@tearleads/client-sdk 0.0.0-stage → 0.1.11

package/workflows/organizations/principalPolicy.js

@@ -0,0 +1,256 @@
+export { createOrganizationGroup } from "./groupCreation.js";
+import { assertGroupMembershipName } from "./groupMembershipName.js";
+import { prepareAuthoredGroupPolicy } from "./groupPolicyMutationAcknowledgement.js";
+import { cacheGroupPolicy, commitGroupPolicyMutation, loadGroupPolicyMutationContext, } from "./groupPolicyMutationContext.js";
+import { groupPolicyMutationHead } from "./groupPolicyMutationHead.js";
+import { buildAddGroupUserPolicyRequest, buildGroupAccessSetShrinkPolicyRequest, buildRemoveGroupUserPolicyRequest, buildSetGroupContainerGrantPolicyRequest, } from "./groupPolicyRequests.js";
+import { buildOrganizationGroupDirectoryPolicyRequest, replaceOrganizationGroupHead, } from "./organizationGroupDirectory.js";
+import { buildInitialGroupPolicyRequest, buildInitialMemberGroupPolicyRequest, } from "./principalPolicyRequest.js";
+import { projectionUserIds, resolveRequiredUserIdentities, } from "./trustedOrganizationUsers.js";
+export { buildInitialGroupPolicyRequest, buildInitialMemberGroupPolicyRequest };
+function createPolicyMutationCommitGuard(assertCanCommit) {
+    if (!assertCanCommit)
+        return undefined;
+    return () => {
+        assertCanCommit();
+        return true;
+    };
+}
+/**
+ * Plan the container mutations the policy change rematerializes and place their
+ * requests on the policy request. A bare request list has nothing to
+ * acknowledge or carry; a prepared batch does both.
+ */
+async function prepareGroupContainerMutations(input, expectedHead) {
+    if (!input.prepareContainerMutations)
+        return null;
+    const prepared = await input.prepareContainerMutations({
+        currentPolicy: input.currentPolicy,
+        nextPolicy: await prepareAuthoredGroupPolicy({
+            currentPolicy: input.currentPolicy,
+            expectedHead,
+            request: input.request,
+        }),
+    });
+    if ("requests" in prepared) {
+        input.request.containerMutations = [...prepared.requests];
+        return prepared;
+    }
+    input.request.containerMutations = [...prepared];
+    return {};
+}
+async function commitAndCacheGroupPolicyMutation(input) {
+    const stillCurrent = createPolicyMutationCommitGuard(input.assertCanCommit);
+    const expectedHead = await groupPolicyMutationHead(input.request);
+    input.beforePolicyCommit?.(expectedHead);
+    const containerMutations = await prepareGroupContainerMutations(input, expectedHead);
+    const nextAdminProjection = input.policyContext.isOrganizationAdminsGroup
+        ? input.request.projection
+        : input.policyContext.adminPolicyBundle.currentProjection;
+    const adminUsers = await resolveRequiredUserIdentities({
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+        userIds: projectionUserIds(nextAdminProjection),
+    });
+    const organizationRequest = await buildOrganizationGroupDirectoryPolicyRequest({
+        adminProjection: nextAdminProjection,
+        adminUsers,
+        currentPolicy: input.policyContext.organizationPolicyBundle,
+        descriptor: input.policyContext.organizationDescriptor,
+        groupHeads: replaceOrganizationGroupHead({
+            descriptor: input.policyContext.organizationDescriptor,
+            nextHead: expectedHead,
+        }),
+        signerUserId: input.policyContext.signerUserId,
+        signingFingerprint: input.policyContext.signingFingerprint,
+        signingKeyPair: input.policyContext.signingKeyPair,
+    });
+    input.assertCanCommit?.();
+    const acknowledgedBundle = await commitGroupPolicyMutation({
+        apiClient: input.apiClient,
+        carryDescendantRekeys: containerMutations?.carry,
+        retiredContainerIds: () => containerMutations?.retiredContainerIds ?? [],
+        currentPolicy: input.currentPolicy,
+        execSql: input.execSql,
+        expectedHead,
+        groupId: input.groupId,
+        organizationId: input.organizationId,
+        organizationPolicy: input.policyContext.organizationPolicyBundle,
+        organizationRequest,
+        request: input.request,
+        stillCurrent,
+    });
+    input.assertCanCommit?.();
+    if (containerMutations?.acknowledge) {
+        await containerMutations.acknowledge(acknowledgedBundle.containerMutations, stillCurrent);
+    }
+    input.assertCanCommit?.();
+    await input.afterPolicyCommitBeforeCache?.();
+    input.assertCanCommit?.();
+    await cacheGroupPolicy({
+        acknowledgedMemberEnvelopes: acknowledgedBundle.currentMemberEnvelopes,
+        apiClient: input.apiClient,
+        execSql: input.execSql,
+        expectedCurrentHead: expectedHead,
+        externalAuthority: input.externalAuthority,
+        groupId: input.groupId,
+        localPolicyCheckpoint: {
+            principalId: expectedHead.principalId,
+            principalType: expectedHead.principalType,
+            stateHash: expectedHead.stateHash,
+            version: expectedHead.version,
+        },
+        organizationId: input.organizationId,
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+        stillCurrent,
+    });
+    input.assertCanCommit?.();
+    return acknowledgedBundle;
+}
+export async function addOrganizationGroupUser(input) {
+    const policyContext = await loadGroupPolicyMutationContext(input);
+    await assertGroupMembershipName(policyContext.currentPolicy, input.expectedGroupName, input.readEncryptedName);
+    const identities = await resolveRequiredUserIdentities({
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+        userIds: [
+            ...projectionUserIds(policyContext.currentPolicy.currentProjection),
+            input.targetUserId,
+        ],
+    });
+    const targetUser = identities.find((identity) => identity.userId === input.targetUserId);
+    if (!targetUser) {
+        throw new Error(`User identity could not be loaded for ${input.targetUserId}`);
+    }
+    const request = await buildAddGroupUserPolicyRequest({
+        ...policyContext,
+        currentUserSecretKey: input.currentUserSecretKey,
+        currentUsers: identities.filter((identity) => identity.userId !== input.targetUserId),
+        reportSecurityIncident: input.reportSecurityIncident,
+        targetUser,
+    });
+    return commitAndCacheGroupPolicyMutation({
+        afterPolicyCommitBeforeCache: input.afterPolicyCommitBeforeCache,
+        apiClient: input.apiClient,
+        beforePolicyCommit: (head) => input.beforePolicyCommit(head, {
+            adminGroupId: policyContext.adminGroupId,
+            memberGroupId: policyContext.memberGroupId,
+        }),
+        currentPolicy: policyContext.currentPolicy,
+        execSql: input.execSql,
+        externalAuthority: policyContext.externalAuthority,
+        groupId: input.groupId,
+        prepareContainerMutations: input.prepareContainerMutations,
+        request,
+        organizationId: input.organizationId,
+        policyContext,
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+    });
+}
+export async function removeOrganizationGroupUser(input) {
+    const policyContext = await loadGroupPolicyMutationContext(input);
+    await assertGroupMembershipName(policyContext.currentPolicy, input.expectedGroupName, input.readEncryptedName);
+    const removedKey = input.removedUserId;
+    const projection = policyContext.currentPolicy.currentProjection.filter((member) => member.userId !== removedKey);
+    if (projection.length === policyContext.currentPolicy.currentProjection.length) {
+        throw new Error("User is not a group member");
+    }
+    const remainingUsers = await resolveRequiredUserIdentities({
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+        userIds: projectionUserIds(projection),
+    });
+    const request = await buildRemoveGroupUserPolicyRequest({
+        ...policyContext,
+        remainingUsers,
+        removedUserId: input.removedUserId,
+    });
+    return commitAndCacheGroupPolicyMutation({
+        afterPolicyCommitBeforeCache: input.afterPolicyCommitBeforeCache,
+        apiClient: input.apiClient,
+        beforePolicyCommit: (head) => input.beforePolicyCommit(head, {
+            adminGroupId: policyContext.adminGroupId,
+            memberGroupId: policyContext.memberGroupId,
+        }),
+        currentPolicy: policyContext.currentPolicy,
+        execSql: input.execSql,
+        externalAuthority: policyContext.externalAuthority,
+        groupId: input.groupId,
+        prepareContainerMutations: input.prepareContainerMutations,
+        request,
+        organizationId: input.organizationId,
+        policyContext,
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+    });
+}
+/**
+ * Adds or changes one container in the group's signed complete grant set and
+ * commits every resulting container rematerialization in the same request.
+ */
+export async function setOrganizationGroupContainerGrant(input) {
+    const policyContext = await loadGroupPolicyMutationContext({
+        apiClient: input.apiClient,
+        execSql: input.execSql,
+        groupId: input.groupId,
+        organizationId: input.organizationId,
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+        signerUserId: input.signerUserId,
+        signingFingerprint: input.signingFingerprint,
+        signingKeyPair: input.signingKeyPair,
+    });
+    const request = await buildSetGroupContainerGrantPolicyRequest({
+        ...policyContext,
+        accessLevel: input.accessLevel,
+        containerId: input.containerId,
+    });
+    return commitAndCacheGroupPolicyMutation({
+        apiClient: input.apiClient,
+        assertCanCommit: input.assertCanCommit,
+        currentPolicy: policyContext.currentPolicy,
+        execSql: input.execSql,
+        externalAuthority: policyContext.externalAuthority,
+        groupId: input.groupId,
+        prepareContainerMutations: input.prepareContainerMutations,
+        request,
+        organizationId: input.organizationId,
+        policyContext,
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+    });
+}
+/**
+ * A group losing a container grant rotates its own key in the same request as
+ * that container revoke and the rekeys of all remaining grants. This prevents
+ * a later member from using the group's still-current key to open a retained
+ * wrap from before the revoke.
+ */
+export async function rotateOrganizationGroupForAccessSetShrink(input) {
+    const policyContext = await loadGroupPolicyMutationContext({
+        apiClient: input.apiClient,
+        execSql: input.execSql,
+        groupId: input.groupId,
+        organizationId: input.organizationId,
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+        signerUserId: input.signerUserId,
+        signingFingerprint: input.signingFingerprint,
+        signingKeyPair: input.signingKeyPair,
+    });
+    const currentUsers = await resolveRequiredUserIdentities({
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+        userIds: projectionUserIds(policyContext.currentPolicy.currentProjection),
+    });
+    const request = await buildGroupAccessSetShrinkPolicyRequest({
+        ...policyContext,
+        currentUsers,
+        revokedContainerId: input.revokedContainerId,
+    });
+    return commitAndCacheGroupPolicyMutation({
+        apiClient: input.apiClient,
+        currentPolicy: policyContext.currentPolicy,
+        execSql: input.execSql,
+        externalAuthority: policyContext.externalAuthority,
+        groupId: input.groupId,
+        prepareContainerMutations: input.prepareContainerMutations,
+        request,
+        organizationId: input.organizationId,
+        policyContext,
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+    });
+}
+//# sourceMappingURL=principalPolicy.js.map

package/workflows/organizations/principalPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalPolicy.js","sourceRoot":"","sources":["principalPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAoB1D,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAClF,OAAO,EACL,gBAAgB,EAChB,yBAAyB,EACzB,8BAA8B,GAE/B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EACL,8BAA8B,EAC9B,sCAAsC,EACtC,iCAAiC,EACjC,wCAAwC,GACzC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,4CAA4C,EAC5C,4BAA4B,GAC7B,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,8BAA8B,EAC9B,oCAAoC,GACrC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,iBAAiB,EACjB,6BAA6B,GAC9B,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,8BAA8B,EAAE,oCAAoC,EAAE,CAAC;AA8ChF,SAAS,+BAA+B,CACtC,eAAyC;IAEzC,IAAI,CAAC,eAAe;QAAE,OAAO,SAAS,CAAC;IACvC,OAAO,GAAG,EAAE;QACV,eAAe,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,8BAA8B,CAC3C,KAA6C,EAC7C,YAAqC;IAErC,IAAI,CAAC,KAAK,CAAC,yBAAyB;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,yBAAyB,CAAC;QACrD,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,UAAU,EAAE,MAAM,0BAA0B,CAAC;YAC3C,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,YAAY;YACZ,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;KACH,CAAC,CAAC;IACH,IAAI,UAAU,IAAI,QAAQ,EAAE,CAAC;QAC3B,KAAK,CAAC,OAAO,CAAC,kBAAkB,GAAG,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC1D,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,kBAAkB,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;IACjD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,KAAK,UAAU,iCAAiC,CAC9C,KAA6C;IAE7C,MAAM,YAAY,GAAG,+BAA+B,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAC5E,MAAM,YAAY,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClE,KAAK,CAAC,kBAAkB,EAAE,CAAC,YAAY,CAAC,CAAC;IACzC,MAAM,kBAAkB,GAAG,MAAM,8BAA8B,CAC7D,KAAK,EACL,YAAY,CACb,CAAC;IACF,MAAM,mBAAmB,GAAG,KAAK,CAAC,aAAa,CAAC,yBAAyB;QACvE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU;QAC1B,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,iBAAiB,CAAC,iBAAiB,CAAC;IAC5D,MAAM,UAAU,GAAG,MAAM,6BAA6B,CAAC;QACrD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,OAAO,EAAE,iBAAiB,CAAC,mBAAmB,CAAC;KAChD,CAAC,CAAC;IACH,MAAM,mBAAmB,GACvB,MAAM,4CAA4C,CAAC;QACjD,eAAe,EAAE,mBAAmB;QACpC,UAAU;QACV,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,wBAAwB;QAC3D,UAAU,EAAE,KAAK,CAAC,aAAa,CAAC,sBAAsB;QACtD,UAAU,EAAE,4BAA4B,CAAC;YACvC,UAAU,EAAE,KAAK,CAAC,aAAa,CAAC,sBAAsB;YACtD,QAAQ,EAAE,YAAY;SACvB,CAAC;QACF,YAAY,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY;QAC9C,kBAAkB,EAAE,KAAK,CAAC,aAAa,CAAC,kBAAkB;QAC1D,cAAc,EAAE,KAAK,CAAC,aAAa,CAAC,cAAc;KACnD,CAAC,CAAC;IACL,KAAK,CAAC,eAAe,EAAE,EAAE,CAAC;IAC1B,MAAM,kBAAkB,GAAG,MAAM,yBAAyB,CAAC;QACzD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,qBAAqB,EAAE,kBAAkB,EAAE,KAAK;QAChD,mBAAmB,EAAE,GAAG,EAAE,CAAC,kBAAkB,EAAE,mBAAmB,IAAI,EAAE;QACxE,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY;QACZ,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,kBAAkB,EAAE,KAAK,CAAC,aAAa,CAAC,wBAAwB;QAChE,mBAAmB;QACnB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY;KACb,CAAC,CAAC;IACH,KAAK,CAAC,eAAe,EAAE,EAAE,CAAC;IAC1B,IAAI,kBAAkB,EAAE,WAAW,EAAE,CAAC;QACpC,MAAM,kBAAkB,CAAC,WAAW,CAClC,kBAAkB,CAAC,kBAAkB,EACrC,YAAY,CACb,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,eAAe,EAAE,EAAE,CAAC;IAC1B,MAAM,KAAK,CAAC,4BAA4B,EAAE,EAAE,CAAC;IAC7C,KAAK,CAAC,eAAe,EAAE,EAAE,CAAC;IAC1B,MAAM,gBAAgB,CAAC;QACrB,2BAA2B,EAAE,kBAAkB,CAAC,sBAAsB;QACtE,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,mBAAmB,EAAE,YAAY;QACjC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,qBAAqB,EAAE;YACrB,WAAW,EAAE,YAAY,CAAC,WAAW;YACrC,aAAa,EAAE,YAAY,CAAC,aAAa;YACzC,SAAS,EAAE,YAAY,CAAC,SAAS;YACjC,OAAO,EAAE,YAAY,CAAC,OAAO;SAC9B;QACD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,YAAY;KACb,CAAC,CAAC;IACH,KAAK,CAAC,eAAe,EAAE,EAAE,CAAC;IAC1B,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAyB9C;IACC,MAAM,aAAa,GAAG,MAAM,8BAA8B,CAAC,KAAK,CAAC,CAAC;IAClE,MAAM,yBAAyB,CAC7B,aAAa,CAAC,aAAa,EAC3B,KAAK,CAAC,iBAAiB,EACvB,KAAK,CAAC,iBAAiB,CACxB,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,6BAA6B,CAAC;QACrD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,OAAO,EAAE;YACP,GAAG,iBAAiB,CAAC,aAAa,CAAC,aAAa,CAAC,iBAAiB,CAAC;YACnE,KAAK,CAAC,YAAY;SACnB;KACF,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAChC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,YAAY,CACrD,CAAC;IACF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,yCAAyC,KAAK,CAAC,YAAY,EAAE,CAC9D,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC;QACnD,GAAG,aAAa;QAChB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,YAAY,EAAE,UAAU,CAAC,MAAM,CAC7B,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,YAAY,CACrD;QACD,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,UAAU;KACX,CAAC,CAAC;IACH,OAAO,iCAAiC,CAAC;QACvC,4BAA4B,EAAE,KAAK,CAAC,4BAA4B;QAChE,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,kBAAkB,EAAE,CAAC,IAAI,EAAE,EAAE,CAC3B,KAAK,CAAC,kBAAkB,CAAC,IAAI,EAAE;YAC7B,YAAY,EAAE,aAAa,CAAC,YAAY;YACxC,aAAa,EAAE,aAAa,CAAC,aAAa;SAC3C,CAAC;QACJ,aAAa,EAAE,aAAa,CAAC,aAAa;QAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,iBAAiB,EAAE,aAAa,CAAC,iBAAiB;QAClD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;QAC1D,OAAO;QACP,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,aAAa;QACb,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAuBjD;IACC,MAAM,aAAa,GAAG,MAAM,8BAA8B,CAAC,KAAK,CAAC,CAAC;IAClE,MAAM,yBAAyB,CAC7B,aAAa,CAAC,aAAa,EAC3B,KAAK,CAAC,iBAAiB,EACvB,KAAK,CAAC,iBAAiB,CACxB,CAAC;IACF,MAAM,UAAU,GAAG,KAAK,CAAC,aAAa,CAAC;IACvC,MAAM,UAAU,GAAG,aAAa,CAAC,aAAa,CAAC,iBAAiB,CAAC,MAAM,CACrE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,UAAU,CACzC,CAAC;IACF,IACE,UAAU,CAAC,MAAM,KAAK,aAAa,CAAC,aAAa,CAAC,iBAAiB,CAAC,MAAM,EAC1E,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,6BAA6B,CAAC;QACzD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,OAAO,EAAE,iBAAiB,CAAC,UAAU,CAAC;KACvC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,iCAAiC,CAAC;QACtD,GAAG,aAAa;QAChB,cAAc;QACd,aAAa,EAAE,KAAK,CAAC,aAAa;KACnC,CAAC,CAAC;IACH,OAAO,iCAAiC,CAAC;QACvC,4BAA4B,EAAE,KAAK,CAAC,4BAA4B;QAChE,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,kBAAkB,EAAE,CAAC,IAAI,EAAE,EAAE,CAC3B,KAAK,CAAC,kBAAkB,CAAC,IAAI,EAAE;YAC7B,YAAY,EAAE,aAAa,CAAC,YAAY;YACxC,aAAa,EAAE,aAAa,CAAC,aAAa;SAC3C,CAAC;QACJ,aAAa,EAAE,aAAa,CAAC,aAAa;QAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,iBAAiB,EAAE,aAAa,CAAC,iBAAiB;QAClD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;QAC1D,OAAO;QACP,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,aAAa;QACb,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAaxD;IACC,MAAM,aAAa,GAAG,MAAM,8BAA8B,CAAC;QACzD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,wCAAwC,CAAC;QAC7D,GAAG,aAAa;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC,CAAC;IACH,OAAO,iCAAiC,CAAC;QACvC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,aAAa,EAAE,aAAa,CAAC,aAAa;QAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,iBAAiB,EAAE,aAAa,CAAC,iBAAiB;QAClD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;QAC1D,OAAO;QACP,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,aAAa;QACb,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAAC,KAW/D;IACC,MAAM,aAAa,GAAG,MAAM,8BAA8B,CAAC;QACzD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,MAAM,6BAA6B,CAAC;QACvD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,OAAO,EAAE,iBAAiB,CAAC,aAAa,CAAC,aAAa,CAAC,iBAAiB,CAAC;KAC1E,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,sCAAsC,CAAC;QAC3D,GAAG,aAAa;QAChB,YAAY;QACZ,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAC7C,CAAC,CAAC;IACH,OAAO,iCAAiC,CAAC;QACvC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,aAAa,EAAE,aAAa,CAAC,aAAa;QAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,iBAAiB,EAAE,aAAa,CAAC,iBAAiB;QAClD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;QAC1D,OAAO;QACP,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,aAAa;QACb,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;AACL,CAAC","sourcesContent":["export { createOrganizationGroup } from \"./groupCreation\";\n\nimport type {\n  PrincipalPolicyExternalAuthority,\n  ReferencedPrincipalHead,\n  SigningKeyPair,\n  VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type {\n  ContainerMutationRequest,\n  PutPrincipalPolicyRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n  ContainerMutationResponse,\n  PrincipalPolicyBundleResponse,\n  PrincipalPolicyMutationResponse,\n} from \"@tearleads/validators/response\";\nimport type { SecurityIncidentReporter } from \"../../data/securityIncidents\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\nimport { assertGroupMembershipName } from \"./groupMembershipName\";\nimport { prepareAuthoredGroupPolicy } from \"./groupPolicyMutationAcknowledgement\";\nimport {\n  cacheGroupPolicy,\n  commitGroupPolicyMutation,\n  loadGroupPolicyMutationContext,\n  type PrincipalPolicyReadWriteApi,\n} from \"./groupPolicyMutationContext\";\nimport { groupPolicyMutationHead } from \"./groupPolicyMutationHead\";\nimport {\n  buildAddGroupUserPolicyRequest,\n  buildGroupAccessSetShrinkPolicyRequest,\n  buildRemoveGroupUserPolicyRequest,\n  buildSetGroupContainerGrantPolicyRequest,\n} from \"./groupPolicyRequests\";\nimport {\n  buildOrganizationGroupDirectoryPolicyRequest,\n  replaceOrganizationGroupHead,\n} from \"./organizationGroupDirectory\";\nimport type { GroupPolicyNameReader } from \"./principalPolicyRequest\";\nimport {\n  buildInitialGroupPolicyRequest,\n  buildInitialMemberGroupPolicyRequest,\n} from \"./principalPolicyRequest\";\nimport {\n  projectionUserIds,\n  resolveRequiredUserIdentities,\n} from \"./trustedOrganizationUsers\";\n\nexport { buildInitialGroupPolicyRequest, buildInitialMemberGroupPolicyRequest };\n\ninterface PreparedGroupContainerMutations {\n  readonly retiredContainerIds: readonly string[];\n  readonly acknowledge: (\n    responses: readonly ContainerMutationResponse[],\n    stillCurrent?: (() => boolean) | undefined,\n  ) => Promise<void>;\n  /** Sign the descendant rekeys a refused commit named; see `carry` there. */\n  readonly carry?:\n    | ((\n        requiredContainerIds: readonly string[],\n      ) => Promise<readonly ContainerMutationRequest[]>)\n    | undefined;\n  readonly requests: readonly ContainerMutationRequest[];\n}\n\ntype PrepareGroupContainerMutations = (input: {\n  readonly currentPolicy: PrincipalPolicyBundleResponse;\n  readonly nextPolicy: VerifiedPrincipalPolicy;\n}) => Promise<\n  readonly ContainerMutationRequest[] | PreparedGroupContainerMutations\n>;\n\ninterface CommitAndCacheGroupPolicyMutationInput {\n  readonly afterPolicyCommitBeforeCache?: (() => Promise<void>) | undefined;\n  readonly apiClient: PrincipalPolicyReadWriteApi;\n  readonly assertCanCommit?: (() => void) | undefined;\n  readonly beforePolicyCommit?:\n    | ((head: ReferencedPrincipalHead) => void)\n    | undefined;\n  readonly currentPolicy: PrincipalPolicyBundleResponse;\n  readonly execSql: ExecSql;\n  readonly externalAuthority: PrincipalPolicyExternalAuthority | undefined;\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly policyContext: Awaited<\n    ReturnType<typeof loadGroupPolicyMutationContext>\n  >;\n  readonly prepareContainerMutations?:\n    | PrepareGroupContainerMutations\n    | undefined;\n  readonly request: PutPrincipalPolicyRequest;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}\n\nfunction createPolicyMutationCommitGuard(\n  assertCanCommit: (() => void) | undefined,\n): (() => boolean) | undefined {\n  if (!assertCanCommit) return undefined;\n  return () => {\n    assertCanCommit();\n    return true;\n  };\n}\n\n/**\n * Plan the container mutations the policy change rematerializes and place their\n * requests on the policy request. A bare request list has nothing to\n * acknowledge or carry; a prepared batch does both.\n */\nasync function prepareGroupContainerMutations(\n  input: CommitAndCacheGroupPolicyMutationInput,\n  expectedHead: ReferencedPrincipalHead,\n): Promise<Partial<PreparedGroupContainerMutations> | null> {\n  if (!input.prepareContainerMutations) return null;\n  const prepared = await input.prepareContainerMutations({\n    currentPolicy: input.currentPolicy,\n    nextPolicy: await prepareAuthoredGroupPolicy({\n      currentPolicy: input.currentPolicy,\n      expectedHead,\n      request: input.request,\n    }),\n  });\n  if (\"requests\" in prepared) {\n    input.request.containerMutations = [...prepared.requests];\n    return prepared;\n  }\n  input.request.containerMutations = [...prepared];\n  return {};\n}\n\nasync function commitAndCacheGroupPolicyMutation(\n  input: CommitAndCacheGroupPolicyMutationInput,\n): Promise<PrincipalPolicyBundleResponse & PrincipalPolicyMutationResponse> {\n  const stillCurrent = createPolicyMutationCommitGuard(input.assertCanCommit);\n  const expectedHead = await groupPolicyMutationHead(input.request);\n  input.beforePolicyCommit?.(expectedHead);\n  const containerMutations = await prepareGroupContainerMutations(\n    input,\n    expectedHead,\n  );\n  const nextAdminProjection = input.policyContext.isOrganizationAdminsGroup\n    ? input.request.projection\n    : input.policyContext.adminPolicyBundle.currentProjection;\n  const adminUsers = await resolveRequiredUserIdentities({\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    userIds: projectionUserIds(nextAdminProjection),\n  });\n  const organizationRequest =\n    await buildOrganizationGroupDirectoryPolicyRequest({\n      adminProjection: nextAdminProjection,\n      adminUsers,\n      currentPolicy: input.policyContext.organizationPolicyBundle,\n      descriptor: input.policyContext.organizationDescriptor,\n      groupHeads: replaceOrganizationGroupHead({\n        descriptor: input.policyContext.organizationDescriptor,\n        nextHead: expectedHead,\n      }),\n      signerUserId: input.policyContext.signerUserId,\n      signingFingerprint: input.policyContext.signingFingerprint,\n      signingKeyPair: input.policyContext.signingKeyPair,\n    });\n  input.assertCanCommit?.();\n  const acknowledgedBundle = await commitGroupPolicyMutation({\n    apiClient: input.apiClient,\n    carryDescendantRekeys: containerMutations?.carry,\n    retiredContainerIds: () => containerMutations?.retiredContainerIds ?? [],\n    currentPolicy: input.currentPolicy,\n    execSql: input.execSql,\n    expectedHead,\n    groupId: input.groupId,\n    organizationId: input.organizationId,\n    organizationPolicy: input.policyContext.organizationPolicyBundle,\n    organizationRequest,\n    request: input.request,\n    stillCurrent,\n  });\n  input.assertCanCommit?.();\n  if (containerMutations?.acknowledge) {\n    await containerMutations.acknowledge(\n      acknowledgedBundle.containerMutations,\n      stillCurrent,\n    );\n  }\n  input.assertCanCommit?.();\n  await input.afterPolicyCommitBeforeCache?.();\n  input.assertCanCommit?.();\n  await cacheGroupPolicy({\n    acknowledgedMemberEnvelopes: acknowledgedBundle.currentMemberEnvelopes,\n    apiClient: input.apiClient,\n    execSql: input.execSql,\n    expectedCurrentHead: expectedHead,\n    externalAuthority: input.externalAuthority,\n    groupId: input.groupId,\n    localPolicyCheckpoint: {\n      principalId: expectedHead.principalId,\n      principalType: expectedHead.principalType,\n      stateHash: expectedHead.stateHash,\n      version: expectedHead.version,\n    },\n    organizationId: input.organizationId,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    stillCurrent,\n  });\n  input.assertCanCommit?.();\n  return acknowledgedBundle;\n}\n\nexport async function addOrganizationGroupUser(input: {\n  readonly afterPolicyCommitBeforeCache?: (() => Promise<void>) | undefined;\n  readonly apiClient: PrincipalPolicyReadWriteApi;\n  readonly currentUserSecretKey: Uint8Array;\n  readonly execSql: ExecSql;\n  readonly expectedGroupName: string;\n  readonly readEncryptedName?: GroupPolicyNameReader;\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly reportSecurityIncident?: SecurityIncidentReporter | undefined;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n  readonly targetUserId: string;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly beforePolicyCommit: (\n    head: ReferencedPrincipalHead,\n    authority: {\n      readonly adminGroupId: string;\n      readonly memberGroupId: string;\n    },\n  ) => void;\n  readonly prepareContainerMutations?:\n    | PrepareGroupContainerMutations\n    | undefined;\n}): Promise<PrincipalPolicyBundleResponse & PrincipalPolicyMutationResponse> {\n  const policyContext = await loadGroupPolicyMutationContext(input);\n  await assertGroupMembershipName(\n    policyContext.currentPolicy,\n    input.expectedGroupName,\n    input.readEncryptedName,\n  );\n  const identities = await resolveRequiredUserIdentities({\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    userIds: [\n      ...projectionUserIds(policyContext.currentPolicy.currentProjection),\n      input.targetUserId,\n    ],\n  });\n  const targetUser = identities.find(\n    (identity) => identity.userId === input.targetUserId,\n  );\n  if (!targetUser) {\n    throw new Error(\n      `User identity could not be loaded for ${input.targetUserId}`,\n    );\n  }\n  const request = await buildAddGroupUserPolicyRequest({\n    ...policyContext,\n    currentUserSecretKey: input.currentUserSecretKey,\n    currentUsers: identities.filter(\n      (identity) => identity.userId !== input.targetUserId,\n    ),\n    reportSecurityIncident: input.reportSecurityIncident,\n    targetUser,\n  });\n  return commitAndCacheGroupPolicyMutation({\n    afterPolicyCommitBeforeCache: input.afterPolicyCommitBeforeCache,\n    apiClient: input.apiClient,\n    beforePolicyCommit: (head) =>\n      input.beforePolicyCommit(head, {\n        adminGroupId: policyContext.adminGroupId,\n        memberGroupId: policyContext.memberGroupId,\n      }),\n    currentPolicy: policyContext.currentPolicy,\n    execSql: input.execSql,\n    externalAuthority: policyContext.externalAuthority,\n    groupId: input.groupId,\n    prepareContainerMutations: input.prepareContainerMutations,\n    request,\n    organizationId: input.organizationId,\n    policyContext,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n}\n\nexport async function removeOrganizationGroupUser(input: {\n  readonly afterPolicyCommitBeforeCache?: (() => Promise<void>) | undefined;\n  readonly apiClient: PrincipalPolicyReadWriteApi;\n  readonly execSql: ExecSql;\n  readonly expectedGroupName: string;\n  readonly readEncryptedName?: GroupPolicyNameReader;\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly removedUserId: string;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n  readonly beforePolicyCommit: (\n    head: ReferencedPrincipalHead,\n    authority: {\n      readonly adminGroupId: string;\n      readonly memberGroupId: string;\n    },\n  ) => void;\n  readonly prepareContainerMutations?:\n    | PrepareGroupContainerMutations\n    | undefined;\n}): Promise<PrincipalPolicyBundleResponse & PrincipalPolicyMutationResponse> {\n  const policyContext = await loadGroupPolicyMutationContext(input);\n  await assertGroupMembershipName(\n    policyContext.currentPolicy,\n    input.expectedGroupName,\n    input.readEncryptedName,\n  );\n  const removedKey = input.removedUserId;\n  const projection = policyContext.currentPolicy.currentProjection.filter(\n    (member) => member.userId !== removedKey,\n  );\n  if (\n    projection.length === policyContext.currentPolicy.currentProjection.length\n  ) {\n    throw new Error(\"User is not a group member\");\n  }\n  const remainingUsers = await resolveRequiredUserIdentities({\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    userIds: projectionUserIds(projection),\n  });\n  const request = await buildRemoveGroupUserPolicyRequest({\n    ...policyContext,\n    remainingUsers,\n    removedUserId: input.removedUserId,\n  });\n  return commitAndCacheGroupPolicyMutation({\n    afterPolicyCommitBeforeCache: input.afterPolicyCommitBeforeCache,\n    apiClient: input.apiClient,\n    beforePolicyCommit: (head) =>\n      input.beforePolicyCommit(head, {\n        adminGroupId: policyContext.adminGroupId,\n        memberGroupId: policyContext.memberGroupId,\n      }),\n    currentPolicy: policyContext.currentPolicy,\n    execSql: input.execSql,\n    externalAuthority: policyContext.externalAuthority,\n    groupId: input.groupId,\n    prepareContainerMutations: input.prepareContainerMutations,\n    request,\n    organizationId: input.organizationId,\n    policyContext,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n}\n\n/**\n * Adds or changes one container in the group's signed complete grant set and\n * commits every resulting container rematerialization in the same request.\n */\nexport async function setOrganizationGroupContainerGrant(input: {\n  readonly accessLevel: \"admin\" | \"read\" | \"write\";\n  readonly apiClient: PrincipalPolicyReadWriteApi;\n  readonly assertCanCommit?: (() => void) | undefined;\n  readonly containerId: string;\n  readonly execSql: ExecSql;\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly prepareContainerMutations: PrepareGroupContainerMutations;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n}): Promise<PrincipalPolicyBundleResponse & PrincipalPolicyMutationResponse> {\n  const policyContext = await loadGroupPolicyMutationContext({\n    apiClient: input.apiClient,\n    execSql: input.execSql,\n    groupId: input.groupId,\n    organizationId: input.organizationId,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    signerUserId: input.signerUserId,\n    signingFingerprint: input.signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  });\n  const request = await buildSetGroupContainerGrantPolicyRequest({\n    ...policyContext,\n    accessLevel: input.accessLevel,\n    containerId: input.containerId,\n  });\n  return commitAndCacheGroupPolicyMutation({\n    apiClient: input.apiClient,\n    assertCanCommit: input.assertCanCommit,\n    currentPolicy: policyContext.currentPolicy,\n    execSql: input.execSql,\n    externalAuthority: policyContext.externalAuthority,\n    groupId: input.groupId,\n    prepareContainerMutations: input.prepareContainerMutations,\n    request,\n    organizationId: input.organizationId,\n    policyContext,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n}\n\n/**\n * A group losing a container grant rotates its own key in the same request as\n * that container revoke and the rekeys of all remaining grants. This prevents\n * a later member from using the group's still-current key to open a retained\n * wrap from before the revoke.\n */\nexport async function rotateOrganizationGroupForAccessSetShrink(input: {\n  readonly apiClient: PrincipalPolicyReadWriteApi;\n  readonly execSql: ExecSql;\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly revokedContainerId: string;\n  readonly prepareContainerMutations: PrepareGroupContainerMutations;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n}): Promise<PrincipalPolicyBundleResponse & PrincipalPolicyMutationResponse> {\n  const policyContext = await loadGroupPolicyMutationContext({\n    apiClient: input.apiClient,\n    execSql: input.execSql,\n    groupId: input.groupId,\n    organizationId: input.organizationId,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    signerUserId: input.signerUserId,\n    signingFingerprint: input.signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  });\n  const currentUsers = await resolveRequiredUserIdentities({\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    userIds: projectionUserIds(policyContext.currentPolicy.currentProjection),\n  });\n  const request = await buildGroupAccessSetShrinkPolicyRequest({\n    ...policyContext,\n    currentUsers,\n    revokedContainerId: input.revokedContainerId,\n  });\n  return commitAndCacheGroupPolicyMutation({\n    apiClient: input.apiClient,\n    currentPolicy: policyContext.currentPolicy,\n    execSql: input.execSql,\n    externalAuthority: policyContext.externalAuthority,\n    groupId: input.groupId,\n    prepareContainerMutations: input.prepareContainerMutations,\n    request,\n    organizationId: input.organizationId,\n    policyContext,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n}\n"]}

package/workflows/organizations/principalPolicyRecipients.js

@@ -0,0 +1,43 @@
+import { wrapDekForRecipients } from "../../internal/crypto/index.js";
+import { base64ToBytes, bytesToBase64 } from "../../internal/encoding/index.js";
+function toPrincipalMemberEnvelopeRequest(input) {
+    return {
+        userId: input.userId,
+        memberKeyFingerprint: input.envelope.keyFingerprint,
+        kemCipherText: bytesToBase64(input.envelope.kemCipherText),
+        wrappedKey: bytesToBase64(input.envelope.wrappedKey),
+    };
+}
+export function toRecipientEntries(envelopes) {
+    return envelopes.map((envelope) => ({
+        keyFingerprint: envelope.memberKeyFingerprint,
+        kemCipherText: base64ToBytes(envelope.kemCipherText),
+        wrappedKey: base64ToBytes(envelope.wrappedKey),
+    }));
+}
+/** Every projected member is a user, so there is no group recipient branch. */
+function toRekeyRecipientEntries(input) {
+    const usersById = new Map(input.users.map((user) => [user.userId, user]));
+    return input.projection.map((member) => {
+        const user = usersById.get(member.userId);
+        if (!user) {
+            throw new Error(`Missing recipient key for user ${member.userId}`);
+        }
+        return {
+            encapsulationPublicKey: user.encapsulationPublicKey,
+            userId: user.userId,
+        };
+    });
+}
+export async function rewrapProjectionMemberEnvelopes(input) {
+    const recipients = toRekeyRecipientEntries(input);
+    if (recipients.length === 0) {
+        return [];
+    }
+    const wrappedRecipients = await wrapDekForRecipients(input.secretKey, recipients.map((recipient) => recipient.encapsulationPublicKey));
+    return wrappedRecipients.map((envelope, index) => toPrincipalMemberEnvelopeRequest({
+        envelope,
+        userId: recipients[index]?.userId ?? "",
+    }));
+}
+//# sourceMappingURL=principalPolicyRecipients.js.map

package/workflows/organizations/principalPolicyRecipients.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalPolicyRecipients.js","sourceRoot":"","sources":["principalPolicyRecipients.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAanE,SAAS,gCAAgC,CAAC,KAOzC;IACC,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,oBAAoB,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc;QACnD,aAAa,EAAE,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC1D,UAAU,EAAE,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;KACrD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,SAAyD;IAEzD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAClC,cAAc,EAAE,QAAQ,CAAC,oBAAoB;QAC7C,aAAa,EAAE,aAAa,CAAC,QAAQ,CAAC,aAAa,CAAC;QACpD,UAAU,EAAE,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC;KAC/C,CAAC,CAAC,CAAC;AACN,CAAC;AAED,+EAA+E;AAC/E,SAAS,uBAAuB,CAAC,KAGhC;IACC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAE1E,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,kCAAkC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,OAAO;YACL,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;YACnD,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAIrD;IACC,MAAM,UAAU,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAClD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,iBAAiB,GAAG,MAAM,oBAAoB,CAClD,KAAK,CAAC,SAAS,EACf,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAChE,CAAC;IAEF,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAC/C,gCAAgC,CAAC;QAC/B,QAAQ;QACR,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,EAAE;KACxC,CAAC,CACH,CAAC;AACJ,CAAC","sourcesContent":["import { wrapDekForRecipients } from \"@tearleads/crypto\";\nimport { base64ToBytes, bytesToBase64 } from \"@tearleads/encoding\";\nimport type {\n  PrincipalMemberEnvelopeRequest,\n  PrincipalProjectionMemberRequest,\n} from \"@tearleads/validators/request\";\nimport type { PrincipalMemberEnvelopeResponse } from \"@tearleads/validators/response\";\nimport type { TrustedUserIdentity } from \"../../data/trustedUserIdentity\";\n\ntype PrincipalRekeyRecipient = {\n  readonly encapsulationPublicKey: Uint8Array;\n  readonly userId: string;\n};\n\nfunction toPrincipalMemberEnvelopeRequest(input: {\n  readonly envelope: {\n    readonly keyFingerprint: string;\n    readonly kemCipherText: Uint8Array;\n    readonly wrappedKey: Uint8Array;\n  };\n  readonly userId: string;\n}): PrincipalMemberEnvelopeRequest {\n  return {\n    userId: input.userId,\n    memberKeyFingerprint: input.envelope.keyFingerprint,\n    kemCipherText: bytesToBase64(input.envelope.kemCipherText),\n    wrappedKey: bytesToBase64(input.envelope.wrappedKey),\n  };\n}\n\nexport function toRecipientEntries(\n  envelopes: ReadonlyArray<PrincipalMemberEnvelopeResponse>,\n) {\n  return envelopes.map((envelope) => ({\n    keyFingerprint: envelope.memberKeyFingerprint,\n    kemCipherText: base64ToBytes(envelope.kemCipherText),\n    wrappedKey: base64ToBytes(envelope.wrappedKey),\n  }));\n}\n\n/** Every projected member is a user, so there is no group recipient branch. */\nfunction toRekeyRecipientEntries(input: {\n  readonly projection: ReadonlyArray<PrincipalProjectionMemberRequest>;\n  readonly users: ReadonlyArray<TrustedUserIdentity>;\n}): PrincipalRekeyRecipient[] {\n  const usersById = new Map(input.users.map((user) => [user.userId, user]));\n\n  return input.projection.map((member) => {\n    const user = usersById.get(member.userId);\n    if (!user) {\n      throw new Error(`Missing recipient key for user ${member.userId}`);\n    }\n\n    return {\n      encapsulationPublicKey: user.encapsulationPublicKey,\n      userId: user.userId,\n    };\n  });\n}\n\nexport async function rewrapProjectionMemberEnvelopes(input: {\n  readonly projection: ReadonlyArray<PrincipalProjectionMemberRequest>;\n  readonly secretKey: Uint8Array;\n  readonly users: ReadonlyArray<TrustedUserIdentity>;\n}): Promise<PrincipalMemberEnvelopeRequest[]> {\n  const recipients = toRekeyRecipientEntries(input);\n  if (recipients.length === 0) {\n    return [];\n  }\n  const wrappedRecipients = await wrapDekForRecipients(\n    input.secretKey,\n    recipients.map((recipient) => recipient.encapsulationPublicKey),\n  );\n\n  return wrappedRecipients.map((envelope, index) =>\n    toPrincipalMemberEnvelopeRequest({\n      envelope,\n      userId: recipients[index]?.userId ?? \"\",\n    }),\n  );\n}\n"]}

package/workflows/organizations/principalPolicyRequest.d.ts

@@ -0,0 +1,67 @@
+import { type EncapsulationKeyPair, type GroupMetadataKey, type PrincipalContainerGrant, type PrincipalPolicyExternalAuthority, type SigningKeyPair } from "../../internal/crypto/index.js";
+import type { CreateOrganizationGroupRequest, PrincipalMemberEnvelopeRequest, PrincipalProjectionMemberRequest, PutPrincipalPolicyRequest } from "../../internal/validators/request/index.js";
+import type { PrincipalPolicyBundleResponse } from "../../internal/validators/response/index.js";
+interface BuildInitialGroupPolicyInput {
+    readonly creatorEncapsulationKeyPair: EncapsulationKeyPair;
+    readonly externalAuthority?: PrincipalPolicyExternalAuthority["currentHead"] | null;
+    readonly groupId: string;
+    readonly grants?: readonly PrincipalContainerGrant[] | undefined;
+    readonly includeSignerAsAdmin?: boolean;
+    readonly name: string;
+    readonly metadataKey?: GroupMetadataKey;
+    readonly builtinRole?: "admins" | "members";
+    readonly signerUserId: string;
+    readonly signingFingerprint: string;
+    readonly signingKeyPair: SigningKeyPair;
+}
+export declare function userProjectionMember(userId: string, role: "member" | "admin"): PrincipalProjectionMemberRequest;
+/**
+ * The comparison key for a group display name: width- and compatibility-
+ * normalized, stripped of control, format, and default-ignorable characters,
+ * whitespace-collapsed, and case-folded. Two names that a user cannot tell
+ * apart in a picker must compare equal, or a look-alike name would slip past
+ * the share-time binding. Cross-script homoglyphs (Latin "A" against Greek
+ * "Α") are not folded: that needs the UTS #39 confusables table, and both
+ * names would still have to be signed groups the organization's own admins
+ * created.
+ */
+export declare function canonicalGroupNameKey(name: string): string;
+export type GroupPolicyNameReader = (bundle: PrincipalPolicyBundleResponse) => Promise<string>;
+/** Read only after the policy and its organization-directory binding verify. */
+export declare function readGroupPolicyPayloadName(bundle: PrincipalPolicyBundleResponse, readEncryptedName?: GroupPolicyNameReader): Promise<string>;
+/** One binding predicate for every operation selected by a read-model label. */
+export declare function groupPolicyNameMismatch(bundle: PrincipalPolicyBundleResponse, expectedGroupName: string, readEncryptedName?: GroupPolicyNameReader): Promise<"forbidden_characters" | "name_mismatch" | null>;
+export declare function signedGroupPolicyRequest(input: {
+    readonly currentPolicy?: PrincipalPolicyBundleResponse;
+    readonly encapsulationPublicKey: string;
+    readonly externalAuthority: PrincipalPolicyExternalAuthority["currentHead"] | null;
+    readonly keyEpoch: number;
+    readonly keyFingerprint: string;
+    readonly grants: ReadonlyArray<PrincipalContainerGrant>;
+    readonly memberEnvelopes: ReadonlyArray<PrincipalMemberEnvelopeRequest>;
+    readonly payloadCiphertext: string;
+    readonly principalId: string;
+    readonly projection: ReadonlyArray<PrincipalProjectionMemberRequest>;
+    readonly signedAt: string;
+    readonly signerUserId: string;
+    readonly signingFingerprint: string;
+    readonly signingKeyPair: SigningKeyPair;
+}): Promise<PutPrincipalPolicyRequest>;
+export declare function buildInitialGroupPolicyRequest(input: BuildInitialGroupPolicyInput): Promise<CreateOrganizationGroupRequest>;
+/**
+ * Members at bootstrap holds the registering user alone.
+ *
+ * It used to also contain the Admins group as a nested member, so that admins
+ * were implicitly members. Principals contain only users now, so an admin is an
+ * ordinary Members entry — and bootstrap has exactly one user, who is that
+ * admin.
+ */
+export declare function buildInitialMemberGroupPolicyRequest(input: {
+    readonly creatorEncapsulationKeyPair: EncapsulationKeyPair;
+    readonly groupId: string;
+    readonly grants?: readonly PrincipalContainerGrant[] | undefined;
+    readonly signerUserId: string;
+    readonly signingFingerprint: string;
+    readonly signingKeyPair: SigningKeyPair;
+}): Promise<CreateOrganizationGroupRequest>;
+export {};

package/workflows/organizations/principalPolicyRequest.js

@@ -0,0 +1,176 @@
+import { buildPrincipalStateSigningInput, encodeBuiltinGroupMetadata, encryptGroupMetadata, generateKemSeedAndKeyPair, normalizePrincipalContainerGrants, normalizePrincipalProjectionMembers, readGroupMetadata, signPrincipalState, toFingerprint, wrapDekForRecipients, } from "../../internal/crypto/index.js";
+import { bytesToBase64 } from "../../internal/encoding/index.js";
+export function userProjectionMember(userId, role) {
+    return { userId: userId, role };
+}
+function projectionToStateMembers(projection) {
+    return projection.map((member) => ({ userId: member.userId }));
+}
+/**
+ * Code points that must never appear in a group name: control and format
+ * characters (bidi overrides, zero-width joiners, newlines), lone surrogates
+ * (re-encoded as U+FFFD when signed, so the signed name would no longer match
+ * the one sent to the server), and every other default-ignorable code point
+ * (Hangul fillers, variation selectors), which render as nothing and would
+ * let one name pass for another. A group name is an identifier here, so this
+ * deliberately refuses ZWJ emoji sequences as well. One predicate serves the
+ * signing-time and the share-time refusal so the two cannot drift.
+ */
+function hasForbiddenGroupNameCharacter(name) {
+    return /[\p{Cc}\p{Cf}\p{Cs}\p{Default_Ignorable_Code_Point}]/u.test(name);
+}
+/**
+ * The comparison key for a group display name: width- and compatibility-
+ * normalized, stripped of control, format, and default-ignorable characters,
+ * whitespace-collapsed, and case-folded. Two names that a user cannot tell
+ * apart in a picker must compare equal, or a look-alike name would slip past
+ * the share-time binding. Cross-script homoglyphs (Latin "A" against Greek
+ * "Α") are not folded: that needs the UTS #39 confusables table, and both
+ * names would still have to be signed groups the organization's own admins
+ * created.
+ */
+export function canonicalGroupNameKey(name) {
+    return (name
+        .normalize("NFKC")
+        .replace(/[\p{Cc}\p{Cf}\p{Default_Ignorable_Code_Point}]/gu, "")
+        .replace(/\s+/gu, " ")
+        .trim()
+        .toLocaleLowerCase("en-US")
+        // Case folding can leave the string un-normalized (U+0130 lowercases to
+        // "i" plus a combining dot), so normalize once more after it.
+        .normalize("NFKC"));
+}
+/** Read only after the policy and its organization-directory binding verify. */
+export async function readGroupPolicyPayloadName(bundle, readEncryptedName) {
+    const metadata = readGroupMetadata(bundle.currentPayload.ciphertext);
+    if ("role" in metadata)
+        return metadata.role === "admins" ? "Admins" : "Members";
+    if (!readEncryptedName)
+        throw new Error("Group metadata decryption context is unavailable");
+    return readEncryptedName(bundle);
+}
+/** One binding predicate for every operation selected by a read-model label. */
+export async function groupPolicyNameMismatch(bundle, expectedGroupName, readEncryptedName) {
+    if (hasForbiddenGroupNameCharacter(expectedGroupName)) {
+        return "forbidden_characters";
+    }
+    const signedName = await readGroupPolicyPayloadName(bundle, readEncryptedName);
+    if (hasForbiddenGroupNameCharacter(signedName))
+        return "forbidden_characters";
+    return canonicalGroupNameKey(signedName) ===
+        canonicalGroupNameKey(expectedGroupName)
+        ? null
+        : "name_mismatch";
+}
+export async function signedGroupPolicyRequest(input) {
+    const projection = normalizePrincipalProjectionMembers(input.projection);
+    const grants = normalizePrincipalContainerGrants(input.grants);
+    const payloadCiphertext = input.payloadCiphertext;
+    const state = await signPrincipalState(await buildPrincipalStateSigningInput({
+        principalType: "group",
+        principalId: input.principalId,
+        version: input.currentPolicy
+            ? input.currentPolicy.currentState.version + 1
+            : 1,
+        prevStateHash: input.currentPolicy?.currentState.stateHash ?? null,
+        keyEpoch: input.keyEpoch,
+        encapsulationPublicKey: input.encapsulationPublicKey,
+        keyFingerprint: input.keyFingerprint,
+        members: projectionToStateMembers(projection),
+        memberEnvelopes: [...input.memberEnvelopes],
+        projection,
+        grants,
+        payloadCiphertext,
+        externalAuthority: input.externalAuthority,
+        signedAt: input.signedAt,
+        signerUserId: input.signerUserId,
+        signerUserKeyFingerprint: input.signingFingerprint,
+    }), input.signingKeyPair.signingPrivateKey);
+    return {
+        state,
+        encryptedPayload: {
+            cipherSuite: "aes-256-gcm",
+            ciphertext: payloadCiphertext,
+            ciphertextHash: state.payloadCiphertextHash,
+        },
+        projection,
+        grants,
+        memberEnvelopes: [...input.memberEnvelopes],
+    };
+}
+export async function buildInitialGroupPolicyRequest(input) {
+    const groupKem = generateKemSeedAndKeyPair();
+    const withSigner = input.includeSignerAsAdmin ?? true;
+    const projection = withSigner
+        ? [userProjectionMember(input.signerUserId, "admin")]
+        : [];
+    const memberEnvelopes = [];
+    if (withSigner) {
+        const creatorFingerprint = await toFingerprint(input.creatorEncapsulationKeyPair.publicKey);
+        const [creatorEnvelope] = await wrapDekForRecipients(groupKem.secretKey, [
+            input.creatorEncapsulationKeyPair.publicKey,
+        ]);
+        if (!creatorEnvelope) {
+            throw new Error("Failed to wrap group key for creator");
+        }
+        memberEnvelopes.push({
+            userId: input.signerUserId,
+            memberKeyFingerprint: creatorFingerprint,
+            kemCipherText: bytesToBase64(creatorEnvelope.kemCipherText),
+            wrappedKey: bytesToBase64(creatorEnvelope.wrappedKey),
+        });
+    }
+    const name = input.name.trim();
+    // A name is compared by canonical key but displayed raw, so an invisible
+    // code point would let one signed name render as another. Refuse them
+    // where the name is signed.
+    if (name.length === 0 || hasForbiddenGroupNameCharacter(name)) {
+        throw new Error("Group names must be non-empty and contain no control, format, or surrogate characters");
+    }
+    const payloadCiphertext = input.builtinRole
+        ? encodeBuiltinGroupMetadata(input.builtinRole)
+        : input.metadataKey
+            ? await encryptGroupMetadata({
+                key: input.metadataKey,
+                groupId: input.groupId,
+                name,
+            })
+            : (() => {
+                throw new Error("Group metadata encryption context is unavailable");
+            })();
+    const policyRequest = await signedGroupPolicyRequest({
+        encapsulationPublicKey: bytesToBase64(groupKem.publicKey),
+        externalAuthority: input.externalAuthority ?? null,
+        keyEpoch: 1,
+        keyFingerprint: await toFingerprint(groupKem.publicKey),
+        grants: input.grants ?? [],
+        memberEnvelopes,
+        payloadCiphertext,
+        principalId: input.groupId,
+        projection,
+        signedAt: new Date().toISOString(),
+        signerUserId: input.signerUserId,
+        signingFingerprint: input.signingFingerprint,
+        signingKeyPair: input.signingKeyPair,
+    });
+    return {
+        groupId: input.groupId,
+        initialGroupPolicy: policyRequest,
+    };
+}
+/**
+ * Members at bootstrap holds the registering user alone.
+ *
+ * It used to also contain the Admins group as a nested member, so that admins
+ * were implicitly members. Principals contain only users now, so an admin is an
+ * ordinary Members entry — and bootstrap has exactly one user, who is that
+ * admin.
+ */
+export async function buildInitialMemberGroupPolicyRequest(input) {
+    return buildInitialGroupPolicyRequest({
+        ...input,
+        name: "Members",
+        builtinRole: "members",
+    });
+}
+//# sourceMappingURL=principalPolicyRequest.js.map

package/workflows/organizations/principalPolicyRequest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalPolicyRequest.js","sourceRoot":"","sources":["principalPolicyRequest.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,EAE/B,0BAA0B,EAC1B,oBAAoB,EAEpB,yBAAyB,EACzB,iCAAiC,EACjC,mCAAmC,EAGnC,iBAAiB,EAEjB,kBAAkB,EAClB,aAAa,EACb,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAyBpD,MAAM,UAAU,oBAAoB,CAClC,MAAc,EACd,IAAwB;IAExB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,wBAAwB,CAC/B,UAA2D;IAE3D,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,8BAA8B,CAAC,IAAY;IAClD,OAAO,uDAAuD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,OAAO,CACL,IAAI;SACD,SAAS,CAAC,MAAM,CAAC;SACjB,OAAO,CAAC,kDAAkD,EAAE,EAAE,CAAC;SAC/D,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;SACrB,IAAI,EAAE;SACN,iBAAiB,CAAC,OAAO,CAAC;QAC3B,wEAAwE;QACxE,8DAA8D;SAC7D,SAAS,CAAC,MAAM,CAAC,CACrB,CAAC;AACJ,CAAC;AAMD,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAAqC,EACrC,iBAAyC;IAEzC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IACrE,IAAI,MAAM,IAAI,QAAQ;QACpB,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3D,IAAI,CAAC,iBAAiB;QACpB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC;AACnC,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAqC,EACrC,iBAAyB,EACzB,iBAAyC;IAEzC,IAAI,8BAA8B,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACtD,OAAO,sBAAsB,CAAC;IAChC,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,0BAA0B,CACjD,MAAM,EACN,iBAAiB,CAClB,CAAC;IACF,IAAI,8BAA8B,CAAC,UAAU,CAAC;QAAE,OAAO,sBAAsB,CAAC;IAC9E,OAAO,qBAAqB,CAAC,UAAU,CAAC;QACtC,qBAAqB,CAAC,iBAAiB,CAAC;QACxC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,eAAe,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAiB9C;IACC,MAAM,UAAU,GAAG,mCAAmC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,iCAAiC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/D,MAAM,iBAAiB,GAAG,KAAK,CAAC,iBAAiB,CAAC;IAClD,MAAM,KAAK,GAAG,MAAM,kBAAkB,CACpC,MAAM,+BAA+B,CAAC;QACpC,aAAa,EAAE,OAAO;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,aAAa;YAC1B,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,OAAO,GAAG,CAAC;YAC9C,CAAC,CAAC,CAAC;QACL,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,YAAY,CAAC,SAAS,IAAI,IAAI;QAClE,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO,EAAE,wBAAwB,CAAC,UAAU,CAAC;QAC7C,eAAe,EAAE,CAAC,GAAG,KAAK,CAAC,eAAe,CAAC;QAC3C,UAAU;QACV,MAAM;QACN,iBAAiB;QACjB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,wBAAwB,EAAE,KAAK,CAAC,kBAAkB;KACnD,CAAC,EACF,KAAK,CAAC,cAAc,CAAC,iBAAiB,CACvC,CAAC;IAEF,OAAO;QACL,KAAK;QACL,gBAAgB,EAAE;YAChB,WAAW,EAAE,aAAa;YAC1B,UAAU,EAAE,iBAAiB;YAC7B,cAAc,EAAE,KAAK,CAAC,qBAAqB;SAC5C;QACD,UAAU;QACV,MAAM;QACN,eAAe,EAAE,CAAC,GAAG,KAAK,CAAC,eAAe,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAAmC;IAEnC,MAAM,QAAQ,GAAG,yBAAyB,EAAE,CAAC;IAC7C,MAAM,UAAU,GAAG,KAAK,CAAC,oBAAoB,IAAI,IAAI,CAAC;IACtD,MAAM,UAAU,GAAG,UAAU;QAC3B,CAAC,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACrD,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,eAAe,GAAqC,EAAE,CAAC;IAE7D,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,kBAAkB,GAAG,MAAM,aAAa,CAC5C,KAAK,CAAC,2BAA2B,CAAC,SAAS,CAC5C,CAAC;QACF,MAAM,CAAC,eAAe,CAAC,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,SAAS,EAAE;YACvE,KAAK,CAAC,2BAA2B,CAAC,SAAS;SAC5C,CAAC,CAAC;QAEH,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QAED,eAAe,CAAC,IAAI,CAAC;YACnB,MAAM,EAAE,KAAK,CAAC,YAAY;YAC1B,oBAAoB,EAAE,kBAAkB;YACxC,aAAa,EAAE,aAAa,CAAC,eAAe,CAAC,aAAa,CAAC;YAC3D,UAAU,EAAE,aAAa,CAAC,eAAe,CAAC,UAAU,CAAC;SACtD,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC/B,yEAAyE;IACzE,sEAAsE;IACtE,4BAA4B;IAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,8BAA8B,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CACb,uFAAuF,CACxF,CAAC;IACJ,CAAC;IACD,MAAM,iBAAiB,GAAG,KAAK,CAAC,WAAW;QACzC,CAAC,CAAC,0BAA0B,CAAC,KAAK,CAAC,WAAW,CAAC;QAC/C,CAAC,CAAC,KAAK,CAAC,WAAW;YACjB,CAAC,CAAC,MAAM,oBAAoB,CAAC;gBACzB,GAAG,EAAE,KAAK,CAAC,WAAW;gBACtB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,IAAI;aACL,CAAC;YACJ,CAAC,CAAC,CAAC,GAAG,EAAE;gBACJ,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;YACtE,CAAC,CAAC,EAAE,CAAC;IACX,MAAM,aAAa,GAAG,MAAM,wBAAwB,CAAC;QACnD,sBAAsB,EAAE,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;QACzD,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,IAAI;QAClD,QAAQ,EAAE,CAAC;QACX,cAAc,EAAE,MAAM,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;QACvD,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,EAAE;QAC1B,eAAe;QACf,iBAAiB;QACjB,WAAW,EAAE,KAAK,CAAC,OAAO;QAC1B,UAAU;QACV,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,kBAAkB,EAAE,aAAa;KAClC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,KAO1D;IACC,OAAO,8BAA8B,CAAC;QACpC,GAAG,KAAK;QACR,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,SAAS;KACvB,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  buildPrincipalStateSigningInput,\n  type EncapsulationKeyPair,\n  encodeBuiltinGroupMetadata,\n  encryptGroupMetadata,\n  type GroupMetadataKey,\n  generateKemSeedAndKeyPair,\n  normalizePrincipalContainerGrants,\n  normalizePrincipalProjectionMembers,\n  type PrincipalContainerGrant,\n  type PrincipalPolicyExternalAuthority,\n  readGroupMetadata,\n  type SigningKeyPair,\n  signPrincipalState,\n  toFingerprint,\n  wrapDekForRecipients,\n} from \"@tearleads/crypto\";\nimport { bytesToBase64 } from \"@tearleads/encoding\";\nimport type {\n  CreateOrganizationGroupRequest,\n  PrincipalMemberEnvelopeRequest,\n  PrincipalProjectionMemberRequest,\n  PutPrincipalPolicyRequest,\n} from \"@tearleads/validators/request\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\n\ninterface BuildInitialGroupPolicyInput {\n  readonly creatorEncapsulationKeyPair: EncapsulationKeyPair;\n  readonly externalAuthority?:\n    | PrincipalPolicyExternalAuthority[\"currentHead\"]\n    | null;\n  readonly groupId: string;\n  readonly grants?: readonly PrincipalContainerGrant[] | undefined;\n  readonly includeSignerAsAdmin?: boolean;\n  readonly name: string;\n  readonly metadataKey?: GroupMetadataKey;\n  readonly builtinRole?: \"admins\" | \"members\";\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n}\n\nexport function userProjectionMember(\n  userId: string,\n  role: \"member\" | \"admin\",\n): PrincipalProjectionMemberRequest {\n  return { userId: userId, role };\n}\n\nfunction projectionToStateMembers(\n  projection: ReadonlyArray<PrincipalProjectionMemberRequest>,\n) {\n  return projection.map((member) => ({ userId: member.userId }));\n}\n\n/**\n * Code points that must never appear in a group name: control and format\n * characters (bidi overrides, zero-width joiners, newlines), lone surrogates\n * (re-encoded as U+FFFD when signed, so the signed name would no longer match\n * the one sent to the server), and every other default-ignorable code point\n * (Hangul fillers, variation selectors), which render as nothing and would\n * let one name pass for another. A group name is an identifier here, so this\n * deliberately refuses ZWJ emoji sequences as well. One predicate serves the\n * signing-time and the share-time refusal so the two cannot drift.\n */\nfunction hasForbiddenGroupNameCharacter(name: string): boolean {\n  return /[\\p{Cc}\\p{Cf}\\p{Cs}\\p{Default_Ignorable_Code_Point}]/u.test(name);\n}\n\n/**\n * The comparison key for a group display name: width- and compatibility-\n * normalized, stripped of control, format, and default-ignorable characters,\n * whitespace-collapsed, and case-folded. Two names that a user cannot tell\n * apart in a picker must compare equal, or a look-alike name would slip past\n * the share-time binding. Cross-script homoglyphs (Latin \"A\" against Greek\n * \"Α\") are not folded: that needs the UTS #39 confusables table, and both\n * names would still have to be signed groups the organization's own admins\n * created.\n */\nexport function canonicalGroupNameKey(name: string): string {\n  return (\n    name\n      .normalize(\"NFKC\")\n      .replace(/[\\p{Cc}\\p{Cf}\\p{Default_Ignorable_Code_Point}]/gu, \"\")\n      .replace(/\\s+/gu, \" \")\n      .trim()\n      .toLocaleLowerCase(\"en-US\")\n      // Case folding can leave the string un-normalized (U+0130 lowercases to\n      // \"i\" plus a combining dot), so normalize once more after it.\n      .normalize(\"NFKC\")\n  );\n}\n\nexport type GroupPolicyNameReader = (\n  bundle: PrincipalPolicyBundleResponse,\n) => Promise<string>;\n\n/** Read only after the policy and its organization-directory binding verify. */\nexport async function readGroupPolicyPayloadName(\n  bundle: PrincipalPolicyBundleResponse,\n  readEncryptedName?: GroupPolicyNameReader,\n): Promise<string> {\n  const metadata = readGroupMetadata(bundle.currentPayload.ciphertext);\n  if (\"role\" in metadata)\n    return metadata.role === \"admins\" ? \"Admins\" : \"Members\";\n  if (!readEncryptedName)\n    throw new Error(\"Group metadata decryption context is unavailable\");\n  return readEncryptedName(bundle);\n}\n\n/** One binding predicate for every operation selected by a read-model label. */\nexport async function groupPolicyNameMismatch(\n  bundle: PrincipalPolicyBundleResponse,\n  expectedGroupName: string,\n  readEncryptedName?: GroupPolicyNameReader,\n): Promise<\"forbidden_characters\" | \"name_mismatch\" | null> {\n  if (hasForbiddenGroupNameCharacter(expectedGroupName)) {\n    return \"forbidden_characters\";\n  }\n  const signedName = await readGroupPolicyPayloadName(\n    bundle,\n    readEncryptedName,\n  );\n  if (hasForbiddenGroupNameCharacter(signedName)) return \"forbidden_characters\";\n  return canonicalGroupNameKey(signedName) ===\n    canonicalGroupNameKey(expectedGroupName)\n    ? null\n    : \"name_mismatch\";\n}\n\nexport async function signedGroupPolicyRequest(input: {\n  readonly currentPolicy?: PrincipalPolicyBundleResponse;\n  readonly encapsulationPublicKey: string;\n  readonly externalAuthority:\n    | PrincipalPolicyExternalAuthority[\"currentHead\"]\n    | null;\n  readonly keyEpoch: number;\n  readonly keyFingerprint: string;\n  readonly grants: ReadonlyArray<PrincipalContainerGrant>;\n  readonly memberEnvelopes: ReadonlyArray<PrincipalMemberEnvelopeRequest>;\n  readonly payloadCiphertext: string;\n  readonly principalId: string;\n  readonly projection: ReadonlyArray<PrincipalProjectionMemberRequest>;\n  readonly signedAt: string;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n}): Promise<PutPrincipalPolicyRequest> {\n  const projection = normalizePrincipalProjectionMembers(input.projection);\n  const grants = normalizePrincipalContainerGrants(input.grants);\n  const payloadCiphertext = input.payloadCiphertext;\n  const state = await signPrincipalState(\n    await buildPrincipalStateSigningInput({\n      principalType: \"group\",\n      principalId: input.principalId,\n      version: input.currentPolicy\n        ? input.currentPolicy.currentState.version + 1\n        : 1,\n      prevStateHash: input.currentPolicy?.currentState.stateHash ?? null,\n      keyEpoch: input.keyEpoch,\n      encapsulationPublicKey: input.encapsulationPublicKey,\n      keyFingerprint: input.keyFingerprint,\n      members: projectionToStateMembers(projection),\n      memberEnvelopes: [...input.memberEnvelopes],\n      projection,\n      grants,\n      payloadCiphertext,\n      externalAuthority: input.externalAuthority,\n      signedAt: input.signedAt,\n      signerUserId: input.signerUserId,\n      signerUserKeyFingerprint: input.signingFingerprint,\n    }),\n    input.signingKeyPair.signingPrivateKey,\n  );\n\n  return {\n    state,\n    encryptedPayload: {\n      cipherSuite: \"aes-256-gcm\",\n      ciphertext: payloadCiphertext,\n      ciphertextHash: state.payloadCiphertextHash,\n    },\n    projection,\n    grants,\n    memberEnvelopes: [...input.memberEnvelopes],\n  };\n}\n\nexport async function buildInitialGroupPolicyRequest(\n  input: BuildInitialGroupPolicyInput,\n): Promise<CreateOrganizationGroupRequest> {\n  const groupKem = generateKemSeedAndKeyPair();\n  const withSigner = input.includeSignerAsAdmin ?? true;\n  const projection = withSigner\n    ? [userProjectionMember(input.signerUserId, \"admin\")]\n    : [];\n  const memberEnvelopes: PrincipalMemberEnvelopeRequest[] = [];\n\n  if (withSigner) {\n    const creatorFingerprint = await toFingerprint(\n      input.creatorEncapsulationKeyPair.publicKey,\n    );\n    const [creatorEnvelope] = await wrapDekForRecipients(groupKem.secretKey, [\n      input.creatorEncapsulationKeyPair.publicKey,\n    ]);\n\n    if (!creatorEnvelope) {\n      throw new Error(\"Failed to wrap group key for creator\");\n    }\n\n    memberEnvelopes.push({\n      userId: input.signerUserId,\n      memberKeyFingerprint: creatorFingerprint,\n      kemCipherText: bytesToBase64(creatorEnvelope.kemCipherText),\n      wrappedKey: bytesToBase64(creatorEnvelope.wrappedKey),\n    });\n  }\n  const name = input.name.trim();\n  // A name is compared by canonical key but displayed raw, so an invisible\n  // code point would let one signed name render as another. Refuse them\n  // where the name is signed.\n  if (name.length === 0 || hasForbiddenGroupNameCharacter(name)) {\n    throw new Error(\n      \"Group names must be non-empty and contain no control, format, or surrogate characters\",\n    );\n  }\n  const payloadCiphertext = input.builtinRole\n    ? encodeBuiltinGroupMetadata(input.builtinRole)\n    : input.metadataKey\n      ? await encryptGroupMetadata({\n          key: input.metadataKey,\n          groupId: input.groupId,\n          name,\n        })\n      : (() => {\n          throw new Error(\"Group metadata encryption context is unavailable\");\n        })();\n  const policyRequest = await signedGroupPolicyRequest({\n    encapsulationPublicKey: bytesToBase64(groupKem.publicKey),\n    externalAuthority: input.externalAuthority ?? null,\n    keyEpoch: 1,\n    keyFingerprint: await toFingerprint(groupKem.publicKey),\n    grants: input.grants ?? [],\n    memberEnvelopes,\n    payloadCiphertext,\n    principalId: input.groupId,\n    projection,\n    signedAt: new Date().toISOString(),\n    signerUserId: input.signerUserId,\n    signingFingerprint: input.signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  });\n\n  return {\n    groupId: input.groupId,\n    initialGroupPolicy: policyRequest,\n  };\n}\n\n/**\n * Members at bootstrap holds the registering user alone.\n *\n * It used to also contain the Admins group as a nested member, so that admins\n * were implicitly members. Principals contain only users now, so an admin is an\n * ordinary Members entry — and bootstrap has exactly one user, who is that\n * admin.\n */\nexport async function buildInitialMemberGroupPolicyRequest(input: {\n  readonly creatorEncapsulationKeyPair: EncapsulationKeyPair;\n  readonly groupId: string;\n  readonly grants?: readonly PrincipalContainerGrant[] | undefined;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n}): Promise<CreateOrganizationGroupRequest> {\n  return buildInitialGroupPolicyRequest({\n    ...input,\n    name: \"Members\",\n    builtinRole: \"members\",\n  });\n}\n"]}