().toISOString(),\n      signerUserId: input.signerUserId,\n      signerUserKeyFingerprint: input.signingFingerprint,\n    }),\n    input.signingKeyPair.signingPrivateKey,\n  );\n\n  return {\n    encryptedPayload: {\n      cipherSuite: \"aes-256-gcm\",\n      ciphertext: payloadCiphertext,\n      ciphertextHash: state.payloadCiphertextHash,\n    },\n    grants: [],\n    memberEnvelopes,\n    projection,\n    state,\n  };\n}\n\nexport async function commitCreatedGroupToDirectory(input: {\n  readonly name: string;\n  readonly readEncryptedName?: GroupPolicyNameReader;\n  readonly apiClient: OrganizationPrincipalPolicyApi;\n  readonly execSql: ExecSql;\n  readonly externalAdminPolicy: NonNullable<\n    Awaited<ReturnType<typeof loadOrganizationExternalAdminPolicy>>\n  >;\n  readonly organizationId: string;\n  readonly reportSecurityIncident: SecurityIncidentReporter;\n  readonly request: Awaited<ReturnType<typeof buildInitialGroupPolicyRequest>>;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n}): Promise<{\n  readonly group: OrganizationGroupSummaryResponse;\n  readonly head: ReferencedPrincipalHead;\n}> {\n  // Signed group names are unique per organization; refuse a collision before\n  // anything reaches the server.\n  await assertGroupNameUniqueInDirectory({\n    apiClient: input.apiClient,\n    descriptor: input.externalAdminPolicy.descriptor,\n    execSql: input.execSql,\n    externalAuthority: input.externalAdminPolicy.externalAuthority,\n    name: input.name,\n    readEncryptedName: input.readEncryptedName,\n    organizationId: input.organizationId,\n    reportSecurityIncident: input.reportSecurityIncident,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  const expectedHead = await groupPolicyMutationHead(\n    input.request.initialGroupPolicy,\n  );\n  const adminProjection =\n    input.externalAdminPolicy.adminBundle.currentProjection;\n  const adminUsers = await resolveRequiredUserIdentities({\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    userIds: projectionUserIds(adminProjection),\n  });\n  const organizationRequest =\n    await buildOrganizationGroupDirectoryPolicyRequest({\n      adminProjection,\n      adminUsers,\n      currentPolicy: input.externalAdminPolicy.bundle,\n      descriptor: input.externalAdminPolicy.descriptor,\n      groupHeads: [\n        ...input.externalAdminPolicy.descriptor.groupHeads,\n        organizationGroupHead(expectedHead),\n      ],\n      signerUserId: input.signerUserId,\n      signingFingerprint: input.signingFingerprint,\n      signingKeyPair: input.signingKeyPair,\n    });\n  const stored = await input.apiClient.createOrganizationGroup(\n    input.organizationId,\n    { ...input.request, organizationPolicy: organizationRequest },\n  );\n  if (!stored) {\n    throw new Error(\"Group could not be created\");\n  }\n  const acknowledged = await acknowledgeInitialGroupPolicy({\n    organizationId: input.organizationId,\n    request: input.request,\n    response: stored.group,\n    stateHash: expectedHead.stateHash,\n  });\n  const organizationHead = await groupPolicyMutationHead(organizationRequest);\n  const organizationPolicy = await acknowledgeGroupPolicyState({\n    currentPolicy: input.externalAdminPolicy.bundle,\n    expectedHead: organizationHead,\n    request: organizationRequest,\n    response: stored.organizationPolicy.currentState,\n  });\n  const organizationBundle = buildAcknowledgedGroupPolicyBundle({\n    currentPolicy: input.externalAdminPolicy.bundle,\n    expectedHead: organizationHead,\n    request: organizationRequest,\n    response: stored.organizationPolicy,\n  });\n  await persistLocallyAcknowledgedPrincipalPolicyBundles({\n    entries: [\n      { bundle: acknowledged.bundle, policy: acknowledged.policy },\n      { bundle: organizationBundle, policy: organizationPolicy },\n    ],\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    updatedAt: new Date().toISOString(),\n  });\n  return { group: stored.group, head: expectedHead };\n}\n"]}

package/workflows/organizations/organizationGroupNamePolicies.js

@@ -0,0 +1,34 @@
+import { loadPrincipalPolicyCheckpoint } from "../../data/persistence/keyingCheckpointPersistence.js";
+import { loadPrincipalPolicyBundleForReference } from "../../data/persistence/principalPolicyReferencePersistence.js";
+import { parseOrganizationAuthorityDescriptor, principalHeadMatchesReference, } from "../../data/principals/organizationAuthorityDescriptor.js";
+import { principalPolicyReferenceFromBundle } from "../../data/principals/principalPolicyAdminSigners.js";
+import { loadOrganizationExternalAdminPolicy } from "../principals/externalAdminPolicy.js";
+/** Cached directory policies are reusable only at the exact projected head. */
+export async function loadGroupNameDirectoryAuthority(input) {
+    const load = async (reference) => {
+        const checkpoint = await loadPrincipalPolicyCheckpoint(input.execSql, reference.principalType, reference.principalId);
+        const bundle = (await loadPrincipalPolicyBundleForReference(input.execSql, reference, checkpoint)) ??
+            (await input.apiClient.getCurrentPrincipalPolicy(reference.principalType, reference.principalId));
+        if (bundle &&
+            !principalHeadMatchesReference(principalPolicyReferenceFromBundle(bundle), reference))
+            throw new Error("Group name authority does not match the projected directory head");
+        return bundle;
+    };
+    const organization = input.organizationPolicyReference
+        ? await load(input.organizationPolicyReference)
+        : await input.apiClient.getCurrentPrincipalPolicy("organization", input.organizationId);
+    if (!organization)
+        return null;
+    return loadOrganizationExternalAdminPolicy({
+        ...input,
+        getCurrentPrincipalPolicy: async (type, id) => {
+            if (type === "organization")
+                return id === input.organizationId ? organization : null;
+            // This callback runs after the organization signature and scope checks.
+            const descriptor = parseOrganizationAuthorityDescriptor(organization.currentPayload.ciphertext);
+            const head = descriptor.groupHeads.find((head) => head.principalId === id);
+            return head ? load(head) : null;
+        },
+    });
+}
+//# sourceMappingURL=organizationGroupNamePolicies.js.map

package/workflows/organizations/organizationGroupNamePolicies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizationGroupNamePolicies.js","sourceRoot":"","sources":["organizationGroupNamePolicies.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,qCAAqC,EAAE,MAAM,4DAA4D,CAAC;AACnH,OAAO,EACL,oCAAoC,EACpC,6BAA6B,GAC9B,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AACvG,OAAO,EAAE,mCAAmC,EAAE,MAAM,mCAAmC,CAAC;AAWxF,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAAY;IAChE,MAAM,IAAI,GAAG,KAAK,EAAE,SAAkC,EAAE,EAAE;QACxD,MAAM,UAAU,GAAG,MAAM,6BAA6B,CACpD,KAAK,CAAC,OAAO,EACb,SAAS,CAAC,aAAa,EACvB,SAAS,CAAC,WAAW,CACtB,CAAC;QACF,MAAM,MAAM,GACV,CAAC,MAAM,qCAAqC,CAC1C,KAAK,CAAC,OAAO,EACb,SAAS,EACT,UAAU,CACX,CAAC;YACF,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,yBAAyB,CAC9C,SAAS,CAAC,aAAa,EACvB,SAAS,CAAC,WAAW,CACtB,CAAC,CAAC;QACL,IACE,MAAM;YACN,CAAC,6BAA6B,CAC5B,kCAAkC,CAAC,MAAM,CAAC,EAC1C,SAAS,CACV;YAED,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;QACJ,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IACF,MAAM,YAAY,GAAG,KAAK,CAAC,2BAA2B;QACpD,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,2BAA2B,CAAC;QAC/C,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,yBAAyB,CAC7C,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;IACN,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAC/B,OAAO,mCAAmC,CAAC;QACzC,GAAG,KAAK;QACR,yBAAyB,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE;YAC5C,IAAI,IAAI,KAAK,cAAc;gBACzB,OAAO,EAAE,KAAK,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;YAC3D,wEAAwE;YACxE,MAAM,UAAU,GAAG,oCAAoC,CACrD,YAAY,CAAC,cAAc,CAAC,UAAU,CACvC,CAAC;YACF,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,CAAC,IAAI,CACrC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,EAAE,CAClC,CAAC;YACF,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAClC,CAAC;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { ReferencedPrincipalHead } from \"@tearleads/crypto\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../data/persistence/keyingCheckpointPersistence\";\nimport { loadPrincipalPolicyBundleForReference } from \"../../data/persistence/principalPolicyReferencePersistence\";\nimport {\n  parseOrganizationAuthorityDescriptor,\n  principalHeadMatchesReference,\n} from \"../../data/principals/organizationAuthorityDescriptor\";\nimport { principalPolicyReferenceFromBundle } from \"../../data/principals/principalPolicyAdminSigners\";\nimport { loadOrganizationExternalAdminPolicy } from \"../principals/externalAdminPolicy\";\nimport type { DirectoryGroupWalkInput } from \"./groupNameUniqueness\";\n\ntype Input = Pick<\n  DirectoryGroupWalkInput,\n  \"apiClient\" | \"execSql\" | \"organizationId\" | \"resolveTrustedUserIdentity\"\n> & {\n  readonly organizationPolicyReference?: ReferencedPrincipalHead | null;\n  readonly stillCurrent: () => boolean;\n};\n\n/** Cached directory policies are reusable only at the exact projected head. */\nexport async function loadGroupNameDirectoryAuthority(input: Input) {\n  const load = async (reference: ReferencedPrincipalHead) => {\n    const checkpoint = await loadPrincipalPolicyCheckpoint(\n      input.execSql,\n      reference.principalType,\n      reference.principalId,\n    );\n    const bundle =\n      (await loadPrincipalPolicyBundleForReference(\n        input.execSql,\n        reference,\n        checkpoint,\n      )) ??\n      (await input.apiClient.getCurrentPrincipalPolicy(\n        reference.principalType,\n        reference.principalId,\n      ));\n    if (\n      bundle &&\n      !principalHeadMatchesReference(\n        principalPolicyReferenceFromBundle(bundle),\n        reference,\n      )\n    )\n      throw new Error(\n        \"Group name authority does not match the projected directory head\",\n      );\n    return bundle;\n  };\n  const organization = input.organizationPolicyReference\n    ? await load(input.organizationPolicyReference)\n    : await input.apiClient.getCurrentPrincipalPolicy(\n        \"organization\",\n        input.organizationId,\n      );\n  if (!organization) return null;\n  return loadOrganizationExternalAdminPolicy({\n    ...input,\n    getCurrentPrincipalPolicy: async (type, id) => {\n      if (type === \"organization\")\n        return id === input.organizationId ? organization : null;\n      // This callback runs after the organization signature and scope checks.\n      const descriptor = parseOrganizationAuthorityDescriptor(\n        organization.currentPayload.ciphertext,\n      );\n      const head = descriptor.groupHeads.find(\n        (head) => head.principalId === id,\n      );\n      return head ? load(head) : null;\n    },\n  });\n}\n"]}