npm - @tearleads/client-sdk - Versions diffs - 0.1.16 → 0.1.17 - Mend

@tearleads/client-sdk 0.1.16 → 0.1.17

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (128) hide show

package/workflows/organizations/currentPrincipalMutationLease.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"currentPrincipalMutationLease.js","sourceRoot":"","sources":["currentPrincipalMutationLease.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,8BAA8B,EAAE,MAAM,+CAA+C,CAAC;AAC/F,OAAO,EAAE,0BAA0B,EAAE,MAAM,uDAAuD,CAAC;AACnG,OAAO,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AACvG,OAAO,EACL,2CAA2C,GAE5C,MAAM,qCAAqC,CAAC;AAsB7C,yFAAyF;AACzF,MAAM,UAAU,mCAAmC,CACjD,OAAuC;IAEvC,MAAM,KAAK,GAAG,8BAA8B,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,oBAAoB,GACxB,2CAA2C,CAAC,OAAO,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,uBAAuB,EAAE,IAAI,CAC/D,OAAO,CAAC,SAAS,CAClB,CAAC;IACF,IAAI,CAAC,KAAK,IAAI,CAAC,oBAAoB,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACpE,OAAO,KAAK,EACV,aAA4B,EAC5B,IAAmE,EACvD,EAAE,CACd,KAAK,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,EAAE,EAAE;QACzD,IAAI,MAAM,GAAG,IAAI,CAAC;QAClB,MAAM,YAAY,GAAG,GAAG,EAAE,CAAC,MAAM,IAAI,YAAY,EAAE,IAAI,aAAa,EAAE,CAAC;QACvE,IAAI,CAAC;YACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;YAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC;gBACxB,UAAU;gBACV,YAAY;gBACZ,oBAAoB;gBACpB,SAAS;gBACT,iBAAiB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;oBAC/B,SAAS,EAAE,EAAE,uBAAuB,EAAE,SAAS,EAAE;oBACjD,YAAY,EAAE,kCAAkC,CAAC,OAAO,CAAC;oBACzD,UAAU,EAAE,0BAA0B,CAAC,UAAU,CAAC;oBAClD,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;iBAC/D,CAAC;aACH,CAAC,CAAC;YACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;YAClD,OAAO,MAAM,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,MAAM,GAAG,KAAK,CAAC;QACjB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC","sourcesContent":["import type { PrincipalPolicyPageCurrent } from \"@tearleads/api-client\";\nimport type { PrincipalPolicyHistoryProgressOptions } from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { readPrincipalHistoryProtection } from \"../../data/principals/principalHistoryRuntime\";\nimport { directoryHistoryProtection } from \"../../data/principals/principalHistoryScopeProtection\";\nimport { principalPolicyReferenceFromBundle } from \"../../data/principals/principalPolicyAdminSigners\";\nimport {\n createRuntimePrincipalPolicyCurrentResolver,\n type PrincipalPolicyRecoveryRuntime,\n} from \"../principals/runtimePolicyRecovery\";\nimport type { AcknowledgedPrincipalCurrentInput } from \"./retainAcknowledgedPrincipalCurrents\";\n\ninterface CurrentPrincipalMutationLeaseContext {\n readonly protection: PrincipalPolicyHistoryProgressOptions;\n readonly stillCurrent: () => boolean;\n readonly resolveCurrentPolicy: NonNullable<\n ReturnType<typeof createRuntimePrincipalPolicyCurrentResolver>\n >;\n readonly readPages: NonNullable<\n PrincipalPolicyRecoveryRuntime[\"apiClient\"][\"getPrincipalPolicyPages\"]\n >;\n readonly directoryRecovery: (\n current: PrincipalPolicyPageCurrent,\n ) => AcknowledgedPrincipalCurrentInput[\"recovery\"];\n}\n\ntype CurrentPrincipalMutationLease = <T>(\n callerCurrent: () => boolean,\n work: (context: CurrentPrincipalMutationLeaseContext) => Promise<T>,\n) => Promise<T>;\n\n/** One lifetime fence and private custody boundary for every current-policy mutation. */\nexport function createCurrentPrincipalMutationLease(\n runtime: PrincipalPolicyRecoveryRuntime,\n): CurrentPrincipalMutationLease | undefined {\n const lease = readPrincipalHistoryProtection(runtime);\n const resolveCurrentPolicy =\n createRuntimePrincipalPolicyCurrentResolver(runtime);\n const readPages = runtime.apiClient.getPrincipalPolicyPages?.bind(\n runtime.apiClient,\n );\n if (!lease || !resolveCurrentPolicy || !readPages) return undefined;\n return async <T>(\n callerCurrent: () => boolean,\n work: (context: CurrentPrincipalMutationLeaseContext) => Promise<T>,\n ): Promise<T> =>\n lease(async ({ protection, stillCurrent: leaseCurrent }) => {\n let active = true;\n const stillCurrent = () => active && leaseCurrent() && callerCurrent();\n try {\n assertProjectionVerificationCurrent(stillCurrent);\n const result = await work({\n protection,\n stillCurrent,\n resolveCurrentPolicy,\n readPages,\n directoryRecovery: (current) => ({\n apiClient: { getPrincipalPolicyPages: readPages },\n expectedHead: principalPolicyReferenceFromBundle(current),\n protection: directoryHistoryProtection(protection),\n resolveTrustedUserIdentity: runtime.resolveTrustedUserIdentity,\n }),\n });\n assertProjectionVerificationCurrent(stillCurrent);\n return result;\n } finally {\n active = false;\n }\n });\n}\n"]}

package/workflows/organizations/deleteCurrentOrganizationGroup.js ADDED Viewed

@@ -0,0 +1,35 @@
+import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
+import { buildOrganizationGroupDirectoryPolicyRequest, removeOrganizationGroupHead, } from "./organizationGroupDirectory.js";
+import { projectionUserIds, resolveRequiredUserIdentities, } from "./trustedOrganizationUsers.js";
+/** Delete against a verified directory without loading the removed group's history. */
+export async function deleteCurrentOrganizationGroup(input) {
+    const { context } = input;
+    assertProjectionVerificationCurrent(context.stillCurrent);
+    const adminProjection = context.admins.policy.projection;
+    const request = await buildOrganizationGroupDirectoryPolicyRequest({
+        ...input,
+        adminProjection,
+        adminUsers: await resolveRequiredUserIdentities({
+            resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+            userIds: projectionUserIds(adminProjection),
+        }),
+        currentPolicy: context.directory.current,
+        descriptor: context.descriptor,
+        groupHeads: removeOrganizationGroupHead({
+            descriptor: context.descriptor,
+            groupId: input.groupId,
+        }),
+    });
+    assertProjectionVerificationCurrent(context.stillCurrent);
+    const stored = await input.apiClient.deleteOrganizationGroup(input.organizationId, input.groupId, { organizationPolicy: request });
+    assertProjectionVerificationCurrent(context.stillCurrent);
+    if (!stored)
+        throw new Error("Group could not be deleted");
+    if (stored.organizationId !== input.organizationId ||
+        stored.groupId !== input.groupId)
+        throw new Error("Group deletion response target mismatch");
+    await context.retainDirectory(request, stored.organizationPolicy);
+    assertProjectionVerificationCurrent(context.stillCurrent);
+    return stored;
+}
+//# sourceMappingURL=deleteCurrentOrganizationGroup.js.map

package/workflows/organizations/deleteCurrentOrganizationGroup.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"deleteCurrentOrganizationGroup.js","sourceRoot":"","sources":["deleteCurrentOrganizationGroup.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AAGpG,OAAO,EACL,4CAA4C,EAC5C,2BAA2B,GAC5B,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,iBAAiB,EACjB,6BAA6B,GAC9B,MAAM,4BAA4B,CAAC;AAEpC,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAYpD;IACC,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC1B,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;IACzD,MAAM,OAAO,GAAG,MAAM,4CAA4C,CAAC;QACjE,GAAG,KAAK;QACR,eAAe;QACf,UAAU,EAAE,MAAM,6BAA6B,CAAC;YAC9C,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;YAC5D,OAAO,EAAE,iBAAiB,CAAC,eAAe,CAAC;SAC5C,CAAC;QACF,aAAa,EAAE,OAAO,CAAC,SAAS,CAAC,OAAO;QACxC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,UAAU,EAAE,2BAA2B,CAAC;YACtC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;KACH,CAAC,CAAC;IACH,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,uBAAuB,CAC1D,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,OAAO,EACb,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAChC,CAAC;IACF,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC3D,IACE,MAAM,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QAC9C,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QAEhC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,MAAM,OAAO,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAClE,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import type { SigningKeyPair } from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\nimport type { deleteOrganizationGroup } from \"./deleteOrganizationGroup\";\nimport {\n buildOrganizationGroupDirectoryPolicyRequest,\n removeOrganizationGroupHead,\n} from \"./organizationGroupDirectory\";\nimport type { CurrentOrganizationMutationContext } from \"./runtimeCurrentOrganizationMutation\";\nimport {\n projectionUserIds,\n resolveRequiredUserIdentities,\n} from \"./trustedOrganizationUsers\";\n\n/** Delete against a verified directory without loading the removed group's history. */\nexport async function deleteCurrentOrganizationGroup(input: {\n readonly apiClient: Pick<\n Parameters<typeof deleteOrganizationGroup>[0][\"apiClient\"],\n \"deleteOrganizationGroup\"\n >;\n readonly context: CurrentOrganizationMutationContext;\n readonly groupId: string;\n readonly organizationId: string;\n readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n readonly signerUserId: string;\n readonly signingFingerprint: string;\n readonly signingKeyPair: SigningKeyPair;\n}) {\n const { context } = input;\n assertProjectionVerificationCurrent(context.stillCurrent);\n const adminProjection = context.admins.policy.projection;\n const request = await buildOrganizationGroupDirectoryPolicyRequest({\n ...input,\n adminProjection,\n adminUsers: await resolveRequiredUserIdentities({\n resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n userIds: projectionUserIds(adminProjection),\n }),\n currentPolicy: context.directory.current,\n descriptor: context.descriptor,\n groupHeads: removeOrganizationGroupHead({\n descriptor: context.descriptor,\n groupId: input.groupId,\n }),\n });\n assertProjectionVerificationCurrent(context.stillCurrent);\n const stored = await input.apiClient.deleteOrganizationGroup(\n input.organizationId,\n input.groupId,\n { organizationPolicy: request },\n );\n assertProjectionVerificationCurrent(context.stillCurrent);\n if (!stored) throw new Error(\"Group could not be deleted\");\n if (\n stored.organizationId !== input.organizationId ||\n stored.groupId !== input.groupId\n )\n throw new Error(\"Group deletion response target mismatch\");\n await context.retainDirectory(request, stored.organizationPolicy);\n assertProjectionVerificationCurrent(context.stillCurrent);\n return stored;\n}\n"]}

package/workflows/organizations/deleteOrganizationGroup.d.ts CHANGED Viewed

@@ -15,4 +15,5 @@ export declare function deleteOrganizationGroup(input: {
     readonly signerUserId: string;
     readonly signingFingerprint: string;
     readonly signingKeyPair: SigningKeyPair;
+    readonly stillCurrent?: (() => boolean) | undefined;
 }): Promise<DeleteOrganizationGroupResponse>;

package/workflows/organizations/deleteOrganizationGroup.js CHANGED Viewed

@@ -1,3 +1,4 @@
+import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
 import { persistLocallyAcknowledgedPrincipalPolicyBundles } from "../../data/persistence/locallyAcknowledgedCheckpointPersistence.js";
 import { loadOrganizationExternalAdminPolicy } from "../principals/externalAdminPolicy.js";
 import { acknowledgeGroupPolicyState, buildAcknowledgedGroupPolicyBundle, } from "./groupPolicyMutationAcknowledgement.js";
@@ -5,13 +6,18 @@ import { groupPolicyMutationHead } from "./groupPolicyMutationHead.js";
 import { buildOrganizationGroupDirectoryPolicyRequest, removeOrganizationGroupHead, } from "./organizationGroupDirectory.js";
 import { projectionUserIds, resolveRequiredUserIdentities, } from "./trustedOrganizationUsers.js";
 export async function deleteOrganizationGroup(input) {
+    const stillCurrent = input.stillCurrent;
+    assertProjectionVerificationCurrent(stillCurrent);
     await input.apiClient.recoverPendingPrincipalMutation?.(input.organizationId);
+    assertProjectionVerificationCurrent(stillCurrent);
     const externalAdminPolicy = await loadOrganizationExternalAdminPolicy({
         execSql: input.execSql,
         getCurrentPrincipalPolicy: (principalType, principalId) => input.apiClient.getCurrentPrincipalPolicy(principalType, principalId),
         organizationId: input.organizationId,
         resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+        stillCurrent,
     });
+    assertProjectionVerificationCurrent(stillCurrent);
     if (!externalAdminPolicy?.signerUserIds.includes(input.signerUserId)) {
         throw new Error("Organization admin authority could not be verified");
     }
@@ -33,7 +39,9 @@ export async function deleteOrganizationGroup(input) {
         signingFingerprint: input.signingFingerprint,
         signingKeyPair: input.signingKeyPair,
     });
+    assertProjectionVerificationCurrent(stillCurrent);
     const stored = await input.apiClient.deleteOrganizationGroup(input.organizationId, input.groupId, { organizationPolicy: organizationRequest });
+    assertProjectionVerificationCurrent(stillCurrent);
     if (!stored) {
         throw new Error("Group could not be deleted");
     }
@@ -59,7 +67,9 @@ export async function deleteOrganizationGroup(input) {
         execSql: input.execSql,
         organizationId: input.organizationId,
         updatedAt: new Date().toISOString(),
+        stillCurrent,
     });
+    assertProjectionVerificationCurrent(stillCurrent);
     return stored;
 }
 //# sourceMappingURL=deleteOrganizationGroup.js.map

package/workflows/organizations/deleteOrganizationGroup.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"deleteOrganizationGroup.js","sourceRoot":"","sources":["deleteOrganizationGroup.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,gDAAgD,EAAE,MAAM,iEAAiE,CAAC;AAGnI,OAAO,EAAE,mCAAmC,EAAE,MAAM,mCAAmC,CAAC;AACxF,OAAO,EACL,2BAA2B,EAC3B,kCAAkC,GACnC,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EACL,4CAA4C,EAC5C,2BAA2B,GAC5B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,iBAAiB,EACjB,6BAA6B,GAC9B,MAAM,4BAA4B,CAAC;AAEpC,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,~~KAe7C~~;IACC,MAAM,KAAK,CAAC,SAAS,CAAC,+BAA+B,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC9E,MAAM,mBAAmB,GAAG,MAAM,mCAAmC,CAAC;QACpE,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,yBAAyB,EAAE,CAAC,aAAa,EAAE,WAAW,EAAE,EAAE,CACxD,KAAK,CAAC,SAAS,CAAC,yBAAyB,CAAC,aAAa,EAAE,WAAW,CAAC;QACvE,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;~~KAC7D~~,CAAC,CAAC;IACH,IAAI,CAAC,mBAAmB,EAAE,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,eAAe,GAAG,mBAAmB,CAAC,WAAW,CAAC,iBAAiB,CAAC;IAC1E,MAAM,UAAU,GAAG,MAAM,6BAA6B,CAAC;QACrD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,OAAO,EAAE,iBAAiB,CAAC,eAAe,CAAC;KAC5C,CAAC,CAAC;IACH,MAAM,mBAAmB,GACvB,MAAM,4CAA4C,CAAC;QACjD,eAAe;QACf,UAAU;QACV,aAAa,EAAE,mBAAmB,CAAC,MAAM;QACzC,UAAU,EAAE,mBAAmB,CAAC,UAAU;QAC1C,UAAU,EAAE,2BAA2B,CAAC;YACtC,UAAU,EAAE,mBAAmB,CAAC,UAAU;YAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;QACF,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACL,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,uBAAuB,CAC1D,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,OAAO,EACb,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,CAC5C,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,IACE,MAAM,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QAC9C,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,EAChC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,gBAAgB,GAAG,MAAM,uBAAuB,CAAC,mBAAmB,CAAC,CAAC;IAC5E,MAAM,kBAAkB,GAAG,MAAM,2BAA2B,CAAC;QAC3D,aAAa,EAAE,mBAAmB,CAAC,MAAM;QACzC,YAAY,EAAE,gBAAgB;QAC9B,OAAO,EAAE,mBAAmB;QAC5B,QAAQ,EAAE,MAAM,CAAC,kBAAkB,CAAC,YAAY;KACjD,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,kCAAkC,CAAC;QAC5D,aAAa,EAAE,mBAAmB,CAAC,MAAM;QACzC,YAAY,EAAE,gBAAgB;QAC9B,OAAO,EAAE,mBAAmB;QAC5B,QAAQ,EAAE,MAAM,CAAC,kBAAkB;KACpC,CAAC,CAAC;IACH,MAAM,gDAAgD,CAAC;QACrD,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QACrE,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;~~KACpC~~,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import type { SigningKeyPair } from \"@tearleads/crypto\";\nimport type { DeleteOrganizationGroupRequest } from \"@tearleads/validators/request\";\nimport type { DeleteOrganizationGroupResponse } from \"@tearleads/validators/response\";\nimport { persistLocallyAcknowledgedPrincipalPolicyBundles } from \"../../data/persistence/locallyAcknowledgedCheckpointPersistence\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\nimport { loadOrganizationExternalAdminPolicy } from \"../principals/externalAdminPolicy\";\nimport {\n acknowledgeGroupPolicyState,\n buildAcknowledgedGroupPolicyBundle,\n} from \"./groupPolicyMutationAcknowledgement\";\nimport type { PrincipalPolicyReadApi } from \"./groupPolicyMutationContext\";\nimport { groupPolicyMutationHead } from \"./groupPolicyMutationHead\";\nimport {\n buildOrganizationGroupDirectoryPolicyRequest,\n removeOrganizationGroupHead,\n} from \"./organizationGroupDirectory\";\nimport {\n projectionUserIds,\n resolveRequiredUserIdentities,\n} from \"./trustedOrganizationUsers\";\n\nexport async function deleteOrganizationGroup(input: {\n readonly apiClient: PrincipalPolicyReadApi & {\n deleteOrganizationGroup: (\n organizationId: string,\n groupId: string,\n request: DeleteOrganizationGroupRequest,\n ) => Promise<DeleteOrganizationGroupResponse \| null>;\n };\n readonly execSql: ExecSql;\n readonly groupId: string;\n readonly organizationId: string;\n readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n readonly signerUserId: string;\n readonly signingFingerprint: string;\n readonly signingKeyPair: SigningKeyPair;\n}): Promise<DeleteOrganizationGroupResponse> {\n await input.apiClient.recoverPendingPrincipalMutation?.(input.organizationId);\n const externalAdminPolicy = await loadOrganizationExternalAdminPolicy({\n execSql: input.execSql,\n getCurrentPrincipalPolicy: (principalType, principalId) =>\n input.apiClient.getCurrentPrincipalPolicy(principalType, principalId),\n organizationId: input.organizationId,\n resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n });\n if (!externalAdminPolicy?.signerUserIds.includes(input.signerUserId)) {\n throw new Error(\"Organization admin authority could not be verified\");\n }\n const adminProjection = externalAdminPolicy.adminBundle.currentProjection;\n const adminUsers = await resolveRequiredUserIdentities({\n resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n userIds: projectionUserIds(adminProjection),\n });\n const organizationRequest =\n await buildOrganizationGroupDirectoryPolicyRequest({\n adminProjection,\n adminUsers,\n currentPolicy: externalAdminPolicy.bundle,\n descriptor: externalAdminPolicy.descriptor,\n groupHeads: removeOrganizationGroupHead({\n descriptor: externalAdminPolicy.descriptor,\n groupId: input.groupId,\n }),\n signerUserId: input.signerUserId,\n signingFingerprint: input.signingFingerprint,\n signingKeyPair: input.signingKeyPair,\n });\n const stored = await input.apiClient.deleteOrganizationGroup(\n input.organizationId,\n input.groupId,\n { organizationPolicy: organizationRequest },\n );\n if (!stored) {\n throw new Error(\"Group could not be deleted\");\n }\n if (\n stored.organizationId !== input.organizationId \|\|\n stored.groupId !== input.groupId\n ) {\n throw new Error(\"Group deletion response target mismatch\");\n }\n const organizationHead = await groupPolicyMutationHead(organizationRequest);\n const organizationPolicy = await acknowledgeGroupPolicyState({\n currentPolicy: externalAdminPolicy.bundle,\n expectedHead: organizationHead,\n request: organizationRequest,\n response: stored.organizationPolicy.currentState,\n });\n const organizationBundle = buildAcknowledgedGroupPolicyBundle({\n currentPolicy: externalAdminPolicy.bundle,\n expectedHead: organizationHead,\n request: organizationRequest,\n response: stored.organizationPolicy,\n });\n await persistLocallyAcknowledgedPrincipalPolicyBundles({\n entries: [{ bundle: organizationBundle, policy: organizationPolicy }],\n execSql: input.execSql,\n organizationId: input.organizationId,\n updatedAt: new Date().toISOString(),\n });\n return stored;\n}\n"]}
1	+ {"version":3,"file":"deleteOrganizationGroup.js","sourceRoot":"","sources":["deleteOrganizationGroup.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,gDAAgD,EAAE,MAAM,iEAAiE,CAAC;AAGnI,OAAO,EAAE,mCAAmC,EAAE,MAAM,mCAAmC,CAAC;AACxF,OAAO,EACL,2BAA2B,EAC3B,kCAAkC,GACnC,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EACL,4CAA4C,EAC5C,2BAA2B,GAC5B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,iBAAiB,EACjB,6BAA6B,GAC9B,MAAM,4BAA4B,CAAC;AAEpC,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAgB7C;IACC,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IACxC,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,KAAK,CAAC,SAAS,CAAC,+BAA+B,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC9E,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,mBAAmB,GAAG,MAAM,mCAAmC,CAAC;QACpE,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,yBAAyB,EAAE,CAAC,aAAa,EAAE,WAAW,EAAE,EAAE,CACxD,KAAK,CAAC,SAAS,CAAC,yBAAyB,CAAC,aAAa,EAAE,WAAW,CAAC;QACvE,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,YAAY;KACb,CAAC,CAAC;IACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,CAAC,mBAAmB,EAAE,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,eAAe,GAAG,mBAAmB,CAAC,WAAW,CAAC,iBAAiB,CAAC;IAC1E,MAAM,UAAU,GAAG,MAAM,6BAA6B,CAAC;QACrD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,OAAO,EAAE,iBAAiB,CAAC,eAAe,CAAC;KAC5C,CAAC,CAAC;IACH,MAAM,mBAAmB,GACvB,MAAM,4CAA4C,CAAC;QACjD,eAAe;QACf,UAAU;QACV,aAAa,EAAE,mBAAmB,CAAC,MAAM;QACzC,UAAU,EAAE,mBAAmB,CAAC,UAAU;QAC1C,UAAU,EAAE,2BAA2B,CAAC;YACtC,UAAU,EAAE,mBAAmB,CAAC,UAAU;YAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;QACF,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACL,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,uBAAuB,CAC1D,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,OAAO,EACb,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,CAC5C,CAAC;IACF,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,IACE,MAAM,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QAC9C,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,EAChC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,gBAAgB,GAAG,MAAM,uBAAuB,CAAC,mBAAmB,CAAC,CAAC;IAC5E,MAAM,kBAAkB,GAAG,MAAM,2BAA2B,CAAC;QAC3D,aAAa,EAAE,mBAAmB,CAAC,MAAM;QACzC,YAAY,EAAE,gBAAgB;QAC9B,OAAO,EAAE,mBAAmB;QAC5B,QAAQ,EAAE,MAAM,CAAC,kBAAkB,CAAC,YAAY;KACjD,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,kCAAkC,CAAC;QAC5D,aAAa,EAAE,mBAAmB,CAAC,MAAM;QACzC,YAAY,EAAE,gBAAgB;QAC9B,OAAO,EAAE,mBAAmB;QAC5B,QAAQ,EAAE,MAAM,CAAC,kBAAkB;KACpC,CAAC,CAAC;IACH,MAAM,gDAAgD,CAAC;QACrD,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QACrE,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,YAAY;KACb,CAAC,CAAC;IACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import type { SigningKeyPair } from \"@tearleads/crypto\";\nimport type { DeleteOrganizationGroupRequest } from \"@tearleads/validators/request\";\nimport type { DeleteOrganizationGroupResponse } from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { persistLocallyAcknowledgedPrincipalPolicyBundles } from \"../../data/persistence/locallyAcknowledgedCheckpointPersistence\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\nimport { loadOrganizationExternalAdminPolicy } from \"../principals/externalAdminPolicy\";\nimport {\n acknowledgeGroupPolicyState,\n buildAcknowledgedGroupPolicyBundle,\n} from \"./groupPolicyMutationAcknowledgement\";\nimport type { PrincipalPolicyReadApi } from \"./groupPolicyMutationContext\";\nimport { groupPolicyMutationHead } from \"./groupPolicyMutationHead\";\nimport {\n buildOrganizationGroupDirectoryPolicyRequest,\n removeOrganizationGroupHead,\n} from \"./organizationGroupDirectory\";\nimport {\n projectionUserIds,\n resolveRequiredUserIdentities,\n} from \"./trustedOrganizationUsers\";\n\nexport async function deleteOrganizationGroup(input: {\n readonly apiClient: PrincipalPolicyReadApi & {\n deleteOrganizationGroup: (\n organizationId: string,\n groupId: string,\n request: DeleteOrganizationGroupRequest,\n ) => Promise<DeleteOrganizationGroupResponse \| null>;\n };\n readonly execSql: ExecSql;\n readonly groupId: string;\n readonly organizationId: string;\n readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n readonly signerUserId: string;\n readonly signingFingerprint: string;\n readonly signingKeyPair: SigningKeyPair;\n readonly stillCurrent?: (() => boolean) \| undefined;\n}): Promise<DeleteOrganizationGroupResponse> {\n const stillCurrent = input.stillCurrent;\n assertProjectionVerificationCurrent(stillCurrent);\n await input.apiClient.recoverPendingPrincipalMutation?.(input.organizationId);\n assertProjectionVerificationCurrent(stillCurrent);\n const externalAdminPolicy = await loadOrganizationExternalAdminPolicy({\n execSql: input.execSql,\n getCurrentPrincipalPolicy: (principalType, principalId) =>\n input.apiClient.getCurrentPrincipalPolicy(principalType, principalId),\n organizationId: input.organizationId,\n resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n stillCurrent,\n });\n assertProjectionVerificationCurrent(stillCurrent);\n if (!externalAdminPolicy?.signerUserIds.includes(input.signerUserId)) {\n throw new Error(\"Organization admin authority could not be verified\");\n }\n const adminProjection = externalAdminPolicy.adminBundle.currentProjection;\n const adminUsers = await resolveRequiredUserIdentities({\n resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n userIds: projectionUserIds(adminProjection),\n });\n const organizationRequest =\n await buildOrganizationGroupDirectoryPolicyRequest({\n adminProjection,\n adminUsers,\n currentPolicy: externalAdminPolicy.bundle,\n descriptor: externalAdminPolicy.descriptor,\n groupHeads: removeOrganizationGroupHead({\n descriptor: externalAdminPolicy.descriptor,\n groupId: input.groupId,\n }),\n signerUserId: input.signerUserId,\n signingFingerprint: input.signingFingerprint,\n signingKeyPair: input.signingKeyPair,\n });\n assertProjectionVerificationCurrent(stillCurrent);\n const stored = await input.apiClient.deleteOrganizationGroup(\n input.organizationId,\n input.groupId,\n { organizationPolicy: organizationRequest },\n );\n assertProjectionVerificationCurrent(stillCurrent);\n if (!stored) {\n throw new Error(\"Group could not be deleted\");\n }\n if (\n stored.organizationId !== input.organizationId \|\|\n stored.groupId !== input.groupId\n ) {\n throw new Error(\"Group deletion response target mismatch\");\n }\n const organizationHead = await groupPolicyMutationHead(organizationRequest);\n const organizationPolicy = await acknowledgeGroupPolicyState({\n currentPolicy: externalAdminPolicy.bundle,\n expectedHead: organizationHead,\n request: organizationRequest,\n response: stored.organizationPolicy.currentState,\n });\n const organizationBundle = buildAcknowledgedGroupPolicyBundle({\n currentPolicy: externalAdminPolicy.bundle,\n expectedHead: organizationHead,\n request: organizationRequest,\n response: stored.organizationPolicy,\n });\n await persistLocallyAcknowledgedPrincipalPolicyBundles({\n entries: [{ bundle: organizationBundle, policy: organizationPolicy }],\n execSql: input.execSql,\n organizationId: input.organizationId,\n updatedAt: new Date().toISOString(),\n stillCurrent,\n });\n assertProjectionVerificationCurrent(stillCurrent);\n return stored;\n}\n"]}

package/workflows/organizations/groupCreation.d.ts CHANGED Viewed

@@ -17,4 +17,5 @@ export declare function createOrganizationGroup(input: {
     readonly signerUserId: string;
     readonly signingFingerprint: string;
     readonly signingKeyPair: SigningKeyPair;
+    readonly stillCurrent?: (() => boolean) | undefined;
 }): Promise<OrganizationGroupSummary>;

package/workflows/organizations/groupCreation.js CHANGED Viewed

@@ -1,15 +1,20 @@
+import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
 import { loadOrganizationExternalAdminPolicy } from "../principals/externalAdminPolicy.js";
 import { cacheGroupPolicy, } from "./groupPolicyMutationContext.js";
 import { commitCreatedGroupToDirectory } from "./organizationGroupDirectory.js";
 import { buildInitialGroupPolicyRequest } from "./principalPolicyRequest.js";
 export async function createOrganizationGroup(input) {
+    assertProjectionVerificationCurrent(input.stillCurrent);
     await input.apiClient.recoverPendingPrincipalMutation?.(input.organizationId);
+    assertProjectionVerificationCurrent(input.stillCurrent);
     const externalAdminPolicy = await loadOrganizationExternalAdminPolicy({
         execSql: input.execSql,
         getCurrentPrincipalPolicy: (principalType, principalId) => input.apiClient.getCurrentPrincipalPolicy(principalType, principalId),
         organizationId: input.organizationId,
         resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+        stillCurrent: input.stillCurrent,
     });
+    assertProjectionVerificationCurrent(input.stillCurrent);
     if (!externalAdminPolicy) {
         throw new Error("Organization admin authority could not be verified");
     }
@@ -33,6 +38,7 @@ export async function createOrganizationGroup(input) {
         readEncryptedName: input.metadataAccess.readName,
         request,
     });
+    assertProjectionVerificationCurrent(input.stillCurrent);
     await cacheGroupPolicy({
         acknowledgedMemberEnvelopes: {
             envelopes: request.initialGroupPolicy.memberEnvelopes,
@@ -54,7 +60,9 @@ export async function createOrganizationGroup(input) {
         },
         organizationId: input.organizationId,
         resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+        stillCurrent: input.stillCurrent,
     });
+    assertProjectionVerificationCurrent(input.stillCurrent);
     return { ...group, name: input.name.trim(), nameUnreadable: false };
 }
 //# sourceMappingURL=groupCreation.js.map

package/workflows/organizations/groupCreation.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"groupCreation.js","sourceRoot":"","sources":["groupCreation.ts"],"names":[],"mappings":"~~AAIA~~,OAAO,EAAE,mCAAmC,EAAE,MAAM,mCAAmC,CAAC;AAExF,OAAO,EACL,gBAAgB,GAEjB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAG1E,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,~~KAY7C~~;IACC,MAAM,KAAK,CAAC,SAAS,CAAC,+BAA+B,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC9E,MAAM,mBAAmB,GAAG,MAAM,mCAAmC,CAAC;QACpE,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,yBAAyB,EAAE,CAAC,aAAa,EAAE,WAAW,EAAE,EAAE,CACxD,KAAK,CAAC,SAAS,CAAC,yBAAyB,CAAC,aAAa,EAAE,WAAW,CAAC;QACvE,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;~~KAC7D~~,CAAC,CAAC;IACH,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC;QACnD,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,iBAAiB,EAAE,mBAAmB,CAAC,iBAAiB,CAAC,WAAW;QACpE,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE;QAC5B,oBAAoB,EAAE,KAAK;QAC3B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,MAAM,KAAK,CAAC,cAAc,CAAC,iBAAiB,EAAE;QAC3D,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,MAAM,6BAA6B,CAAC;QACxE,GAAG,KAAK;QACR,mBAAmB;QACnB,iBAAiB,EAAE,KAAK,CAAC,cAAc,CAAC,QAAQ;QAChD,OAAO;KACR,CAAC,CAAC;~~IAEH~~,MAAM,gBAAgB,CAAC;QACrB,2BAA2B,EAAE;YAC3B,SAAS,EAAE,OAAO,CAAC,kBAAkB,CAAC,eAAe;YACrD,KAAK,EAAE,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,QAAQ;YAChD,WAAW,EAAE,OAAO,CAAC,OAAO;YAC5B,aAAa,EAAE,OAAO;YACtB,SAAS,EAAE,YAAY,CAAC,SAAS;SAClC;QACD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,mBAAmB,EAAE,YAAY;QACjC,iBAAiB,EAAE,mBAAmB,CAAC,iBAAiB;QACxD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,qBAAqB,EAAE;YACrB,WAAW,EAAE,OAAO,CAAC,OAAO;YAC5B,aAAa,EAAE,OAAO;YACtB,SAAS,EAAE,YAAY,CAAC,SAAS;YACjC,OAAO,EAAE,YAAY,CAAC,OAAO;SAC9B;QACD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;~~KAC7D~~,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;AACtE,CAAC","sourcesContent":["import type { EncapsulationKeyPair, SigningKeyPair } from \"@tearleads/crypto\";\nimport type { SecurityIncidentReporter } from \"../../data/securityIncidents\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\nimport { loadOrganizationExternalAdminPolicy } from \"../principals/externalAdminPolicy\";\nimport type { createGroupMetadataAccess } from \"./groupMetadataAccess\";\nimport {\n cacheGroupPolicy,\n type OrganizationPrincipalPolicyApi,\n} from \"./groupPolicyMutationContext\";\nimport { commitCreatedGroupToDirectory } from \"./organizationGroupDirectory\";\nimport { buildInitialGroupPolicyRequest } from \"./principalPolicyRequest\";\nimport type { OrganizationGroupSummary } from \"./readModel\";\n\nexport async function createOrganizationGroup(input: {\n readonly metadataAccess: ReturnType<typeof createGroupMetadataAccess>;\n readonly apiClient: OrganizationPrincipalPolicyApi;\n readonly creatorEncapsulationKeyPair: EncapsulationKeyPair;\n readonly execSql: ExecSql;\n readonly name: string;\n readonly organizationId: string;\n readonly reportSecurityIncident: SecurityIncidentReporter;\n readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n readonly signerUserId: string;\n readonly signingFingerprint: string;\n readonly signingKeyPair: SigningKeyPair;\n}): Promise<OrganizationGroupSummary> {\n await input.apiClient.recoverPendingPrincipalMutation?.(input.organizationId);\n const externalAdminPolicy = await loadOrganizationExternalAdminPolicy({\n execSql: input.execSql,\n getCurrentPrincipalPolicy: (principalType, principalId) =>\n input.apiClient.getCurrentPrincipalPolicy(principalType, principalId),\n organizationId: input.organizationId,\n resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n });\n if (!externalAdminPolicy) {\n throw new Error(\"Organization admin authority could not be verified\");\n }\n if (!externalAdminPolicy.signerUserIds.includes(input.signerUserId)) {\n throw new Error(\"Organization admin authority could not be verified\");\n }\n const request = await buildInitialGroupPolicyRequest({\n creatorEncapsulationKeyPair: input.creatorEncapsulationKeyPair,\n externalAuthority: externalAdminPolicy.externalAuthority.currentHead,\n groupId: crypto.randomUUID(),\n includeSignerAsAdmin: false,\n name: input.name,\n metadataKey: await input.metadataAccess.loadEncryptionKey(),\n signerUserId: input.signerUserId,\n signingFingerprint: input.signingFingerprint,\n signingKeyPair: input.signingKeyPair,\n });\n const { group, head: expectedHead } = await commitCreatedGroupToDirectory({\n ...input,\n externalAdminPolicy,\n readEncryptedName: input.metadataAccess.readName,\n request,\n });\n\n await cacheGroupPolicy({\n acknowledgedMemberEnvelopes: {\n envelopes: request.initialGroupPolicy.memberEnvelopes,\n epoch: request.initialGroupPolicy.state.keyEpoch,\n principalId: request.groupId,\n principalType: \"group\",\n stateHash: expectedHead.stateHash,\n },\n apiClient: input.apiClient,\n execSql: input.execSql,\n expectedCurrentHead: expectedHead,\n externalAuthority: externalAdminPolicy.externalAuthority,\n groupId: group.groupId,\n localPolicyCheckpoint: {\n principalId: request.groupId,\n principalType: \"group\",\n stateHash: expectedHead.stateHash,\n version: expectedHead.version,\n },\n organizationId: input.organizationId,\n resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n });\n return { ...group, name: input.name.trim(), nameUnreadable: false };\n}\n"]}
1	+ {"version":3,"file":"groupCreation.js","sourceRoot":"","sources":["groupCreation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AAIpG,OAAO,EAAE,mCAAmC,EAAE,MAAM,mCAAmC,CAAC;AAExF,OAAO,EACL,gBAAgB,GAEjB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAG1E,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAa7C;IACC,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,KAAK,CAAC,SAAS,CAAC,+BAA+B,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC9E,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,mBAAmB,GAAG,MAAM,mCAAmC,CAAC;QACpE,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,yBAAyB,EAAE,CAAC,aAAa,EAAE,WAAW,EAAE,EAAE,CACxD,KAAK,CAAC,SAAS,CAAC,yBAAyB,CAAC,aAAa,EAAE,WAAW,CAAC;QACvE,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC;QACnD,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,iBAAiB,EAAE,mBAAmB,CAAC,iBAAiB,CAAC,WAAW;QACpE,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE;QAC5B,oBAAoB,EAAE,KAAK;QAC3B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,MAAM,KAAK,CAAC,cAAc,CAAC,iBAAiB,EAAE;QAC3D,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,MAAM,6BAA6B,CAAC;QACxE,GAAG,KAAK;QACR,mBAAmB;QACnB,iBAAiB,EAAE,KAAK,CAAC,cAAc,CAAC,QAAQ;QAChD,OAAO;KACR,CAAC,CAAC;IACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,gBAAgB,CAAC;QACrB,2BAA2B,EAAE;YAC3B,SAAS,EAAE,OAAO,CAAC,kBAAkB,CAAC,eAAe;YACrD,KAAK,EAAE,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,QAAQ;YAChD,WAAW,EAAE,OAAO,CAAC,OAAO;YAC5B,aAAa,EAAE,OAAO;YACtB,SAAS,EAAE,YAAY,CAAC,SAAS;SAClC;QACD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,mBAAmB,EAAE,YAAY;QACjC,iBAAiB,EAAE,mBAAmB,CAAC,iBAAiB;QACxD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,qBAAqB,EAAE;YACrB,WAAW,EAAE,OAAO,CAAC,OAAO;YAC5B,aAAa,EAAE,OAAO;YACtB,SAAS,EAAE,YAAY,CAAC,SAAS;YACjC,OAAO,EAAE,YAAY,CAAC,OAAO;SAC9B;QACD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;AACtE,CAAC","sourcesContent":["import type { EncapsulationKeyPair, SigningKeyPair } from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport type { SecurityIncidentReporter } from \"../../data/securityIncidents\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\nimport { loadOrganizationExternalAdminPolicy } from \"../principals/externalAdminPolicy\";\nimport type { createGroupMetadataAccess } from \"./groupMetadataAccess\";\nimport {\n cacheGroupPolicy,\n type OrganizationPrincipalPolicyApi,\n} from \"./groupPolicyMutationContext\";\nimport { commitCreatedGroupToDirectory } from \"./organizationGroupDirectory\";\nimport { buildInitialGroupPolicyRequest } from \"./principalPolicyRequest\";\nimport type { OrganizationGroupSummary } from \"./readModel\";\n\nexport async function createOrganizationGroup(input: {\n readonly metadataAccess: ReturnType<typeof createGroupMetadataAccess>;\n readonly apiClient: OrganizationPrincipalPolicyApi;\n readonly creatorEncapsulationKeyPair: EncapsulationKeyPair;\n readonly execSql: ExecSql;\n readonly name: string;\n readonly organizationId: string;\n readonly reportSecurityIncident: SecurityIncidentReporter;\n readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n readonly signerUserId: string;\n readonly signingFingerprint: string;\n readonly signingKeyPair: SigningKeyPair;\n readonly stillCurrent?: (() => boolean) \| undefined;\n}): Promise<OrganizationGroupSummary> {\n assertProjectionVerificationCurrent(input.stillCurrent);\n await input.apiClient.recoverPendingPrincipalMutation?.(input.organizationId);\n assertProjectionVerificationCurrent(input.stillCurrent);\n const externalAdminPolicy = await loadOrganizationExternalAdminPolicy({\n execSql: input.execSql,\n getCurrentPrincipalPolicy: (principalType, principalId) =>\n input.apiClient.getCurrentPrincipalPolicy(principalType, principalId),\n organizationId: input.organizationId,\n resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n stillCurrent: input.stillCurrent,\n });\n assertProjectionVerificationCurrent(input.stillCurrent);\n if (!externalAdminPolicy) {\n throw new Error(\"Organization admin authority could not be verified\");\n }\n if (!externalAdminPolicy.signerUserIds.includes(input.signerUserId)) {\n throw new Error(\"Organization admin authority could not be verified\");\n }\n const request = await buildInitialGroupPolicyRequest({\n creatorEncapsulationKeyPair: input.creatorEncapsulationKeyPair,\n externalAuthority: externalAdminPolicy.externalAuthority.currentHead,\n groupId: crypto.randomUUID(),\n includeSignerAsAdmin: false,\n name: input.name,\n metadataKey: await input.metadataAccess.loadEncryptionKey(),\n signerUserId: input.signerUserId,\n signingFingerprint: input.signingFingerprint,\n signingKeyPair: input.signingKeyPair,\n });\n const { group, head: expectedHead } = await commitCreatedGroupToDirectory({\n ...input,\n externalAdminPolicy,\n readEncryptedName: input.metadataAccess.readName,\n request,\n });\n assertProjectionVerificationCurrent(input.stillCurrent);\n await cacheGroupPolicy({\n acknowledgedMemberEnvelopes: {\n envelopes: request.initialGroupPolicy.memberEnvelopes,\n epoch: request.initialGroupPolicy.state.keyEpoch,\n principalId: request.groupId,\n principalType: \"group\",\n stateHash: expectedHead.stateHash,\n },\n apiClient: input.apiClient,\n execSql: input.execSql,\n expectedCurrentHead: expectedHead,\n externalAuthority: externalAdminPolicy.externalAuthority,\n groupId: group.groupId,\n localPolicyCheckpoint: {\n principalId: request.groupId,\n principalType: \"group\",\n stateHash: expectedHead.stateHash,\n version: expectedHead.version,\n },\n organizationId: input.organizationId,\n resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n stillCurrent: input.stillCurrent,\n });\n assertProjectionVerificationCurrent(input.stillCurrent);\n return { ...group, name: input.name.trim(), nameUnreadable: false };\n}\n"]}

package/workflows/organizations/groupMembershipName.d.ts CHANGED Viewed

@@ -5,4 +5,4 @@ export declare class GroupMembershipNameMismatchError extends KeyingVerification
     constructor(reason: "forbidden_characters" | "name_mismatch");
 }
 /** Check the selected label only after verifying the signed policy bundle. */
-export declare function assertGroupMembershipName(verifiedBundle: PrincipalPolicyBundleResponse, expectedGroupName: string, readEncryptedName?: GroupPolicyNameReader): Promise<void>;
+export declare function assertGroupMembershipName(verifiedBundle: Pick<PrincipalPolicyBundleResponse, "currentState" | "currentPayload">, expectedGroupName: string, readEncryptedName?: GroupPolicyNameReader): Promise<void>;

package/workflows/organizations/groupMembershipName.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"groupMembershipName.js","sourceRoot":"","sources":["groupMembershipName.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,OAAO,EAEL,uBAAuB,GACxB,MAAM,0BAA0B,CAAC;AAElC,MAAM,OAAO,gCAAiC,SAAQ,uBAAuB;IAC3E,YAAY,MAAgD;QAC1D,KAAK,CACH,iBAAiB,EACjB,MAAM,KAAK,sBAAsB;YAC/B,CAAC,CAAC,uEAAuE;YACzE,CAAC,CAAC,8DAA8D,CACnE,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;IACjD,CAAC;CACF;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,~~cAA6C~~,~~EAC7C~~,iBAAyB,EACzB,iBAAyC;IAEzC,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAC5C,cAAc,EACd,iBAAiB,EACjB,iBAAiB,CAClB,CAAC;IACF,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,IAAI,gCAAgC,CAAC,QAAQ,CAAC,CAAC;IACvD,CAAC;AACH,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport {\n type GroupPolicyNameReader,\n groupPolicyNameMismatch,\n} from \"./principalPolicyRequest\";\n\nexport class GroupMembershipNameMismatchError extends KeyingVerificationError {\n constructor(reason: \"forbidden_characters\" \| \"name_mismatch\") {\n super(\n \"object_mismatch\",\n reason === \"forbidden_characters\"\n ? \"Group membership name contains forbidden control or format characters\"\n : \"Group membership name does not match the signed group policy\",\n );\n this.name = \"GroupMembershipNameMismatchError\";\n }\n}\n\n/** Check the selected label only after verifying the signed policy bundle. */\nexport async function assertGroupMembershipName(\n verifiedBundle: PrincipalPolicyBundleResponse,\n expectedGroupName: string,\n readEncryptedName?: GroupPolicyNameReader,\n): Promise<void> {\n const mismatch = await groupPolicyNameMismatch(\n verifiedBundle,\n expectedGroupName,\n readEncryptedName,\n );\n if (mismatch) {\n throw new GroupMembershipNameMismatchError(mismatch);\n }\n}\n"]}
1	+ {"version":3,"file":"groupMembershipName.js","sourceRoot":"","sources":["groupMembershipName.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,OAAO,EAEL,uBAAuB,GACxB,MAAM,0BAA0B,CAAC;AAElC,MAAM,OAAO,gCAAiC,SAAQ,uBAAuB;IAC3E,YAAY,MAAgD;QAC1D,KAAK,CACH,iBAAiB,EACjB,MAAM,KAAK,sBAAsB;YAC/B,CAAC,CAAC,uEAAuE;YACzE,CAAC,CAAC,8DAA8D,CACnE,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;IACjD,CAAC;CACF;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,cAGC,EACD,iBAAyB,EACzB,iBAAyC;IAEzC,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAC5C,cAAc,EACd,iBAAiB,EACjB,iBAAiB,CAClB,CAAC;IACF,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,IAAI,gCAAgC,CAAC,QAAQ,CAAC,CAAC;IACvD,CAAC;AACH,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport {\n type GroupPolicyNameReader,\n groupPolicyNameMismatch,\n} from \"./principalPolicyRequest\";\n\nexport class GroupMembershipNameMismatchError extends KeyingVerificationError {\n constructor(reason: \"forbidden_characters\" \| \"name_mismatch\") {\n super(\n \"object_mismatch\",\n reason === \"forbidden_characters\"\n ? \"Group membership name contains forbidden control or format characters\"\n : \"Group membership name does not match the signed group policy\",\n );\n this.name = \"GroupMembershipNameMismatchError\";\n }\n}\n\n/** Check the selected label only after verifying the signed policy bundle. */\nexport async function assertGroupMembershipName(\n verifiedBundle: Pick<\n PrincipalPolicyBundleResponse,\n \"currentState\" \| \"currentPayload\"\n >,\n expectedGroupName: string,\n readEncryptedName?: GroupPolicyNameReader,\n): Promise<void> {\n const mismatch = await groupPolicyNameMismatch(\n verifiedBundle,\n expectedGroupName,\n readEncryptedName,\n );\n if (mismatch) {\n throw new GroupMembershipNameMismatchError(mismatch);\n }\n}\n"]}

package/workflows/organizations/groupMetadataRuntime.js CHANGED Viewed

@@ -4,11 +4,15 @@ import { createRuntimePrincipalPolicyWarmer } from "../principals/runtimePolicyW
 import { createCurrentGroupMetadataContainerVerifier } from "./currentGroupMetadataAuthority.js";
 import { createGroupMetadataAccess, } from "./groupMetadataAccess.js";
 import { createGroupMetadataContainerVerifier } from "./groupMetadataContainerAuthority.js";
-export function createRuntimeGroupMetadataAccess(runtime, organizationId, stillCurrent, currentRecovery) {
+export function createRuntimeGroupMetadataAccess(runtime, organizationId, stillCurrent, verifyMetadataContainer, currentRecovery) {
     const targetSecretKey = runtime.crypto.encapsulationKeyPair?.secretKey;
     if (!targetSecretKey)
         throw new Error("Group metadata identity is locked");
-    const warmer = createRuntimePrincipalPolicyWarmer(runtime);
+    // The signed metadata projection selects exact citations. Reuse matching
+    // private evidence with its dependencies and pins before bounded online reads.
+    const warmer = createRuntimePrincipalPolicyWarmer(runtime, {
+        preferLocalCurrent: true,
+    });
     const resolveCurrentPolicy = currentRecovery?.resolveCurrentPolicy ??
         createRuntimePrincipalPolicyCurrentResolver(runtime);
     const authorityInput = {
@@ -20,13 +24,14 @@ export function createRuntimeGroupMetadataAccess(runtime, organizationId, stillC
         stillCurrent: stillCurrent ?? (() => true),
     };
     return createGroupMetadataAccess({
-        verifyMetadataContainer: resolveCurrentPolicy
-            ? createCurrentGroupMetadataContainerVerifier({
-                ...authorityInput,
-                resolveCurrentPolicy,
-                recoveryBatch: currentRecovery?.recoveryBatch,
-            })
-            : createGroupMetadataContainerVerifier(authorityInput),
+        verifyMetadataContainer: verifyMetadataContainer ??
+            (resolveCurrentPolicy
+                ? createCurrentGroupMetadataContainerVerifier({
+                    ...authorityInput,
+                    resolveCurrentPolicy,
+                    recoveryBatch: currentRecovery?.recoveryBatch,
+                })
+                : createGroupMetadataContainerVerifier(authorityInput)),
         apiClient: runtime.apiClient,
         execSql: runtime.infra.execSql,
         organizationId,

package/workflows/organizations/groupMetadataRuntime.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"groupMetadataRuntime.js","sourceRoot":"","sources":["groupMetadataRuntime.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,+BAA+B,EAAE,MAAM,yDAAyD,CAAC;AAI1G,OAAO,EACL,2CAA2C,GAE5C,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,kCAAkC,EAAE,MAAM,mCAAmC,CAAC;AACvF,OAAO,EAAE,2CAA2C,EAAE,MAAM,iCAAiC,CAAC;AAC9F,OAAO,EACL,yBAAyB,GAE1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,oCAAoC,EAAE,MAAM,mCAAmC,CAAC;AAmBzF,MAAM,UAAU,gCAAgC,CAC9C,OAA6B,EAC7B,cAAsB,EACtB,YAA4B,EAC5B,eAKC;IAED,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,SAAS,CAAC;IACvE,IAAI,CAAC,eAAe;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,kCAAkC,CAAC,OAAO,CAAC,CAAC;~~IAC3D~~,MAAM,oBAAoB,GACxB,eAAe,EAAE,oBAAoB;QACrC,2CAA2C,CAAC,OAAO,CAAC,CAAC;IACvD,MAAM,cAAc,GAAG;QACrB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9B,cAAc;QACd,sBAAsB,EAAE,OAAO,CAAC,IAAI,CAAC,sBAAsB;QAC3D,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;QAC9D,YAAY,EAAE,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;KAC3C,CAAC;IACF,OAAO,yBAAyB,CAAC;QAC/B,uBAAuB,~~EAAE~~,oBAAoB;~~YAC3C~~,CAAC,CAAC,2CAA2C,CAAC;~~gBAC1C~~,GAAG,cAAc;~~gBACjB~~,oBAAoB;~~gBACpB~~,aAAa,EAAE,eAAe,EAAE,aAAa;~~aAC9C~~,CAAC;~~YACJ~~,CAAC,CAAC,oCAAoC,CAAC,cAAc,CAAC;~~QACxD~~,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9B,cAAc;QACd,wBAAwB,EAAE,+BAA+B,CAAC,OAAO,CAAC;QAClE,eAAe;QACf,YAAY;QACZ,+BAA+B,EAAE,MAAM;KACxC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { EncapsulationKeyPair } from \"@tearleads/crypto\";\nimport { createProjectionUserKeyResolver } from \"../../data/keyingProjectionVerification/userKeyResolver\";\nimport type { SecurityIncidentReporter } from \"../../data/securityIncidents\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\nimport {\n createRuntimePrincipalPolicyCurrentResolver,\n type PrincipalPolicyRecoveryRuntime,\n} from \"../principals/runtimePolicyRecovery\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../principals/runtimePolicyWarmer\";\nimport { createCurrentGroupMetadataContainerVerifier } from \"./currentGroupMetadataAuthority\";\nimport {\n createGroupMetadataAccess,\n type GroupMetadataAccessInput,\n} from \"./groupMetadataAccess\";\nimport { createGroupMetadataContainerVerifier } from \"./groupMetadataContainerAuthority\";\nimport type { PrincipalPolicyReadApi } from \"./groupPolicyMutationContext\";\n\ninterface GroupMetadataRuntime {\n readonly state?: PrincipalPolicyRecoveryRuntime[\"state\"];\n readonly apiClient: GroupMetadataAccessInput[\"apiClient\"] &\n PrincipalPolicyReadApi &\n PrincipalPolicyRecoveryRuntime[\"apiClient\"];\n readonly crypto: {\n readonly encapsulationKeyPair: EncapsulationKeyPair \| null;\n };\n readonly infra: { readonly execSql: ExecSql };\n readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n readonly util: {\n readonly log: (message: string) => void;\n readonly reportSecurityIncident: SecurityIncidentReporter;\n };\n}\n\nexport function createRuntimeGroupMetadataAccess(\n runtime: GroupMetadataRuntime,\n organizationId: string,\n stillCurrent?: () => boolean,\n currentRecovery?: {\n readonly resolveCurrentPolicy: ReturnType<\n typeof createRuntimePrincipalPolicyCurrentResolver\n >;\n readonly recoveryBatch: object;\n },\n) {\n const targetSecretKey = runtime.crypto.encapsulationKeyPair?.secretKey;\n if (!targetSecretKey) throw new Error(\"Group metadata identity is locked\");\n const warmer = createRuntimePrincipalPolicyWarmer(runtime);\n const resolveCurrentPolicy =\n currentRecovery?.resolveCurrentPolicy ??\n createRuntimePrincipalPolicyCurrentResolver(runtime);\n const authorityInput = {\n apiClient: runtime.apiClient,\n execSql: runtime.infra.execSql,\n organizationId,\n reportSecurityIncident: runtime.util.reportSecurityIncident,\n resolveTrustedUserIdentity: runtime.resolveTrustedUserIdentity,\n stillCurrent: stillCurrent ?? (() => true),\n };\n return createGroupMetadataAccess({\n verifyMetadataContainer: resolveCurrentPolicy\n ? createCurrentGroupMetadataContainerVerifier({\n ...authorityInput,\n resolveCurrentPolicy,\n recoveryBatch: currentRecovery?.recoveryBatch,\n })\n : createGroupMetadataContainerVerifier(authorityInput),\n apiClient: runtime.apiClient,\n execSql: runtime.infra.execSql,\n organizationId,\n resolveProjectionUserKey: createProjectionUserKeyResolver(runtime),\n targetSecretKey,\n stillCurrent,\n warmReferencedPrincipalPolicies: warmer,\n });\n}\n"]}
1	+ {"version":3,"file":"groupMetadataRuntime.js","sourceRoot":"","sources":["groupMetadataRuntime.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,+BAA+B,EAAE,MAAM,yDAAyD,CAAC;AAI1G,OAAO,EACL,2CAA2C,GAE5C,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,kCAAkC,EAAE,MAAM,mCAAmC,CAAC;AACvF,OAAO,EAAE,2CAA2C,EAAE,MAAM,iCAAiC,CAAC;AAC9F,OAAO,EACL,yBAAyB,GAE1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,oCAAoC,EAAE,MAAM,mCAAmC,CAAC;AAmBzF,MAAM,UAAU,gCAAgC,CAC9C,OAA6B,EAC7B,cAAsB,EACtB,YAA4B,EAC5B,uBAA6E,EAC7E,eAKC;IAED,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,SAAS,CAAC;IACvE,IAAI,CAAC,eAAe;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAC3E,yEAAyE;IACzE,+EAA+E;IAC/E,MAAM,MAAM,GAAG,kCAAkC,CAAC,OAAO,EAAE;QACzD,kBAAkB,EAAE,IAAI;KACzB,CAAC,CAAC;IACH,MAAM,oBAAoB,GACxB,eAAe,EAAE,oBAAoB;QACrC,2CAA2C,CAAC,OAAO,CAAC,CAAC;IACvD,MAAM,cAAc,GAAG;QACrB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9B,cAAc;QACd,sBAAsB,EAAE,OAAO,CAAC,IAAI,CAAC,sBAAsB;QAC3D,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;QAC9D,YAAY,EAAE,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;KAC3C,CAAC;IACF,OAAO,yBAAyB,CAAC;QAC/B,uBAAuB,EACrB,uBAAuB;YACvB,CAAC,oBAAoB;gBACnB,CAAC,CAAC,2CAA2C,CAAC;oBAC1C,GAAG,cAAc;oBACjB,oBAAoB;oBACpB,aAAa,EAAE,eAAe,EAAE,aAAa;iBAC9C,CAAC;gBACJ,CAAC,CAAC,oCAAoC,CAAC,cAAc,CAAC,CAAC;QAC3D,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9B,cAAc;QACd,wBAAwB,EAAE,+BAA+B,CAAC,OAAO,CAAC;QAClE,eAAe;QACf,YAAY;QACZ,+BAA+B,EAAE,MAAM;KACxC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { EncapsulationKeyPair } from \"@tearleads/crypto\";\nimport { createProjectionUserKeyResolver } from \"../../data/keyingProjectionVerification/userKeyResolver\";\nimport type { SecurityIncidentReporter } from \"../../data/securityIncidents\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\nimport {\n createRuntimePrincipalPolicyCurrentResolver,\n type PrincipalPolicyRecoveryRuntime,\n} from \"../principals/runtimePolicyRecovery\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../principals/runtimePolicyWarmer\";\nimport { createCurrentGroupMetadataContainerVerifier } from \"./currentGroupMetadataAuthority\";\nimport {\n createGroupMetadataAccess,\n type GroupMetadataAccessInput,\n} from \"./groupMetadataAccess\";\nimport { createGroupMetadataContainerVerifier } from \"./groupMetadataContainerAuthority\";\nimport type { PrincipalPolicyReadApi } from \"./groupPolicyMutationContext\";\n\ninterface GroupMetadataRuntime {\n readonly state?: PrincipalPolicyRecoveryRuntime[\"state\"];\n readonly apiClient: GroupMetadataAccessInput[\"apiClient\"] &\n PrincipalPolicyReadApi &\n PrincipalPolicyRecoveryRuntime[\"apiClient\"];\n readonly crypto: {\n readonly encapsulationKeyPair: EncapsulationKeyPair \| null;\n };\n readonly infra: { readonly execSql: ExecSql };\n readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n readonly util: {\n readonly log: (message: string) => void;\n readonly reportSecurityIncident: SecurityIncidentReporter;\n };\n}\n\nexport function createRuntimeGroupMetadataAccess(\n runtime: GroupMetadataRuntime,\n organizationId: string,\n stillCurrent?: () => boolean,\n verifyMetadataContainer?: GroupMetadataAccessInput[\"verifyMetadataContainer\"],\n currentRecovery?: {\n readonly resolveCurrentPolicy: ReturnType<\n typeof createRuntimePrincipalPolicyCurrentResolver\n >;\n readonly recoveryBatch: object;\n },\n) {\n const targetSecretKey = runtime.crypto.encapsulationKeyPair?.secretKey;\n if (!targetSecretKey) throw new Error(\"Group metadata identity is locked\");\n // The signed metadata projection selects exact citations. Reuse matching\n // private evidence with its dependencies and pins before bounded online reads.\n const warmer = createRuntimePrincipalPolicyWarmer(runtime, {\n preferLocalCurrent: true,\n });\n const resolveCurrentPolicy =\n currentRecovery?.resolveCurrentPolicy ??\n createRuntimePrincipalPolicyCurrentResolver(runtime);\n const authorityInput = {\n apiClient: runtime.apiClient,\n execSql: runtime.infra.execSql,\n organizationId,\n reportSecurityIncident: runtime.util.reportSecurityIncident,\n resolveTrustedUserIdentity: runtime.resolveTrustedUserIdentity,\n stillCurrent: stillCurrent ?? (() => true),\n };\n return createGroupMetadataAccess({\n verifyMetadataContainer:\n verifyMetadataContainer ??\n (resolveCurrentPolicy\n ? createCurrentGroupMetadataContainerVerifier({\n ...authorityInput,\n resolveCurrentPolicy,\n recoveryBatch: currentRecovery?.recoveryBatch,\n })\n : createGroupMetadataContainerVerifier(authorityInput)),\n apiClient: runtime.apiClient,\n execSql: runtime.infra.execSql,\n organizationId,\n resolveProjectionUserKey: createProjectionUserKeyResolver(runtime),\n targetSecretKey,\n stillCurrent,\n warmReferencedPrincipalPolicies: warmer,\n });\n}\n"]}

package/workflows/organizations/groupNameUniqueness.js CHANGED Viewed

@@ -68,7 +68,7 @@ export async function verifyDirectoryGroup(input, head) {
  * walk isolates it rather than failing every name in the organization, but it
  * still records the incident: only a dishonest admin signs such a name.
  */
-async function readDirectoryGroupName(input, bundle) {
+export async function readDirectoryGroupName(input, bundle) {
     try {
         return await readGroupPolicyPayloadName(bundle, input.readEncryptedName);
     }

package/workflows/organizations/groupNameUniqueness.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"groupNameUniqueness.js","sourceRoot":"","sources":["groupNameUniqueness.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAGxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,uCAAuC,EAAE,MAAM,+CAA+C,CAAC;AACxG,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,qCAAqC,EAAE,MAAM,4DAA4D,CAAC;AACnH,OAAO,EAAE,mCAAmC,EAAE,MAAM,oEAAoE,CAAC;AACzH,OAAO,EAEL,6BAA6B,GAC9B,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EACL,kCAAkC,EAClC,yDAAyD,GAC1D,MAAM,mDAAmD,CAAC;AAI3D,OAAO,EAAE,sCAAsC,EAAE,MAAM,kCAAkC,CAAC;AAC1F,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EACL,qBAAqB,EAErB,0BAA0B,GAC3B,MAAM,0BAA0B,CAAC;AA4BlC;;;GAGG;AACH,KAAK,UAAU,wBAAwB,CACrC,KAA8B,EAC9B,IAAwB;IAExB,MAAM,eAAe,GAAG,MAAM,6BAA6B,CACzD,KAAK,CAAC,OAAO,EACb,OAAO,EACP,IAAI,CAAC,WAAW,CACjB,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,qCAAqC,CACxD,KAAK,CAAC,OAAO,EACb,IAAI,EACJ,eAAe,CAChB,CAAC;IACF,MAAM,MAAM,GACV,MAAM;QACN,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,yBAAyB,CAC9C,OAAO,EACP,IAAI,CAAC,WAAW,CACjB,CAAC,CAAC;IACL,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,gCAAgC,IAAI,CAAC,WAAW,sBAAsB,CACvE,CAAC;IACJ,CAAC;IACD,IACE,CAAC,6BAA6B,CAC5B,kCAAkC,CAAC,MAAM,CAAC,EAC1C,IAAI,CACL,EACD,CAAC;QACD,qEAAqE;QACrE,uEAAuE;QACvE,2DAA2D;QAC3D,MAAM,IAAI,KAAK,CACb,sFAAsF,CACvF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAA8B,EAC9B,IAAwB;IAExB,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,wBAAwB,CAChE,KAAK,EACL,IAAI,CACL,CAAC;IACF,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;QACpE,MAAM;QACN,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,IAAI,OAAO,IAAI,gBAAgB,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,gEAAgE,gBAAgB,CAAC,KAAK,GAAG,CAC1F,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GACZ,MAAM,yDAAyD,CAAC;QAC9D,MAAM;QACN,iBAAiB,EAAE,IAAI;QACvB,qBAAqB,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,iBAAiB;QAC1D,eAAe;QACf,gBAAgB,EAAE,gBAAgB,CAAC,gBAAgB;KACpD,CAAC,CAAC;IACL,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,uCAAuC,CACrC,QAAQ,CAAC,KAAK,EACd,kDAAkD,CACnD,CAAC;IACJ,CAAC;IACD,0BAA0B,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACzD,OAAO;QACL,MAAM;QACN,IAAI;QACJ,OAAO,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC;QAC3D,MAAM,EAAE,QAAQ,CAAC,KAAK;KACvB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,sBAAsB,CACnC,KAA8B,EAC9B,MAAqC;IAErC,IAAI,CAAC;QACH,OAAO,MAAM,0BAA0B,CAAC,MAAM,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,4BAA4B,CAAC;YAAE,MAAM,KAAK,CAAC;QAClE,MAAM,KAAK,CAAC,sBAAsB,CAChC,IAAI,uBAAuB,CACzB,eAAe,EACf,8DAA8D,CAC/D,EACD;YACE,cAAc,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE;YAC5D,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW;YACzC,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,wBAAwB;YACnC,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CACF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,0BAA0B,GAAG,CAAC,CAAC;AAErC,8EAA8E;AAC9E,KAAK,UAAU,kBAAkB,CAC/B,KAAuB,EACvB,KAAa,EACb,IAA6B;IAE7B,MAAM,OAAO,GAAQ,EAAE,CAAC;IACxB,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE;QACxB,SAAS,CAAC;YACR,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO;YACxD,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;IACH,CAAC,CAAC;IACF,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAC9D,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAA0D;IAE1D,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClD,wEAAwE;IACxE,0EAA0E;IAC1E,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,SAAS,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IACjD,MAAM,eAAe,GAAG,KAAK,EAC3B,IAAwB,EACS,EAAE;QACnC,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACtD,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,CAC9B,mCAAmC,CAAC;YAClC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS,EAAE,UAAU;SACtB,CAAC,CACH,CAAC;QACF,MAAM,SAAS,CAAC;QAChB,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,kBAAkB,CACrC,KAAK,CAAC,UAAU,CAAC,UAAU,EAC3B,0BAA0B,EAC1B,eAAe,CAChB,CAAC;IACF,4EAA4E;IAC5E,2EAA2E;IAC3E,+CAA+C;IAC/C,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import {\n KeyingVerificationError,\n type PrincipalPolicyExternalAuthority,\n type VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { throwKeyingVerificationErrorWithContext } from \"../../data/keyingProjectionVerification/error\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../data/persistence/keyingCheckpointPersistence\";\nimport { loadPrincipalPolicyBundleForReference } from \"../../data/persistence/principalPolicyReferencePersistence\";\nimport { retainVerifiedPrincipalPolicyBundle } from \"../../data/persistence/verifiedPrincipalPolicyRetentionPersistence\";\nimport {\n type OrganizationAuthorityDescriptor,\n principalHeadMatchesReference,\n} from \"../../data/principals/organizationAuthorityDescriptor\";\nimport {\n principalPolicyReferenceFromBundle,\n verifyPrincipalPolicyBundleWithExternalOrganizationAdmins,\n} from \"../../data/principals/principalPolicyAdminSigners\";\nimport type { SecurityIncidentReporter } from \"../../data/securityIncidents\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\nimport { collectPrincipalPolicySignerPublicKeys } from \"../principals/policyVerification\";\nimport { GroupMetadataUnreadableError } from \"./groupMetadataAccess\";\nimport { assertGroupMetadataBinding } from \"./groupMetadataBinding\";\nimport {\n canonicalGroupNameKey,\n type GroupPolicyNameReader,\n readGroupPolicyPayloadName,\n} from \"./principalPolicyRequest\";\n\nexport interface DirectoryGroupWalkInput {\n readonly readEncryptedName?: GroupPolicyNameReader \| undefined;\n readonly apiClient: {\n getCurrentPrincipalPolicy: (\n principalType: \"group\" \| \"organization\",\n principalId: string,\n ) => Promise<PrincipalPolicyBundleResponse \| null>;\n };\n readonly descriptor: OrganizationAuthorityDescriptor;\n readonly execSql: ExecSql;\n readonly externalAuthority: PrincipalPolicyExternalAuthority;\n readonly organizationId: string;\n readonly reportSecurityIncident: SecurityIncidentReporter;\n readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}\n\ntype DirectoryGroupHead = OrganizationAuthorityDescriptor[\"groupHeads\"][number];\n\ninterface VerifiedDirectoryGroup {\n readonly bundle: PrincipalPolicyBundleResponse;\n /** Null when the signed name does not decrypt for any member. /\n readonly name: string \| null;\n readonly nameKey: string \| null;\n readonly policy: VerifiedPrincipalPolicy;\n}\n\n/\n Loads one directory group at its committed head: from the local retained\n * bundles when they already hold that head, and from the API otherwise.\n /\nasync function loadDirectoryGroupBundle(\n input: DirectoryGroupWalkInput,\n head: DirectoryGroupHead,\n) {\n const localCheckpoint = await loadPrincipalPolicyCheckpoint(\n input.execSql,\n \"group\",\n head.principalId,\n );\n const cached = await loadPrincipalPolicyBundleForReference(\n input.execSql,\n head,\n localCheckpoint,\n );\n const bundle =\n cached ??\n (await input.apiClient.getCurrentPrincipalPolicy(\n \"group\",\n head.principalId,\n ));\n if (!bundle) {\n throw new Error(\n `Organization directory group ${head.principalId} could not be loaded`,\n );\n }\n if (\n !principalHeadMatchesReference(\n principalPolicyReferenceFromBundle(bundle),\n head,\n )\n ) {\n // Head drift is reachable by a concurrent admin mutation, so it is a\n // plain error to retry on, not an incident (as in the share path). The\n // typed errors stay for signature and projection failures.\n throw new Error(\n \"Organization directory group policy does not match the signed organization directory\",\n );\n }\n return { bundle, localCheckpoint };\n}\n\n/\n A bundle served from local retention was verified when it was retained, and\n * is verified again here on purpose: the re-check costs local CPU only, and it\n * keeps the name a group vouches for independent of what any earlier caller\n * trusted at retention time.\n /\nexport async function verifyDirectoryGroup(\n input: DirectoryGroupWalkInput,\n head: DirectoryGroupHead,\n): Promise<VerifiedDirectoryGroup> {\n const { bundle, localCheckpoint } = await loadDirectoryGroupBundle(\n input,\n head,\n );\n const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({\n bundle,\n resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n });\n if (\"error\" in signerPublicKeys) {\n throw new Error(\n `Organization directory group signer key could not be loaded (${signerPublicKeys.error})`,\n );\n }\n const verified =\n await verifyPrincipalPolicyBundleWithExternalOrganizationAdmins({\n bundle,\n expectedReference: head,\n loadExternalAuthority: async () => input.externalAuthority,\n localCheckpoint,\n signerPublicKeys: signerPublicKeys.signerPublicKeys,\n });\n if (!verified.ok) {\n throwKeyingVerificationErrorWithContext(\n verified.error,\n \"Organization directory group verification failed\",\n );\n }\n assertGroupMetadataBinding(bundle, input.descriptor);\n const name = await readDirectoryGroupName(input, bundle);\n return {\n bundle,\n name,\n nameKey: name === null ? null : canonicalGroupNameKey(name),\n policy: verified.value,\n };\n}\n\n/\n A verified group whose name no member can open has no name to select by. The\n * walk isolates it rather than failing every name in the organization, but it\n * still records the incident: only a dishonest admin signs such a name.\n /\nasync function readDirectoryGroupName(\n input: DirectoryGroupWalkInput,\n bundle: PrincipalPolicyBundleResponse,\n): Promise<string \| null> {\n try {\n return await readGroupPolicyPayloadName(bundle, input.readEncryptedName);\n } catch (error) {\n if (!(error instanceof GroupMetadataUnreadableError)) throw error;\n await input.reportSecurityIncident(\n new KeyingVerificationError(\n \"invalid_shape\",\n \"Signed group name does not open under the cited metadata key\",\n ),\n {\n evidenceHashes: { stateHash: bundle.currentState.stateHash },\n objectId: bundle.currentState.principalId,\n objectKind: \"principal\",\n operation: \"organization.groupName\",\n organizationId: input.organizationId,\n },\n );\n return null;\n }\n}\n\n/\n Signed group names are the only authenticated label a member can choose a\n * group by, and the API does not make them unique within an organization. So\n * uniqueness is enforced here, where a name enters: before an admin signs a\n * new group, every group committed in the signed organization directory\n * (the reserved Admins and Members groups included) is loaded, verified\n * against its directory head, and its committed name compared by canonical\n * key. A share then needs only the target's verified name. A compromised\n * server cannot mint a signed group, so it cannot create the duplicate this\n * check refuses.\n \n The walk is fail-closed: one group that cannot be loaded or verified blocks\n * the creation, since an unverifiable group could carry any name. A verified\n * group whose name does not decrypt is skipped: no member can open that name,\n * so it cannot collide with one. It runs the\n * loads in parallel and retains every verified bundle, so a later creation\n * finds unchanged groups locally and fetches only those whose head moved.\n /\nconst DIRECTORY_WALK_CONCURRENCY = 4;\n\n/* Runs `work` over `items` with at most `limit` in flight, keeping order. */\nasync function mapWithConcurrency<T, R>(\n items: ReadonlyArray<T>,\n limit: number,\n work: (item: T) => Promise<R>,\n): Promise<R[]> {\n const results: R[] = [];\n let next = 0;\n const worker = async () => {\n for (;;) {\n const index = next++;\n const item = items[index];\n if (index >= items.length \|\| item === undefined) return;\n results[index] = await work(item);\n }\n };\n await Promise.all(\n Array.from({ length: Math.min(limit, items.length) }, worker),\n );\n return results;\n}\n\nexport async function assertGroupNameUniqueInDirectory(\n input: DirectoryGroupWalkInput & { readonly name: string },\n): Promise<void> {\n const nameKey = canonicalGroupNameKey(input.name);\n // Each verified bundle is retained as soon as it verifies, so a failure\n // later in the walk (or a taken name) still leaves the cache warm for the\n // retry. Retention runs in a transaction on the shared connection, so the\n // writes are chained one after another while the loads stay concurrent.\n const retainedAt = new Date().toISOString();\n let retention: Promise<void> = Promise.resolve();\n const verifyAndRetain = async (\n head: DirectoryGroupHead,\n ): Promise<VerifiedDirectoryGroup> => {\n const group = await verifyDirectoryGroup(input, head);\n retention = retention.then(() =>\n retainVerifiedPrincipalPolicyBundle({\n bundle: group.bundle,\n execSql: input.execSql,\n organizationId: input.organizationId,\n policy: group.policy,\n updatedAt: retainedAt,\n }),\n );\n await retention;\n return group;\n };\n const groups = await mapWithConcurrency(\n input.descriptor.groupHeads,\n DIRECTORY_WALK_CONCURRENCY,\n verifyAndRetain,\n );\n // A taken name is user input to correct, not evidence of tampering, so this\n // is a plain error: group creation runs under security-incident reporting,\n // which records every KeyingVerificationError.\n if (groups.some((group) => group.nameKey === nameKey)) {\n throw new Error(\n \"Another signed group in this organization already carries this name\",\n );\n }\n}\n"]}
1	+ {"version":3,"file":"groupNameUniqueness.js","sourceRoot":"","sources":["groupNameUniqueness.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAGxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,uCAAuC,EAAE,MAAM,+CAA+C,CAAC;AACxG,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,qCAAqC,EAAE,MAAM,4DAA4D,CAAC;AACnH,OAAO,EAAE,mCAAmC,EAAE,MAAM,oEAAoE,CAAC;AACzH,OAAO,EAEL,6BAA6B,GAC9B,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EACL,kCAAkC,EAClC,yDAAyD,GAC1D,MAAM,mDAAmD,CAAC;AAI3D,OAAO,EAAE,sCAAsC,EAAE,MAAM,kCAAkC,CAAC;AAC1F,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EACL,qBAAqB,EAErB,0BAA0B,GAC3B,MAAM,0BAA0B,CAAC;AA4BlC;;;GAGG;AACH,KAAK,UAAU,wBAAwB,CACrC,KAA8B,EAC9B,IAAwB;IAExB,MAAM,eAAe,GAAG,MAAM,6BAA6B,CACzD,KAAK,CAAC,OAAO,EACb,OAAO,EACP,IAAI,CAAC,WAAW,CACjB,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,qCAAqC,CACxD,KAAK,CAAC,OAAO,EACb,IAAI,EACJ,eAAe,CAChB,CAAC;IACF,MAAM,MAAM,GACV,MAAM;QACN,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,yBAAyB,CAC9C,OAAO,EACP,IAAI,CAAC,WAAW,CACjB,CAAC,CAAC;IACL,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,gCAAgC,IAAI,CAAC,WAAW,sBAAsB,CACvE,CAAC;IACJ,CAAC;IACD,IACE,CAAC,6BAA6B,CAC5B,kCAAkC,CAAC,MAAM,CAAC,EAC1C,IAAI,CACL,EACD,CAAC;QACD,qEAAqE;QACrE,uEAAuE;QACvE,2DAA2D;QAC3D,MAAM,IAAI,KAAK,CACb,sFAAsF,CACvF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAA8B,EAC9B,IAAwB;IAExB,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,wBAAwB,CAChE,KAAK,EACL,IAAI,CACL,CAAC;IACF,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;QACpE,MAAM;QACN,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,IAAI,OAAO,IAAI,gBAAgB,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,gEAAgE,gBAAgB,CAAC,KAAK,GAAG,CAC1F,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GACZ,MAAM,yDAAyD,CAAC;QAC9D,MAAM;QACN,iBAAiB,EAAE,IAAI;QACvB,qBAAqB,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,iBAAiB;QAC1D,eAAe;QACf,gBAAgB,EAAE,gBAAgB,CAAC,gBAAgB;KACpD,CAAC,CAAC;IACL,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,uCAAuC,CACrC,QAAQ,CAAC,KAAK,EACd,kDAAkD,CACnD,CAAC;IACJ,CAAC;IACD,0BAA0B,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACzD,OAAO;QACL,MAAM;QACN,IAAI;QACJ,OAAO,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC;QAC3D,MAAM,EAAE,QAAQ,CAAC,KAAK;KACvB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAGC,EACD,MAAwD;IAExD,IAAI,CAAC;QACH,OAAO,MAAM,0BAA0B,CAAC,MAAM,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,4BAA4B,CAAC;YAAE,MAAM,KAAK,CAAC;QAClE,MAAM,KAAK,CAAC,sBAAsB,CAChC,IAAI,uBAAuB,CACzB,eAAe,EACf,8DAA8D,CAC/D,EACD;YACE,cAAc,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE;YAC5D,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW;YACzC,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,wBAAwB;YACnC,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CACF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,0BAA0B,GAAG,CAAC,CAAC;AAErC,8EAA8E;AAC9E,KAAK,UAAU,kBAAkB,CAC/B,KAAuB,EACvB,KAAa,EACb,IAA6B;IAE7B,MAAM,OAAO,GAAQ,EAAE,CAAC;IACxB,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE;QACxB,SAAS,CAAC;YACR,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO;YACxD,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;IACH,CAAC,CAAC;IACF,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAC9D,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAA0D;IAE1D,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClD,wEAAwE;IACxE,0EAA0E;IAC1E,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,SAAS,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IACjD,MAAM,eAAe,GAAG,KAAK,EAC3B,IAAwB,EACS,EAAE;QACnC,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACtD,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,CAC9B,mCAAmC,CAAC;YAClC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS,EAAE,UAAU;SACtB,CAAC,CACH,CAAC;QACF,MAAM,SAAS,CAAC;QAChB,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,kBAAkB,CACrC,KAAK,CAAC,UAAU,CAAC,UAAU,EAC3B,0BAA0B,EAC1B,eAAe,CAChB,CAAC;IACF,4EAA4E;IAC5E,2EAA2E;IAC3E,+CAA+C;IAC/C,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import {\n KeyingVerificationError,\n type PrincipalPolicyExternalAuthority,\n type VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { throwKeyingVerificationErrorWithContext } from \"../../data/keyingProjectionVerification/error\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../data/persistence/keyingCheckpointPersistence\";\nimport { loadPrincipalPolicyBundleForReference } from \"../../data/persistence/principalPolicyReferencePersistence\";\nimport { retainVerifiedPrincipalPolicyBundle } from \"../../data/persistence/verifiedPrincipalPolicyRetentionPersistence\";\nimport {\n type OrganizationAuthorityDescriptor,\n principalHeadMatchesReference,\n} from \"../../data/principals/organizationAuthorityDescriptor\";\nimport {\n principalPolicyReferenceFromBundle,\n verifyPrincipalPolicyBundleWithExternalOrganizationAdmins,\n} from \"../../data/principals/principalPolicyAdminSigners\";\nimport type { SecurityIncidentReporter } from \"../../data/securityIncidents\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\nimport { collectPrincipalPolicySignerPublicKeys } from \"../principals/policyVerification\";\nimport { GroupMetadataUnreadableError } from \"./groupMetadataAccess\";\nimport { assertGroupMetadataBinding } from \"./groupMetadataBinding\";\nimport {\n canonicalGroupNameKey,\n type GroupPolicyNameReader,\n readGroupPolicyPayloadName,\n} from \"./principalPolicyRequest\";\n\nexport interface DirectoryGroupWalkInput {\n readonly readEncryptedName?: GroupPolicyNameReader \| undefined;\n readonly apiClient: {\n getCurrentPrincipalPolicy: (\n principalType: \"group\" \| \"organization\",\n principalId: string,\n ) => Promise<PrincipalPolicyBundleResponse \| null>;\n };\n readonly descriptor: OrganizationAuthorityDescriptor;\n readonly execSql: ExecSql;\n readonly externalAuthority: PrincipalPolicyExternalAuthority;\n readonly organizationId: string;\n readonly reportSecurityIncident: SecurityIncidentReporter;\n readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}\n\ntype DirectoryGroupHead = OrganizationAuthorityDescriptor[\"groupHeads\"][number];\n\ninterface VerifiedDirectoryGroup {\n readonly bundle: PrincipalPolicyBundleResponse;\n /** Null when the signed name does not decrypt for any member. /\n readonly name: string \| null;\n readonly nameKey: string \| null;\n readonly policy: VerifiedPrincipalPolicy;\n}\n\n/\n Loads one directory group at its committed head: from the local retained\n * bundles when they already hold that head, and from the API otherwise.\n /\nasync function loadDirectoryGroupBundle(\n input: DirectoryGroupWalkInput,\n head: DirectoryGroupHead,\n) {\n const localCheckpoint = await loadPrincipalPolicyCheckpoint(\n input.execSql,\n \"group\",\n head.principalId,\n );\n const cached = await loadPrincipalPolicyBundleForReference(\n input.execSql,\n head,\n localCheckpoint,\n );\n const bundle =\n cached ??\n (await input.apiClient.getCurrentPrincipalPolicy(\n \"group\",\n head.principalId,\n ));\n if (!bundle) {\n throw new Error(\n `Organization directory group ${head.principalId} could not be loaded`,\n );\n }\n if (\n !principalHeadMatchesReference(\n principalPolicyReferenceFromBundle(bundle),\n head,\n )\n ) {\n // Head drift is reachable by a concurrent admin mutation, so it is a\n // plain error to retry on, not an incident (as in the share path). The\n // typed errors stay for signature and projection failures.\n throw new Error(\n \"Organization directory group policy does not match the signed organization directory\",\n );\n }\n return { bundle, localCheckpoint };\n}\n\n/\n A bundle served from local retention was verified when it was retained, and\n * is verified again here on purpose: the re-check costs local CPU only, and it\n * keeps the name a group vouches for independent of what any earlier caller\n * trusted at retention time.\n /\nexport async function verifyDirectoryGroup(\n input: DirectoryGroupWalkInput,\n head: DirectoryGroupHead,\n): Promise<VerifiedDirectoryGroup> {\n const { bundle, localCheckpoint } = await loadDirectoryGroupBundle(\n input,\n head,\n );\n const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({\n bundle,\n resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n });\n if (\"error\" in signerPublicKeys) {\n throw new Error(\n `Organization directory group signer key could not be loaded (${signerPublicKeys.error})`,\n );\n }\n const verified =\n await verifyPrincipalPolicyBundleWithExternalOrganizationAdmins({\n bundle,\n expectedReference: head,\n loadExternalAuthority: async () => input.externalAuthority,\n localCheckpoint,\n signerPublicKeys: signerPublicKeys.signerPublicKeys,\n });\n if (!verified.ok) {\n throwKeyingVerificationErrorWithContext(\n verified.error,\n \"Organization directory group verification failed\",\n );\n }\n assertGroupMetadataBinding(bundle, input.descriptor);\n const name = await readDirectoryGroupName(input, bundle);\n return {\n bundle,\n name,\n nameKey: name === null ? null : canonicalGroupNameKey(name),\n policy: verified.value,\n };\n}\n\n/\n A verified group whose name no member can open has no name to select by. The\n * walk isolates it rather than failing every name in the organization, but it\n * still records the incident: only a dishonest admin signs such a name.\n /\nexport async function readDirectoryGroupName(\n input: Pick<\n DirectoryGroupWalkInput,\n \"readEncryptedName\" \| \"reportSecurityIncident\" \| \"organizationId\"\n >,\n bundle: Parameters<typeof readGroupPolicyPayloadName>[0],\n): Promise<string \| null> {\n try {\n return await readGroupPolicyPayloadName(bundle, input.readEncryptedName);\n } catch (error) {\n if (!(error instanceof GroupMetadataUnreadableError)) throw error;\n await input.reportSecurityIncident(\n new KeyingVerificationError(\n \"invalid_shape\",\n \"Signed group name does not open under the cited metadata key\",\n ),\n {\n evidenceHashes: { stateHash: bundle.currentState.stateHash },\n objectId: bundle.currentState.principalId,\n objectKind: \"principal\",\n operation: \"organization.groupName\",\n organizationId: input.organizationId,\n },\n );\n return null;\n }\n}\n\n/\n Signed group names are the only authenticated label a member can choose a\n * group by, and the API does not make them unique within an organization. So\n * uniqueness is enforced here, where a name enters: before an admin signs a\n * new group, every group committed in the signed organization directory\n * (the reserved Admins and Members groups included) is loaded, verified\n * against its directory head, and its committed name compared by canonical\n * key. A share then needs only the target's verified name. A compromised\n * server cannot mint a signed group, so it cannot create the duplicate this\n * check refuses.\n \n The walk is fail-closed: one group that cannot be loaded or verified blocks\n * the creation, since an unverifiable group could carry any name. A verified\n * group whose name does not decrypt is skipped: no member can open that name,\n * so it cannot collide with one. It runs the\n * loads in parallel and retains every verified bundle, so a later creation\n * finds unchanged groups locally and fetches only those whose head moved.\n /\nconst DIRECTORY_WALK_CONCURRENCY = 4;\n\n/* Runs `work` over `items` with at most `limit` in flight, keeping order. */\nasync function mapWithConcurrency<T, R>(\n items: ReadonlyArray<T>,\n limit: number,\n work: (item: T) => Promise<R>,\n): Promise<R[]> {\n const results: R[] = [];\n let next = 0;\n const worker = async () => {\n for (;;) {\n const index = next++;\n const item = items[index];\n if (index >= items.length \|\| item === undefined) return;\n results[index] = await work(item);\n }\n };\n await Promise.all(\n Array.from({ length: Math.min(limit, items.length) }, worker),\n );\n return results;\n}\n\nexport async function assertGroupNameUniqueInDirectory(\n input: DirectoryGroupWalkInput & { readonly name: string },\n): Promise<void> {\n const nameKey = canonicalGroupNameKey(input.name);\n // Each verified bundle is retained as soon as it verifies, so a failure\n // later in the walk (or a taken name) still leaves the cache warm for the\n // retry. Retention runs in a transaction on the shared connection, so the\n // writes are chained one after another while the loads stay concurrent.\n const retainedAt = new Date().toISOString();\n let retention: Promise<void> = Promise.resolve();\n const verifyAndRetain = async (\n head: DirectoryGroupHead,\n ): Promise<VerifiedDirectoryGroup> => {\n const group = await verifyDirectoryGroup(input, head);\n retention = retention.then(() =>\n retainVerifiedPrincipalPolicyBundle({\n bundle: group.bundle,\n execSql: input.execSql,\n organizationId: input.organizationId,\n policy: group.policy,\n updatedAt: retainedAt,\n }),\n );\n await retention;\n return group;\n };\n const groups = await mapWithConcurrency(\n input.descriptor.groupHeads,\n DIRECTORY_WALK_CONCURRENCY,\n verifyAndRetain,\n );\n // A taken name is user input to correct, not evidence of tampering, so this\n // is a plain error: group creation runs under security-incident reporting,\n // which records every KeyingVerificationError.\n if (groups.some((group) => group.nameKey === nameKey)) {\n throw new Error(\n \"Another signed group in this organization already carries this name\",\n );\n }\n}\n"]}

package/workflows/organizations/groupPolicyHistoryPage.js ADDED Viewed

@@ -0,0 +1,31 @@
+import { diffPrincipalProjectionMembers } from "./policyHistoryReadModel.js";
+/** Keep a page boundary's actual predecessor when describing membership changes. */
+export function buildOrganizationGroupPolicyHistoryPage(input) {
+    const { page } = input;
+    return {
+        groupId: input.groupId,
+        organizationId: input.organizationId,
+        principalId: input.groupId,
+        principalType: "group",
+        nextBeforeVersion: page.nextBeforeVersion,
+        entries: page.entries
+            .map((entry, index) => ({
+            changes: diffPrincipalProjectionMembers({
+                current: entry.projection,
+                previous: (index === 0
+                    ? page.predecessor?.projection
+                    : page.entries[index - 1]?.projection) ?? [],
+            }),
+            createdAt: entry.state.createdAt,
+            keyEpoch: entry.state.keyEpoch,
+            memberCount: entry.state.memberCount,
+            signedAt: entry.state.signedAt,
+            signerUserId: entry.state.signerUserId,
+            signerUserKeyFingerprint: entry.state.signerUserKeyFingerprint,
+            stateHash: entry.state.stateHash,
+            version: entry.state.version,
+        }))
+            .reverse(),
+    };
+}
+//# sourceMappingURL=groupPolicyHistoryPage.js.map

package/workflows/organizations/groupPolicyHistoryPage.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"groupPolicyHistoryPage.js","sourceRoot":"","sources":["groupPolicyHistoryPage.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAG1E,oFAAoF;AACpF,MAAM,UAAU,uCAAuC,CAAC,KAIvD;IACC,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IACvB,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,WAAW,EAAE,KAAK,CAAC,OAAO;QAC1B,aAAa,EAAE,OAAO;QACtB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,OAAO,EAAE,IAAI,CAAC,OAAO;aAClB,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YACtB,OAAO,EAAE,8BAA8B,CAAC;gBACtC,OAAO,EAAE,KAAK,CAAC,UAAU;gBACzB,QAAQ,EACN,CAAC,KAAK,KAAK,CAAC;oBACV,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU;oBAC9B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,IAAI,EAAE;aACjD,CAAC;YACF,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;YAChC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;YAC9B,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;YACpC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;YAC9B,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY;YACtC,wBAAwB,EAAE,KAAK,CAAC,KAAK,CAAC,wBAAwB;YAC9D,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;YAChC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO;SAC7B,CAAC,CAAC;aACF,OAAO,EAAE;KACb,CAAC;AACJ,CAAC","sourcesContent":["import type { RecoveredPrincipalHistoryPage } from \"../principals/loadRecoveredPrincipalHistoryPage\";\nimport { diffPrincipalProjectionMembers } from \"./policyHistoryReadModel\";\nimport type { OrganizationGroupPolicyHistory } from \"./policyHistoryTypes\";\n\n/** Keep a page boundary's actual predecessor when describing membership changes. */\nexport function buildOrganizationGroupPolicyHistoryPage(input: {\n readonly groupId: string;\n readonly organizationId: string;\n readonly page: RecoveredPrincipalHistoryPage;\n}): OrganizationGroupPolicyHistory {\n const { page } = input;\n return {\n groupId: input.groupId,\n organizationId: input.organizationId,\n principalId: input.groupId,\n principalType: \"group\",\n nextBeforeVersion: page.nextBeforeVersion,\n entries: page.entries\n .map((entry, index) => ({\n changes: diffPrincipalProjectionMembers({\n current: entry.projection,\n previous:\n (index === 0\n ? page.predecessor?.projection\n : page.entries[index - 1]?.projection) ?? [],\n }),\n createdAt: entry.state.createdAt,\n keyEpoch: entry.state.keyEpoch,\n memberCount: entry.state.memberCount,\n signedAt: entry.state.signedAt,\n signerUserId: entry.state.signerUserId,\n signerUserKeyFingerprint: entry.state.signerUserKeyFingerprint,\n stateHash: entry.state.stateHash,\n version: entry.state.version,\n }))\n .reverse(),\n };\n}\n"]}

package/workflows/organizations/groupPolicyMutationAcknowledgement.js CHANGED Viewed

@@ -129,6 +129,7 @@ export async function acknowledgeInitialGroupPolicy(input) {
         input.response.currentState?.stateHash !== input.stateHash ||
         input.response.currentState.version !== state.version ||
         input.response.currentState.keyEpoch !== state.keyEpoch ||
+        input.response.currentState.keyFingerprint !== state.keyFingerprint ||
         input.response.currentState.memberCount !== state.memberCount ||
         state.principalType !== "group" ||
         state.principalId !== input.request.groupId ||

package/workflows/organizations/groupPolicyMutationAcknowledgement.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"groupPolicyMutationAcknowledgement.js","sourceRoot":"","sources":["groupPolicyMutationAcknowledgement.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kCAAkC,EAClC,mCAAmC,EACnC,8BAA8B,EAC9B,8BAA8B,EAC9B,0CAA0C,EAC1C,2BAA2B,EAC3B,mCAAmC,GAIpC,MAAM,mBAAmB,CAAC;AAW3B,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAEL,2BAA2B,GAC5B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,qCAAqC,EAAE,MAAM,mCAAmC,CAAC;AAE1F,OAAO,EAAE,8CAA8C,EAAE,MAAM,mCAAmC,CAAC;AAEnG,SAAS,kBAAkB,CACzB,MAAqC;IAErC,OAAO;QACL,GAAG,MAAM,CAAC,cAAc;QACxB;YACE,KAAK,EAAE,MAAM,CAAC,YAAY;YAC1B,UAAU,EAAE,MAAM,CAAC,iBAAiB;YACpC,MAAM,EAAE,MAAM,CAAC,aAAa;SAC7B;KACF,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CACpC,KAQC,EACD,YAAqC,EACrC,QAAgC;IAEhC,OAAO,CACL,KAAK,CAAC,aAAa,KAAK,YAAY,CAAC,aAAa;QAClD,KAAK,CAAC,WAAW,KAAK,YAAY,CAAC,WAAW;QAC9C,KAAK,CAAC,OAAO,KAAK,YAAY,CAAC,OAAO;QACtC,KAAK,CAAC,QAAQ,KAAK,YAAY,CAAC,QAAQ;QACxC,KAAK,CAAC,cAAc,KAAK,YAAY,CAAC,cAAc;QACpD,KAAK,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa;QAC9C,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;QAC1C,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,GAAG,CAAC;QACtC,KAAK,CAAC,aAAa,KAAK,QAAQ,CAAC,SAAS,CAC3C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kCAAkC,CAAC,KAKlD;IACC,qCAAqC,CAAC,KAAK,CAAC,CAAC;IAC7C,OAAO;QACL,GAAG,KAAK,CAAC,QAAQ;QACjB,cAAc,EAAE,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC;KACxD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,8BAA8B,CAC3C,OAAkC;IAElC,MAAM,UAAU,GAAG,mCAAmC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACxE,MAAM,CACJ,cAAc,EACd,mBAAmB,EACnB,cAAc,EACd,qBAAqB,EACrB,SAAS,EACV,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpB,8BAA8B,CAAC,OAAO,CAAC;QACvC,mCAAmC,CAAC,OAAO,CAAC,eAAe,CAAC;QAC5D,8BAA8B,CAAC,UAAU,CAAC;QAC1C,0CAA0C,CACxC,OAAO,CAAC,gBAAgB,CAAC,UAAU,CACpC;QACD,kCAAkC,CAAC,OAAO,CAAC,MAAM,CAAC;KACnD,CAAC,CAAC;IACH,IACE,OAAO,CAAC,KAAK,CAAC,cAAc,KAAK,cAAc;QAC/C,OAAO,CAAC,KAAK,CAAC,mBAAmB,KAAK,mBAAmB;QACzD,OAAO,CAAC,KAAK,CAAC,cAAc,KAAK,cAAc;QAC/C,OAAO,CAAC,KAAK,CAAC,WAAW,KAAK,UAAU,CAAC,MAAM;QAC/C,OAAO,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS;QACrC,OAAO,CAAC,KAAK,CAAC,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM;QAClD,OAAO,CAAC,gBAAgB,CAAC,cAAc,KAAK,qBAAqB;QACjE,OAAO,CAAC,KAAK,CAAC,qBAAqB,KAAK,qBAAqB,EAC7D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAKvB;IACC,MAAM,cAAc,GAAG,KAAK,CAAC,aAAa;QACxC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC;QACzC,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,2BAA2B,CAAC;QACjC,UAAU,EAAE;YACV,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;YACpC,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa;YACxC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;YAChC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO;SAC7B;QACD,OAAO,EAAE;YACP,GAAG,cAAc;YACjB;gBACE,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB;SACF;QACD,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;QAC9B,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;QACpC,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa;QACxC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;QAChC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO;KAC7B,CAAC,CAAC;AACL,CAAC;AAmBD,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,KAEC;IAED,IAAI,KAAK,CAAC,qBAAqB,KAAK,SAAS;QAC3C,OAAO,2BAA2B,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5D,MAAM,8BAA8B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,aAAa,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC;IAC9E,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC;IAClD,IACE,SAAS,KAAK,KAAK,CAAC,YAAY,CAAC,SAAS;QAC1C,CAAC,6BAA6B,CAC5B,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,YAAY,EAClB,QAAQ,CACT;QACD,yBAAyB,CAAC,aAAa,EAAE,2BAA2B,CAAC;YACnE,yBAAyB,CACvB,KAAK,CAAC,OAAO,CAAC,KAAK,EACnB,6BAA6B,CAC9B,EACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,cAAc,CAAC;QACpB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU;QACpC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;QAC5B,KAAK,EAAE,KAAK,CAAC,QAAQ;KACtB,CAAC,CAAC;AACL,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAA2D;IAE3D,IAAI,KAAK,CAAC,qBAAqB,KAAK,SAAS;QAC3C,OAAO,2BAA2B,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,8BAA8B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC;IAClD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;IAClC,IAAI,CAAC,6BAA6B,CAAC,KAAK,EAAE,KAAK,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,cAAc,CAAC;QACpB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU;QACpC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;QAC5B,KAAK,EAAE;YACL,GAAG,KAAK;YACR,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,SAAS;YACvC,SAAS,EAAE,KAAK,CAAC,QAAQ;SAC1B;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAKnD;IAIC,MAAM,8BAA8B,CAAC,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC;IACrD,IACE,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC,OAAO;QAChD,KAAK,CAAC,QAAQ,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QACtD,KAAK,CAAC,QAAQ,CAAC,SAAS;QACxB,KAAK,CAAC,QAAQ,CAAC,YAAY,EAAE,SAAS,KAAK,KAAK,CAAC,SAAS;QAC1D,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QACrD,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QACvD,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;QAC7D,KAAK,CAAC,aAAa,KAAK,OAAO;QAC/B,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,OAAO,CAAC,OAAO;QAC3C,KAAK,CAAC,OAAO,KAAK,CAAC;QACnB,KAAK,CAAC,aAAa,KAAK,IAAI,EAC5B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,WAAW,GAAG;QAClB,GAAG,KAAK;QACR,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS;QACnC,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;IACF,MAAM,MAAM,GAAkC;QAC5C,sBAAsB,EAAE;YACtB,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,eAAe;YAC3D,KAAK,EAAE,KAAK,CAAC,QAAQ;YACrB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B;QACD,cAAc,EAAE;YACd,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,GAAG,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,gBAAgB;YACpD,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS;SACpC;QACD,iBAAiB,EAAE,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,UAAU;QAC9D,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,MAAM;QACtD,YAAY,EAAE,WAAW;QACzB,cAAc,EAAE,EAAE;KACnB,CAAC;IACF,OAAO;QACL,MAAM;QACN,MAAM,EAAE,cAAc,CAAC;YACrB,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,UAAU;YACvD,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,MAAM;YAC/C,KAAK,EAAE,WAAW;SACnB,CAAC;KACH,CAAC;AACJ,CAAC","sourcesContent":["import {\n computePrincipalContainerGrantRoot,\n computePrincipalMemberEnvelopesRoot,\n computePrincipalMembershipRoot,\n computePrincipalProjectionRoot,\n computePrincipalStatePayloadCiphertextHash,\n makeVerifiedPrincipalPolicy,\n normalizePrincipalProjectionMembers,\n type ReferencedPrincipalHead,\n type VerifiedPrincipalPolicy,\n type VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport type {\n CreateOrganizationGroupRequest,\n PutPrincipalPolicyRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n OrganizationGroupSummaryResponse,\n PrincipalPolicyBundleResponse,\n PrincipalPolicyMutationResponse,\n PrincipalStateResponse,\n} from \"@tearleads/validators/response\";\nimport { canonicalKeyingJsonString } from \"../../data/keyingCanonicalJson\";\nimport {\n type CurrentPolicyMutationInput,\n verifyCurrentPolicyMutation,\n} from \"./currentPolicyMutationAcknowledgement\";\nimport { assertPrincipalPolicyReceiptArtifacts } from \"./principalPolicyReceiptArtifacts\";\n\nexport { assertGroupPolicyEnvelopesMatchAcknowledgement } from \"./principalPolicyReceiptArtifacts\";\n\nfunction historyWithCurrent(\n bundle: PrincipalPolicyBundleResponse,\n): PrincipalPolicyBundleResponse[\"previousStates\"] {\n return [\n ...bundle.previousStates,\n {\n state: bundle.currentState,\n projection: bundle.currentProjection,\n grants: bundle.currentGrants,\n },\n ];\n}\n\nfunction isAuthoredSuccessorConsistent(\n state: Pick<\n PrincipalStateResponse,\n \| \"keyEpoch\"\n \| \"keyFingerprint\"\n \| \"prevStateHash\"\n \| \"principalId\"\n \| \"principalType\"\n \| \"version\"\n >,\n expectedHead: ReferencedPrincipalHead,\n previous: PrincipalStateResponse,\n): boolean {\n return (\n state.principalType === expectedHead.principalType &&\n state.principalId === expectedHead.principalId &&\n state.version === expectedHead.version &&\n state.keyEpoch === expectedHead.keyEpoch &&\n state.keyFingerprint === expectedHead.keyFingerprint &&\n state.principalType === previous.principalType &&\n state.principalId === previous.principalId &&\n state.version === previous.version + 1 &&\n state.prevStateHash === previous.stateHash\n );\n}\n\nexport function buildAcknowledgedGroupPolicyBundle(input: {\n readonly currentPolicy: PrincipalPolicyBundleResponse;\n readonly expectedHead: ReferencedPrincipalHead;\n readonly request: PutPrincipalPolicyRequest;\n readonly response: PrincipalPolicyMutationResponse;\n}): PrincipalPolicyBundleResponse & PrincipalPolicyMutationResponse {\n assertPrincipalPolicyReceiptArtifacts(input);\n return {\n ...input.response,\n previousStates: historyWithCurrent(input.currentPolicy),\n };\n}\n\nasync function assertPolicyRequestCommitments(\n request: PutPrincipalPolicyRequest,\n): Promise<void> {\n const projection = normalizePrincipalProjectionMembers(request.projection);\n const members = projection.map((member) => ({ userId: member.userId }));\n const [\n membershipRoot,\n memberEnvelopesRoot,\n projectionRoot,\n payloadCiphertextHash,\n grantRoot,\n ] = await Promise.all([\n computePrincipalMembershipRoot(members),\n computePrincipalMemberEnvelopesRoot(request.memberEnvelopes),\n computePrincipalProjectionRoot(projection),\n computePrincipalStatePayloadCiphertextHash(\n request.encryptedPayload.ciphertext,\n ),\n computePrincipalContainerGrantRoot(request.grants),\n ]);\n if (\n request.state.membershipRoot !== membershipRoot \|\|\n request.state.memberEnvelopesRoot !== memberEnvelopesRoot \|\|\n request.state.projectionRoot !== projectionRoot \|\|\n request.state.memberCount !== projection.length \|\|\n request.state.grantRoot !== grantRoot \|\|\n request.state.grantCount !== request.grants.length \|\|\n request.encryptedPayload.ciphertextHash !== payloadCiphertextHash \|\|\n request.state.payloadCiphertextHash !== payloadCiphertextHash\n ) {\n throw new Error(\"Authored group policy commitments are invalid\");\n }\n}\n\nfunction verifiedPolicy(input: {\n currentPolicy?: PrincipalPolicyBundleResponse \| undefined;\n projection: PutPrincipalPolicyRequest[\"projection\"];\n grants: PutPrincipalPolicyRequest[\"grants\"];\n state: PrincipalStateResponse;\n}): VerifiedPrincipalPolicy {\n const previousStates = input.currentPolicy\n ? historyWithCurrent(input.currentPolicy)\n : [];\n return makeVerifiedPrincipalPolicy({\n checkpoint: {\n principalId: input.state.principalId,\n principalType: input.state.principalType,\n stateHash: input.state.stateHash,\n version: input.state.version,\n },\n history: [\n ...previousStates,\n {\n state: input.state,\n projection: input.projection,\n grants: input.grants,\n },\n ],\n keyEpoch: input.state.keyEpoch,\n principalId: input.state.principalId,\n principalType: input.state.principalType,\n projection: input.projection,\n grants: input.grants,\n state: input.state,\n stateHash: input.state.stateHash,\n version: input.state.version,\n });\n}\n\ninterface FullPolicyMutationInput {\n readonly verifiedCurrentPolicy?: never;\n readonly currentPolicy: PrincipalPolicyBundleResponse;\n readonly expectedHead: ReferencedPrincipalHead;\n readonly request: PutPrincipalPolicyRequest;\n}\n\nexport function acknowledgeGroupPolicyState(\n input: CurrentPolicyMutationInput & {\n readonly response: PrincipalStateResponse;\n },\n): Promise<VerifiedPrincipalPolicyCurrent>;\nexport function acknowledgeGroupPolicyState(\n input: FullPolicyMutationInput & {\n readonly response: PrincipalStateResponse;\n },\n): Promise<VerifiedPrincipalPolicy>;\nexport async function acknowledgeGroupPolicyState(\n input: (FullPolicyMutationInput \| CurrentPolicyMutationInput) & {\n readonly response: PrincipalStateResponse;\n },\n): Promise<VerifiedPrincipalPolicy \| VerifiedPrincipalPolicyCurrent> {\n if (input.verifiedCurrentPolicy !== undefined)\n return verifyCurrentPolicyMutation(input, input.response);\n await assertPolicyRequestCommitments(input.request);\n const { createdAt: _createdAt, stateHash, ...responseState } = input.response;\n const previous = input.currentPolicy.currentState;\n if (\n stateHash !== input.expectedHead.stateHash \|\|\n !isAuthoredSuccessorConsistent(\n input.response,\n input.expectedHead,\n previous,\n ) \|\|\n canonicalKeyingJsonString(responseState, \"stored group policy state\") !==\n canonicalKeyingJsonString(\n input.request.state,\n \"authored group policy state\",\n )\n ) {\n throw new Error(\"Group policy state acknowledgement mismatch\");\n }\n return verifiedPolicy({\n currentPolicy: input.currentPolicy,\n projection: input.request.projection,\n grants: input.request.grants,\n state: input.response,\n });\n}\n\n/*\n Materialize the locally signed successor before submission so dependent\n * container mutations can wrap to the exact head that will commit with it.\n * The server still performs the authoritative signature, transition, and\n * authorization checks inside the combined transaction.\n */\nexport function prepareAuthoredGroupPolicy(\n input: CurrentPolicyMutationInput,\n): Promise<VerifiedPrincipalPolicyCurrent>;\nexport function prepareAuthoredGroupPolicy(\n input: FullPolicyMutationInput,\n): Promise<VerifiedPrincipalPolicy>;\nexport async function prepareAuthoredGroupPolicy(\n input: FullPolicyMutationInput \| CurrentPolicyMutationInput,\n): Promise<VerifiedPrincipalPolicy \| VerifiedPrincipalPolicyCurrent> {\n if (input.verifiedCurrentPolicy !== undefined)\n return verifyCurrentPolicyMutation(input);\n await assertPolicyRequestCommitments(input.request);\n const previous = input.currentPolicy.currentState;\n const state = input.request.state;\n if (!isAuthoredSuccessorConsistent(state, input.expectedHead, previous)) {\n throw new Error(\"Authored group policy successor is inconsistent\");\n }\n return verifiedPolicy({\n currentPolicy: input.currentPolicy,\n projection: input.request.projection,\n grants: input.request.grants,\n state: {\n ...state,\n stateHash: input.expectedHead.stateHash,\n createdAt: state.signedAt,\n },\n });\n}\n\nexport async function acknowledgeInitialGroupPolicy(input: {\n readonly organizationId: string;\n readonly request: CreateOrganizationGroupRequest;\n readonly response: OrganizationGroupSummaryResponse;\n readonly stateHash: string;\n}): Promise<{\n readonly bundle: PrincipalPolicyBundleResponse;\n readonly policy: VerifiedPrincipalPolicy;\n}> {\n await assertPolicyRequestCommitments(input.request.initialGroupPolicy);\n const state = input.request.initialGroupPolicy.state;\n if (\n input.response.groupId !== input.request.groupId \|\|\n input.response.organizationId !== input.organizationId \|\|\n input.response.isBuiltin \|\|\n input.response.currentState?.stateHash !== input.stateHash \|\|\n input.response.currentState.version !== state.version \|\|\n input.response.currentState.keyEpoch !== state.keyEpoch \|\|\n input.response.currentState.memberCount !== state.memberCount \|\|\n state.principalType !== \"group\" \|\|\n state.principalId !== input.request.groupId \|\|\n state.version !== 1 \|\|\n state.prevStateHash !== null\n ) {\n throw new Error(\"Created group policy acknowledgement mismatch\");\n }\n const storedState = {\n ...state,\n createdAt: input.response.createdAt,\n stateHash: input.stateHash,\n };\n const bundle: PrincipalPolicyBundleResponse = {\n currentMemberEnvelopes: {\n envelopes: input.request.initialGroupPolicy.memberEnvelopes,\n epoch: state.keyEpoch,\n principalId: state.principalId,\n principalType: state.principalType,\n stateHash: input.stateHash,\n },\n currentPayload: {\n principalId: state.principalId,\n principalType: state.principalType,\n stateHash: input.stateHash,\n ...input.request.initialGroupPolicy.encryptedPayload,\n createdAt: input.response.createdAt,\n },\n currentProjection: input.request.initialGroupPolicy.projection,\n currentGrants: input.request.initialGroupPolicy.grants,\n currentState: storedState,\n previousStates: [],\n };\n return {\n bundle,\n policy: verifiedPolicy({\n projection: input.request.initialGroupPolicy.projection,\n grants: input.request.initialGroupPolicy.grants,\n state: storedState,\n }),\n };\n}\n"]}
1	+ {"version":3,"file":"groupPolicyMutationAcknowledgement.js","sourceRoot":"","sources":["groupPolicyMutationAcknowledgement.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kCAAkC,EAClC,mCAAmC,EACnC,8BAA8B,EAC9B,8BAA8B,EAC9B,0CAA0C,EAC1C,2BAA2B,EAC3B,mCAAmC,GAIpC,MAAM,mBAAmB,CAAC;AAW3B,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAEL,2BAA2B,GAC5B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,qCAAqC,EAAE,MAAM,mCAAmC,CAAC;AAE1F,OAAO,EAAE,8CAA8C,EAAE,MAAM,mCAAmC,CAAC;AAEnG,SAAS,kBAAkB,CACzB,MAAqC;IAErC,OAAO;QACL,GAAG,MAAM,CAAC,cAAc;QACxB;YACE,KAAK,EAAE,MAAM,CAAC,YAAY;YAC1B,UAAU,EAAE,MAAM,CAAC,iBAAiB;YACpC,MAAM,EAAE,MAAM,CAAC,aAAa;SAC7B;KACF,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CACpC,KAQC,EACD,YAAqC,EACrC,QAAgC;IAEhC,OAAO,CACL,KAAK,CAAC,aAAa,KAAK,YAAY,CAAC,aAAa;QAClD,KAAK,CAAC,WAAW,KAAK,YAAY,CAAC,WAAW;QAC9C,KAAK,CAAC,OAAO,KAAK,YAAY,CAAC,OAAO;QACtC,KAAK,CAAC,QAAQ,KAAK,YAAY,CAAC,QAAQ;QACxC,KAAK,CAAC,cAAc,KAAK,YAAY,CAAC,cAAc;QACpD,KAAK,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa;QAC9C,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;QAC1C,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,GAAG,CAAC;QACtC,KAAK,CAAC,aAAa,KAAK,QAAQ,CAAC,SAAS,CAC3C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kCAAkC,CAAC,KAKlD;IACC,qCAAqC,CAAC,KAAK,CAAC,CAAC;IAC7C,OAAO;QACL,GAAG,KAAK,CAAC,QAAQ;QACjB,cAAc,EAAE,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC;KACxD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,8BAA8B,CAC3C,OAAkC;IAElC,MAAM,UAAU,GAAG,mCAAmC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACxE,MAAM,CACJ,cAAc,EACd,mBAAmB,EACnB,cAAc,EACd,qBAAqB,EACrB,SAAS,EACV,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpB,8BAA8B,CAAC,OAAO,CAAC;QACvC,mCAAmC,CAAC,OAAO,CAAC,eAAe,CAAC;QAC5D,8BAA8B,CAAC,UAAU,CAAC;QAC1C,0CAA0C,CACxC,OAAO,CAAC,gBAAgB,CAAC,UAAU,CACpC;QACD,kCAAkC,CAAC,OAAO,CAAC,MAAM,CAAC;KACnD,CAAC,CAAC;IACH,IACE,OAAO,CAAC,KAAK,CAAC,cAAc,KAAK,cAAc;QAC/C,OAAO,CAAC,KAAK,CAAC,mBAAmB,KAAK,mBAAmB;QACzD,OAAO,CAAC,KAAK,CAAC,cAAc,KAAK,cAAc;QAC/C,OAAO,CAAC,KAAK,CAAC,WAAW,KAAK,UAAU,CAAC,MAAM;QAC/C,OAAO,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS;QACrC,OAAO,CAAC,KAAK,CAAC,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM;QAClD,OAAO,CAAC,gBAAgB,CAAC,cAAc,KAAK,qBAAqB;QACjE,OAAO,CAAC,KAAK,CAAC,qBAAqB,KAAK,qBAAqB,EAC7D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAKvB;IACC,MAAM,cAAc,GAAG,KAAK,CAAC,aAAa;QACxC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC;QACzC,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,2BAA2B,CAAC;QACjC,UAAU,EAAE;YACV,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;YACpC,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa;YACxC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;YAChC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO;SAC7B;QACD,OAAO,EAAE;YACP,GAAG,cAAc;YACjB;gBACE,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB;SACF;QACD,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;QAC9B,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;QACpC,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa;QACxC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;QAChC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO;KAC7B,CAAC,CAAC;AACL,CAAC;AAmBD,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,KAEC;IAED,IAAI,KAAK,CAAC,qBAAqB,KAAK,SAAS;QAC3C,OAAO,2BAA2B,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5D,MAAM,8BAA8B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,aAAa,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC;IAC9E,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC;IAClD,IACE,SAAS,KAAK,KAAK,CAAC,YAAY,CAAC,SAAS;QAC1C,CAAC,6BAA6B,CAC5B,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,YAAY,EAClB,QAAQ,CACT;QACD,yBAAyB,CAAC,aAAa,EAAE,2BAA2B,CAAC;YACnE,yBAAyB,CACvB,KAAK,CAAC,OAAO,CAAC,KAAK,EACnB,6BAA6B,CAC9B,EACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,cAAc,CAAC;QACpB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU;QACpC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;QAC5B,KAAK,EAAE,KAAK,CAAC,QAAQ;KACtB,CAAC,CAAC;AACL,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAA2D;IAE3D,IAAI,KAAK,CAAC,qBAAqB,KAAK,SAAS;QAC3C,OAAO,2BAA2B,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,8BAA8B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC;IAClD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;IAClC,IAAI,CAAC,6BAA6B,CAAC,KAAK,EAAE,KAAK,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,cAAc,CAAC;QACpB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU;QACpC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;QAC5B,KAAK,EAAE;YACL,GAAG,KAAK;YACR,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,SAAS;YACvC,SAAS,EAAE,KAAK,CAAC,QAAQ;SAC1B;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAKnD;IAIC,MAAM,8BAA8B,CAAC,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC;IACrD,IACE,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC,OAAO;QAChD,KAAK,CAAC,QAAQ,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QACtD,KAAK,CAAC,QAAQ,CAAC,SAAS;QACxB,KAAK,CAAC,QAAQ,CAAC,YAAY,EAAE,SAAS,KAAK,KAAK,CAAC,SAAS;QAC1D,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QACrD,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QACvD,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QACnE,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;QAC7D,KAAK,CAAC,aAAa,KAAK,OAAO;QAC/B,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,OAAO,CAAC,OAAO;QAC3C,KAAK,CAAC,OAAO,KAAK,CAAC;QACnB,KAAK,CAAC,aAAa,KAAK,IAAI,EAC5B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,WAAW,GAAG;QAClB,GAAG,KAAK;QACR,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS;QACnC,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;IACF,MAAM,MAAM,GAAkC;QAC5C,sBAAsB,EAAE;YACtB,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,eAAe;YAC3D,KAAK,EAAE,KAAK,CAAC,QAAQ;YACrB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B;QACD,cAAc,EAAE;YACd,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,GAAG,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,gBAAgB;YACpD,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS;SACpC;QACD,iBAAiB,EAAE,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,UAAU;QAC9D,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,MAAM;QACtD,YAAY,EAAE,WAAW;QACzB,cAAc,EAAE,EAAE;KACnB,CAAC;IACF,OAAO;QACL,MAAM;QACN,MAAM,EAAE,cAAc,CAAC;YACrB,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,UAAU;YACvD,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,MAAM;YAC/C,KAAK,EAAE,WAAW;SACnB,CAAC;KACH,CAAC;AACJ,CAAC","sourcesContent":["import {\n computePrincipalContainerGrantRoot,\n computePrincipalMemberEnvelopesRoot,\n computePrincipalMembershipRoot,\n computePrincipalProjectionRoot,\n computePrincipalStatePayloadCiphertextHash,\n makeVerifiedPrincipalPolicy,\n normalizePrincipalProjectionMembers,\n type ReferencedPrincipalHead,\n type VerifiedPrincipalPolicy,\n type VerifiedPrincipalPolicyCurrent,\n} from \"@tearleads/crypto\";\nimport type {\n CreateOrganizationGroupRequest,\n PutPrincipalPolicyRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n OrganizationGroupSummaryResponse,\n PrincipalPolicyBundleResponse,\n PrincipalPolicyMutationResponse,\n PrincipalStateResponse,\n} from \"@tearleads/validators/response\";\nimport { canonicalKeyingJsonString } from \"../../data/keyingCanonicalJson\";\nimport {\n type CurrentPolicyMutationInput,\n verifyCurrentPolicyMutation,\n} from \"./currentPolicyMutationAcknowledgement\";\nimport { assertPrincipalPolicyReceiptArtifacts } from \"./principalPolicyReceiptArtifacts\";\n\nexport { assertGroupPolicyEnvelopesMatchAcknowledgement } from \"./principalPolicyReceiptArtifacts\";\n\nfunction historyWithCurrent(\n bundle: PrincipalPolicyBundleResponse,\n): PrincipalPolicyBundleResponse[\"previousStates\"] {\n return [\n ...bundle.previousStates,\n {\n state: bundle.currentState,\n projection: bundle.currentProjection,\n grants: bundle.currentGrants,\n },\n ];\n}\n\nfunction isAuthoredSuccessorConsistent(\n state: Pick<\n PrincipalStateResponse,\n \| \"keyEpoch\"\n \| \"keyFingerprint\"\n \| \"prevStateHash\"\n \| \"principalId\"\n \| \"principalType\"\n \| \"version\"\n >,\n expectedHead: ReferencedPrincipalHead,\n previous: PrincipalStateResponse,\n): boolean {\n return (\n state.principalType === expectedHead.principalType &&\n state.principalId === expectedHead.principalId &&\n state.version === expectedHead.version &&\n state.keyEpoch === expectedHead.keyEpoch &&\n state.keyFingerprint === expectedHead.keyFingerprint &&\n state.principalType === previous.principalType &&\n state.principalId === previous.principalId &&\n state.version === previous.version + 1 &&\n state.prevStateHash === previous.stateHash\n );\n}\n\nexport function buildAcknowledgedGroupPolicyBundle(input: {\n readonly currentPolicy: PrincipalPolicyBundleResponse;\n readonly expectedHead: ReferencedPrincipalHead;\n readonly request: PutPrincipalPolicyRequest;\n readonly response: PrincipalPolicyMutationResponse;\n}): PrincipalPolicyBundleResponse & PrincipalPolicyMutationResponse {\n assertPrincipalPolicyReceiptArtifacts(input);\n return {\n ...input.response,\n previousStates: historyWithCurrent(input.currentPolicy),\n };\n}\n\nasync function assertPolicyRequestCommitments(\n request: PutPrincipalPolicyRequest,\n): Promise<void> {\n const projection = normalizePrincipalProjectionMembers(request.projection);\n const members = projection.map((member) => ({ userId: member.userId }));\n const [\n membershipRoot,\n memberEnvelopesRoot,\n projectionRoot,\n payloadCiphertextHash,\n grantRoot,\n ] = await Promise.all([\n computePrincipalMembershipRoot(members),\n computePrincipalMemberEnvelopesRoot(request.memberEnvelopes),\n computePrincipalProjectionRoot(projection),\n computePrincipalStatePayloadCiphertextHash(\n request.encryptedPayload.ciphertext,\n ),\n computePrincipalContainerGrantRoot(request.grants),\n ]);\n if (\n request.state.membershipRoot !== membershipRoot \|\|\n request.state.memberEnvelopesRoot !== memberEnvelopesRoot \|\|\n request.state.projectionRoot !== projectionRoot \|\|\n request.state.memberCount !== projection.length \|\|\n request.state.grantRoot !== grantRoot \|\|\n request.state.grantCount !== request.grants.length \|\|\n request.encryptedPayload.ciphertextHash !== payloadCiphertextHash \|\|\n request.state.payloadCiphertextHash !== payloadCiphertextHash\n ) {\n throw new Error(\"Authored group policy commitments are invalid\");\n }\n}\n\nfunction verifiedPolicy(input: {\n currentPolicy?: PrincipalPolicyBundleResponse \| undefined;\n projection: PutPrincipalPolicyRequest[\"projection\"];\n grants: PutPrincipalPolicyRequest[\"grants\"];\n state: PrincipalStateResponse;\n}): VerifiedPrincipalPolicy {\n const previousStates = input.currentPolicy\n ? historyWithCurrent(input.currentPolicy)\n : [];\n return makeVerifiedPrincipalPolicy({\n checkpoint: {\n principalId: input.state.principalId,\n principalType: input.state.principalType,\n stateHash: input.state.stateHash,\n version: input.state.version,\n },\n history: [\n ...previousStates,\n {\n state: input.state,\n projection: input.projection,\n grants: input.grants,\n },\n ],\n keyEpoch: input.state.keyEpoch,\n principalId: input.state.principalId,\n principalType: input.state.principalType,\n projection: input.projection,\n grants: input.grants,\n state: input.state,\n stateHash: input.state.stateHash,\n version: input.state.version,\n });\n}\n\ninterface FullPolicyMutationInput {\n readonly verifiedCurrentPolicy?: never;\n readonly currentPolicy: PrincipalPolicyBundleResponse;\n readonly expectedHead: ReferencedPrincipalHead;\n readonly request: PutPrincipalPolicyRequest;\n}\n\nexport function acknowledgeGroupPolicyState(\n input: CurrentPolicyMutationInput & {\n readonly response: PrincipalStateResponse;\n },\n): Promise<VerifiedPrincipalPolicyCurrent>;\nexport function acknowledgeGroupPolicyState(\n input: FullPolicyMutationInput & {\n readonly response: PrincipalStateResponse;\n },\n): Promise<VerifiedPrincipalPolicy>;\nexport async function acknowledgeGroupPolicyState(\n input: (FullPolicyMutationInput \| CurrentPolicyMutationInput) & {\n readonly response: PrincipalStateResponse;\n },\n): Promise<VerifiedPrincipalPolicy \| VerifiedPrincipalPolicyCurrent> {\n if (input.verifiedCurrentPolicy !== undefined)\n return verifyCurrentPolicyMutation(input, input.response);\n await assertPolicyRequestCommitments(input.request);\n const { createdAt: _createdAt, stateHash, ...responseState } = input.response;\n const previous = input.currentPolicy.currentState;\n if (\n stateHash !== input.expectedHead.stateHash \|\|\n !isAuthoredSuccessorConsistent(\n input.response,\n input.expectedHead,\n previous,\n ) \|\|\n canonicalKeyingJsonString(responseState, \"stored group policy state\") !==\n canonicalKeyingJsonString(\n input.request.state,\n \"authored group policy state\",\n )\n ) {\n throw new Error(\"Group policy state acknowledgement mismatch\");\n }\n return verifiedPolicy({\n currentPolicy: input.currentPolicy,\n projection: input.request.projection,\n grants: input.request.grants,\n state: input.response,\n });\n}\n\n/*\n Materialize the locally signed successor before submission so dependent\n * container mutations can wrap to the exact head that will commit with it.\n * The server still performs the authoritative signature, transition, and\n * authorization checks inside the combined transaction.\n */\nexport function prepareAuthoredGroupPolicy(\n input: CurrentPolicyMutationInput,\n): Promise<VerifiedPrincipalPolicyCurrent>;\nexport function prepareAuthoredGroupPolicy(\n input: FullPolicyMutationInput,\n): Promise<VerifiedPrincipalPolicy>;\nexport async function prepareAuthoredGroupPolicy(\n input: FullPolicyMutationInput \| CurrentPolicyMutationInput,\n): Promise<VerifiedPrincipalPolicy \| VerifiedPrincipalPolicyCurrent> {\n if (input.verifiedCurrentPolicy !== undefined)\n return verifyCurrentPolicyMutation(input);\n await assertPolicyRequestCommitments(input.request);\n const previous = input.currentPolicy.currentState;\n const state = input.request.state;\n if (!isAuthoredSuccessorConsistent(state, input.expectedHead, previous)) {\n throw new Error(\"Authored group policy successor is inconsistent\");\n }\n return verifiedPolicy({\n currentPolicy: input.currentPolicy,\n projection: input.request.projection,\n grants: input.request.grants,\n state: {\n ...state,\n stateHash: input.expectedHead.stateHash,\n createdAt: state.signedAt,\n },\n });\n}\n\nexport async function acknowledgeInitialGroupPolicy(input: {\n readonly organizationId: string;\n readonly request: CreateOrganizationGroupRequest;\n readonly response: OrganizationGroupSummaryResponse;\n readonly stateHash: string;\n}): Promise<{\n readonly bundle: PrincipalPolicyBundleResponse;\n readonly policy: VerifiedPrincipalPolicy;\n}> {\n await assertPolicyRequestCommitments(input.request.initialGroupPolicy);\n const state = input.request.initialGroupPolicy.state;\n if (\n input.response.groupId !== input.request.groupId \|\|\n input.response.organizationId !== input.organizationId \|\|\n input.response.isBuiltin \|\|\n input.response.currentState?.stateHash !== input.stateHash \|\|\n input.response.currentState.version !== state.version \|\|\n input.response.currentState.keyEpoch !== state.keyEpoch \|\|\n input.response.currentState.keyFingerprint !== state.keyFingerprint \|\|\n input.response.currentState.memberCount !== state.memberCount \|\|\n state.principalType !== \"group\" \|\|\n state.principalId !== input.request.groupId \|\|\n state.version !== 1 \|\|\n state.prevStateHash !== null\n ) {\n throw new Error(\"Created group policy acknowledgement mismatch\");\n }\n const storedState = {\n ...state,\n createdAt: input.response.createdAt,\n stateHash: input.stateHash,\n };\n const bundle: PrincipalPolicyBundleResponse = {\n currentMemberEnvelopes: {\n envelopes: input.request.initialGroupPolicy.memberEnvelopes,\n epoch: state.keyEpoch,\n principalId: state.principalId,\n principalType: state.principalType,\n stateHash: input.stateHash,\n },\n currentPayload: {\n principalId: state.principalId,\n principalType: state.principalType,\n stateHash: input.stateHash,\n ...input.request.initialGroupPolicy.encryptedPayload,\n createdAt: input.response.createdAt,\n },\n currentProjection: input.request.initialGroupPolicy.projection,\n currentGrants: input.request.initialGroupPolicy.grants,\n currentState: storedState,\n previousStates: [],\n };\n return {\n bundle,\n policy: verifiedPolicy({\n projection: input.request.initialGroupPolicy.projection,\n grants: input.request.initialGroupPolicy.grants,\n state: storedState,\n }),\n };\n}\n"]}

package/workflows/organizations/groupPolicyMutationContext.d.ts CHANGED Viewed

@@ -66,6 +66,24 @@ export declare function loadGroupPolicyMutationContext(input: {
     readonly signingFingerprint: string;
     readonly signingKeyPair: SigningKeyPair;
 }): Promise<LoadedGroupPolicyMutationContext>;
+/**
+ * Commit, answering one refusal: a rematerialized rekey or revoke that would
+ * strand a level above a directly granted container is refused with the
+ * descendant rekeys it must carry. The refused attempt rolled back whole, so
+ * the served heads still stand; the batch is signed again with the named
+ * levels woven in, replaces the container mutations, and the commit is retried
+ * once. A second refusal means the tree moved underneath, and the caller's own
+ * retry starts from a fresh policy.
+ */
+export declare function submitGroupPolicyCommit(input: {
+    readonly apiClient: PrincipalPolicyReadWriteApi;
+    readonly carryDescendantRekeys?: ((requiredContainerIds: readonly string[]) => Promise<readonly ContainerMutationRequest[]>) | undefined;
+    readonly groupId: string;
+    readonly organizationId: string;
+    readonly organizationRequest: PutPrincipalPolicyRequest;
+    readonly request: PutPrincipalPolicyRequest;
+    readonly stillCurrent?: (() => boolean) | undefined;
+}): Promise<CommitOrganizationGroupPolicyResponse | null>;
 export declare function commitGroupPolicyMutation(input: {
     readonly retiredContainerIds?: (() => readonly string[]) | undefined;
     readonly apiClient: PrincipalPolicyReadWriteApi;

package/workflows/organizations/groupPolicyMutationContext.js CHANGED Viewed

@@ -120,7 +120,7 @@ export async function loadGroupPolicyMutationContext(input) {
  * once. A second refusal means the tree moved underneath, and the caller's own
  * retry starts from a fresh policy.
  */
-async function submitGroupPolicyCommit(input) {
+export async function submitGroupPolicyCommit(input) {
     const body = () => ({
         groupPolicy: input.request,
         organizationPolicy: input.organizationRequest,