@tearleads/client-sdk 0.1.105 → 0.1.107

package/workflows/organizations/memberships/leaveRequestVerification.js

@@ -1,27 +1,34 @@
 import { isValidOrganizationLeaveRequest } from "../../../internal/crypto/index.js";
 /**
  * The user as shown, with its leave request kept only when the member signed
- * it. Every directory user a client presents passes through here, whether a
- * read model or a mutation response carried it.
+ * it during their current membership. Every directory user a client presents
+ * passes through here, whether a read model or a mutation response carried
+ * it.
  */
-export async function withVerifiedDirectoryUser(organizationId, user, resolveTrustedUserIdentity) {
+export async function withVerifiedDirectoryUser(organizationId, user, verifier) {
     const request = user.leaveRequest;
     if (!request)
         return user;
     // The member's pinned identity, never the key the directory served beside
     // the request: a server that could swap both could forge any member's ask.
-    const identity = await resolveTrustedUserIdentity(user.userId).catch(() => null);
-    const verified = identity !== null &&
+    const identity = await verifier
+        .resolveTrustedUserIdentity(user.userId)
+        .catch(() => null);
+    const signed = identity !== null &&
         request.organizationId === organizationId &&
         request.userId === user.userId &&
         isValidOrganizationLeaveRequest(request, identity.signingPublicKey);
+    // A genuine request from a membership that has since ended would otherwise
+    // look current to an administrator once the member rejoined.
+    const verified = signed && (await verifier.membershipIsCurrent(request));
     return verified ? user : { ...user, leaveRequest: null };
 }
 /**
- * Keeps only leave requests their member signed, checked against the member's
- * trusted identity; any other is shown as no request at all.
+ * Keeps only leave requests their member signed during their current
+ * membership, checked against the member's trusted identity and this device's
+ * verified Members history; any other is shown as no request at all.
  */
-export async function withVerifiedLeaveRequests(result, resolveTrustedUserIdentity) {
+export async function withVerifiedLeaveRequests(result, verifier) {
     if (!result?.directory.users.some((user) => user.leaveRequest)) {
         return result;
     }
@@ -30,17 +37,17 @@ export async function withVerifiedLeaveRequests(result, resolveTrustedUserIdenti
         ...result,
         directory: {
             ...result.directory,
-            users: await Promise.all(result.directory.users.map((user) => withVerifiedDirectoryUser(organizationId, user, resolveTrustedUserIdentity))),
+            users: await Promise.all(result.directory.users.map((user) => withVerifiedDirectoryUser(organizationId, user, verifier))),
         },
     };
 }
 /** The user detail counterpart of withVerifiedLeaveRequests. */
-export async function withVerifiedUserLeaveRequest(detail, organizationId, resolveTrustedUserIdentity) {
+export async function withVerifiedUserLeaveRequest(detail, organizationId, verifier) {
     if (!detail?.user.leaveRequest)
         return detail;
     return {
         ...detail,
-        user: await withVerifiedDirectoryUser(organizationId, detail.user, resolveTrustedUserIdentity),
+        user: await withVerifiedDirectoryUser(organizationId, detail.user, verifier),
     };
 }
 //# sourceMappingURL=leaveRequestVerification.js.map

package/workflows/organizations/memberships/leaveRequestVerification.js.map

@@ -1 +1 @@
-{"version":3,"file":"leaveRequestVerification.js","sourceRoot":"","sources":["leaveRequestVerification.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,mBAAmB,CAAC;AAQpE;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,cAAsB,EACtB,IAA+B,EAC/B,0BAAuD;IAEvD,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC;IAClC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAClE,GAAG,EAAE,CAAC,IAAI,CACX,CAAC;IACF,MAAM,QAAQ,GACZ,QAAQ,KAAK,IAAI;QACjB,OAAO,CAAC,cAAc,KAAK,cAAc;QACzC,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAC9B,+BAA+B,CAAC,OAAO,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IACtE,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAG7C,MAAc,EACd,0BAAuD;IAEvD,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/D,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC;IAC5C,OAAO;QACL,GAAG,MAAM;QACT,SAAS,EAAE;YACT,GAAG,MAAM,CAAC,SAAS;YACnB,KAAK,EAAE,MAAM,OAAO,CAAC,GAAG,CACtB,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAClC,yBAAyB,CACvB,cAAc,EACd,IAAI,EACJ,0BAA0B,CAC3B,CACF,CACF;SACF;KACF,CAAC;AACJ,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,MAAqC,EACrC,cAAsB,EACtB,0BAAuD;IAEvD,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY;QAAE,OAAO,MAAM,CAAC;IAC9C,OAAO;QACL,GAAG,MAAM;QACT,IAAI,EAAE,MAAM,yBAAyB,CACnC,cAAc,EACd,MAAM,CAAC,IAAI,EACX,0BAA0B,CAC3B;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { isValidOrganizationLeaveRequest } from \"@tearleads/crypto\";\nimport type { TrustedUserIdentityResolver } from \"../../../data/trustedUserIdentity\";\nimport type {\n  OrganizationDirectoryAndGroups,\n  OrganizationDirectoryUser,\n  OrganizationUserDetail,\n} from \"../readModel\";\n\n/**\n * The user as shown, with its leave request kept only when the member signed\n * it. Every directory user a client presents passes through here, whether a\n * read model or a mutation response carried it.\n */\nexport async function withVerifiedDirectoryUser(\n  organizationId: string,\n  user: OrganizationDirectoryUser,\n  resolveTrustedUserIdentity: TrustedUserIdentityResolver,\n): Promise<OrganizationDirectoryUser> {\n  const request = user.leaveRequest;\n  if (!request) return user;\n  // The member's pinned identity, never the key the directory served beside\n  // the request: a server that could swap both could forge any member's ask.\n  const identity = await resolveTrustedUserIdentity(user.userId).catch(\n    () => null,\n  );\n  const verified =\n    identity !== null &&\n    request.organizationId === organizationId &&\n    request.userId === user.userId &&\n    isValidOrganizationLeaveRequest(request, identity.signingPublicKey);\n  return verified ? user : { ...user, leaveRequest: null };\n}\n\n/**\n * Keeps only leave requests their member signed, checked against the member's\n * trusted identity; any other is shown as no request at all.\n */\nexport async function withVerifiedLeaveRequests<\n  Result extends OrganizationDirectoryAndGroups | null | undefined,\n>(\n  result: Result,\n  resolveTrustedUserIdentity: TrustedUserIdentityResolver,\n): Promise<Result> {\n  if (!result?.directory.users.some((user) => user.leaveRequest)) {\n    return result;\n  }\n  const { organizationId } = result.directory;\n  return {\n    ...result,\n    directory: {\n      ...result.directory,\n      users: await Promise.all(\n        result.directory.users.map((user) =>\n          withVerifiedDirectoryUser(\n            organizationId,\n            user,\n            resolveTrustedUserIdentity,\n          ),\n        ),\n      ),\n    },\n  };\n}\n\n/** The user detail counterpart of withVerifiedLeaveRequests. */\nexport async function withVerifiedUserLeaveRequest(\n  detail: OrganizationUserDetail | null,\n  organizationId: string,\n  resolveTrustedUserIdentity: TrustedUserIdentityResolver,\n): Promise<OrganizationUserDetail | null> {\n  if (!detail?.user.leaveRequest) return detail;\n  return {\n    ...detail,\n    user: await withVerifiedDirectoryUser(\n      organizationId,\n      detail.user,\n      resolveTrustedUserIdentity,\n    ),\n  };\n}\n"]}
+{"version":3,"file":"leaveRequestVerification.js","sourceRoot":"","sources":["leaveRequestVerification.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,mBAAmB,CAAC;AAepE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,cAAsB,EACtB,IAA+B,EAC/B,QAA8B;IAE9B,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC;IAClC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,QAAQ,GAAG,MAAM,QAAQ;SAC5B,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC;SACvC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACrB,MAAM,MAAM,GACV,QAAQ,KAAK,IAAI;QACjB,OAAO,CAAC,cAAc,KAAK,cAAc;QACzC,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAC9B,+BAA+B,CAAC,OAAO,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IACtE,2EAA2E;IAC3E,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,QAAQ,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC;IACzE,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAE7C,MAAc,EAAE,QAA8B;IAC9C,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/D,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC;IAC5C,OAAO;QACL,GAAG,MAAM;QACT,SAAS,EAAE;YACT,GAAG,MAAM,CAAC,SAAS;YACnB,KAAK,EAAE,MAAM,OAAO,CAAC,GAAG,CACtB,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAClC,yBAAyB,CAAC,cAAc,EAAE,IAAI,EAAE,QAAQ,CAAC,CAC1D,CACF;SACF;KACF,CAAC;AACJ,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,MAAqC,EACrC,cAAsB,EACtB,QAA8B;IAE9B,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY;QAAE,OAAO,MAAM,CAAC;IAC9C,OAAO;QACL,GAAG,MAAM;QACT,IAAI,EAAE,MAAM,yBAAyB,CACnC,cAAc,EACd,MAAM,CAAC,IAAI,EACX,QAAQ,CACT;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { isValidOrganizationLeaveRequest } from \"@tearleads/crypto\";\nimport type { TrustedUserIdentityResolver } from \"../../../data/trustedUserIdentity\";\nimport type {\n  OrganizationDirectoryAndGroups,\n  OrganizationDirectoryUser,\n  OrganizationUserDetail,\n} from \"../readModel\";\nimport type { LeaveRequestMembershipCheck } from \"./leaveRequestMembership\";\n\n/** What a shown leave request is checked against. */\nexport interface LeaveRequestVerifier {\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly membershipIsCurrent: LeaveRequestMembershipCheck;\n}\n\n/**\n * The user as shown, with its leave request kept only when the member signed\n * it during their current membership. Every directory user a client presents\n * passes through here, whether a read model or a mutation response carried\n * it.\n */\nexport async function withVerifiedDirectoryUser(\n  organizationId: string,\n  user: OrganizationDirectoryUser,\n  verifier: LeaveRequestVerifier,\n): Promise<OrganizationDirectoryUser> {\n  const request = user.leaveRequest;\n  if (!request) return user;\n  // The member's pinned identity, never the key the directory served beside\n  // the request: a server that could swap both could forge any member's ask.\n  const identity = await verifier\n    .resolveTrustedUserIdentity(user.userId)\n    .catch(() => null);\n  const signed =\n    identity !== null &&\n    request.organizationId === organizationId &&\n    request.userId === user.userId &&\n    isValidOrganizationLeaveRequest(request, identity.signingPublicKey);\n  // A genuine request from a membership that has since ended would otherwise\n  // look current to an administrator once the member rejoined.\n  const verified = signed && (await verifier.membershipIsCurrent(request));\n  return verified ? user : { ...user, leaveRequest: null };\n}\n\n/**\n * Keeps only leave requests their member signed during their current\n * membership, checked against the member's trusted identity and this device's\n * verified Members history; any other is shown as no request at all.\n */\nexport async function withVerifiedLeaveRequests<\n  Result extends OrganizationDirectoryAndGroups | null | undefined,\n>(result: Result, verifier: LeaveRequestVerifier): Promise<Result> {\n  if (!result?.directory.users.some((user) => user.leaveRequest)) {\n    return result;\n  }\n  const { organizationId } = result.directory;\n  return {\n    ...result,\n    directory: {\n      ...result.directory,\n      users: await Promise.all(\n        result.directory.users.map((user) =>\n          withVerifiedDirectoryUser(organizationId, user, verifier),\n        ),\n      ),\n    },\n  };\n}\n\n/** The user detail counterpart of withVerifiedLeaveRequests. */\nexport async function withVerifiedUserLeaveRequest(\n  detail: OrganizationUserDetail | null,\n  organizationId: string,\n  verifier: LeaveRequestVerifier,\n): Promise<OrganizationUserDetail | null> {\n  if (!detail?.user.leaveRequest) return detail;\n  return {\n    ...detail,\n    user: await withVerifiedDirectoryUser(\n      organizationId,\n      detail.user,\n      verifier,\n    ),\n  };\n}\n"]}