@tearleads/client-sdk 0.1.15 → 0.1.17

package/client/organizations/principalMutations.d.ts

@@ -24,108 +24,6 @@ interface PrincipalMutationRuntime {
     readonly runtime: InternalWorkflowRuntimeInput;
 }
 export declare function addUserToOrganizationGroup(input: PrincipalMutationRuntime & AddOrganizationGroupUserInput): Promise<{
-    previousStates: {
-        grants: {
-            accessLevel: "admin" | "read" | "write";
-            containerId: string;
-        }[];
-        projection: {
-            role: "member" | "admin";
-            userId: string;
-        }[];
-        state: {
-            createdAt: string;
-            encapsulationPublicKey: string;
-            externalAuthority: {
-                keyEpoch: number;
-                keyFingerprint: string;
-                principalId: string;
-                principalType: "group";
-                stateHash: string;
-                version: number;
-            } | null;
-            grantCount: number;
-            grantRoot: string;
-            keyEpoch: number;
-            keyFingerprint: string;
-            memberCount: number;
-            memberEnvelopesRoot: string;
-            membershipMode: "projection";
-            membershipRoot: string;
-            payloadCiphertextHash: string;
-            prevStateHash: string | null;
-            principalId: string;
-            principalType: "group" | "organization";
-            projectionRoot: string;
-            signature: string;
-            signedAt: string;
-            signerUserId: string;
-            signerUserKeyFingerprint: string;
-            stateHash: string;
-            version: number;
-        };
-    }[];
-    currentGrants: {
-        accessLevel: "admin" | "read" | "write";
-        containerId: string;
-    }[];
-    currentMemberEnvelopes: {
-        envelopes: {
-            kemCipherText: string;
-            memberKeyFingerprint: string;
-            userId: string;
-            wrappedKey: string;
-        }[];
-        epoch: number;
-        principalId: string;
-        principalType: "group" | "organization";
-        stateHash: string;
-    };
-    currentPayload: {
-        cipherSuite: "aes-256-gcm";
-        ciphertext: string;
-        ciphertextHash: string;
-        createdAt: string;
-        principalId: string;
-        principalType: "group" | "organization";
-        stateHash: string;
-    };
-    currentProjection: {
-        role: "member" | "admin";
-        userId: string;
-    }[];
-    currentState: {
-        createdAt: string;
-        encapsulationPublicKey: string;
-        externalAuthority: {
-            keyEpoch: number;
-            keyFingerprint: string;
-            principalId: string;
-            principalType: "group";
-            stateHash: string;
-            version: number;
-        } | null;
-        grantCount: number;
-        grantRoot: string;
-        keyEpoch: number;
-        keyFingerprint: string;
-        memberCount: number;
-        memberEnvelopesRoot: string;
-        membershipMode: "projection";
-        membershipRoot: string;
-        payloadCiphertextHash: string;
-        prevStateHash: string | null;
-        principalId: string;
-        principalType: "group" | "organization";
-        projectionRoot: string;
-        signature: string;
-        signedAt: string;
-        signerUserId: string;
-        signerUserKeyFingerprint: string;
-        stateHash: string;
-        version: number;
-    };
-} & {
     containerMutations: {
         createdAt: string;
         manifestHead: {
@@ -250,10 +148,12 @@ export declare function addUserToOrganizationGroup(input: PrincipalMutationRunti
 export declare function createGroupForOrganization(input: {
     readonly name: string;
     readonly runtime: InternalWorkflowRuntimeInput;
+    readonly stillCurrent: () => boolean;
 }): Promise<import("./index.js").OrganizationGroupSummary>;
 export declare function deleteGroupForOrganization(input: {
     readonly groupId: string;
     readonly runtime: InternalWorkflowRuntimeInput;
+    readonly stillCurrent: () => boolean;
 }): Promise<{
     deleted: true;
     groupId: string;
@@ -382,108 +282,6 @@ export declare function deleteGroupForOrganization(input: {
     organizationId: string;
 }>;
 export declare function removeUserFromOrganizationGroup(input: PrincipalMutationRuntime & RemoveOrganizationGroupUserInput): Promise<{
-    previousStates: {
-        grants: {
-            accessLevel: "admin" | "read" | "write";
-            containerId: string;
-        }[];
-        projection: {
-            role: "member" | "admin";
-            userId: string;
-        }[];
-        state: {
-            createdAt: string;
-            encapsulationPublicKey: string;
-            externalAuthority: {
-                keyEpoch: number;
-                keyFingerprint: string;
-                principalId: string;
-                principalType: "group";
-                stateHash: string;
-                version: number;
-            } | null;
-            grantCount: number;
-            grantRoot: string;
-            keyEpoch: number;
-            keyFingerprint: string;
-            memberCount: number;
-            memberEnvelopesRoot: string;
-            membershipMode: "projection";
-            membershipRoot: string;
-            payloadCiphertextHash: string;
-            prevStateHash: string | null;
-            principalId: string;
-            principalType: "group" | "organization";
-            projectionRoot: string;
-            signature: string;
-            signedAt: string;
-            signerUserId: string;
-            signerUserKeyFingerprint: string;
-            stateHash: string;
-            version: number;
-        };
-    }[];
-    currentGrants: {
-        accessLevel: "admin" | "read" | "write";
-        containerId: string;
-    }[];
-    currentMemberEnvelopes: {
-        envelopes: {
-            kemCipherText: string;
-            memberKeyFingerprint: string;
-            userId: string;
-            wrappedKey: string;
-        }[];
-        epoch: number;
-        principalId: string;
-        principalType: "group" | "organization";
-        stateHash: string;
-    };
-    currentPayload: {
-        cipherSuite: "aes-256-gcm";
-        ciphertext: string;
-        ciphertextHash: string;
-        createdAt: string;
-        principalId: string;
-        principalType: "group" | "organization";
-        stateHash: string;
-    };
-    currentProjection: {
-        role: "member" | "admin";
-        userId: string;
-    }[];
-    currentState: {
-        createdAt: string;
-        encapsulationPublicKey: string;
-        externalAuthority: {
-            keyEpoch: number;
-            keyFingerprint: string;
-            principalId: string;
-            principalType: "group";
-            stateHash: string;
-            version: number;
-        } | null;
-        grantCount: number;
-        grantRoot: string;
-        keyEpoch: number;
-        keyFingerprint: string;
-        memberCount: number;
-        memberEnvelopesRoot: string;
-        membershipMode: "projection";
-        membershipRoot: string;
-        payloadCiphertextHash: string;
-        prevStateHash: string | null;
-        principalId: string;
-        principalType: "group" | "organization";
-        projectionRoot: string;
-        signature: string;
-        signedAt: string;
-        signerUserId: string;
-        signerUserKeyFingerprint: string;
-        stateHash: string;
-        version: number;
-    };
-} & {
     containerMutations: {
         createdAt: string;
         manifestHead: {
@@ -664,109 +462,7 @@ export declare function revokeOrganizationGrant(input: PrincipalMutationRuntime
         wraps: Record<string, unknown>[];
     };
     systemSlot?: string | null | undefined;
-} | ({
-    previousStates: {
-        grants: {
-            accessLevel: "admin" | "read" | "write";
-            containerId: string;
-        }[];
-        projection: {
-            role: "member" | "admin";
-            userId: string;
-        }[];
-        state: {
-            createdAt: string;
-            encapsulationPublicKey: string;
-            externalAuthority: {
-                keyEpoch: number;
-                keyFingerprint: string;
-                principalId: string;
-                principalType: "group";
-                stateHash: string;
-                version: number;
-            } | null;
-            grantCount: number;
-            grantRoot: string;
-            keyEpoch: number;
-            keyFingerprint: string;
-            memberCount: number;
-            memberEnvelopesRoot: string;
-            membershipMode: "projection";
-            membershipRoot: string;
-            payloadCiphertextHash: string;
-            prevStateHash: string | null;
-            principalId: string;
-            principalType: "group" | "organization";
-            projectionRoot: string;
-            signature: string;
-            signedAt: string;
-            signerUserId: string;
-            signerUserKeyFingerprint: string;
-            stateHash: string;
-            version: number;
-        };
-    }[];
-    currentGrants: {
-        accessLevel: "admin" | "read" | "write";
-        containerId: string;
-    }[];
-    currentMemberEnvelopes: {
-        envelopes: {
-            kemCipherText: string;
-            memberKeyFingerprint: string;
-            userId: string;
-            wrappedKey: string;
-        }[];
-        epoch: number;
-        principalId: string;
-        principalType: "group" | "organization";
-        stateHash: string;
-    };
-    currentPayload: {
-        cipherSuite: "aes-256-gcm";
-        ciphertext: string;
-        ciphertextHash: string;
-        createdAt: string;
-        principalId: string;
-        principalType: "group" | "organization";
-        stateHash: string;
-    };
-    currentProjection: {
-        role: "member" | "admin";
-        userId: string;
-    }[];
-    currentState: {
-        createdAt: string;
-        encapsulationPublicKey: string;
-        externalAuthority: {
-            keyEpoch: number;
-            keyFingerprint: string;
-            principalId: string;
-            principalType: "group";
-            stateHash: string;
-            version: number;
-        } | null;
-        grantCount: number;
-        grantRoot: string;
-        keyEpoch: number;
-        keyFingerprint: string;
-        memberCount: number;
-        memberEnvelopesRoot: string;
-        membershipMode: "projection";
-        membershipRoot: string;
-        payloadCiphertextHash: string;
-        prevStateHash: string | null;
-        principalId: string;
-        principalType: "group" | "organization";
-        projectionRoot: string;
-        signature: string;
-        signedAt: string;
-        signerUserId: string;
-        signerUserKeyFingerprint: string;
-        stateHash: string;
-        version: number;
-    };
-} & {
+} | {
     containerMutations: {
         createdAt: string;
         manifestHead: {
@@ -887,5 +583,5 @@ export declare function revokeOrganizationGrant(input: PrincipalMutationRuntime
         stateHash: string;
         version: number;
     };
-})>;
+}>;
 export {};

package/client/organizations/principalMutations.js

@@ -1,7 +1,12 @@
 import { runWithSecurityIncidentReporting } from "../../data/keyingProjectionVerification/error.js";
 import { addOrganizationGroupUser, createOrganizationGroup, deleteOrganizationGroup, removeOrganizationGroupUser, revokeOrganizationContainerGrant, rotateOrganizationGroupForAccessSetShrink, } from "../../workflows/organizations/index.js";
+import { createCurrentOrganizationGroup } from "../../workflows/organizations/createCurrentOrganizationGroup.js";
+import { createSelectedCurrentGroupMetadataContainerVerifier } from "../../workflows/organizations/currentGroupMetadataAuthority.js";
+import { deleteCurrentOrganizationGroup } from "../../workflows/organizations/deleteCurrentOrganizationGroup.js";
 import { createRuntimeGroupMetadataAccess } from "../../workflows/organizations/groupMetadataRuntime.js";
+import { createRuntimeCurrentOrganizationMutation } from "../../workflows/organizations/runtimeCurrentOrganizationMutation.js";
 import { createRuntimePrincipalPolicyWarmer } from "../../workflows/principals/runtimePolicyWarmer.js";
+import { createCurrentPrincipalMutation } from "./currentPrincipalMutations.js";
 import { syncOrganizationMetadataProfile } from "./organizationMetadataProfileSync.js";
 import { preparePrincipalContainerMutations } from "./principalContainerMutations.js";
 function requireSigningContext(runtime) {
@@ -33,30 +38,44 @@ export async function addUserToOrganizationGroup(input) {
         organizationId: signingContext.organizationId,
     }, async () => {
         let memberGroupId = null;
-        const bundle = await addOrganizationGroupUser({
-            apiClient: input.runtime.apiClient,
-            beforePolicyCommit: (_head, authority) => {
-                memberGroupId = authority.memberGroupId;
-            },
-            currentUserSecretKey: requireEncapsulationKeyPair(input.runtime)
-                .secretKey,
-            execSql: input.runtime.infra.execSql,
-            expectedGroupName: input.expectedGroupName,
-            readEncryptedName: createRuntimeGroupMetadataAccess(input.runtime, signingContext.organizationId, input.stillCurrent).readName,
-            groupId: input.groupId,
-            prepareContainerMutations: ({ currentPolicy, nextPolicy }) => preparePrincipalContainerMutations({
-                currentPolicy,
-                groupId: input.groupId,
-                nextPolicy,
-                organizationId: signingContext.organizationId,
-                runtime: input.runtime,
-                stillCurrent: input.stillCurrent,
-            }),
-            reportSecurityIncident: input.runtime.util.reportSecurityIncident,
-            resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
-            targetUserId: input.targetUserId,
+        const mutateCurrent = createCurrentPrincipalMutation({
             ...signingContext,
+            runtime: input.runtime,
+            stillCurrent: input.stillCurrent,
         });
+        const current = mutateCurrent
+            ? await mutateCurrent(input.groupId, {
+                kind: "add",
+                expectedGroupName: input.expectedGroupName,
+                targetUserId: input.targetUserId,
+            })
+            : undefined;
+        memberGroupId = current?.memberGroupId ?? null;
+        const bundle = current?.response ??
+            (await addOrganizationGroupUser({
+                apiClient: input.runtime.apiClient,
+                beforePolicyCommit: (_head, authority) => {
+                    memberGroupId = authority.memberGroupId;
+                },
+                currentUserSecretKey: requireEncapsulationKeyPair(input.runtime)
+                    .secretKey,
+                execSql: input.runtime.infra.execSql,
+                expectedGroupName: input.expectedGroupName,
+                readEncryptedName: createRuntimeGroupMetadataAccess(input.runtime, signingContext.organizationId, input.stillCurrent).readName,
+                groupId: input.groupId,
+                prepareContainerMutations: ({ currentPolicy, nextPolicy }) => preparePrincipalContainerMutations({
+                    currentPolicy,
+                    groupId: input.groupId,
+                    nextPolicy,
+                    organizationId: signingContext.organizationId,
+                    runtime: input.runtime,
+                    stillCurrent: input.stillCurrent,
+                }),
+                reportSecurityIncident: input.runtime.util.reportSecurityIncident,
+                resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
+                targetUserId: input.targetUserId,
+                ...signingContext,
+            }));
         if (input.groupId === memberGroupId) {
             await syncOrganizationMetadataProfile({
                 containerContents: input.containerContents,
@@ -75,16 +94,37 @@ export function createGroupForOrganization(input) {
         objectKind: "principal",
         operation: "group.create",
         organizationId: signingContext.organizationId,
-    }, () => createOrganizationGroup({
-        apiClient: input.runtime.apiClient,
-        creatorEncapsulationKeyPair: requireEncapsulationKeyPair(input.runtime),
-        execSql: input.runtime.infra.execSql,
-        name: input.name,
-        metadataAccess: createRuntimeGroupMetadataAccess(input.runtime, signingContext.organizationId),
-        reportSecurityIncident: input.runtime.util.reportSecurityIncident,
-        resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
-        ...signingContext,
-    }));
+    }, () => {
+        const creatorEncapsulationKeyPair = requireEncapsulationKeyPair(input.runtime);
+        const mutate = createRuntimeCurrentOrganizationMutation(input.runtime);
+        if (mutate)
+            return mutate({ ...signingContext, stillCurrent: input.stillCurrent }, (context) => createCurrentOrganizationGroup({
+                ...signingContext,
+                context,
+                apiClient: input.runtime.apiClient,
+                creatorEncapsulationKeyPair,
+                execSql: input.runtime.infra.execSql,
+                name: input.name,
+                metadataAccess: createRuntimeGroupMetadataAccess(input.runtime, signingContext.organizationId, context.stillCurrent, createSelectedCurrentGroupMetadataContainerVerifier({
+                    authority: context,
+                    organizationId: signingContext.organizationId,
+                    stillCurrent: context.stillCurrent,
+                })),
+                reportSecurityIncident: input.runtime.util.reportSecurityIncident,
+                resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
+            }));
+        return createOrganizationGroup({
+            stillCurrent: input.stillCurrent,
+            apiClient: input.runtime.apiClient,
+            creatorEncapsulationKeyPair,
+            execSql: input.runtime.infra.execSql,
+            name: input.name,
+            metadataAccess: createRuntimeGroupMetadataAccess(input.runtime, signingContext.organizationId, input.stillCurrent),
+            reportSecurityIncident: input.runtime.util.reportSecurityIncident,
+            resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
+            ...signingContext,
+        });
+    });
 }
 export function deleteGroupForOrganization(input) {
     const signingContext = requireSigningContext(input.runtime);
@@ -93,13 +133,25 @@ export function deleteGroupForOrganization(input) {
         objectKind: "principal",
         operation: "group.delete",
         organizationId: signingContext.organizationId,
-    }, () => deleteOrganizationGroup({
-        apiClient: input.runtime.apiClient,
-        execSql: input.runtime.infra.execSql,
-        groupId: input.groupId,
-        resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
-        ...signingContext,
-    }));
+    }, () => {
+        const mutate = createRuntimeCurrentOrganizationMutation(input.runtime);
+        if (mutate)
+            return mutate({ ...signingContext, stillCurrent: input.stillCurrent }, (context) => deleteCurrentOrganizationGroup({
+                ...signingContext,
+                context,
+                groupId: input.groupId,
+                apiClient: input.runtime.apiClient,
+                resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
+            }));
+        return deleteOrganizationGroup({
+            stillCurrent: input.stillCurrent,
+            apiClient: input.runtime.apiClient,
+            execSql: input.runtime.infra.execSql,
+            groupId: input.groupId,
+            resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
+            ...signingContext,
+        });
+    });
 }
 export async function removeUserFromOrganizationGroup(input) {
     const signingContext = requireSigningContext(input.runtime);
@@ -110,27 +162,41 @@ export async function removeUserFromOrganizationGroup(input) {
         organizationId: signingContext.organizationId,
     }, async () => {
         let memberGroupId = null;
-        const bundle = await removeOrganizationGroupUser({
-            apiClient: input.runtime.apiClient,
-            beforePolicyCommit: (_head, authority) => {
-                memberGroupId = authority.memberGroupId;
-            },
-            execSql: input.runtime.infra.execSql,
-            expectedGroupName: input.expectedGroupName,
-            readEncryptedName: createRuntimeGroupMetadataAccess(input.runtime, signingContext.organizationId, input.stillCurrent).readName,
-            groupId: input.groupId,
-            prepareContainerMutations: ({ currentPolicy, nextPolicy }) => preparePrincipalContainerMutations({
-                currentPolicy,
-                groupId: input.groupId,
-                nextPolicy,
-                organizationId: signingContext.organizationId,
-                runtime: input.runtime,
-                stillCurrent: input.stillCurrent,
-            }),
-            removedUserId: input.removedUserId,
-            resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
+        const mutateCurrent = createCurrentPrincipalMutation({
             ...signingContext,
+            runtime: input.runtime,
+            stillCurrent: input.stillCurrent,
         });
+        const current = mutateCurrent
+            ? await mutateCurrent(input.groupId, {
+                kind: "remove",
+                expectedGroupName: input.expectedGroupName,
+                removedUserId: input.removedUserId,
+            })
+            : undefined;
+        memberGroupId = current?.memberGroupId ?? null;
+        const bundle = current?.response ??
+            (await removeOrganizationGroupUser({
+                apiClient: input.runtime.apiClient,
+                beforePolicyCommit: (_head, authority) => {
+                    memberGroupId = authority.memberGroupId;
+                },
+                execSql: input.runtime.infra.execSql,
+                expectedGroupName: input.expectedGroupName,
+                readEncryptedName: createRuntimeGroupMetadataAccess(input.runtime, signingContext.organizationId, input.stillCurrent).readName,
+                groupId: input.groupId,
+                prepareContainerMutations: ({ currentPolicy, nextPolicy }) => preparePrincipalContainerMutations({
+                    currentPolicy,
+                    groupId: input.groupId,
+                    nextPolicy,
+                    organizationId: signingContext.organizationId,
+                    runtime: input.runtime,
+                    stillCurrent: input.stillCurrent,
+                }),
+                removedUserId: input.removedUserId,
+                resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
+                ...signingContext,
+            }));
         if (input.groupId === memberGroupId) {
             await syncOrganizationMetadataProfile({
                 containerContents: input.containerContents,
@@ -154,39 +220,51 @@ export async function revokeOrganizationGrant(input) {
         operation: "principal.grant.revoke",
         organizationId: signingContext.organizationId,
     }, async () => {
-        const response = input.subjectType === "group"
-            ? await rotateOrganizationGroupForAccessSetShrink({
-                apiClient: input.runtime.apiClient,
-                execSql: input.runtime.infra.execSql,
-                groupId: input.subjectId,
+        const mutateCurrent = createCurrentPrincipalMutation({
+            ...signingContext,
+            runtime: input.runtime,
+            stillCurrent: input.stillCurrent,
+        });
+        const current = input.subjectType === "group" && mutateCurrent
+            ? await mutateCurrent(input.subjectId, {
+                kind: "revoke",
                 revokedContainerId: input.containerId,
-                prepareContainerMutations: ({ currentPolicy, nextPolicy }) => preparePrincipalContainerMutations({
-                    currentPolicy,
+            })
+            : undefined;
+        const response = current?.response ??
+            (input.subjectType === "group"
+                ? await rotateOrganizationGroupForAccessSetShrink({
+                    apiClient: input.runtime.apiClient,
+                    execSql: input.runtime.infra.execSql,
                     groupId: input.subjectId,
-                    nextPolicy,
-                    organizationId: signingContext.organizationId,
                     revokedContainerId: input.containerId,
-                    runtime: input.runtime,
+                    prepareContainerMutations: ({ currentPolicy, nextPolicy }) => preparePrincipalContainerMutations({
+                        currentPolicy,
+                        groupId: input.subjectId,
+                        nextPolicy,
+                        organizationId: signingContext.organizationId,
+                        revokedContainerId: input.containerId,
+                        runtime: input.runtime,
+                        stillCurrent: input.stillCurrent,
+                    }),
+                    resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
+                    ...signingContext,
+                })
+                : await revokeOrganizationContainerGrant({
                     stillCurrent: input.stillCurrent,
-                }),
-                resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
-                ...signingContext,
-            })
-            : await revokeOrganizationContainerGrant({
-                stillCurrent: input.stillCurrent,
-                reportSecurityIncident: input.runtime.util.reportSecurityIncident,
-                apiClient: input.runtime.apiClient,
-                containerId: input.containerId,
-                encapsulationKeyPair,
-                execSql: input.runtime.infra.execSql,
-                revokedSubject: {
-                    subjectId: input.subjectId,
-                    subjectType: input.subjectType,
-                },
-                resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
-                warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(input.runtime),
-                ...signingContext,
-            });
+                    reportSecurityIncident: input.runtime.util.reportSecurityIncident,
+                    apiClient: input.runtime.apiClient,
+                    containerId: input.containerId,
+                    encapsulationKeyPair,
+                    execSql: input.runtime.infra.execSql,
+                    revokedSubject: {
+                        subjectId: input.subjectId,
+                        subjectType: input.subjectType,
+                    },
+                    resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
+                    warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(input.runtime),
+                    ...signingContext,
+                }));
         await input.readModelCoordinator.reconcileAfterMutation(signingContext.organizationId);
         return response;
     });