npm - @tearleads/client-sdk - Versions diffs - 0.1.15 → 0.1.17 - Mend

@tearleads/client-sdk 0.1.15 → 0.1.17

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (244) hide show

package/workflows/organizations/groupPolicyMutationEvidence.js ADDED Viewed

@@ -0,0 +1,64 @@
+import { verifyPrincipalPolicyCheckpoint, verifyPrincipalPolicyCurrentMutation, } from "../../internal/crypto/index.js";
+import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
+import { assertCurrentMatchesVerifiedPolicy } from "../../data/persistence/verifiedPrincipalPolicyCurrent.js";
+import { requireSignerCanManageGroup } from "./groupMutationAuthorization.js";
+import { verifyGroupPolicy } from "./groupPolicyVerification.js";
+/** Current artifacts require their verified evidence; omitted history is never a bundle. */
+export async function withVerifiedGroupMutation(input, work) {
+    input = {
+        ...input,
+        currentPolicy: structuredClone(input.currentPolicy),
+        ...("currentPolicySignerPublicKeys" in input
+            ? {
+                currentPolicySignerPublicKeys: structuredClone(input.currentPolicySignerPublicKeys),
+            }
+            : {}),
+        currentOrgAdminUserIds: structuredClone(input.currentOrgAdminUserIds),
+        externalAuthority: structuredClone(input.externalAuthority),
+        localPolicyCheckpoint: structuredClone(input.localPolicyCheckpoint),
+        signingKeyPair: structuredClone(input.signingKeyPair),
+    };
+    try {
+        const current = () => !("verifiedCurrentPolicy" in input) || input.stillCurrent();
+        assertProjectionVerificationCurrent(current);
+        if ("verifiedCurrentPolicy" in input) {
+            await assertCurrentMatchesVerifiedPolicy({
+                current: input.currentPolicy,
+                policy: input.verifiedCurrentPolicy,
+            });
+            requireSignerCanManageGroup(input.currentPolicy, input.currentOrgAdminUserIds ?? [], input.signerUserId);
+            const verified = await verifyPrincipalPolicyCurrentMutation({
+                current: input.currentPolicy,
+                policy: input.verifiedCurrentPolicy,
+                signerUserId: input.signerUserId,
+                externalAuthority: input.externalAuthority,
+            });
+            if (!verified.ok)
+                throw verified.error;
+            verifyPrincipalPolicyCheckpoint({
+                chain: verified.value.retainedHistory,
+                currentState: verified.value.state,
+                localCheckpoint: input.localPolicyCheckpoint,
+            });
+        }
+        else {
+            await verifyGroupPolicy({
+                currentPolicy: input.currentPolicy,
+                ...(input.externalAuthority
+                    ? { externalAuthority: input.externalAuthority }
+                    : {}),
+                localPolicyCheckpoint: input.localPolicyCheckpoint ?? null,
+                signerPublicKeys: input.currentPolicySignerPublicKeys,
+            });
+        }
+        assertProjectionVerificationCurrent(current);
+        requireSignerCanManageGroup(input.currentPolicy, input.currentOrgAdminUserIds ?? [], input.signerUserId);
+        const result = await work(input);
+        assertProjectionVerificationCurrent(current);
+        return result;
+    }
+    finally {
+        input.signingKeyPair.signingPrivateKey.fill(0);
+    }
+}
+//# sourceMappingURL=groupPolicyMutationEvidence.js.map

package/workflows/organizations/groupPolicyMutationEvidence.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"groupPolicyMutationEvidence.js","sourceRoot":"","sources":["groupPolicyMutationEvidence.ts"],"names":[],"mappings":"AACA,OAAO,EAML,+BAA+B,EAC/B,oCAAoC,GACrC,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,kCAAkC,EAAE,MAAM,uDAAuD,CAAC;AAC3G,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AA6B9D,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAG7C,KAAQ,EACR,IAAsD;IAEtD,KAAK,GAAG;QACN,GAAG,KAAK;QACR,aAAa,EAAE,eAAe,CAAC,KAAK,CAAC,aAAa,CAAC;QACnD,GAAG,CAAC,+BAA+B,IAAI,KAAK;YAC1C,CAAC,CAAC;gBACE,6BAA6B,EAAE,eAAe,CAC5C,KAAK,CAAC,6BAA6B,CACpC;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,sBAAsB,EAAE,eAAe,CAAC,KAAK,CAAC,sBAAsB,CAAC;QACrE,iBAAiB,EAAE,eAAe,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAC3D,qBAAqB,EAAE,eAAe,CAAC,KAAK,CAAC,qBAAqB,CAAC;QACnE,cAAc,EAAE,eAAe,CAAC,KAAK,CAAC,cAAc,CAAC;KACtD,CAAC;IACF,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,CAAC,CAAC,uBAAuB,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QAC9D,mCAAmC,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,uBAAuB,IAAI,KAAK,EAAE,CAAC;YACrC,MAAM,kCAAkC,CAAC;gBACvC,OAAO,EAAE,KAAK,CAAC,aAAa;gBAC5B,MAAM,EAAE,KAAK,CAAC,qBAAqB;aACpC,CAAC,CAAC;YACH,2BAA2B,CACzB,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,sBAAsB,IAAI,EAAE,EAClC,KAAK,CAAC,YAAY,CACnB,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,oCAAoC,CAAC;gBAC1D,OAAO,EAAE,KAAK,CAAC,aAAa;gBAC5B,MAAM,EAAE,KAAK,CAAC,qBAAqB;gBACnC,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;aAC3C,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;YACvC,+BAA+B,CAAC;gBAC9B,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,eAAe;gBACrC,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK;gBAClC,eAAe,EAAE,KAAK,CAAC,qBAAqB;aAC7C,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,iBAAiB,CAAC;gBACtB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,GAAG,CAAC,KAAK,CAAC,iBAAiB;oBACzB,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE;oBAChD,CAAC,CAAC,EAAE,CAAC;gBACP,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,IAAI,IAAI;gBAC1D,gBAAgB,EAAE,KAAK,CAAC,6BAA6B;aACtD,CAAC,CAAC;QACL,CAAC;QACD,mCAAmC,CAAC,OAAO,CAAC,CAAC;QAC7C,2BAA2B,CACzB,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,sBAAsB,IAAI,EAAE,EAClC,KAAK,CAAC,YAAY,CACnB,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,mCAAmC,CAAC,OAAO,CAAC,CAAC;QAC7C,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,cAAc,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC;AACH,CAAC","sourcesContent":["import type { PrincipalPolicyPageCurrent } from \"@tearleads/api-client\";\nimport {\n type PrincipalPolicyCheckpoint,\n type PrincipalPolicyExternalAuthority,\n type PrincipalPolicySignerPublicKey,\n type SigningKeyPair,\n type VerifiedPrincipalPolicyCurrent,\n verifyPrincipalPolicyCheckpoint,\n verifyPrincipalPolicyCurrentMutation,\n} from \"@tearleads/crypto\";\nimport type { PutPrincipalPolicyRequest } from \"@tearleads/validators/request\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { assertCurrentMatchesVerifiedPolicy } from \"../../data/persistence/verifiedPrincipalPolicyCurrent\";\nimport { requireSignerCanManageGroup } from \"./groupMutationAuthorization\";\nimport { verifyGroupPolicy } from \"./groupPolicyVerification\";\n\ninterface GroupMembershipSigningInput {\n readonly currentOrgAdminUserIds?: readonly string[] | undefined;\n readonly externalAuthority?: PrincipalPolicyExternalAuthority | undefined;\n readonly isOrganizationAdminsGroup?: boolean | undefined;\n readonly localPolicyCheckpoint?: PrincipalPolicyCheckpoint | null;\n readonly signerUserId: string;\n readonly signingFingerprint: string;\n readonly signingKeyPair: SigningKeyPair;\n}\n\nexport interface FullGroupMembershipMutationInput\n extends GroupMembershipSigningInput {\n readonly currentPolicy: PrincipalPolicyBundleResponse;\n readonly currentPolicySignerPublicKeys: readonly PrincipalPolicySignerPublicKey[];\n}\n\ninterface CurrentGroupMembershipMutationInput\n extends GroupMembershipSigningInput {\n readonly currentPolicy: PrincipalPolicyPageCurrent;\n readonly verifiedCurrentPolicy: VerifiedPrincipalPolicyCurrent;\n readonly stillCurrent: () => boolean;\n}\n\nexport type BuildGroupMembershipMutationInput =\n | FullGroupMembershipMutationInput\n | CurrentGroupMembershipMutationInput;\n\n/** Current artifacts require their verified evidence; omitted history is never a bundle. */\nexport async function withVerifiedGroupMutation<\n T extends BuildGroupMembershipMutationInput,\n>(\n input: T,\n work: (owned: T) => Promise<PutPrincipalPolicyRequest>,\n): Promise<PutPrincipalPolicyRequest> {\n input = {\n ...input,\n currentPolicy: structuredClone(input.currentPolicy),\n ...(\"currentPolicySignerPublicKeys\" in input\n ? {\n currentPolicySignerPublicKeys: structuredClone(\n input.currentPolicySignerPublicKeys,\n ),\n }\n : {}),\n currentOrgAdminUserIds: structuredClone(input.currentOrgAdminUserIds),\n externalAuthority: structuredClone(input.externalAuthority),\n localPolicyCheckpoint: structuredClone(input.localPolicyCheckpoint),\n signingKeyPair: structuredClone(input.signingKeyPair),\n };\n try {\n const current = () =>\n !(\"verifiedCurrentPolicy\" in input) || input.stillCurrent();\n assertProjectionVerificationCurrent(current);\n if (\"verifiedCurrentPolicy\" in input) {\n await assertCurrentMatchesVerifiedPolicy({\n current: input.currentPolicy,\n policy: input.verifiedCurrentPolicy,\n });\n requireSignerCanManageGroup(\n input.currentPolicy,\n input.currentOrgAdminUserIds ?? [],\n input.signerUserId,\n );\n const verified = await verifyPrincipalPolicyCurrentMutation({\n current: input.currentPolicy,\n policy: input.verifiedCurrentPolicy,\n signerUserId: input.signerUserId,\n externalAuthority: input.externalAuthority,\n });\n if (!verified.ok) throw verified.error;\n verifyPrincipalPolicyCheckpoint({\n chain: verified.value.retainedHistory,\n currentState: verified.value.state,\n localCheckpoint: input.localPolicyCheckpoint,\n });\n } else {\n await verifyGroupPolicy({\n currentPolicy: input.currentPolicy,\n ...(input.externalAuthority\n ? { externalAuthority: input.externalAuthority }\n : {}),\n localPolicyCheckpoint: input.localPolicyCheckpoint ?? null,\n signerPublicKeys: input.currentPolicySignerPublicKeys,\n });\n }\n assertProjectionVerificationCurrent(current);\n requireSignerCanManageGroup(\n input.currentPolicy,\n input.currentOrgAdminUserIds ?? [],\n input.signerUserId,\n );\n const result = await work(input);\n assertProjectionVerificationCurrent(current);\n return result;\n } finally {\n input.signingKeyPair.signingPrivateKey.fill(0);\n }\n}\n"]}

package/workflows/organizations/groupPolicyMutationHead.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"groupPolicyMutationHead.js","sourceRoot":"","sources":["groupPolicyMutationHead.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,GAE1B,MAAM,mBAAmB,CAAC;~~AAI3B~~,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAkC;IAElC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,OAAO;QACL,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,MAAM,yBAAyB,CAAC,KAAK,CAAC;QACjD,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;AACJ,CAAC;AAED,SAAS,sCAAsC,CAC7C,~~KAAoD~~,~~EACpD~~,IAA6B;IAE7B,OAAO,CACL,KAAK,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa;QAC1C,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW;QACtC,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO;QAC9B,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;QAChC,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS;QAClC,KAAK,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc,CAC7C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,4CAA4C,CAC1D,~~KAAoD~~,~~EACpD~~,IAA6B;IAE7B,IAAI,CAAC,sCAAsC,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;AACH,CAAC","sourcesContent":["import {\n computePrincipalStateHash,\n type ReferencedPrincipalHead,\n} from \"@tearleads/crypto\";\nimport type { PutPrincipalPolicyRequest } from \"@tearleads/validators/request\";\~~nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\~~n\nexport async function groupPolicyMutationHead(\n request: PutPrincipalPolicyRequest,\n): Promise<ReferencedPrincipalHead> {\n const state = request.state;\n return {\n principalType: state.principalType,\n principalId: state.principalId,\n version: state.version,\n keyEpoch: state.keyEpoch,\n stateHash: await computePrincipalStateHash(state),\n keyFingerprint: state.keyFingerprint,\n };\n}\n\nfunction principalPolicyCurrentStateMatchesHead(\n state: ~~PrincipalPolicyBundleResponse[\"currentState\"]~~,\n head: ReferencedPrincipalHead,\n): boolean {\n return (\n state.principalType === head.principalType &&\n state.principalId === head.principalId &&\n state.version === head.version &&\n state.keyEpoch === head.keyEpoch &&\n state.stateHash === head.stateHash &&\n state.keyFingerprint === head.keyFingerprint\n );\n}\n\nexport function assertPrincipalPolicyCurrentStateMatchesHead(\n state: ~~PrincipalPolicyBundleResponse[\"currentState\"]~~,\n head: ReferencedPrincipalHead,\n): void {\n if (!principalPolicyCurrentStateMatchesHead(state, head)) {\n throw new Error(\"Updated group policy advanced during root re-wrap\");\n }\n}\n"]}
1	+ {"version":3,"file":"groupPolicyMutationHead.js","sourceRoot":"","sources":["groupPolicyMutationHead.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,GAE1B,MAAM,mBAAmB,CAAC;AAG3B,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAkC;IAElC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,OAAO;QACL,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,MAAM,yBAAyB,CAAC,KAAK,CAAC;QACjD,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;AACJ,CAAC;AAED,SAAS,sCAAsC,CAC7C,KAA8B,EAC9B,IAA6B;IAE7B,OAAO,CACL,KAAK,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa;QAC1C,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW;QACtC,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO;QAC9B,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;QAChC,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS;QAClC,KAAK,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc,CAC7C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,4CAA4C,CAC1D,KAA8B,EAC9B,IAA6B;IAE7B,IAAI,CAAC,sCAAsC,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;AACH,CAAC","sourcesContent":["import {\n computePrincipalStateHash,\n type ReferencedPrincipalHead,\n} from \"@tearleads/crypto\";\nimport type { PutPrincipalPolicyRequest } from \"@tearleads/validators/request\";\n\nexport async function groupPolicyMutationHead(\n request: PutPrincipalPolicyRequest,\n): Promise<ReferencedPrincipalHead> {\n const state = request.state;\n return {\n principalType: state.principalType,\n principalId: state.principalId,\n version: state.version,\n keyEpoch: state.keyEpoch,\n stateHash: await computePrincipalStateHash(state),\n keyFingerprint: state.keyFingerprint,\n };\n}\n\nfunction principalPolicyCurrentStateMatchesHead(\n state: ReferencedPrincipalHead,\n head: ReferencedPrincipalHead,\n): boolean {\n return (\n state.principalType === head.principalType &&\n state.principalId === head.principalId &&\n state.version === head.version &&\n state.keyEpoch === head.keyEpoch &&\n state.stateHash === head.stateHash &&\n state.keyFingerprint === head.keyFingerprint\n );\n}\n\nexport function assertPrincipalPolicyCurrentStateMatchesHead(\n state: ReferencedPrincipalHead,\n head: ReferencedPrincipalHead,\n): void {\n if (!principalPolicyCurrentStateMatchesHead(state, head)) {\n throw new Error(\"Updated group policy advanced during root re-wrap\");\n }\n}\n"]}

package/workflows/organizations/groupPolicyRequests.js CHANGED Viewed

@@ -1,8 +1,8 @@
 import { generateKemSeedAndKeyPair, KeyingVerificationError, toFingerprint, unwrapDek, wrapDekForRecipients, } from "../../internal/crypto/index.js";
 import { bytesToBase64 } from "../../internal/encoding/index.js";
 import { principalSecretKeyMatchesState } from "../../data/principals/principalKeyValidation.js";
-import { isDirectGroupAdmin, requireSignerCanManageGroup, } from "./groupMutationAuthorization.js";
-import { verifyGroupPolicy } from "./groupPolicyVerification.js";
+import { isDirectGroupAdmin } from "./groupMutationAuthorization.js";
+import { withVerifiedGroupMutation, } from "./groupPolicyMutationEvidence.js";
 import { rewrapProjectionMemberEnvelopes, toRecipientEntries, } from "./principalPolicyRecipients.js";
 import { signedGroupPolicyRequest, userProjectionMember, } from "./principalPolicyRequest.js";
 /**
@@ -33,17 +33,6 @@ function requireExternalAuthority(authority) {
     }
     return authority;
 }
-async function verifyAndAuthorizeGroupMutation(input) {
-    await verifyGroupPolicy({
-        currentPolicy: input.currentPolicy,
-        ...(input.externalAuthority
-            ? { externalAuthority: input.externalAuthority }
-            : {}),
-        localPolicyCheckpoint: input.localPolicyCheckpoint ?? null,
-        signerPublicKeys: input.currentPolicySignerPublicKeys,
-    });
-    requireSignerCanManageGroup(input.currentPolicy, input.currentOrgAdminUserIds ?? [], input.signerUserId);
-}
 async function buildRotatedKeyGroupPolicyRequest(input, projection, users, grants = input.currentPolicy.currentGrants) {
     const groupKem = generateKemSeedAndKeyPair();
     const memberEnvelopes = await rewrapProjectionMemberEnvelopes({
@@ -112,64 +101,81 @@ async function buildDirectAdminAddGroupUserPolicyRequest(input, projection, targ
     });
 }
 export async function buildAddGroupUserPolicyRequest(input) {
-    await verifyAndAuthorizeGroupMutation(input);
-    const targetKey = input.targetUser.userId;
-    const currentProjection = input.currentPolicy.currentProjection;
-    if (currentProjection.some((member) => member.userId === targetKey)) {
-        throw new Error("User is already a group member");
+    input = {
+        ...input,
+        currentUsers: structuredClone(input.currentUsers),
+        currentUserSecretKey: input.currentUserSecretKey.slice(),
+        targetUser: structuredClone(input.targetUser),
+    };
+    try {
+        return await withVerifiedGroupMutation(input, async (input) => {
+            const targetKey = input.targetUser.userId;
+            const currentProjection = input.currentPolicy.currentProjection;
+            if (currentProjection.some((member) => member.userId === targetKey)) {
+                throw new Error("User is already a group member");
+            }
+            const projection = [
+                ...currentProjection,
+                userProjectionMember(input.targetUser.userId, input.isOrganizationAdminsGroup ? "admin" : "member"),
+            ];
+            return isDirectGroupAdmin(input.currentPolicy, input.signerUserId)
+                ? buildDirectAdminAddGroupUserPolicyRequest(input, projection, targetKey)
+                : buildRotatedKeyGroupPolicyRequest(input, projection, [
+                    ...input.currentUsers,
+                    input.targetUser,
+                ]);
+        });
+    }
+    finally {
+        input.currentUserSecretKey.fill(0);
     }
-    const projection = [
-        ...currentProjection,
-        userProjectionMember(input.targetUser.userId, input.isOrganizationAdminsGroup ? "admin" : "member"),
-    ];
-    return isDirectGroupAdmin(input.currentPolicy, input.signerUserId)
-        ? buildDirectAdminAddGroupUserPolicyRequest(input, projection, targetKey)
-        : buildRotatedKeyGroupPolicyRequest(input, projection, [
-            ...input.currentUsers,
-            input.targetUser,
-        ]);
 }
 export async function buildRemoveGroupUserPolicyRequest(input) {
-    await verifyAndAuthorizeGroupMutation(input);
-    const key = input.removedUserId;
-    const projection = input.currentPolicy.currentProjection.filter((member) => member.userId !== key);
-    if (projection.length === input.currentPolicy.currentProjection.length) {
-        throw new Error("User is not a group member");
-    }
-    if (hasAdmin(input.currentPolicy.currentProjection) &&
-        !hasAdmin(projection)) {
-        throw new Error("Cannot remove the last group admin");
-    }
-    return buildRotatedKeyGroupPolicyRequest(input, projection, input.remainingUsers);
+    input = { ...input, remainingUsers: structuredClone(input.remainingUsers) };
+    return withVerifiedGroupMutation(input, async (input) => {
+        const key = input.removedUserId;
+        const projection = input.currentPolicy.currentProjection.filter((member) => member.userId !== key);
+        if (projection.length === input.currentPolicy.currentProjection.length) {
+            throw new Error("User is not a group member");
+        }
+        if (hasAdmin(input.currentPolicy.currentProjection) &&
+            !hasAdmin(projection)) {
+            throw new Error("Cannot remove the last group admin");
+        }
+        return buildRotatedKeyGroupPolicyRequest(input, projection, input.remainingUsers);
+    });
 }
 export async function buildGroupAccessSetShrinkPolicyRequest(input) {
-    await verifyAndAuthorizeGroupMutation(input);
-    return buildRotatedKeyGroupPolicyRequest(input, [...input.currentPolicy.currentProjection], input.currentUsers, input.currentPolicy.currentGrants.filter((grant) => grant.containerId !== input.revokedContainerId));
+    input = { ...input, currentUsers: structuredClone(input.currentUsers) };
+    return withVerifiedGroupMutation(input, async (input) => {
+        return buildRotatedKeyGroupPolicyRequest(input, [...input.currentPolicy.currentProjection], input.currentUsers, input.currentPolicy.currentGrants.filter((grant) => grant.containerId !== input.revokedContainerId));
+    });
 }
 /** Signs a complete successor grant projection without rotating group key material. */
 export async function buildSetGroupContainerGrantPolicyRequest(input) {
-    await verifyAndAuthorizeGroupMutation(input);
-    const grants = [
-        ...input.currentPolicy.currentGrants.filter((grant) => grant.containerId !== input.containerId),
-        { accessLevel: input.accessLevel, containerId: input.containerId },
-    ];
-    return signedGroupPolicyRequest({
-        currentPolicy: input.currentPolicy,
-        encapsulationPublicKey: input.currentPolicy.currentState.encapsulationPublicKey,
-        externalAuthority: isDirectGroupAdmin(input.currentPolicy, input.signerUserId)
-            ? null
-            : requireExternalAuthority(input.externalAuthority).currentHead,
-        keyEpoch: input.currentPolicy.currentState.keyEpoch,
-        keyFingerprint: input.currentPolicy.currentState.keyFingerprint,
-        grants,
-        memberEnvelopes: input.currentPolicy.currentMemberEnvelopes.envelopes,
-        payloadCiphertext: input.currentPolicy.currentPayload.ciphertext,
-        principalId: input.currentPolicy.currentState.principalId,
-        projection: input.currentPolicy.currentProjection,
-        signedAt: new Date().toISOString(),
-        signerUserId: input.signerUserId,
-        signingFingerprint: input.signingFingerprint,
-        signingKeyPair: input.signingKeyPair,
+    return withVerifiedGroupMutation(input, async (input) => {
+        const grants = [
+            ...input.currentPolicy.currentGrants.filter((grant) => grant.containerId !== input.containerId),
+            { accessLevel: input.accessLevel, containerId: input.containerId },
+        ];
+        return signedGroupPolicyRequest({
+            currentPolicy: input.currentPolicy,
+            encapsulationPublicKey: input.currentPolicy.currentState.encapsulationPublicKey,
+            externalAuthority: isDirectGroupAdmin(input.currentPolicy, input.signerUserId)
+                ? null
+                : requireExternalAuthority(input.externalAuthority).currentHead,
+            keyEpoch: input.currentPolicy.currentState.keyEpoch,
+            keyFingerprint: input.currentPolicy.currentState.keyFingerprint,
+            grants,
+            memberEnvelopes: input.currentPolicy.currentMemberEnvelopes.envelopes,
+            payloadCiphertext: input.currentPolicy.currentPayload.ciphertext,
+            principalId: input.currentPolicy.currentState.principalId,
+            projection: input.currentPolicy.currentProjection,
+            signedAt: new Date().toISOString(),
+            signerUserId: input.signerUserId,
+            signingFingerprint: input.signingFingerprint,
+            signingKeyPair: input.signingKeyPair,
+        });
     });
 }
 //# sourceMappingURL=groupPolicyRequests.js.map

package/workflows/organizations/groupPolicyRequests.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"groupPolicyRequests.js","sourceRoot":"","sources":["groupPolicyRequests.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EAEvB,aAAa,EACb,SAAS,EACT,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAMpD,OAAO,EAAE,8BAA8B,EAAE,MAAM,8CAA8C,CAAC;AAG9F,OAAO,EACL,kBAAkB,EAClB,2BAA2B,GAC5B,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EACL,+BAA+B,EAC/B,kBAAkB,GACnB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AASlC;;;;;;GAMG;AACH,KAAK,UAAU,+BAA+B,CAC5C,KAAmC;IAEnC,MAAM,KAAK,GAAG,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC;IAC/C,MAAM,KAAK,CAAC,sBAAsB,EAAE,CAClC,IAAI,uBAAuB,CACzB,iBAAiB,EACjB,gEAAgE,CACjE,EACD;QACE,cAAc,EAAE;YACd,uBAAuB,EAAE,KAAK,CAAC,cAAc;YAC7C,kBAAkB,EAAE,KAAK,CAAC,SAAS;SACpC;QACD,QAAQ,EAAE,KAAK,CAAC,WAAW;QAC3B,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,gCAAgC;KAC5C,CACF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CACf,UAA2D;IAE3D,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,wBAAwB,CAC/B,SAAuD;IAEvD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,+BAA+B,CAC5C,KAAwC;IAExC,MAAM,iBAAiB,CAAC;QACtB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,GAAG,CAAC,KAAK,CAAC,iBAAiB;YACzB,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE;YAChD,CAAC,CAAC,EAAE,CAAC;QACP,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,IAAI,IAAI;QAC1D,gBAAgB,EAAE,KAAK,CAAC,6BAA6B;KACtD,CAAC,CAAC;IACH,2BAA2B,CACzB,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,sBAAsB,IAAI,EAAE,EAClC,KAAK,CAAC,YAAY,CACnB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iCAAiC,CAC9C,KAAwC,EACxC,UAA2D,EAC3D,KAAyC,EACzC,MAAM,GAAG,KAAK,CAAC,aAAa,CAAC,aAAa;IAE1C,MAAM,QAAQ,GAAG,yBAAyB,EAAE,CAAC;IAC7C,MAAM,eAAe,GAAG,MAAM,+BAA+B,CAAC;QAC5D,UAAU;QACV,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,KAAK;KACN,CAAC,CAAC;IACH,OAAO,wBAAwB,CAAC;QAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,sBAAsB,EAAE,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;QACzD,iBAAiB,EAAE,kBAAkB,CACnC,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,YAAY,CACnB;YACC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,WAAW;QACjE,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,QAAQ,GAAG,CAAC;QACvD,cAAc,EAAE,MAAM,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;QACvD,MAAM;QACN,eAAe;QACf,iBAAiB,EAAE,KAAK,CAAC,aAAa,CAAC,cAAc,CAAC,UAAU;QAChE,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,WAAW;QACzD,UAAU;QACV,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,yCAAyC,CACtD,KAAmC,EACnC,UAA2D,EAC3D,SAAiB;IAEjB,MAAM,cAAc,GAAG,MAAM,SAAS,CACpC,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,sBAAsB,CAAC,SAAS,CAAC,EACxE,KAAK,CAAC,oBAAoB,CAC3B,CAAC;IACF,IACE,CAAC,CAAC,MAAM,8BAA8B,CACpC,cAAc,EACd,KAAK,CAAC,aAAa,CAAC,YAAY,CACjC,CAAC,EACF,CAAC;QACD,MAAM,+BAA+B,CAAC,KAAK,CAAC,CAAC;QAC7C,OAAO,iCAAiC,CAAC,KAAK,EAAE,UAAU,EAAE;YAC1D,GAAG,KAAK,CAAC,YAAY;YACrB,KAAK,CAAC,UAAU;SACjB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,CAAC,cAAc,CAAC,GAAG,MAAM,oBAAoB,CAAC,cAAc,EAAE;QAClE,KAAK,CAAC,UAAU,CAAC,sBAAsB;KACxC,CAAC,CAAC;IAEH,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,eAAe,GAAG;QACtB,GAAG,KAAK,CAAC,aAAa,CAAC,sBAAsB,CAAC,SAAS,CAAC,MAAM,CAC5D,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAC5C;QACD;YACE,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM;YAC/B,oBAAoB,EAAE,KAAK,CAAC,UAAU,CAAC,2BAA2B;YAClE,aAAa,EAAE,aAAa,CAAC,cAAc,CAAC,aAAa,CAAC;YAC1D,UAAU,EAAE,aAAa,CAAC,cAAc,CAAC,UAAU,CAAC;SACrD;KACF,CAAC;IACF,OAAO,wBAAwB,CAAC;QAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,sBAAsB,EACpB,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,sBAAsB;QACzD,iBAAiB,EAAE,IAAI;QACvB,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,QAAQ;QACnD,cAAc,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,cAAc;QAC/D,MAAM,EAAE,KAAK,CAAC,aAAa,CAAC,aAAa;QACzC,eAAe;QACf,iBAAiB,EAAE,KAAK,CAAC,aAAa,CAAC,cAAc,CAAC,UAAU;QAChE,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,WAAW;QACzD,UAAU;QACV,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAAmC;IAEnC,MAAM,+BAA+B,CAAC,KAAK,CAAC,CAAC;IAE7C,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;IAC1C,MAAM,iBAAiB,GAAG,KAAK,CAAC,aAAa,CAAC,iBAAiB,CAAC;IAChE,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,UAAU,GAAG;QACjB,GAAG,iBAAiB;QACpB,oBAAoB,CAClB,KAAK,CAAC,UAAU,CAAC,MAAM,EACvB,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CACrD;KACF,CAAC;IAEF,OAAO,kBAAkB,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,YAAY,CAAC;QAChE,CAAC,CAAC,yCAAyC,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,CAAC;QACzE,CAAC,CAAC,iCAAiC,CAAC,KAAK,EAAE,UAAU,EAAE;YACnD,GAAG,KAAK,CAAC,YAAY;YACrB,KAAK,CAAC,UAAU;SACjB,CAAC,CAAC;AACT,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,KAGC;IAED,MAAM,+BAA+B,CAAC,KAAK,CAAC,CAAC;IAE7C,MAAM,GAAG,GAAG,KAAK,CAAC,aAAa,CAAC;IAChC,MAAM,UAAU,GAAG,KAAK,CAAC,aAAa,CAAC,iBAAiB,CAAC,MAAM,CAC7D,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,GAAG,CAClC,CAAC;IAEF,IAAI,UAAU,CAAC,MAAM,KAAK,KAAK,CAAC,aAAa,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IAED,IACE,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,iBAAiB,CAAC;QAC/C,CAAC,QAAQ,CAAC,UAAU,CAAC,EACrB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,iCAAiC,CACtC,KAAK,EACL,UAAU,EACV,KAAK,CAAC,cAAc,CACrB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,KAGC;IAED,MAAM,+BAA+B,CAAC,KAAK,CAAC,CAAC;IAE7C,OAAO,iCAAiC,CACtC,KAAK,EACL,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,iBAAiB,CAAC,EAC1C,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,aAAa,CAAC,aAAa,CAAC,MAAM,CACtC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,kBAAkB,CAC1D,CACF,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,wCAAwC,CAC5D,KAGC;IAED,MAAM,+BAA+B,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG;QACb,GAAG,KAAK,CAAC,aAAa,CAAC,aAAa,CAAC,MAAM,CACzC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CACnD;QACD,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE;KACnE,CAAC;IACF,OAAO,wBAAwB,CAAC;QAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,sBAAsB,EACpB,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,sBAAsB;QACzD,iBAAiB,EAAE,kBAAkB,CACnC,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,YAAY,CACnB;YACC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,WAAW;QACjE,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,QAAQ;QACnD,cAAc,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,cAAc;QAC/D,MAAM;QACN,eAAe,EAAE,KAAK,CAAC,aAAa,CAAC,sBAAsB,CAAC,SAAS;QACrE,iBAAiB,EAAE,KAAK,CAAC,aAAa,CAAC,cAAc,CAAC,UAAU;QAChE,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,WAAW;QACzD,UAAU,EAAE,KAAK,CAAC,aAAa,CAAC,iBAAiB;QACjD,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n generateKemSeedAndKeyPair,\n KeyingVerificationError,\n type PrincipalPolicyExternalAuthority,\n toFingerprint,\n unwrapDek,\n wrapDekForRecipients,\n} from \"@tearleads/crypto\";\nimport { bytesToBase64 } from \"@tearleads/encoding\";\nimport type {\n PrincipalContainerGrantRequest,\n PrincipalProjectionMemberRequest,\n PutPrincipalPolicyRequest,\n} from \"@tearleads/validators/request\";\nimport { principalSecretKeyMatchesState } from \"../../data/principals/principalKeyValidation\";\nimport type { SecurityIncidentReporter } from \"../../data/securityIncidents\";\nimport type { TrustedUserIdentity } from \"../../data/trustedUserIdentity\";\nimport {\n isDirectGroupAdmin,\n requireSignerCanManageGroup,\n} from \"./groupMutationAuthorization\";\nimport type { BuildGroupMembershipMutationInput } from \"./groupPolicyMutationContext\";\nimport { verifyGroupPolicy } from \"./groupPolicyVerification\";\nimport {\n rewrapProjectionMemberEnvelopes,\n toRecipientEntries,\n} from \"./principalPolicyRecipients\";\nimport {\n signedGroupPolicyRequest,\n userProjectionMember,\n} from \"./principalPolicyRequest\";\n\ntype BuildAddGroupUserPolicyInput = BuildGroupMembershipMutationInput & {\n readonly currentUsers: ReadonlyArray<TrustedUserIdentity>;\n readonly currentUserSecretKey: Uint8Array;\n readonly reportSecurityIncident?: SecurityIncidentReporter \| undefined;\n readonly targetUser: TrustedUserIdentity;\n};\n\n/*\n The signed policy commits both the group's public key and the member\n * envelopes that are supposed to wrap its secret. An envelope that unwraps to\n * a different secret means a prior admin (or the server) published a policy\n * whose envelopes do not match its signed key. Rotating repairs the group, but\n * the mismatch is evidence and is recorded before the repair proceeds.\n /\nasync function reportPrincipalEnvelopeMismatch(\n input: BuildAddGroupUserPolicyInput,\n): Promise<void> {\n const state = input.currentPolicy.currentState;\n await input.reportSecurityIncident?.(\n new KeyingVerificationError(\n \"object_mismatch\",\n \"Group member envelope does not unwrap the signed principal key\",\n ),\n {\n evidenceHashes: {\n principalKeyFingerprint: state.keyFingerprint,\n principalStateHash: state.stateHash,\n },\n objectId: state.principalId,\n objectKind: \"principal\",\n operation: \"group.policy.envelope_mismatch\",\n },\n );\n}\n\nfunction hasAdmin(\n projection: ReadonlyArray<PrincipalProjectionMemberRequest>,\n): boolean {\n return projection.some((member) => member.role === \"admin\");\n}\n\nfunction requireExternalAuthority(\n authority: PrincipalPolicyExternalAuthority \| undefined,\n): PrincipalPolicyExternalAuthority {\n if (!authority) {\n throw new Error(\"External principal authority could not be verified\");\n }\n return authority;\n}\n\nasync function verifyAndAuthorizeGroupMutation(\n input: BuildGroupMembershipMutationInput,\n): Promise<void> {\n await verifyGroupPolicy({\n currentPolicy: input.currentPolicy,\n ...(input.externalAuthority\n ? { externalAuthority: input.externalAuthority }\n : {}),\n localPolicyCheckpoint: input.localPolicyCheckpoint ?? null,\n signerPublicKeys: input.currentPolicySignerPublicKeys,\n });\n requireSignerCanManageGroup(\n input.currentPolicy,\n input.currentOrgAdminUserIds ?? [],\n input.signerUserId,\n );\n}\n\nasync function buildRotatedKeyGroupPolicyRequest(\n input: BuildGroupMembershipMutationInput,\n projection: ReadonlyArray<PrincipalProjectionMemberRequest>,\n users: ReadonlyArray<TrustedUserIdentity>,\n grants = input.currentPolicy.currentGrants,\n): Promise<PutPrincipalPolicyRequest> {\n const groupKem = generateKemSeedAndKeyPair();\n const memberEnvelopes = await rewrapProjectionMemberEnvelopes({\n projection,\n secretKey: groupKem.secretKey,\n users,\n });\n return signedGroupPolicyRequest({\n currentPolicy: input.currentPolicy,\n encapsulationPublicKey: bytesToBase64(groupKem.publicKey),\n externalAuthority: isDirectGroupAdmin(\n input.currentPolicy,\n input.signerUserId,\n )\n ? null\n : requireExternalAuthority(input.externalAuthority).currentHead,\n keyEpoch: input.currentPolicy.currentState.keyEpoch + 1,\n keyFingerprint: await toFingerprint(groupKem.publicKey),\n grants,\n memberEnvelopes,\n payloadCiphertext: input.currentPolicy.currentPayload.ciphertext,\n principalId: input.currentPolicy.currentState.principalId,\n projection,\n signedAt: new Date().toISOString(),\n signerUserId: input.signerUserId,\n signingFingerprint: input.signingFingerprint,\n signingKeyPair: input.signingKeyPair,\n });\n}\n\nasync function buildDirectAdminAddGroupUserPolicyRequest(\n input: BuildAddGroupUserPolicyInput,\n projection: ReadonlyArray<PrincipalProjectionMemberRequest>,\n targetKey: string,\n): Promise<PutPrincipalPolicyRequest> {\n const groupSecretKey = await unwrapDek(\n toRecipientEntries(input.currentPolicy.currentMemberEnvelopes.envelopes),\n input.currentUserSecretKey,\n );\n if (\n !(await principalSecretKeyMatchesState(\n groupSecretKey,\n input.currentPolicy.currentState,\n ))\n ) {\n await reportPrincipalEnvelopeMismatch(input);\n return buildRotatedKeyGroupPolicyRequest(input, projection, [\n ...input.currentUsers,\n input.targetUser,\n ]);\n }\n const [targetEnvelope] = await wrapDekForRecipients(groupSecretKey, [\n input.targetUser.encapsulationPublicKey,\n ]);\n\n if (!targetEnvelope) {\n throw new Error(\"Failed to wrap group key for target user\");\n }\n\n const memberEnvelopes = [\n ...input.currentPolicy.currentMemberEnvelopes.envelopes.filter(\n (envelope) => envelope.userId !== targetKey,\n ),\n {\n userId: input.targetUser.userId,\n memberKeyFingerprint: input.targetUser.encapsulationKeyFingerprint,\n kemCipherText: bytesToBase64(targetEnvelope.kemCipherText),\n wrappedKey: bytesToBase64(targetEnvelope.wrappedKey),\n },\n ];\n return signedGroupPolicyRequest({\n currentPolicy: input.currentPolicy,\n encapsulationPublicKey:\n input.currentPolicy.currentState.encapsulationPublicKey,\n externalAuthority: null,\n keyEpoch: input.currentPolicy.currentState.keyEpoch,\n keyFingerprint: input.currentPolicy.currentState.keyFingerprint,\n grants: input.currentPolicy.currentGrants,\n memberEnvelopes,\n payloadCiphertext: input.currentPolicy.currentPayload.ciphertext,\n principalId: input.currentPolicy.currentState.principalId,\n projection,\n signedAt: new Date().toISOString(),\n signerUserId: input.signerUserId,\n signingFingerprint: input.signingFingerprint,\n signingKeyPair: input.signingKeyPair,\n });\n}\n\nexport async function buildAddGroupUserPolicyRequest(\n input: BuildAddGroupUserPolicyInput,\n): Promise<PutPrincipalPolicyRequest> {\n await verifyAndAuthorizeGroupMutation(input);\n\n const targetKey = input.targetUser.userId;\n const currentProjection = input.currentPolicy.currentProjection;\n if (currentProjection.some((member) => member.userId === targetKey)) {\n throw new Error(\"User is already a group member\");\n }\n\n const projection = [\n ...currentProjection,\n userProjectionMember(\n input.targetUser.userId,\n input.isOrganizationAdminsGroup ? \"admin\" : \"member\",\n ),\n ];\n\n return isDirectGroupAdmin(input.currentPolicy, input.signerUserId)\n ? buildDirectAdminAddGroupUserPolicyRequest(input, projection, targetKey)\n : buildRotatedKeyGroupPolicyRequest(input, projection, [\n ...input.currentUsers,\n input.targetUser,\n ]);\n}\n\nexport async function buildRemoveGroupUserPolicyRequest(\n input: BuildGroupMembershipMutationInput & {\n readonly remainingUsers: ReadonlyArray<TrustedUserIdentity>;\n readonly removedUserId: string;\n },\n): Promise<PutPrincipalPolicyRequest> {\n await verifyAndAuthorizeGroupMutation(input);\n\n const key = input.removedUserId;\n const projection = input.currentPolicy.currentProjection.filter(\n (member) => member.userId !== key,\n );\n\n if (projection.length === input.currentPolicy.currentProjection.length) {\n throw new Error(\"User is not a group member\");\n }\n\n if (\n hasAdmin(input.currentPolicy.currentProjection) &&\n !hasAdmin(projection)\n ) {\n throw new Error(\"Cannot remove the last group admin\");\n }\n\n return buildRotatedKeyGroupPolicyRequest(\n input,\n projection,\n input.remainingUsers,\n );\n}\n\nexport async function buildGroupAccessSetShrinkPolicyRequest(\n input: BuildGroupMembershipMutationInput & {\n readonly currentUsers: ReadonlyArray<TrustedUserIdentity>;\n readonly revokedContainerId: string;\n },\n): Promise<PutPrincipalPolicyRequest> {\n await verifyAndAuthorizeGroupMutation(input);\n\n return buildRotatedKeyGroupPolicyRequest(\n input,\n [...input.currentPolicy.currentProjection],\n input.currentUsers,\n input.currentPolicy.currentGrants.filter(\n (grant) => grant.containerId !== input.revokedContainerId,\n ),\n );\n}\n\n/* Signs a complete successor grant projection without rotating group key material. */\nexport async function buildSetGroupContainerGrantPolicyRequest(\n input: BuildGroupMembershipMutationInput & {\n readonly accessLevel: PrincipalContainerGrantRequest[\"accessLevel\"];\n readonly containerId: string;\n },\n): Promise<PutPrincipalPolicyRequest> {\n await verifyAndAuthorizeGroupMutation(input);\n const grants = [\n ...input.currentPolicy.currentGrants.filter(\n (grant) => grant.containerId !== input.containerId,\n ),\n { accessLevel: input.accessLevel, containerId: input.containerId },\n ];\n return signedGroupPolicyRequest({\n currentPolicy: input.currentPolicy,\n encapsulationPublicKey:\n input.currentPolicy.currentState.encapsulationPublicKey,\n externalAuthority: isDirectGroupAdmin(\n input.currentPolicy,\n input.signerUserId,\n )\n ? null\n : requireExternalAuthority(input.externalAuthority).currentHead,\n keyEpoch: input.currentPolicy.currentState.keyEpoch,\n keyFingerprint: input.currentPolicy.currentState.keyFingerprint,\n grants,\n memberEnvelopes: input.currentPolicy.currentMemberEnvelopes.envelopes,\n payloadCiphertext: input.currentPolicy.currentPayload.ciphertext,\n principalId: input.currentPolicy.currentState.principalId,\n projection: input.currentPolicy.currentProjection,\n signedAt: new Date().toISOString(),\n signerUserId: input.signerUserId,\n signingFingerprint: input.signingFingerprint,\n signingKeyPair: input.signingKeyPair,\n });\n}\n"]}
1	+ {"version":3,"file":"groupPolicyRequests.js","sourceRoot":"","sources":["groupPolicyRequests.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EAEvB,aAAa,EACb,SAAS,EACT,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAMpD,OAAO,EAAE,8BAA8B,EAAE,MAAM,8CAA8C,CAAC;AAG9F,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAEL,yBAAyB,GAC1B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,+BAA+B,EAC/B,kBAAkB,GACnB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AASlC;;;;;;GAMG;AACH,KAAK,UAAU,+BAA+B,CAC5C,KAAmC;IAEnC,MAAM,KAAK,GAAG,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC;IAC/C,MAAM,KAAK,CAAC,sBAAsB,EAAE,CAClC,IAAI,uBAAuB,CACzB,iBAAiB,EACjB,gEAAgE,CACjE,EACD;QACE,cAAc,EAAE;YACd,uBAAuB,EAAE,KAAK,CAAC,cAAc;YAC7C,kBAAkB,EAAE,KAAK,CAAC,SAAS;SACpC;QACD,QAAQ,EAAE,KAAK,CAAC,WAAW;QAC3B,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,gCAAgC;KAC5C,CACF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CACf,UAA2D;IAE3D,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,wBAAwB,CAC/B,SAAuD;IAEvD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,iCAAiC,CAC9C,KAAwC,EACxC,UAA2D,EAC3D,KAAyC,EACzC,MAAM,GAAG,KAAK,CAAC,aAAa,CAAC,aAAa;IAE1C,MAAM,QAAQ,GAAG,yBAAyB,EAAE,CAAC;IAC7C,MAAM,eAAe,GAAG,MAAM,+BAA+B,CAAC;QAC5D,UAAU;QACV,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,KAAK;KACN,CAAC,CAAC;IACH,OAAO,wBAAwB,CAAC;QAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,sBAAsB,EAAE,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;QACzD,iBAAiB,EAAE,kBAAkB,CACnC,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,YAAY,CACnB;YACC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,WAAW;QACjE,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,QAAQ,GAAG,CAAC;QACvD,cAAc,EAAE,MAAM,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;QACvD,MAAM;QACN,eAAe;QACf,iBAAiB,EAAE,KAAK,CAAC,aAAa,CAAC,cAAc,CAAC,UAAU;QAChE,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,WAAW;QACzD,UAAU;QACV,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,yCAAyC,CACtD,KAAmC,EACnC,UAA2D,EAC3D,SAAiB;IAEjB,MAAM,cAAc,GAAG,MAAM,SAAS,CACpC,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,sBAAsB,CAAC,SAAS,CAAC,EACxE,KAAK,CAAC,oBAAoB,CAC3B,CAAC;IACF,IACE,CAAC,CAAC,MAAM,8BAA8B,CACpC,cAAc,EACd,KAAK,CAAC,aAAa,CAAC,YAAY,CACjC,CAAC,EACF,CAAC;QACD,MAAM,+BAA+B,CAAC,KAAK,CAAC,CAAC;QAC7C,OAAO,iCAAiC,CAAC,KAAK,EAAE,UAAU,EAAE;YAC1D,GAAG,KAAK,CAAC,YAAY;YACrB,KAAK,CAAC,UAAU;SACjB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,CAAC,cAAc,CAAC,GAAG,MAAM,oBAAoB,CAAC,cAAc,EAAE;QAClE,KAAK,CAAC,UAAU,CAAC,sBAAsB;KACxC,CAAC,CAAC;IAEH,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,eAAe,GAAG;QACtB,GAAG,KAAK,CAAC,aAAa,CAAC,sBAAsB,CAAC,SAAS,CAAC,MAAM,CAC5D,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAC5C;QACD;YACE,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM;YAC/B,oBAAoB,EAAE,KAAK,CAAC,UAAU,CAAC,2BAA2B;YAClE,aAAa,EAAE,aAAa,CAAC,cAAc,CAAC,aAAa,CAAC;YAC1D,UAAU,EAAE,aAAa,CAAC,cAAc,CAAC,UAAU,CAAC;SACrD;KACF,CAAC;IACF,OAAO,wBAAwB,CAAC;QAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,sBAAsB,EACpB,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,sBAAsB;QACzD,iBAAiB,EAAE,IAAI;QACvB,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,QAAQ;QACnD,cAAc,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,cAAc;QAC/D,MAAM,EAAE,KAAK,CAAC,aAAa,CAAC,aAAa;QACzC,eAAe;QACf,iBAAiB,EAAE,KAAK,CAAC,aAAa,CAAC,cAAc,CAAC,UAAU;QAChE,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,WAAW;QACzD,UAAU;QACV,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAAmC;IAEnC,KAAK,GAAG;QACN,GAAG,KAAK;QACR,YAAY,EAAE,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC;QACjD,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,CAAC,KAAK,EAAE;QACxD,UAAU,EAAE,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC;KAC9C,CAAC;IACF,IAAI,CAAC;QACH,OAAO,MAAM,yBAAyB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAC5D,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;YAC1C,MAAM,iBAAiB,GAAG,KAAK,CAAC,aAAa,CAAC,iBAAiB,CAAC;YAChE,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,EAAE,CAAC;gBACpE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YAED,MAAM,UAAU,GAAG;gBACjB,GAAG,iBAAiB;gBACpB,oBAAoB,CAClB,KAAK,CAAC,UAAU,CAAC,MAAM,EACvB,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CACrD;aACF,CAAC;YAEF,OAAO,kBAAkB,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,YAAY,CAAC;gBAChE,CAAC,CAAC,yCAAyC,CACvC,KAAK,EACL,UAAU,EACV,SAAS,CACV;gBACH,CAAC,CAAC,iCAAiC,CAAC,KAAK,EAAE,UAAU,EAAE;oBACnD,GAAG,KAAK,CAAC,YAAY;oBACrB,KAAK,CAAC,UAAU;iBACjB,CAAC,CAAC;QACT,CAAC,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,KAGC;IAED,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,eAAe,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;IAC5E,OAAO,yBAAyB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QACtD,MAAM,GAAG,GAAG,KAAK,CAAC,aAAa,CAAC;QAChC,MAAM,UAAU,GAAG,KAAK,CAAC,aAAa,CAAC,iBAAiB,CAAC,MAAM,CAC7D,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,GAAG,CAClC,CAAC;QAEF,IAAI,UAAU,CAAC,MAAM,KAAK,KAAK,CAAC,aAAa,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,IACE,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,iBAAiB,CAAC;YAC/C,CAAC,QAAQ,CAAC,UAAU,CAAC,EACrB,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QAED,OAAO,iCAAiC,CACtC,KAAK,EACL,UAAU,EACV,KAAK,CAAC,cAAc,CACrB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,KAGC;IAED,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;IACxE,OAAO,yBAAyB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QACtD,OAAO,iCAAiC,CACtC,KAAK,EACL,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,iBAAiB,CAAC,EAC1C,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,aAAa,CAAC,aAAa,CAAC,MAAM,CACtC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,kBAAkB,CAC1D,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,wCAAwC,CAC5D,KAGC;IAED,OAAO,yBAAyB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QACtD,MAAM,MAAM,GAAG;YACb,GAAG,KAAK,CAAC,aAAa,CAAC,aAAa,CAAC,MAAM,CACzC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CACnD;YACD,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE;SACnE,CAAC;QACF,OAAO,wBAAwB,CAAC;YAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,sBAAsB,EACpB,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,sBAAsB;YACzD,iBAAiB,EAAE,kBAAkB,CACnC,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,YAAY,CACnB;gBACC,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,WAAW;YACjE,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,QAAQ;YACnD,cAAc,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,cAAc;YAC/D,MAAM;YACN,eAAe,EAAE,KAAK,CAAC,aAAa,CAAC,sBAAsB,CAAC,SAAS;YACrE,iBAAiB,EAAE,KAAK,CAAC,aAAa,CAAC,cAAc,CAAC,UAAU;YAChE,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,WAAW;YACzD,UAAU,EAAE,KAAK,CAAC,aAAa,CAAC,iBAAiB;YACjD,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAClC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n generateKemSeedAndKeyPair,\n KeyingVerificationError,\n type PrincipalPolicyExternalAuthority,\n toFingerprint,\n unwrapDek,\n wrapDekForRecipients,\n} from \"@tearleads/crypto\";\nimport { bytesToBase64 } from \"@tearleads/encoding\";\nimport type {\n PrincipalContainerGrantRequest,\n PrincipalProjectionMemberRequest,\n PutPrincipalPolicyRequest,\n} from \"@tearleads/validators/request\";\nimport { principalSecretKeyMatchesState } from \"../../data/principals/principalKeyValidation\";\nimport type { SecurityIncidentReporter } from \"../../data/securityIncidents\";\nimport type { TrustedUserIdentity } from \"../../data/trustedUserIdentity\";\nimport { isDirectGroupAdmin } from \"./groupMutationAuthorization\";\nimport {\n type BuildGroupMembershipMutationInput,\n withVerifiedGroupMutation,\n} from \"./groupPolicyMutationEvidence\";\nimport {\n rewrapProjectionMemberEnvelopes,\n toRecipientEntries,\n} from \"./principalPolicyRecipients\";\nimport {\n signedGroupPolicyRequest,\n userProjectionMember,\n} from \"./principalPolicyRequest\";\n\ntype BuildAddGroupUserPolicyInput = BuildGroupMembershipMutationInput & {\n readonly currentUsers: ReadonlyArray<TrustedUserIdentity>;\n readonly currentUserSecretKey: Uint8Array;\n readonly reportSecurityIncident?: SecurityIncidentReporter \| undefined;\n readonly targetUser: TrustedUserIdentity;\n};\n\n/*\n The signed policy commits both the group's public key and the member\n * envelopes that are supposed to wrap its secret. An envelope that unwraps to\n * a different secret means a prior admin (or the server) published a policy\n * whose envelopes do not match its signed key. Rotating repairs the group, but\n * the mismatch is evidence and is recorded before the repair proceeds.\n /\nasync function reportPrincipalEnvelopeMismatch(\n input: BuildAddGroupUserPolicyInput,\n): Promise<void> {\n const state = input.currentPolicy.currentState;\n await input.reportSecurityIncident?.(\n new KeyingVerificationError(\n \"object_mismatch\",\n \"Group member envelope does not unwrap the signed principal key\",\n ),\n {\n evidenceHashes: {\n principalKeyFingerprint: state.keyFingerprint,\n principalStateHash: state.stateHash,\n },\n objectId: state.principalId,\n objectKind: \"principal\",\n operation: \"group.policy.envelope_mismatch\",\n },\n );\n}\n\nfunction hasAdmin(\n projection: ReadonlyArray<PrincipalProjectionMemberRequest>,\n): boolean {\n return projection.some((member) => member.role === \"admin\");\n}\n\nfunction requireExternalAuthority(\n authority: PrincipalPolicyExternalAuthority \| undefined,\n): PrincipalPolicyExternalAuthority {\n if (!authority) {\n throw new Error(\"External principal authority could not be verified\");\n }\n return authority;\n}\n\nasync function buildRotatedKeyGroupPolicyRequest(\n input: BuildGroupMembershipMutationInput,\n projection: ReadonlyArray<PrincipalProjectionMemberRequest>,\n users: ReadonlyArray<TrustedUserIdentity>,\n grants = input.currentPolicy.currentGrants,\n): Promise<PutPrincipalPolicyRequest> {\n const groupKem = generateKemSeedAndKeyPair();\n const memberEnvelopes = await rewrapProjectionMemberEnvelopes({\n projection,\n secretKey: groupKem.secretKey,\n users,\n });\n return signedGroupPolicyRequest({\n currentPolicy: input.currentPolicy,\n encapsulationPublicKey: bytesToBase64(groupKem.publicKey),\n externalAuthority: isDirectGroupAdmin(\n input.currentPolicy,\n input.signerUserId,\n )\n ? null\n : requireExternalAuthority(input.externalAuthority).currentHead,\n keyEpoch: input.currentPolicy.currentState.keyEpoch + 1,\n keyFingerprint: await toFingerprint(groupKem.publicKey),\n grants,\n memberEnvelopes,\n payloadCiphertext: input.currentPolicy.currentPayload.ciphertext,\n principalId: input.currentPolicy.currentState.principalId,\n projection,\n signedAt: new Date().toISOString(),\n signerUserId: input.signerUserId,\n signingFingerprint: input.signingFingerprint,\n signingKeyPair: input.signingKeyPair,\n });\n}\n\nasync function buildDirectAdminAddGroupUserPolicyRequest(\n input: BuildAddGroupUserPolicyInput,\n projection: ReadonlyArray<PrincipalProjectionMemberRequest>,\n targetKey: string,\n): Promise<PutPrincipalPolicyRequest> {\n const groupSecretKey = await unwrapDek(\n toRecipientEntries(input.currentPolicy.currentMemberEnvelopes.envelopes),\n input.currentUserSecretKey,\n );\n if (\n !(await principalSecretKeyMatchesState(\n groupSecretKey,\n input.currentPolicy.currentState,\n ))\n ) {\n await reportPrincipalEnvelopeMismatch(input);\n return buildRotatedKeyGroupPolicyRequest(input, projection, [\n ...input.currentUsers,\n input.targetUser,\n ]);\n }\n const [targetEnvelope] = await wrapDekForRecipients(groupSecretKey, [\n input.targetUser.encapsulationPublicKey,\n ]);\n\n if (!targetEnvelope) {\n throw new Error(\"Failed to wrap group key for target user\");\n }\n\n const memberEnvelopes = [\n ...input.currentPolicy.currentMemberEnvelopes.envelopes.filter(\n (envelope) => envelope.userId !== targetKey,\n ),\n {\n userId: input.targetUser.userId,\n memberKeyFingerprint: input.targetUser.encapsulationKeyFingerprint,\n kemCipherText: bytesToBase64(targetEnvelope.kemCipherText),\n wrappedKey: bytesToBase64(targetEnvelope.wrappedKey),\n },\n ];\n return signedGroupPolicyRequest({\n currentPolicy: input.currentPolicy,\n encapsulationPublicKey:\n input.currentPolicy.currentState.encapsulationPublicKey,\n externalAuthority: null,\n keyEpoch: input.currentPolicy.currentState.keyEpoch,\n keyFingerprint: input.currentPolicy.currentState.keyFingerprint,\n grants: input.currentPolicy.currentGrants,\n memberEnvelopes,\n payloadCiphertext: input.currentPolicy.currentPayload.ciphertext,\n principalId: input.currentPolicy.currentState.principalId,\n projection,\n signedAt: new Date().toISOString(),\n signerUserId: input.signerUserId,\n signingFingerprint: input.signingFingerprint,\n signingKeyPair: input.signingKeyPair,\n });\n}\n\nexport async function buildAddGroupUserPolicyRequest(\n input: BuildAddGroupUserPolicyInput,\n): Promise<PutPrincipalPolicyRequest> {\n input = {\n ...input,\n currentUsers: structuredClone(input.currentUsers),\n currentUserSecretKey: input.currentUserSecretKey.slice(),\n targetUser: structuredClone(input.targetUser),\n };\n try {\n return await withVerifiedGroupMutation(input, async (input) => {\n const targetKey = input.targetUser.userId;\n const currentProjection = input.currentPolicy.currentProjection;\n if (currentProjection.some((member) => member.userId === targetKey)) {\n throw new Error(\"User is already a group member\");\n }\n\n const projection = [\n ...currentProjection,\n userProjectionMember(\n input.targetUser.userId,\n input.isOrganizationAdminsGroup ? \"admin\" : \"member\",\n ),\n ];\n\n return isDirectGroupAdmin(input.currentPolicy, input.signerUserId)\n ? buildDirectAdminAddGroupUserPolicyRequest(\n input,\n projection,\n targetKey,\n )\n : buildRotatedKeyGroupPolicyRequest(input, projection, [\n ...input.currentUsers,\n input.targetUser,\n ]);\n });\n } finally {\n input.currentUserSecretKey.fill(0);\n }\n}\n\nexport async function buildRemoveGroupUserPolicyRequest(\n input: BuildGroupMembershipMutationInput & {\n readonly remainingUsers: ReadonlyArray<TrustedUserIdentity>;\n readonly removedUserId: string;\n },\n): Promise<PutPrincipalPolicyRequest> {\n input = { ...input, remainingUsers: structuredClone(input.remainingUsers) };\n return withVerifiedGroupMutation(input, async (input) => {\n const key = input.removedUserId;\n const projection = input.currentPolicy.currentProjection.filter(\n (member) => member.userId !== key,\n );\n\n if (projection.length === input.currentPolicy.currentProjection.length) {\n throw new Error(\"User is not a group member\");\n }\n\n if (\n hasAdmin(input.currentPolicy.currentProjection) &&\n !hasAdmin(projection)\n ) {\n throw new Error(\"Cannot remove the last group admin\");\n }\n\n return buildRotatedKeyGroupPolicyRequest(\n input,\n projection,\n input.remainingUsers,\n );\n });\n}\n\nexport async function buildGroupAccessSetShrinkPolicyRequest(\n input: BuildGroupMembershipMutationInput & {\n readonly currentUsers: ReadonlyArray<TrustedUserIdentity>;\n readonly revokedContainerId: string;\n },\n): Promise<PutPrincipalPolicyRequest> {\n input = { ...input, currentUsers: structuredClone(input.currentUsers) };\n return withVerifiedGroupMutation(input, async (input) => {\n return buildRotatedKeyGroupPolicyRequest(\n input,\n [...input.currentPolicy.currentProjection],\n input.currentUsers,\n input.currentPolicy.currentGrants.filter(\n (grant) => grant.containerId !== input.revokedContainerId,\n ),\n );\n });\n}\n\n/* Signs a complete successor grant projection without rotating group key material. */\nexport async function buildSetGroupContainerGrantPolicyRequest(\n input: BuildGroupMembershipMutationInput & {\n readonly accessLevel: PrincipalContainerGrantRequest[\"accessLevel\"];\n readonly containerId: string;\n },\n): Promise<PutPrincipalPolicyRequest> {\n return withVerifiedGroupMutation(input, async (input) => {\n const grants = [\n ...input.currentPolicy.currentGrants.filter(\n (grant) => grant.containerId !== input.containerId,\n ),\n { accessLevel: input.accessLevel, containerId: input.containerId },\n ];\n return signedGroupPolicyRequest({\n currentPolicy: input.currentPolicy,\n encapsulationPublicKey:\n input.currentPolicy.currentState.encapsulationPublicKey,\n externalAuthority: isDirectGroupAdmin(\n input.currentPolicy,\n input.signerUserId,\n )\n ? null\n : requireExternalAuthority(input.externalAuthority).currentHead,\n keyEpoch: input.currentPolicy.currentState.keyEpoch,\n keyFingerprint: input.currentPolicy.currentState.keyFingerprint,\n grants,\n memberEnvelopes: input.currentPolicy.currentMemberEnvelopes.envelopes,\n payloadCiphertext: input.currentPolicy.currentPayload.ciphertext,\n principalId: input.currentPolicy.currentState.principalId,\n projection: input.currentPolicy.currentProjection,\n signedAt: new Date().toISOString(),\n signerUserId: input.signerUserId,\n signingFingerprint: input.signingFingerprint,\n signingKeyPair: input.signingKeyPair,\n });\n });\n}\n"]}

package/workflows/organizations/index.d.ts CHANGED Viewed

@@ -1,4 +1,7 @@
 export { type OrganizationReadModelInvalidationListener, subscribeOrganizationReadModelInvalidation, } from "../../data/persistence/organizations/organizationReadModelInvalidation.js";
+export { PendingPrincipalMutationError } from "../../data/persistence/principalMutationJournalPersistence.js";
+export type { AuthoredPrincipalMutation, PrincipalMutationJournalScope, } from "../../data/principals/principalMutationJournal.js";
+export { UnreadablePrincipalMutationError } from "../../data/principals/principalMutationJournalRecord.js";
 export { cancelStripeSubscription, checkNativePurchaseEligibility, claimNativeOrganizationSubscription, createStripeCheckout, createStripeCheckoutSession, loadOrganizationBilling, loadOrganizationBillingHistory, loadOrganizationBillingManagementUrl, loadStripeCheckoutOptions, type OrganizationBilling, type OrganizationBillingHistory, type OrganizationBillingHistoryEntry, type OrganizationBillingManagementUrl, type OrganizationBillingView, type OrganizationNativePurchaseEligibility, resolveOrganizationBillingView, type StripeCheckoutIntent, type StripeCheckoutOptions, startOrganizationTrial, } from "./billing.js";
 export { revokeOrganizationContainerGrant } from "./containerGrantRevocation.js";
 export { type CreateOrganizationApi, type CreateOrganizationInput, createOrganization, } from "./createOrganization.js";
@@ -9,7 +12,10 @@ export { type LocalOrganizationSummary, listLocalOrganizations, } from "./listLo
 export { loadLocalOrganizationContainerGrants, loadLocalOrganizationGroupContainers, loadLocalOrganizationGroupPolicyHistory, loadLocalOrganizationPolicyHistory, loadLocalOrganizationPolicyReference, loadLocalOrganizationUserDetail, } from "./localReadModelDetails.js";
 export { buildOrganizationProfileDocumentPatch, createInitializedOrganizationProfileDocument, DEFAULT_PERSONAL_ORGANIZATION_PROFILE_NAME, getOrganizationProfileDocumentLocalId, ORGANIZATION_PROFILE_DOCUMENT_KIND, readOrganizationProfileName, } from "./organizationProfile.js";
 export { type ImportedOrganizationUser, importOrganizationUser, } from "./organizationUserImport.js";
+export { abandonJournaledPrincipalMutation, discardUnreadableJournaledPrincipalMutation, readJournaledPrincipalMutation, } from "./principalMutationJournalManagement.js";
+export { type PrincipalMutationJournalContext, PrincipalMutationOutcomeUnknownError, recoverJournaledPrincipalMutation, submitJournaledPrincipalMutation, } from "./principalMutationJournalSession.js";
 export { addOrganizationGroupUser, buildInitialGroupPolicyRequest, buildInitialMemberGroupPolicyRequest, createOrganizationGroup, removeOrganizationGroupUser, rotateOrganizationGroupForAccessSetShrink, } from "./principalPolicy.js";
 export { buildOrganizationGroupPolicyHistory, type OrganizationContainerGrant, type OrganizationContainerGrants, type OrganizationDirectory, type OrganizationDirectoryAndGroups, type OrganizationDirectoryUser, type OrganizationGroupContainer, type OrganizationGroupContainers, type OrganizationGroupDetails, type OrganizationGroupMember, type OrganizationGroupMembers, type OrganizationGroupPolicyHistory, type OrganizationGroupPolicyHistoryEntry, type OrganizationGroupSummary, type OrganizationPolicyGrantChange, type OrganizationPolicyGroupChange, type OrganizationPolicyHistory, type OrganizationPolicyHistoryEntry, type OrganizationPrincipalMemberChange, type OrganizationPrincipalMemberChangeType, type OrganizationPrincipalPolicyHistory, type OrganizationPrincipalPolicyHistoryEntry, type OrganizationProfile, type OrganizationUserDetail, updateOrganizationProfile, updateOrganizationRosterEntry, } from "./readModel.js";
 export { loadLocalOrganizationDirectoryAndGroups, loadLocalOrganizationGroupMembers, type ReconcileOrganizationDirectoryAndGroupsInput, reconcileOrganizationDirectoryAndGroups, } from "./readModelProjection.js";
+export { type AcknowledgedPrincipalCurrentInput, type AcknowledgedPrincipalCurrentRetirement, retainAcknowledgedPrincipalCurrents, } from "./retainAcknowledgedPrincipalCurrents.js";
 export { buildRosterProfileDocumentPatch, createInitializedRosterProfileDocument, deriveOrganizationMetadataContainerSystemSlot, deriveOrganizationRosterProfileContainerSystemSlot, getRosterProfileDocumentLocalId, ORGANIZATION_METADATA_CONTAINER_NAME, ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME, ROSTER_PROFILE_DOCUMENT_KIND, } from "./rosterProfileContainer.js";

package/workflows/organizations/index.js CHANGED Viewed

@@ -1,4 +1,6 @@
 export { subscribeOrganizationReadModelInvalidation, } from "../../data/persistence/organizations/organizationReadModelInvalidation.js";
+export { PendingPrincipalMutationError } from "../../data/persistence/principalMutationJournalPersistence.js";
+export { UnreadablePrincipalMutationError } from "../../data/principals/principalMutationJournalRecord.js";
 export { cancelStripeSubscription, checkNativePurchaseEligibility, claimNativeOrganizationSubscription, createStripeCheckout, createStripeCheckoutSession, loadOrganizationBilling, loadOrganizationBillingHistory, loadOrganizationBillingManagementUrl, loadStripeCheckoutOptions, resolveOrganizationBillingView, startOrganizationTrial, } from "./billing.js";
 export { revokeOrganizationContainerGrant } from "./containerGrantRevocation.js";
 export { createOrganization, } from "./createOrganization.js";
@@ -9,8 +11,11 @@ export { listLocalOrganizations, } from "./listLocalOrganizations.js";
 export { loadLocalOrganizationContainerGrants, loadLocalOrganizationGroupContainers, loadLocalOrganizationGroupPolicyHistory, loadLocalOrganizationPolicyHistory, loadLocalOrganizationPolicyReference, loadLocalOrganizationUserDetail, } from "./localReadModelDetails.js";
 export { buildOrganizationProfileDocumentPatch, createInitializedOrganizationProfileDocument, DEFAULT_PERSONAL_ORGANIZATION_PROFILE_NAME, getOrganizationProfileDocumentLocalId, ORGANIZATION_PROFILE_DOCUMENT_KIND, readOrganizationProfileName, } from "./organizationProfile.js";
 export { importOrganizationUser, } from "./organizationUserImport.js";
+export { abandonJournaledPrincipalMutation, discardUnreadableJournaledPrincipalMutation, readJournaledPrincipalMutation, } from "./principalMutationJournalManagement.js";
+export { PrincipalMutationOutcomeUnknownError, recoverJournaledPrincipalMutation, submitJournaledPrincipalMutation, } from "./principalMutationJournalSession.js";
 export { addOrganizationGroupUser, buildInitialGroupPolicyRequest, buildInitialMemberGroupPolicyRequest, createOrganizationGroup, removeOrganizationGroupUser, rotateOrganizationGroupForAccessSetShrink, } from "./principalPolicy.js";
 export { buildOrganizationGroupPolicyHistory, updateOrganizationProfile, updateOrganizationRosterEntry, } from "./readModel.js";
 export { loadLocalOrganizationDirectoryAndGroups, loadLocalOrganizationGroupMembers, reconcileOrganizationDirectoryAndGroups, } from "./readModelProjection.js";
+export { retainAcknowledgedPrincipalCurrents, } from "./retainAcknowledgedPrincipalCurrents.js";
 export { buildRosterProfileDocumentPatch, createInitializedRosterProfileDocument, deriveOrganizationMetadataContainerSystemSlot, deriveOrganizationRosterProfileContainerSystemSlot, getRosterProfileDocumentLocalId, ORGANIZATION_METADATA_CONTAINER_NAME, ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME, ROSTER_PROFILE_DOCUMENT_KIND, } from "./rosterProfileContainer.js";
 //# sourceMappingURL=index.js.map

package/workflows/organizations/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,0CAA0C,GAC3C,MAAM,wEAAwE,CAAC;AAChF,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,mCAAmC,EACnC,oBAAoB,EACpB,2BAA2B,EAC3B,uBAAuB,EACvB,8BAA8B,EAC9B,oCAAoC,EACpC,yBAAyB,EAOzB,8BAA8B,EAG9B,sBAAsB,GACvB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,gCAAgC,EAAE,MAAM,4BAA4B,CAAC;AAC9E,OAAO,EAGL,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,8BAA8B,EAG9B,8BAA8B,GAC/B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,gCAAgC,EAAE,MAAM,uBAAuB,CAAC;AACzE,OAAO,EAEL,sBAAsB,GACvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,oCAAoC,EACpC,oCAAoC,EACpC,uCAAuC,EACvC,kCAAkC,EAClC,oCAAoC,EACpC,+BAA+B,GAChC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,qCAAqC,EACrC,4CAA4C,EAC5C,0CAA0C,EAC1C,qCAAqC,EACrC,kCAAkC,EAClC,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,sBAAsB,GACvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,oCAAoC,EACpC,uBAAuB,EACvB,2BAA2B,EAC3B,yCAAyC,GAC1C,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,mCAAmC,EAwBnC,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,uCAAuC,EACvC,iCAAiC,EAEjC,uCAAuC,GACxC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,+BAA+B,EAC/B,sCAAsC,EACtC,6CAA6C,EAC7C,kDAAkD,EAClD,+BAA+B,EAC/B,oCAAoC,EACpC,0CAA0C,EAC1C,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC","sourcesContent":["export {\n type OrganizationReadModelInvalidationListener,\n subscribeOrganizationReadModelInvalidation,\n} from \"../../data/persistence/organizations/organizationReadModelInvalidation\";\nexport {\n cancelStripeSubscription,\n checkNativePurchaseEligibility,\n claimNativeOrganizationSubscription,\n createStripeCheckout,\n createStripeCheckoutSession,\n loadOrganizationBilling,\n loadOrganizationBillingHistory,\n loadOrganizationBillingManagementUrl,\n loadStripeCheckoutOptions,\n type OrganizationBilling,\n type OrganizationBillingHistory,\n type OrganizationBillingHistoryEntry,\n type OrganizationBillingManagementUrl,\n type OrganizationBillingView,\n type OrganizationNativePurchaseEligibility,\n resolveOrganizationBillingView,\n type StripeCheckoutIntent,\n type StripeCheckoutOptions,\n startOrganizationTrial,\n} from \"./billing\";\nexport { revokeOrganizationContainerGrant } from \"./containerGrantRevocation\";\nexport {\n type CreateOrganizationApi,\n type CreateOrganizationInput,\n createOrganization,\n} from \"./createOrganization\";\nexport {\n loadLocalOrganizationDataUsage,\n type OrganizationDataUsage,\n type ReconcileOrganizationDataUsageInput,\n reconcileOrganizationDataUsage,\n} from \"./dataUsageReadModel\";\nexport { deleteOrganizationGroup } from \"./deleteOrganizationGroup\";\nexport { GroupMembershipNameMismatchError } from \"./groupMembershipName\";\nexport {\n type LocalOrganizationSummary,\n listLocalOrganizations,\n} from \"./listLocalOrganizations\";\nexport {\n loadLocalOrganizationContainerGrants,\n loadLocalOrganizationGroupContainers,\n loadLocalOrganizationGroupPolicyHistory,\n loadLocalOrganizationPolicyHistory,\n loadLocalOrganizationPolicyReference,\n loadLocalOrganizationUserDetail,\n} from \"./localReadModelDetails\";\nexport {\n buildOrganizationProfileDocumentPatch,\n createInitializedOrganizationProfileDocument,\n DEFAULT_PERSONAL_ORGANIZATION_PROFILE_NAME,\n getOrganizationProfileDocumentLocalId,\n ORGANIZATION_PROFILE_DOCUMENT_KIND,\n readOrganizationProfileName,\n} from \"./organizationProfile\";\nexport {\n type ImportedOrganizationUser,\n importOrganizationUser,\n} from \"./organizationUserImport\";\nexport {\n addOrganizationGroupUser,\n buildInitialGroupPolicyRequest,\n buildInitialMemberGroupPolicyRequest,\n createOrganizationGroup,\n removeOrganizationGroupUser,\n rotateOrganizationGroupForAccessSetShrink,\n} from \"./principalPolicy\";\nexport {\n buildOrganizationGroupPolicyHistory,\n type OrganizationContainerGrant,\n type OrganizationContainerGrants,\n type OrganizationDirectory,\n type OrganizationDirectoryAndGroups,\n type OrganizationDirectoryUser,\n type OrganizationGroupContainer,\n type OrganizationGroupContainers,\n type OrganizationGroupDetails,\n type OrganizationGroupMember,\n type OrganizationGroupMembers,\n type OrganizationGroupPolicyHistory,\n type OrganizationGroupPolicyHistoryEntry,\n type OrganizationGroupSummary,\n type OrganizationPolicyGrantChange,\n type OrganizationPolicyGroupChange,\n type OrganizationPolicyHistory,\n type OrganizationPolicyHistoryEntry,\n type OrganizationPrincipalMemberChange,\n type OrganizationPrincipalMemberChangeType,\n type OrganizationPrincipalPolicyHistory,\n type OrganizationPrincipalPolicyHistoryEntry,\n type OrganizationProfile,\n type OrganizationUserDetail,\n updateOrganizationProfile,\n updateOrganizationRosterEntry,\n} from \"./readModel\";\nexport {\n loadLocalOrganizationDirectoryAndGroups,\n loadLocalOrganizationGroupMembers,\n type ReconcileOrganizationDirectoryAndGroupsInput,\n reconcileOrganizationDirectoryAndGroups,\n} from \"./readModelProjection\";\nexport {\n buildRosterProfileDocumentPatch,\n createInitializedRosterProfileDocument,\n deriveOrganizationMetadataContainerSystemSlot,\n deriveOrganizationRosterProfileContainerSystemSlot,\n getRosterProfileDocumentLocalId,\n ORGANIZATION_METADATA_CONTAINER_NAME,\n ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME,\n ROSTER_PROFILE_DOCUMENT_KIND,\n} from \"./rosterProfileContainer\";\n"]}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,0CAA0C,GAC3C,MAAM,wEAAwE,CAAC;AAChF,OAAO,EAAE,6BAA6B,EAAE,MAAM,4DAA4D,CAAC;AAK3G,OAAO,EAAE,gCAAgC,EAAE,MAAM,sDAAsD,CAAC;AACxG,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,mCAAmC,EACnC,oBAAoB,EACpB,2BAA2B,EAC3B,uBAAuB,EACvB,8BAA8B,EAC9B,oCAAoC,EACpC,yBAAyB,EAOzB,8BAA8B,EAG9B,sBAAsB,GACvB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,gCAAgC,EAAE,MAAM,4BAA4B,CAAC;AAC9E,OAAO,EAGL,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,8BAA8B,EAG9B,8BAA8B,GAC/B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,gCAAgC,EAAE,MAAM,uBAAuB,CAAC;AACzE,OAAO,EAEL,sBAAsB,GACvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,oCAAoC,EACpC,oCAAoC,EACpC,uCAAuC,EACvC,kCAAkC,EAClC,oCAAoC,EACpC,+BAA+B,GAChC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,qCAAqC,EACrC,4CAA4C,EAC5C,0CAA0C,EAC1C,qCAAqC,EACrC,kCAAkC,EAClC,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,sBAAsB,GACvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,iCAAiC,EACjC,2CAA2C,EAC3C,8BAA8B,GAC/B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAEL,oCAAoC,EACpC,iCAAiC,EACjC,gCAAgC,GACjC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,oCAAoC,EACpC,uBAAuB,EACvB,2BAA2B,EAC3B,yCAAyC,GAC1C,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,mCAAmC,EAwBnC,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,uCAAuC,EACvC,iCAAiC,EAEjC,uCAAuC,GACxC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAGL,mCAAmC,GACpC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,+BAA+B,EAC/B,sCAAsC,EACtC,6CAA6C,EAC7C,kDAAkD,EAClD,+BAA+B,EAC/B,oCAAoC,EACpC,0CAA0C,EAC1C,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC","sourcesContent":["export {\n type OrganizationReadModelInvalidationListener,\n subscribeOrganizationReadModelInvalidation,\n} from \"../../data/persistence/organizations/organizationReadModelInvalidation\";\nexport { PendingPrincipalMutationError } from \"../../data/persistence/principalMutationJournalPersistence\";\nexport type {\n AuthoredPrincipalMutation,\n PrincipalMutationJournalScope,\n} from \"../../data/principals/principalMutationJournal\";\nexport { UnreadablePrincipalMutationError } from \"../../data/principals/principalMutationJournalRecord\";\nexport {\n cancelStripeSubscription,\n checkNativePurchaseEligibility,\n claimNativeOrganizationSubscription,\n createStripeCheckout,\n createStripeCheckoutSession,\n loadOrganizationBilling,\n loadOrganizationBillingHistory,\n loadOrganizationBillingManagementUrl,\n loadStripeCheckoutOptions,\n type OrganizationBilling,\n type OrganizationBillingHistory,\n type OrganizationBillingHistoryEntry,\n type OrganizationBillingManagementUrl,\n type OrganizationBillingView,\n type OrganizationNativePurchaseEligibility,\n resolveOrganizationBillingView,\n type StripeCheckoutIntent,\n type StripeCheckoutOptions,\n startOrganizationTrial,\n} from \"./billing\";\nexport { revokeOrganizationContainerGrant } from \"./containerGrantRevocation\";\nexport {\n type CreateOrganizationApi,\n type CreateOrganizationInput,\n createOrganization,\n} from \"./createOrganization\";\nexport {\n loadLocalOrganizationDataUsage,\n type OrganizationDataUsage,\n type ReconcileOrganizationDataUsageInput,\n reconcileOrganizationDataUsage,\n} from \"./dataUsageReadModel\";\nexport { deleteOrganizationGroup } from \"./deleteOrganizationGroup\";\nexport { GroupMembershipNameMismatchError } from \"./groupMembershipName\";\nexport {\n type LocalOrganizationSummary,\n listLocalOrganizations,\n} from \"./listLocalOrganizations\";\nexport {\n loadLocalOrganizationContainerGrants,\n loadLocalOrganizationGroupContainers,\n loadLocalOrganizationGroupPolicyHistory,\n loadLocalOrganizationPolicyHistory,\n loadLocalOrganizationPolicyReference,\n loadLocalOrganizationUserDetail,\n} from \"./localReadModelDetails\";\nexport {\n buildOrganizationProfileDocumentPatch,\n createInitializedOrganizationProfileDocument,\n DEFAULT_PERSONAL_ORGANIZATION_PROFILE_NAME,\n getOrganizationProfileDocumentLocalId,\n ORGANIZATION_PROFILE_DOCUMENT_KIND,\n readOrganizationProfileName,\n} from \"./organizationProfile\";\nexport {\n type ImportedOrganizationUser,\n importOrganizationUser,\n} from \"./organizationUserImport\";\nexport {\n abandonJournaledPrincipalMutation,\n discardUnreadableJournaledPrincipalMutation,\n readJournaledPrincipalMutation,\n} from \"./principalMutationJournalManagement\";\nexport {\n type PrincipalMutationJournalContext,\n PrincipalMutationOutcomeUnknownError,\n recoverJournaledPrincipalMutation,\n submitJournaledPrincipalMutation,\n} from \"./principalMutationJournalSession\";\nexport {\n addOrganizationGroupUser,\n buildInitialGroupPolicyRequest,\n buildInitialMemberGroupPolicyRequest,\n createOrganizationGroup,\n removeOrganizationGroupUser,\n rotateOrganizationGroupForAccessSetShrink,\n} from \"./principalPolicy\";\nexport {\n buildOrganizationGroupPolicyHistory,\n type OrganizationContainerGrant,\n type OrganizationContainerGrants,\n type OrganizationDirectory,\n type OrganizationDirectoryAndGroups,\n type OrganizationDirectoryUser,\n type OrganizationGroupContainer,\n type OrganizationGroupContainers,\n type OrganizationGroupDetails,\n type OrganizationGroupMember,\n type OrganizationGroupMembers,\n type OrganizationGroupPolicyHistory,\n type OrganizationGroupPolicyHistoryEntry,\n type OrganizationGroupSummary,\n type OrganizationPolicyGrantChange,\n type OrganizationPolicyGroupChange,\n type OrganizationPolicyHistory,\n type OrganizationPolicyHistoryEntry,\n type OrganizationPrincipalMemberChange,\n type OrganizationPrincipalMemberChangeType,\n type OrganizationPrincipalPolicyHistory,\n type OrganizationPrincipalPolicyHistoryEntry,\n type OrganizationProfile,\n type OrganizationUserDetail,\n updateOrganizationProfile,\n updateOrganizationRosterEntry,\n} from \"./readModel\";\nexport {\n loadLocalOrganizationDirectoryAndGroups,\n loadLocalOrganizationGroupMembers,\n type ReconcileOrganizationDirectoryAndGroupsInput,\n reconcileOrganizationDirectoryAndGroups,\n} from \"./readModelProjection\";\nexport {\n type AcknowledgedPrincipalCurrentInput,\n type AcknowledgedPrincipalCurrentRetirement,\n retainAcknowledgedPrincipalCurrents,\n} from \"./retainAcknowledgedPrincipalCurrents\";\nexport {\n buildRosterProfileDocumentPatch,\n createInitializedRosterProfileDocument,\n deriveOrganizationMetadataContainerSystemSlot,\n deriveOrganizationRosterProfileContainerSystemSlot,\n getRosterProfileDocumentLocalId,\n ORGANIZATION_METADATA_CONTAINER_NAME,\n ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME,\n ROSTER_PROFILE_DOCUMENT_KIND,\n} from \"./rosterProfileContainer\";\n"]}

package/workflows/organizations/initialPrincipalCurrentPublication.js ADDED Viewed

@@ -0,0 +1,83 @@
+import { createPrincipalPolicyHistoryVerifier, KeyingVerificationError, verifyPrincipalPolicyCurrent, } from "../../internal/crypto/index.js";
+import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
+import { preparePrincipalHistoryEvidencePage } from "../../data/persistence/principalHistoryEvidencePersistence.js";
+import { principalHeadMatchesReference } from "../../data/principals/organizationAuthorityDescriptor.js";
+import { principalHistoryEvidenceScopeId } from "../../data/principals/principalHistoryPrefixProtection.js";
+import { collectPrincipalPolicySignerPublicKeys } from "../principals/policyVerification.js";
+import { assertPrincipalHistoryVerificationMode, principalHistoryVerificationContext, } from "../principals/principalHistoryRecoveryVerification.js";
+import { groupPolicyMutationHead } from "./groupPolicyMutationHead.js";
+import { sealPrincipalCurrentPublication } from "./principalCurrentPublicationSeal.js";
+import { assertPrincipalPolicyReceiptArtifacts } from "./principalPolicyReceiptArtifacts.js";
+/** Verify a newly authored group from genesis before its atomic directory publication. */
+export async function prepareInitialGroupCurrentPublication(input, request, response) {
+    const current = () => !input.signal?.aborted && input.stillCurrent();
+    assertProjectionVerificationCurrent(current);
+    const expectedHead = await groupPolicyMutationHead(request);
+    if (request.state.principalType !== "group" ||
+        request.state.version !== 1 ||
+        request.state.prevStateHash !== null ||
+        !principalHeadMatchesReference(expectedHead, input.expectedHead))
+        throw new KeyingVerificationError("object_mismatch", "Initial group publication must begin at its exact genesis");
+    assertPrincipalPolicyReceiptArtifacts({ expectedHead, request, response });
+    const keys = await collectPrincipalPolicySignerPublicKeys({
+        bundle: { currentState: response.currentState, previousStates: [] },
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+    });
+    if ("error" in keys)
+        throw new KeyingVerificationError("signer_mismatch", "Initial group signer could not be authenticated");
+    const externalAuthority = await input.loadExternalAuthority?.(request.state.externalAuthority ? [request.state.externalAuthority] : []);
+    assertProjectionVerificationCurrent(current);
+    const verifier = createPrincipalPolicyHistoryVerifier({
+        principalType: "group",
+        principalId: expectedHead.principalId,
+    });
+    const entry = {
+        state: response.currentState,
+        projection: response.currentProjection,
+        grants: response.currentGrants,
+    };
+    assertPrincipalHistoryVerificationMode(input, [entry]);
+    const appended = await verifier.append({
+        entries: [entry],
+        signerPublicKeys: keys.signerPublicKeys,
+        ...(externalAuthority ? { externalAuthority } : {}),
+    });
+    if (!appended.ok)
+        throw appended.error;
+    const history = verifier.finish(expectedHead);
+    if (!history.ok)
+        throw history.error;
+    const policy = await verifyPrincipalPolicyCurrent({
+        current: response,
+        history: history.value,
+    });
+    if (!policy.ok)
+        throw policy.error;
+    const options = {
+        ...input,
+        protection: {
+            ...input.protection,
+            context: principalHistoryVerificationContext(input),
+        },
+    };
+    const scopeId = await principalHistoryEvidenceScopeId({
+        organizationId: input.organizationId,
+        head: expectedHead,
+        protection: options.protection,
+    });
+    const sealed = await sealPrincipalCurrentPublication(options, scopeId, expectedHead, verifier, response);
+    assertProjectionVerificationCurrent(current);
+    return {
+        ...sealed,
+        policy: policy.value,
+        predecessorStage: null,
+        previousPrefixProgress: null,
+        evidence: await preparePrincipalHistoryEvidencePage({
+            scopeId,
+            organizationId: input.organizationId,
+            entries: [entry],
+            nodes: appended.value.indexNodes,
+        }),
+    };
+}
+//# sourceMappingURL=initialPrincipalCurrentPublication.js.map

package/workflows/organizations/initialPrincipalCurrentPublication.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"initialPrincipalCurrentPublication.js","sourceRoot":"","sources":["initialPrincipalCurrentPublication.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oCAAoC,EACpC,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AAEpG,OAAO,EAAE,mCAAmC,EAAE,MAAM,4DAA4D,CAAC;AACjH,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,EAAE,+BAA+B,EAAE,MAAM,wDAAwD,CAAC;AACzG,OAAO,EAAE,sCAAsC,EAAE,MAAM,kCAAkC,CAAC;AAE1F,OAAO,EACL,sCAAsC,EACtC,mCAAmC,GACpC,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,+BAA+B,EAAE,MAAM,mCAAmC,CAAC;AACpF,OAAO,EAAE,qCAAqC,EAAE,MAAM,mCAAmC,CAAC;AAE1F,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,KAA2C,EAC3C,OAAkC,EAClC,QAAyC;IAEzC,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;IACrE,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,YAAY,GAAG,MAAM,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAC5D,IACE,OAAO,CAAC,KAAK,CAAC,aAAa,KAAK,OAAO;QACvC,OAAO,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC;QAC3B,OAAO,CAAC,KAAK,CAAC,aAAa,KAAK,IAAI;QACpC,CAAC,6BAA6B,CAAC,YAAY,EAAE,KAAK,CAAC,YAAY,CAAC;QAEhE,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,2DAA2D,CAC5D,CAAC;IACJ,qCAAqC,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC3E,MAAM,IAAI,GAAG,MAAM,sCAAsC,CAAC;QACxD,MAAM,EAAE,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,cAAc,EAAE,EAAE,EAAE;QACnE,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,IAAI,OAAO,IAAI,IAAI;QACjB,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,iDAAiD,CAClD,CAAC;IACJ,MAAM,iBAAiB,GAAG,MAAM,KAAK,CAAC,qBAAqB,EAAE,CAC3D,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CACzE,CAAC;IACF,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,oCAAoC,CAAC;QACpD,aAAa,EAAE,OAAO;QACtB,WAAW,EAAE,YAAY,CAAC,WAAW;KACtC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG;QACZ,KAAK,EAAE,QAAQ,CAAC,YAAY;QAC5B,UAAU,EAAE,QAAQ,CAAC,iBAAiB;QACtC,MAAM,EAAE,QAAQ,CAAC,aAAa;KAC/B,CAAC;IACF,sCAAsC,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC;QACrC,OAAO,EAAE,CAAC,KAAK,CAAC;QAChB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvC,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC9C,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,OAAO,CAAC,KAAK,CAAC;IACrC,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC;QAChD,OAAO,EAAE,QAAQ;QACjB,OAAO,EAAE,OAAO,CAAC,KAAK;KACvB,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,MAAM,CAAC,KAAK,CAAC;IACnC,MAAM,OAAO,GAAG;QACd,GAAG,KAAK;QACR,UAAU,EAAE;YACV,GAAG,KAAK,CAAC,UAAU;YACnB,OAAO,EAAE,mCAAmC,CAAC,KAAK,CAAC;SACpD;KACF,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,+BAA+B,CAAC;QACpD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,IAAI,EAAE,YAAY;QAClB,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,+BAA+B,CAClD,OAAO,EACP,OAAO,EACP,YAAY,EACZ,QAAQ,EACR,QAAQ,CACT,CAAC;IACF,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO;QACL,GAAG,MAAM;QACT,MAAM,EAAE,MAAM,CAAC,KAAK;QACpB,gBAAgB,EAAE,IAAI;QACtB,sBAAsB,EAAE,IAAI;QAC5B,QAAQ,EAAE,MAAM,mCAAmC,CAAC;YAClD,OAAO;YACP,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,OAAO,EAAE,CAAC,KAAK,CAAC;YAChB,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;SACjC,CAAC;KACH,CAAC;AACJ,CAAC","sourcesContent":["import {\n createPrincipalPolicyHistoryVerifier,\n KeyingVerificationError,\n verifyPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport type { PutPrincipalPolicyRequest } from \"@tearleads/validators/request\";\nimport type { PrincipalPolicyMutationResponse } from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport type { AcknowledgedPrincipalCurrentPublication } from \"../../data/persistence/principalCurrentAcknowledgementPersistence\";\nimport { preparePrincipalHistoryEvidencePage } from \"../../data/persistence/principalHistoryEvidencePersistence\";\nimport { principalHeadMatchesReference } from \"../../data/principals/organizationAuthorityDescriptor\";\nimport { principalHistoryEvidenceScopeId } from \"../../data/principals/principalHistoryPrefixProtection\";\nimport { collectPrincipalPolicySignerPublicKeys } from \"../principals/policyVerification\";\nimport type { RecoverPrincipalPolicyHistoryOptions } from \"../principals/principalHistoryRecoveryTypes\";\nimport {\n assertPrincipalHistoryVerificationMode,\n principalHistoryVerificationContext,\n} from \"../principals/principalHistoryRecoveryVerification\";\nimport { groupPolicyMutationHead } from \"./groupPolicyMutationHead\";\nimport { sealPrincipalCurrentPublication } from \"./principalCurrentPublicationSeal\";\nimport { assertPrincipalPolicyReceiptArtifacts } from \"./principalPolicyReceiptArtifacts\";\n\n/** Verify a newly authored group from genesis before its atomic directory publication. */\nexport async function prepareInitialGroupCurrentPublication(\n input: RecoverPrincipalPolicyHistoryOptions,\n request: PutPrincipalPolicyRequest,\n response: PrincipalPolicyMutationResponse,\n): Promise<AcknowledgedPrincipalCurrentPublication> {\n const current = () => !input.signal?.aborted && input.stillCurrent();\n assertProjectionVerificationCurrent(current);\n const expectedHead = await groupPolicyMutationHead(request);\n if (\n request.state.principalType !== \"group\" ||\n request.state.version !== 1 ||\n request.state.prevStateHash !== null ||\n !principalHeadMatchesReference(expectedHead, input.expectedHead)\n )\n throw new KeyingVerificationError(\n \"object_mismatch\",\n \"Initial group publication must begin at its exact genesis\",\n );\n assertPrincipalPolicyReceiptArtifacts({ expectedHead, request, response });\n const keys = await collectPrincipalPolicySignerPublicKeys({\n bundle: { currentState: response.currentState, previousStates: [] },\n resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n });\n if (\"error\" in keys)\n throw new KeyingVerificationError(\n \"signer_mismatch\",\n \"Initial group signer could not be authenticated\",\n );\n const externalAuthority = await input.loadExternalAuthority?.(\n request.state.externalAuthority ? [request.state.externalAuthority] : [],\n );\n assertProjectionVerificationCurrent(current);\n const verifier = createPrincipalPolicyHistoryVerifier({\n principalType: \"group\",\n principalId: expectedHead.principalId,\n });\n const entry = {\n state: response.currentState,\n projection: response.currentProjection,\n grants: response.currentGrants,\n };\n assertPrincipalHistoryVerificationMode(input, [entry]);\n const appended = await verifier.append({\n entries: [entry],\n signerPublicKeys: keys.signerPublicKeys,\n ...(externalAuthority ? { externalAuthority } : {}),\n });\n if (!appended.ok) throw appended.error;\n const history = verifier.finish(expectedHead);\n if (!history.ok) throw history.error;\n const policy = await verifyPrincipalPolicyCurrent({\n current: response,\n history: history.value,\n });\n if (!policy.ok) throw policy.error;\n const options = {\n ...input,\n protection: {\n ...input.protection,\n context: principalHistoryVerificationContext(input),\n },\n };\n const scopeId = await principalHistoryEvidenceScopeId({\n organizationId: input.organizationId,\n head: expectedHead,\n protection: options.protection,\n });\n const sealed = await sealPrincipalCurrentPublication(\n options,\n scopeId,\n expectedHead,\n verifier,\n response,\n );\n assertProjectionVerificationCurrent(current);\n return {\n ...sealed,\n policy: policy.value,\n predecessorStage: null,\n previousPrefixProgress: null,\n evidence: await preparePrincipalHistoryEvidencePage({\n scopeId,\n organizationId: input.organizationId,\n entries: [entry],\n nodes: appended.value.indexNodes,\n }),\n };\n}\n"]}

package/workflows/organizations/organizationGroupDirectory.js CHANGED Viewed

@@ -1,5 +1,6 @@
 import { buildPrincipalStateSigningInput, generateKemSeedAndKeyPair, normalizePrincipalProjectionMembers, signPrincipalState, toFingerprint, } from "../../internal/crypto/index.js";
 import { bytesToBase64 } from "../../internal/encoding/index.js";
+import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
 import { persistLocallyAcknowledgedPrincipalPolicyBundles } from "../../data/persistence/locallyAcknowledgedCheckpointPersistence.js";
 import { encodeOrganizationAuthorityDescriptor, normalizeOrganizationGroupHeads, } from "../../data/principals/organizationAuthorityDescriptor.js";
 import { assertGroupNameUniqueInDirectory } from "./groupNameUniqueness.js";
@@ -78,6 +79,7 @@ export async function buildOrganizationGroupDirectoryPolicyRequest(input) {
     };
 }
 export async function commitCreatedGroupToDirectory(input) {
+    assertProjectionVerificationCurrent(input.stillCurrent);
     // Signed group names are unique per organization; refuse a collision before
     // anything reaches the server.
     await assertGroupNameUniqueInDirectory({
@@ -110,7 +112,9 @@ export async function commitCreatedGroupToDirectory(input) {
         signingFingerprint: input.signingFingerprint,
         signingKeyPair: input.signingKeyPair,
     });
+    assertProjectionVerificationCurrent(input.stillCurrent);
     const stored = await input.apiClient.createOrganizationGroup(input.organizationId, { ...input.request, organizationPolicy: organizationRequest });
+    assertProjectionVerificationCurrent(input.stillCurrent);
     if (!stored) {
         throw new Error("Group could not be created");
     }
@@ -141,7 +145,9 @@ export async function commitCreatedGroupToDirectory(input) {
         execSql: input.execSql,
         organizationId: input.organizationId,
         updatedAt: new Date().toISOString(),
+        stillCurrent: input.stillCurrent,
     });
+    assertProjectionVerificationCurrent(input.stillCurrent);
     return { group: stored.group, head: expectedHead };
 }
 //# sourceMappingURL=organizationGroupDirectory.js.map