@tearleads/client-sdk 0.1.61 → 0.1.63

package/workflows/organizations/groupPolicy/groupPolicyMutationContext.js

@@ -0,0 +1,166 @@
+import { persistVerifiedPrincipalPolicyBundlesAtomically } from "../../../data/persistence/keyingCheckpointAdvancePersistence.js";
+import { retainLocallyAcknowledgedPrincipalPolicyBundles } from "../../../data/persistence/locallyAcknowledgedCheckpointPersistence.js";
+import { requireOrganizationGroupHead } from "../../../data/principals/organizationAuthorityDescriptor.js";
+import { externalAdminPolicyPersistenceEntries, loadOrganizationExternalAdminPolicy, } from "../../principals/externalAdminPolicy.js";
+import { assertGroupMetadataBinding } from "../groupMetadata/groupMetadataBinding.js";
+import { requireSignerCanManageGroup } from "./groupMutationAuthorization.js";
+import { acknowledgeGroupPolicyState, assertGroupPolicyEnvelopesMatchAcknowledgement, buildAcknowledgedGroupPolicyBundle, } from "./groupPolicyMutationAcknowledgement.js";
+import { assertPrincipalPolicyCurrentStateMatchesHead, groupPolicyMutationHead, } from "./groupPolicyMutationHead.js";
+import { collectGroupPolicySignerPublicKeys, prepareGroupPolicyVerification, verifyGroupPolicy, verifyGroupPolicyWithExternalOrganizationAdmins, } from "./groupPolicyVerification.js";
+import { submitGroupPolicyCommit } from "./submitGroupPolicyCommit.js";
+export { submitGroupPolicyCommit } from "./submitGroupPolicyCommit.js";
+export async function cacheGroupPolicy(input) {
+    const bundle = await input.apiClient.getCurrentPrincipalPolicy("group", input.groupId);
+    if (!bundle) {
+        throw new Error("Updated group policy could not be loaded");
+    }
+    const signerPublicKeys = await collectGroupPolicySignerPublicKeys({
+        bundle,
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+    });
+    const verified = await verifyGroupPolicy({
+        currentPolicy: bundle,
+        ...(input.externalAuthority
+            ? { externalAuthority: input.externalAuthority }
+            : {}),
+        localPolicyCheckpoint: input.localPolicyCheckpoint ?? null,
+        signerPublicKeys,
+    });
+    if (input.expectedCurrentHead) {
+        assertPrincipalPolicyCurrentStateMatchesHead(bundle.currentState, input.expectedCurrentHead);
+    }
+    if (input.acknowledgedMemberEnvelopes) {
+        assertGroupPolicyEnvelopesMatchAcknowledgement(input.acknowledgedMemberEnvelopes, bundle.currentMemberEnvelopes);
+    }
+    await persistVerifiedPrincipalPolicyBundlesAtomically({
+        entries: [{ bundle, policy: verified }],
+        execSql: input.execSql,
+        organizationId: input.organizationId,
+        stillCurrent: input.stillCurrent,
+        updatedAt: new Date().toISOString(),
+    });
+    return bundle;
+}
+export async function loadGroupPolicyMutationContext(input) {
+    await input.apiClient.recoverPendingPrincipalMutation?.(input.organizationId);
+    const adminPolicy = await loadOrganizationExternalAdminPolicy({
+        currentPolicyReader: input.apiClient,
+        execSql: input.execSql,
+        organizationId: input.organizationId,
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+    });
+    if (!adminPolicy) {
+        throw new Error("Organization admin authority could not be verified");
+    }
+    const expectedGroupHead = requireOrganizationGroupHead(adminPolicy.descriptor, input.groupId);
+    const currentPolicy = input.groupId === adminPolicy.adminGroupId
+        ? adminPolicy.adminBundle
+        : await input.apiClient.getCurrentPrincipalPolicy("group", input.groupId);
+    if (!currentPolicy) {
+        throw new Error("Group policy could not be loaded");
+    }
+    assertPrincipalPolicyCurrentStateMatchesHead(currentPolicy.currentState, expectedGroupHead);
+    const verification = await prepareGroupPolicyVerification({
+        currentPolicy,
+        execSql: input.execSql,
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+    });
+    const isOrganizationAdminsGroup = adminPolicy.adminGroupId === input.groupId;
+    const currentOrgAdminUserIds = adminPolicy.signerUserIds;
+    const externalAuthority = adminPolicy.externalAuthority;
+    if (!currentOrgAdminUserIds.includes(input.signerUserId)) {
+        throw new Error("Organization admin authority is required");
+    }
+    const verified = isOrganizationAdminsGroup
+        ? await verifyGroupPolicy({
+            currentPolicy,
+            localPolicyCheckpoint: verification.localPolicyCheckpoint,
+            signerPublicKeys: verification.currentPolicySignerPublicKeys,
+        })
+        : await verifyGroupPolicyWithExternalOrganizationAdmins({
+            currentPolicy,
+            loadExternalAuthority: async () => externalAuthority,
+            localPolicyCheckpoint: verification.localPolicyCheckpoint,
+            signerPublicKeys: verification.currentPolicySignerPublicKeys,
+        });
+    assertGroupMetadataBinding(currentPolicy, adminPolicy.descriptor);
+    requireSignerCanManageGroup(currentPolicy, currentOrgAdminUserIds, input.signerUserId);
+    await persistVerifiedPrincipalPolicyBundlesAtomically({
+        entries: [
+            ...externalAdminPolicyPersistenceEntries(adminPolicy).filter((entry) => entry.policy.principalType !== verified.principalType ||
+                entry.policy.principalId !== verified.principalId),
+            { bundle: currentPolicy, policy: verified },
+        ],
+        execSql: input.execSql,
+        organizationId: input.organizationId,
+        updatedAt: new Date().toISOString(),
+    });
+    return {
+        adminGroupId: adminPolicy.adminGroupId,
+        adminPolicyBundle: adminPolicy.adminBundle,
+        currentPolicy,
+        currentOrgAdminUserIds,
+        externalAuthority,
+        isOrganizationAdminsGroup,
+        memberGroupId: adminPolicy.memberGroupId,
+        organizationDescriptor: adminPolicy.descriptor,
+        organizationPolicyBundle: adminPolicy.bundle,
+        ...verification,
+        localPolicyCheckpoint: verified.checkpoint,
+        signerUserId: input.signerUserId,
+        signingFingerprint: input.signingFingerprint,
+        signingKeyPair: input.signingKeyPair,
+    };
+}
+export async function commitGroupPolicyMutation(input) {
+    const stored = await submitGroupPolicyCommit(input);
+    if (!stored) {
+        throw new Error("Group policy update failed");
+    }
+    const storedPolicy = stored.groupPolicy;
+    const acknowledgedPolicy = await acknowledgeGroupPolicyState({
+        currentPolicy: input.currentPolicy,
+        expectedHead: input.expectedHead,
+        request: input.request,
+        response: storedPolicy.currentState,
+    });
+    const groupBundle = buildAcknowledgedGroupPolicyBundle({
+        currentPolicy: input.currentPolicy,
+        expectedHead: input.expectedHead,
+        request: input.request,
+        response: storedPolicy,
+    });
+    const organizationHead = await groupPolicyMutationHead(input.organizationRequest);
+    const acknowledgedOrganization = await acknowledgeGroupPolicyState({
+        currentPolicy: input.organizationPolicy,
+        expectedHead: organizationHead,
+        request: input.organizationRequest,
+        response: stored.organizationPolicy.currentState,
+    });
+    const organizationBundle = buildAcknowledgedGroupPolicyBundle({
+        currentPolicy: input.organizationPolicy,
+        expectedHead: organizationHead,
+        request: input.organizationRequest,
+        response: stored.organizationPolicy,
+    });
+    await retainLocallyAcknowledgedPrincipalPolicyBundles({
+        retiredContainers: {
+            containerIds: input.retiredContainerIds?.() ?? [],
+            organizationId: input.organizationId,
+            policy: acknowledgedPolicy,
+        },
+        entries: [
+            { bundle: groupBundle, policy: acknowledgedPolicy },
+            {
+                bundle: organizationBundle,
+                policy: acknowledgedOrganization,
+            },
+        ],
+        execSql: input.execSql,
+        organizationId: input.organizationId,
+        stillCurrent: input.stillCurrent,
+        updatedAt: new Date().toISOString(),
+    });
+    return groupBundle;
+}
+//# sourceMappingURL=groupPolicyMutationContext.js.map

package/workflows/organizations/groupPolicy/groupPolicyMutationContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"groupPolicyMutationContext.js","sourceRoot":"","sources":["groupPolicyMutationContext.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,+CAA+C,EAAE,MAAM,8DAA8D,CAAC;AAC/H,OAAO,EAAE,+CAA+C,EAAE,MAAM,oEAAoE,CAAC;AACrI,OAAO,EAAE,4BAA4B,EAAE,MAAM,0DAA0D,CAAC;AAGxG,OAAO,EACL,qCAAqC,EACrC,mCAAmC,GAEpC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AAKnF,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EACL,2BAA2B,EAC3B,8CAA8C,EAC9C,kCAAkC,GACnC,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,4CAA4C,EAC5C,uBAAuB,GACxB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,kCAAkC,EAClC,8BAA8B,EAC9B,iBAAiB,EACjB,+CAA+C,GAChD,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAOpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAYpE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAatC;IACC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,yBAAyB,CAC5D,OAAO,EACP,KAAK,CAAC,OAAO,CACd,CAAC;IAEF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,kCAAkC,CAAC;QAChE,MAAM;QACN,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC;QACvC,aAAa,EAAE,MAAM;QACrB,GAAG,CAAC,KAAK,CAAC,iBAAiB;YACzB,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE;YAChD,CAAC,CAAC,EAAE,CAAC;QACP,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,IAAI,IAAI;QAC1D,gBAAgB;KACjB,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC;QAC9B,4CAA4C,CAC1C,MAAM,CAAC,YAAY,EACnB,KAAK,CAAC,mBAAmB,CAC1B,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,2BAA2B,EAAE,CAAC;QACtC,8CAA8C,CAC5C,KAAK,CAAC,2BAA2B,EACjC,MAAM,CAAC,sBAAsB,CAC9B,CAAC;IACJ,CAAC;IACD,MAAM,+CAA+C,CAAC;QACpD,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QACvC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KASpD;IACC,MAAM,KAAK,CAAC,SAAS,CAAC,+BAA+B,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC9E,MAAM,WAAW,GAAG,MAAM,mCAAmC,CAAC;QAC5D,mBAAmB,EAAE,KAAK,CAAC,SAAS;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,iBAAiB,GAAG,4BAA4B,CACpD,WAAW,CAAC,UAAU,EACtB,KAAK,CAAC,OAAO,CACd,CAAC;IACF,MAAM,aAAa,GACjB,KAAK,CAAC,OAAO,KAAK,WAAW,CAAC,YAAY;QACxC,CAAC,CAAC,WAAW,CAAC,WAAW;QACzB,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,yBAAyB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9E,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,4CAA4C,CAC1C,aAAa,CAAC,YAAY,EAC1B,iBAAiB,CAClB,CAAC;IACF,MAAM,YAAY,GAAG,MAAM,8BAA8B,CAAC;QACxD,aAAa;QACb,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,MAAM,yBAAyB,GAAG,WAAW,CAAC,YAAY,KAAK,KAAK,CAAC,OAAO,CAAC;IAC7E,MAAM,sBAAsB,GAAG,WAAW,CAAC,aAAa,CAAC;IACzD,MAAM,iBAAiB,GAAG,WAAW,CAAC,iBAAiB,CAAC;IACxD,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,QAAQ,GAAG,yBAAyB;QACxC,CAAC,CAAC,MAAM,iBAAiB,CAAC;YACtB,aAAa;YACb,qBAAqB,EAAE,YAAY,CAAC,qBAAqB;YACzD,gBAAgB,EAAE,YAAY,CAAC,6BAA6B;SAC7D,CAAC;QACJ,CAAC,CAAC,MAAM,+CAA+C,CAAC;YACpD,aAAa;YACb,qBAAqB,EAAE,KAAK,IAAI,EAAE,CAAC,iBAAiB;YACpD,qBAAqB,EAAE,YAAY,CAAC,qBAAqB;YACzD,gBAAgB,EAAE,YAAY,CAAC,6BAA6B;SAC7D,CAAC,CAAC;IACP,0BAA0B,CAAC,aAAa,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC;IAClE,2BAA2B,CACzB,aAAa,EACb,sBAAsB,EACtB,KAAK,CAAC,YAAY,CACnB,CAAC;IACF,MAAM,+CAA+C,CAAC;QACpD,OAAO,EAAE;YACP,GAAG,qCAAqC,CAAC,WAAW,CAAC,CAAC,MAAM,CAC1D,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,MAAM,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa;gBACrD,KAAK,CAAC,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,CACpD;YACD,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE;SAC5C;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;IAEH,OAAO;QACL,YAAY,EAAE,WAAW,CAAC,YAAY;QACtC,iBAAiB,EAAE,WAAW,CAAC,WAAW;QAC1C,aAAa;QACb,sBAAsB;QACtB,iBAAiB;QACjB,yBAAyB;QACzB,aAAa,EAAE,WAAW,CAAC,aAAa;QACxC,sBAAsB,EAAE,WAAW,CAAC,UAAU;QAC9C,wBAAwB,EAAE,WAAW,CAAC,MAAM;QAC5C,GAAG,YAAY;QACf,qBAAqB,EAAE,QAAQ,CAAC,UAAU;QAC1C,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAqB/C;IACC,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC;IACxC,MAAM,kBAAkB,GAAG,MAAM,2BAA2B,CAAC;QAC3D,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,YAAY,CAAC,YAAY;KACpC,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,kCAAkC,CAAC;QACrD,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,YAAY;KACvB,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,MAAM,uBAAuB,CACpD,KAAK,CAAC,mBAAmB,CAC1B,CAAC;IACF,MAAM,wBAAwB,GAAG,MAAM,2BAA2B,CAAC;QACjE,aAAa,EAAE,KAAK,CAAC,kBAAkB;QACvC,YAAY,EAAE,gBAAgB;QAC9B,OAAO,EAAE,KAAK,CAAC,mBAAmB;QAClC,QAAQ,EAAE,MAAM,CAAC,kBAAkB,CAAC,YAAY;KACjD,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,kCAAkC,CAAC;QAC5D,aAAa,EAAE,KAAK,CAAC,kBAAkB;QACvC,YAAY,EAAE,gBAAgB;QAC9B,OAAO,EAAE,KAAK,CAAC,mBAAmB;QAClC,QAAQ,EAAE,MAAM,CAAC,kBAAkB;KACpC,CAAC,CAAC;IACH,MAAM,+CAA+C,CAAC;QACpD,iBAAiB,EAAE;YACjB,YAAY,EAAE,KAAK,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE;YACjD,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,MAAM,EAAE,kBAAkB;SAC3B;QACD,OAAO,EAAE;YACP,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACnD;gBACE,MAAM,EAAE,kBAAkB;gBAC1B,MAAM,EAAE,wBAAwB;aACjC;SACF;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;IACH,OAAO,WAAW,CAAC;AACrB,CAAC","sourcesContent":["import type {\n  PrincipalPolicyCheckpoint,\n  PrincipalPolicyExternalAuthority,\n  ReferencedPrincipalHead,\n  SigningKeyPair,\n} from \"@tearleads/crypto\";\nimport type {\n  ContainerMutationRequest,\n  PutPrincipalPolicyRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n  CurrentPrincipalMemberEnvelopesResponse,\n  PrincipalPolicyBundleResponse,\n  PrincipalPolicyMutationResponse,\n} from \"@tearleads/validators/response\";\nimport { persistVerifiedPrincipalPolicyBundlesAtomically } from \"../../../data/persistence/keyingCheckpointAdvancePersistence\";\nimport { retainLocallyAcknowledgedPrincipalPolicyBundles } from \"../../../data/persistence/locallyAcknowledgedCheckpointPersistence\";\nimport { requireOrganizationGroupHead } from \"../../../data/principals/organizationAuthorityDescriptor\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../../data/trustedUserIdentity\";\nimport {\n  externalAdminPolicyPersistenceEntries,\n  loadOrganizationExternalAdminPolicy,\n  type VerifiedExternalAdminPolicy,\n} from \"../../principals/externalAdminPolicy\";\nimport { assertGroupMetadataBinding } from \"../groupMetadata/groupMetadataBinding\";\nimport type {\n  PrincipalPolicyReadApi,\n  PrincipalPolicyReadWriteApi,\n} from \"../principalPolicy/principalPolicyApi\";\nimport { requireSignerCanManageGroup } from \"./groupMutationAuthorization\";\nimport {\n  acknowledgeGroupPolicyState,\n  assertGroupPolicyEnvelopesMatchAcknowledgement,\n  buildAcknowledgedGroupPolicyBundle,\n} from \"./groupPolicyMutationAcknowledgement\";\nimport type { FullGroupMembershipMutationInput } from \"./groupPolicyMutationEvidence\";\nimport {\n  assertPrincipalPolicyCurrentStateMatchesHead,\n  groupPolicyMutationHead,\n} from \"./groupPolicyMutationHead\";\nimport {\n  collectGroupPolicySignerPublicKeys,\n  prepareGroupPolicyVerification,\n  verifyGroupPolicy,\n  verifyGroupPolicyWithExternalOrganizationAdmins,\n} from \"./groupPolicyVerification\";\nimport { submitGroupPolicyCommit } from \"./submitGroupPolicyCommit\";\n\nexport type {\n  OrganizationPrincipalPolicyApi,\n  PrincipalPolicyReadApi,\n  PrincipalPolicyReadWriteApi,\n} from \"../principalPolicy/principalPolicyApi\";\nexport { submitGroupPolicyCommit } from \"./submitGroupPolicyCommit\";\n\ninterface LoadedGroupPolicyMutationContext\n  extends FullGroupMembershipMutationInput {\n  readonly adminGroupId: string;\n  readonly adminPolicyBundle: PrincipalPolicyBundleResponse;\n  readonly currentOrgAdminUserIds: readonly string[];\n  readonly organizationDescriptor: VerifiedExternalAdminPolicy[\"descriptor\"];\n  readonly organizationPolicyBundle: PrincipalPolicyBundleResponse;\n  readonly memberGroupId: string;\n}\n\nexport async function cacheGroupPolicy(input: {\n  readonly acknowledgedMemberEnvelopes?:\n    | CurrentPrincipalMemberEnvelopesResponse\n    | undefined;\n  readonly apiClient: PrincipalPolicyReadApi;\n  readonly externalAuthority?: PrincipalPolicyExternalAuthority | undefined;\n  readonly execSql: ExecSql;\n  readonly expectedCurrentHead?: ReferencedPrincipalHead | undefined;\n  readonly groupId: string;\n  readonly localPolicyCheckpoint?: PrincipalPolicyCheckpoint | null;\n  readonly organizationId: string;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<PrincipalPolicyBundleResponse> {\n  const bundle = await input.apiClient.getCurrentPrincipalPolicy(\n    \"group\",\n    input.groupId,\n  );\n\n  if (!bundle) {\n    throw new Error(\"Updated group policy could not be loaded\");\n  }\n\n  const signerPublicKeys = await collectGroupPolicySignerPublicKeys({\n    bundle,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  const verified = await verifyGroupPolicy({\n    currentPolicy: bundle,\n    ...(input.externalAuthority\n      ? { externalAuthority: input.externalAuthority }\n      : {}),\n    localPolicyCheckpoint: input.localPolicyCheckpoint ?? null,\n    signerPublicKeys,\n  });\n  if (input.expectedCurrentHead) {\n    assertPrincipalPolicyCurrentStateMatchesHead(\n      bundle.currentState,\n      input.expectedCurrentHead,\n    );\n  }\n  if (input.acknowledgedMemberEnvelopes) {\n    assertGroupPolicyEnvelopesMatchAcknowledgement(\n      input.acknowledgedMemberEnvelopes,\n      bundle.currentMemberEnvelopes,\n    );\n  }\n  await persistVerifiedPrincipalPolicyBundlesAtomically({\n    entries: [{ bundle, policy: verified }],\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    stillCurrent: input.stillCurrent,\n    updatedAt: new Date().toISOString(),\n  });\n  return bundle;\n}\n\nexport async function loadGroupPolicyMutationContext(input: {\n  readonly apiClient: PrincipalPolicyReadApi;\n  readonly execSql: ExecSql;\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n}): Promise<LoadedGroupPolicyMutationContext> {\n  await input.apiClient.recoverPendingPrincipalMutation?.(input.organizationId);\n  const adminPolicy = await loadOrganizationExternalAdminPolicy({\n    currentPolicyReader: input.apiClient,\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  if (!adminPolicy) {\n    throw new Error(\"Organization admin authority could not be verified\");\n  }\n  const expectedGroupHead = requireOrganizationGroupHead(\n    adminPolicy.descriptor,\n    input.groupId,\n  );\n  const currentPolicy =\n    input.groupId === adminPolicy.adminGroupId\n      ? adminPolicy.adminBundle\n      : await input.apiClient.getCurrentPrincipalPolicy(\"group\", input.groupId);\n  if (!currentPolicy) {\n    throw new Error(\"Group policy could not be loaded\");\n  }\n  assertPrincipalPolicyCurrentStateMatchesHead(\n    currentPolicy.currentState,\n    expectedGroupHead,\n  );\n  const verification = await prepareGroupPolicyVerification({\n    currentPolicy,\n    execSql: input.execSql,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  const isOrganizationAdminsGroup = adminPolicy.adminGroupId === input.groupId;\n  const currentOrgAdminUserIds = adminPolicy.signerUserIds;\n  const externalAuthority = adminPolicy.externalAuthority;\n  if (!currentOrgAdminUserIds.includes(input.signerUserId)) {\n    throw new Error(\"Organization admin authority is required\");\n  }\n  const verified = isOrganizationAdminsGroup\n    ? await verifyGroupPolicy({\n        currentPolicy,\n        localPolicyCheckpoint: verification.localPolicyCheckpoint,\n        signerPublicKeys: verification.currentPolicySignerPublicKeys,\n      })\n    : await verifyGroupPolicyWithExternalOrganizationAdmins({\n        currentPolicy,\n        loadExternalAuthority: async () => externalAuthority,\n        localPolicyCheckpoint: verification.localPolicyCheckpoint,\n        signerPublicKeys: verification.currentPolicySignerPublicKeys,\n      });\n  assertGroupMetadataBinding(currentPolicy, adminPolicy.descriptor);\n  requireSignerCanManageGroup(\n    currentPolicy,\n    currentOrgAdminUserIds,\n    input.signerUserId,\n  );\n  await persistVerifiedPrincipalPolicyBundlesAtomically({\n    entries: [\n      ...externalAdminPolicyPersistenceEntries(adminPolicy).filter(\n        (entry) =>\n          entry.policy.principalType !== verified.principalType ||\n          entry.policy.principalId !== verified.principalId,\n      ),\n      { bundle: currentPolicy, policy: verified },\n    ],\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    updatedAt: new Date().toISOString(),\n  });\n\n  return {\n    adminGroupId: adminPolicy.adminGroupId,\n    adminPolicyBundle: adminPolicy.adminBundle,\n    currentPolicy,\n    currentOrgAdminUserIds,\n    externalAuthority,\n    isOrganizationAdminsGroup,\n    memberGroupId: adminPolicy.memberGroupId,\n    organizationDescriptor: adminPolicy.descriptor,\n    organizationPolicyBundle: adminPolicy.bundle,\n    ...verification,\n    localPolicyCheckpoint: verified.checkpoint,\n    signerUserId: input.signerUserId,\n    signingFingerprint: input.signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  };\n}\n\nexport async function commitGroupPolicyMutation(input: {\n  readonly retiredContainerIds?: (() => readonly string[]) | undefined;\n  readonly apiClient: PrincipalPolicyReadWriteApi;\n  readonly currentPolicy: PrincipalPolicyBundleResponse;\n  readonly execSql: ExecSql;\n  readonly expectedHead: ReferencedPrincipalHead;\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly organizationPolicy: PrincipalPolicyBundleResponse;\n  readonly organizationRequest: PutPrincipalPolicyRequest;\n  /**\n   * Re-sign the batch with the descendant rekeys a refusal named woven in; the\n   * result replaces `containerMutations` and the commit is retried once.\n   */\n  readonly carryDescendantRekeys?:\n    | ((\n        requiredContainerIds: readonly string[],\n      ) => Promise<readonly ContainerMutationRequest[]>)\n    | undefined;\n  readonly request: PutPrincipalPolicyRequest;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<PrincipalPolicyBundleResponse & PrincipalPolicyMutationResponse> {\n  const stored = await submitGroupPolicyCommit(input);\n  if (!stored) {\n    throw new Error(\"Group policy update failed\");\n  }\n  const storedPolicy = stored.groupPolicy;\n  const acknowledgedPolicy = await acknowledgeGroupPolicyState({\n    currentPolicy: input.currentPolicy,\n    expectedHead: input.expectedHead,\n    request: input.request,\n    response: storedPolicy.currentState,\n  });\n  const groupBundle = buildAcknowledgedGroupPolicyBundle({\n    currentPolicy: input.currentPolicy,\n    expectedHead: input.expectedHead,\n    request: input.request,\n    response: storedPolicy,\n  });\n  const organizationHead = await groupPolicyMutationHead(\n    input.organizationRequest,\n  );\n  const acknowledgedOrganization = await acknowledgeGroupPolicyState({\n    currentPolicy: input.organizationPolicy,\n    expectedHead: organizationHead,\n    request: input.organizationRequest,\n    response: stored.organizationPolicy.currentState,\n  });\n  const organizationBundle = buildAcknowledgedGroupPolicyBundle({\n    currentPolicy: input.organizationPolicy,\n    expectedHead: organizationHead,\n    request: input.organizationRequest,\n    response: stored.organizationPolicy,\n  });\n  await retainLocallyAcknowledgedPrincipalPolicyBundles({\n    retiredContainers: {\n      containerIds: input.retiredContainerIds?.() ?? [],\n      organizationId: input.organizationId,\n      policy: acknowledgedPolicy,\n    },\n    entries: [\n      { bundle: groupBundle, policy: acknowledgedPolicy },\n      {\n        bundle: organizationBundle,\n        policy: acknowledgedOrganization,\n      },\n    ],\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    stillCurrent: input.stillCurrent,\n    updatedAt: new Date().toISOString(),\n  });\n  return groupBundle;\n}\n"]}

package/workflows/organizations/groupPolicy/groupPolicyMutationEvidence.d.ts

@@ -0,0 +1,26 @@
+import type { PrincipalPolicyPageCurrent } from "../../../internal/api-client/index.js";
+import { type PrincipalPolicyCheckpoint, type PrincipalPolicyExternalAuthority, type PrincipalPolicySignerPublicKey, type SigningKeyPair, type VerifiedPrincipalPolicyCurrent } from "../../../internal/crypto/index.js";
+import type { PutPrincipalPolicyRequest } from "../../../internal/validators/request/index.js";
+import type { PrincipalPolicyBundleResponse } from "../../../internal/validators/response/index.js";
+interface GroupMembershipSigningInput {
+    readonly currentOrgAdminUserIds?: readonly string[] | undefined;
+    readonly externalAuthority?: PrincipalPolicyExternalAuthority | undefined;
+    readonly isOrganizationAdminsGroup?: boolean | undefined;
+    readonly localPolicyCheckpoint?: PrincipalPolicyCheckpoint | null;
+    readonly signerUserId: string;
+    readonly signingFingerprint: string;
+    readonly signingKeyPair: SigningKeyPair;
+}
+export interface FullGroupMembershipMutationInput extends GroupMembershipSigningInput {
+    readonly currentPolicy: PrincipalPolicyBundleResponse;
+    readonly currentPolicySignerPublicKeys: readonly PrincipalPolicySignerPublicKey[];
+}
+interface CurrentGroupMembershipMutationInput extends GroupMembershipSigningInput {
+    readonly currentPolicy: PrincipalPolicyPageCurrent;
+    readonly verifiedCurrentPolicy: VerifiedPrincipalPolicyCurrent;
+    readonly stillCurrent: () => boolean;
+}
+export type BuildGroupMembershipMutationInput = FullGroupMembershipMutationInput | CurrentGroupMembershipMutationInput;
+/** Current artifacts require their verified evidence; omitted history is never a bundle. */
+export declare function withVerifiedGroupMutation<T extends BuildGroupMembershipMutationInput>(input: T, work: (owned: T) => Promise<PutPrincipalPolicyRequest>): Promise<PutPrincipalPolicyRequest>;
+export {};

package/workflows/organizations/groupPolicy/groupPolicyMutationEvidence.js

@@ -0,0 +1,64 @@
+import { verifyPrincipalPolicyCheckpoint, verifyPrincipalPolicyCurrentMutation, } from "../../../internal/crypto/index.js";
+import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
+import { assertCurrentMatchesVerifiedPolicy } from "../../../data/persistence/verifiedPrincipalPolicyCurrent.js";
+import { requireSignerCanManageGroup } from "./groupMutationAuthorization.js";
+import { verifyGroupPolicy } from "./groupPolicyVerification.js";
+/** Current artifacts require their verified evidence; omitted history is never a bundle. */
+export async function withVerifiedGroupMutation(input, work) {
+    input = {
+        ...input,
+        currentPolicy: structuredClone(input.currentPolicy),
+        ...("currentPolicySignerPublicKeys" in input
+            ? {
+                currentPolicySignerPublicKeys: structuredClone(input.currentPolicySignerPublicKeys),
+            }
+            : {}),
+        currentOrgAdminUserIds: structuredClone(input.currentOrgAdminUserIds),
+        externalAuthority: structuredClone(input.externalAuthority),
+        localPolicyCheckpoint: structuredClone(input.localPolicyCheckpoint),
+        signingKeyPair: structuredClone(input.signingKeyPair),
+    };
+    try {
+        const current = () => !("verifiedCurrentPolicy" in input) || input.stillCurrent();
+        assertProjectionVerificationCurrent(current);
+        if ("verifiedCurrentPolicy" in input) {
+            await assertCurrentMatchesVerifiedPolicy({
+                current: input.currentPolicy,
+                policy: input.verifiedCurrentPolicy,
+            });
+            requireSignerCanManageGroup(input.currentPolicy, input.currentOrgAdminUserIds ?? [], input.signerUserId);
+            const verified = await verifyPrincipalPolicyCurrentMutation({
+                current: input.currentPolicy,
+                policy: input.verifiedCurrentPolicy,
+                signerUserId: input.signerUserId,
+                externalAuthority: input.externalAuthority,
+            });
+            if (!verified.ok)
+                throw verified.error;
+            verifyPrincipalPolicyCheckpoint({
+                chain: verified.value.retainedHistory,
+                currentState: verified.value.state,
+                localCheckpoint: input.localPolicyCheckpoint,
+            });
+        }
+        else {
+            await verifyGroupPolicy({
+                currentPolicy: input.currentPolicy,
+                ...(input.externalAuthority
+                    ? { externalAuthority: input.externalAuthority }
+                    : {}),
+                localPolicyCheckpoint: input.localPolicyCheckpoint ?? null,
+                signerPublicKeys: input.currentPolicySignerPublicKeys,
+            });
+        }
+        assertProjectionVerificationCurrent(current);
+        requireSignerCanManageGroup(input.currentPolicy, input.currentOrgAdminUserIds ?? [], input.signerUserId);
+        const result = await work(input);
+        assertProjectionVerificationCurrent(current);
+        return result;
+    }
+    finally {
+        input.signingKeyPair.signingPrivateKey.fill(0);
+    }
+}
+//# sourceMappingURL=groupPolicyMutationEvidence.js.map

package/workflows/organizations/groupPolicy/groupPolicyMutationEvidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"groupPolicyMutationEvidence.js","sourceRoot":"","sources":["groupPolicyMutationEvidence.ts"],"names":[],"mappings":"AACA,OAAO,EAML,+BAA+B,EAC/B,oCAAoC,GACrC,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AACvG,OAAO,EAAE,kCAAkC,EAAE,MAAM,0DAA0D,CAAC;AAC9G,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AA6B9D,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAG7C,KAAQ,EACR,IAAsD;IAEtD,KAAK,GAAG;QACN,GAAG,KAAK;QACR,aAAa,EAAE,eAAe,CAAC,KAAK,CAAC,aAAa,CAAC;QACnD,GAAG,CAAC,+BAA+B,IAAI,KAAK;YAC1C,CAAC,CAAC;gBACE,6BAA6B,EAAE,eAAe,CAC5C,KAAK,CAAC,6BAA6B,CACpC;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,sBAAsB,EAAE,eAAe,CAAC,KAAK,CAAC,sBAAsB,CAAC;QACrE,iBAAiB,EAAE,eAAe,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAC3D,qBAAqB,EAAE,eAAe,CAAC,KAAK,CAAC,qBAAqB,CAAC;QACnE,cAAc,EAAE,eAAe,CAAC,KAAK,CAAC,cAAc,CAAC;KACtD,CAAC;IACF,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,CAAC,CAAC,uBAAuB,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QAC9D,mCAAmC,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,uBAAuB,IAAI,KAAK,EAAE,CAAC;YACrC,MAAM,kCAAkC,CAAC;gBACvC,OAAO,EAAE,KAAK,CAAC,aAAa;gBAC5B,MAAM,EAAE,KAAK,CAAC,qBAAqB;aACpC,CAAC,CAAC;YACH,2BAA2B,CACzB,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,sBAAsB,IAAI,EAAE,EAClC,KAAK,CAAC,YAAY,CACnB,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,oCAAoC,CAAC;gBAC1D,OAAO,EAAE,KAAK,CAAC,aAAa;gBAC5B,MAAM,EAAE,KAAK,CAAC,qBAAqB;gBACnC,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;aAC3C,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;YACvC,+BAA+B,CAAC;gBAC9B,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,eAAe;gBACrC,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK;gBAClC,eAAe,EAAE,KAAK,CAAC,qBAAqB;aAC7C,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,iBAAiB,CAAC;gBACtB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,GAAG,CAAC,KAAK,CAAC,iBAAiB;oBACzB,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE;oBAChD,CAAC,CAAC,EAAE,CAAC;gBACP,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,IAAI,IAAI;gBAC1D,gBAAgB,EAAE,KAAK,CAAC,6BAA6B;aACtD,CAAC,CAAC;QACL,CAAC;QACD,mCAAmC,CAAC,OAAO,CAAC,CAAC;QAC7C,2BAA2B,CACzB,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,sBAAsB,IAAI,EAAE,EAClC,KAAK,CAAC,YAAY,CACnB,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,mCAAmC,CAAC,OAAO,CAAC,CAAC;QAC7C,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,cAAc,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC;AACH,CAAC","sourcesContent":["import type { PrincipalPolicyPageCurrent } from \"@tearleads/api-client\";\nimport {\n  type PrincipalPolicyCheckpoint,\n  type PrincipalPolicyExternalAuthority,\n  type PrincipalPolicySignerPublicKey,\n  type SigningKeyPair,\n  type VerifiedPrincipalPolicyCurrent,\n  verifyPrincipalPolicyCheckpoint,\n  verifyPrincipalPolicyCurrentMutation,\n} from \"@tearleads/crypto\";\nimport type { PutPrincipalPolicyRequest } from \"@tearleads/validators/request\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport { assertCurrentMatchesVerifiedPolicy } from \"../../../data/persistence/verifiedPrincipalPolicyCurrent\";\nimport { requireSignerCanManageGroup } from \"./groupMutationAuthorization\";\nimport { verifyGroupPolicy } from \"./groupPolicyVerification\";\n\ninterface GroupMembershipSigningInput {\n  readonly currentOrgAdminUserIds?: readonly string[] | undefined;\n  readonly externalAuthority?: PrincipalPolicyExternalAuthority | undefined;\n  readonly isOrganizationAdminsGroup?: boolean | undefined;\n  readonly localPolicyCheckpoint?: PrincipalPolicyCheckpoint | null;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n}\n\nexport interface FullGroupMembershipMutationInput\n  extends GroupMembershipSigningInput {\n  readonly currentPolicy: PrincipalPolicyBundleResponse;\n  readonly currentPolicySignerPublicKeys: readonly PrincipalPolicySignerPublicKey[];\n}\n\ninterface CurrentGroupMembershipMutationInput\n  extends GroupMembershipSigningInput {\n  readonly currentPolicy: PrincipalPolicyPageCurrent;\n  readonly verifiedCurrentPolicy: VerifiedPrincipalPolicyCurrent;\n  readonly stillCurrent: () => boolean;\n}\n\nexport type BuildGroupMembershipMutationInput =\n  | FullGroupMembershipMutationInput\n  | CurrentGroupMembershipMutationInput;\n\n/** Current artifacts require their verified evidence; omitted history is never a bundle. */\nexport async function withVerifiedGroupMutation<\n  T extends BuildGroupMembershipMutationInput,\n>(\n  input: T,\n  work: (owned: T) => Promise<PutPrincipalPolicyRequest>,\n): Promise<PutPrincipalPolicyRequest> {\n  input = {\n    ...input,\n    currentPolicy: structuredClone(input.currentPolicy),\n    ...(\"currentPolicySignerPublicKeys\" in input\n      ? {\n          currentPolicySignerPublicKeys: structuredClone(\n            input.currentPolicySignerPublicKeys,\n          ),\n        }\n      : {}),\n    currentOrgAdminUserIds: structuredClone(input.currentOrgAdminUserIds),\n    externalAuthority: structuredClone(input.externalAuthority),\n    localPolicyCheckpoint: structuredClone(input.localPolicyCheckpoint),\n    signingKeyPair: structuredClone(input.signingKeyPair),\n  };\n  try {\n    const current = () =>\n      !(\"verifiedCurrentPolicy\" in input) || input.stillCurrent();\n    assertProjectionVerificationCurrent(current);\n    if (\"verifiedCurrentPolicy\" in input) {\n      await assertCurrentMatchesVerifiedPolicy({\n        current: input.currentPolicy,\n        policy: input.verifiedCurrentPolicy,\n      });\n      requireSignerCanManageGroup(\n        input.currentPolicy,\n        input.currentOrgAdminUserIds ?? [],\n        input.signerUserId,\n      );\n      const verified = await verifyPrincipalPolicyCurrentMutation({\n        current: input.currentPolicy,\n        policy: input.verifiedCurrentPolicy,\n        signerUserId: input.signerUserId,\n        externalAuthority: input.externalAuthority,\n      });\n      if (!verified.ok) throw verified.error;\n      verifyPrincipalPolicyCheckpoint({\n        chain: verified.value.retainedHistory,\n        currentState: verified.value.state,\n        localCheckpoint: input.localPolicyCheckpoint,\n      });\n    } else {\n      await verifyGroupPolicy({\n        currentPolicy: input.currentPolicy,\n        ...(input.externalAuthority\n          ? { externalAuthority: input.externalAuthority }\n          : {}),\n        localPolicyCheckpoint: input.localPolicyCheckpoint ?? null,\n        signerPublicKeys: input.currentPolicySignerPublicKeys,\n      });\n    }\n    assertProjectionVerificationCurrent(current);\n    requireSignerCanManageGroup(\n      input.currentPolicy,\n      input.currentOrgAdminUserIds ?? [],\n      input.signerUserId,\n    );\n    const result = await work(input);\n    assertProjectionVerificationCurrent(current);\n    return result;\n  } finally {\n    input.signingKeyPair.signingPrivateKey.fill(0);\n  }\n}\n"]}

package/workflows/organizations/groupPolicy/groupPolicyMutationHead.js

@@ -0,0 +1,26 @@
+import { computePrincipalStateHash, } from "../../../internal/crypto/index.js";
+export async function groupPolicyMutationHead(request) {
+    const state = request.state;
+    return {
+        principalType: state.principalType,
+        principalId: state.principalId,
+        version: state.version,
+        keyEpoch: state.keyEpoch,
+        stateHash: await computePrincipalStateHash(state),
+        keyFingerprint: state.keyFingerprint,
+    };
+}
+function principalPolicyCurrentStateMatchesHead(state, head) {
+    return (state.principalType === head.principalType &&
+        state.principalId === head.principalId &&
+        state.version === head.version &&
+        state.keyEpoch === head.keyEpoch &&
+        state.stateHash === head.stateHash &&
+        state.keyFingerprint === head.keyFingerprint);
+}
+export function assertPrincipalPolicyCurrentStateMatchesHead(state, head) {
+    if (!principalPolicyCurrentStateMatchesHead(state, head)) {
+        throw new Error("Updated group policy advanced during root re-wrap");
+    }
+}
+//# sourceMappingURL=groupPolicyMutationHead.js.map

package/workflows/organizations/groupPolicy/groupPolicyRequests.js

@@ -0,0 +1,181 @@
+import { generateKemSeedAndKeyPair, KeyingVerificationError, toFingerprint, unwrapDek, wrapDekForRecipients, } from "../../../internal/crypto/index.js";
+import { bytesToBase64 } from "../../../internal/encoding/index.js";
+import { principalSecretKeyMatchesState } from "../../../data/principals/principalKeyValidation.js";
+import { rewrapProjectionMemberEnvelopes, toRecipientEntries, } from "../principalPolicy/principalPolicyRecipients.js";
+import { signedGroupPolicyRequest, userProjectionMember, } from "../principalPolicy/principalPolicyRequest.js";
+import { isDirectGroupAdmin } from "./groupMutationAuthorization.js";
+import { withVerifiedGroupMutation, } from "./groupPolicyMutationEvidence.js";
+/**
+ * The signed policy commits both the group's public key and the member
+ * envelopes that are supposed to wrap its secret. An envelope that unwraps to
+ * a different secret means a prior admin (or the server) published a policy
+ * whose envelopes do not match its signed key. Rotating repairs the group, but
+ * the mismatch is evidence and is recorded before the repair proceeds.
+ */
+async function reportPrincipalEnvelopeMismatch(input) {
+    const state = input.currentPolicy.currentState;
+    await input.reportSecurityIncident?.(new KeyingVerificationError("object_mismatch", "Group member envelope does not unwrap the signed principal key"), {
+        evidenceHashes: {
+            principalKeyFingerprint: state.keyFingerprint,
+            principalStateHash: state.stateHash,
+        },
+        objectId: state.principalId,
+        objectKind: "principal",
+        operation: "group.policy.envelope_mismatch",
+    });
+}
+function hasAdmin(projection) {
+    return projection.some((member) => member.role === "admin");
+}
+function requireExternalAuthority(authority) {
+    if (!authority) {
+        throw new Error("External principal authority could not be verified");
+    }
+    return authority;
+}
+async function buildRotatedKeyGroupPolicyRequest(input, projection, users, grants = input.currentPolicy.currentGrants) {
+    const groupKem = generateKemSeedAndKeyPair();
+    const memberEnvelopes = await rewrapProjectionMemberEnvelopes({
+        projection,
+        secretKey: groupKem.secretKey,
+        users,
+    });
+    return signedGroupPolicyRequest({
+        currentPolicy: input.currentPolicy,
+        encapsulationPublicKey: bytesToBase64(groupKem.publicKey),
+        externalAuthority: isDirectGroupAdmin(input.currentPolicy, input.signerUserId)
+            ? null
+            : requireExternalAuthority(input.externalAuthority).currentHead,
+        keyEpoch: input.currentPolicy.currentState.keyEpoch + 1,
+        keyFingerprint: await toFingerprint(groupKem.publicKey),
+        grants,
+        memberEnvelopes,
+        payloadCiphertext: input.currentPolicy.currentPayload.ciphertext,
+        principalId: input.currentPolicy.currentState.principalId,
+        projection,
+        signedAt: new Date().toISOString(),
+        signerUserId: input.signerUserId,
+        signingFingerprint: input.signingFingerprint,
+        signingKeyPair: input.signingKeyPair,
+    });
+}
+async function buildDirectAdminAddGroupUserPolicyRequest(input, projection, targetKey) {
+    const groupSecretKey = await unwrapDek(toRecipientEntries(input.currentPolicy.currentMemberEnvelopes.envelopes), input.currentUserSecretKey);
+    if (!(await principalSecretKeyMatchesState(groupSecretKey, input.currentPolicy.currentState))) {
+        await reportPrincipalEnvelopeMismatch(input);
+        return buildRotatedKeyGroupPolicyRequest(input, projection, [
+            ...input.currentUsers,
+            input.targetUser,
+        ]);
+    }
+    const [targetEnvelope] = await wrapDekForRecipients(groupSecretKey, [
+        input.targetUser.encapsulationPublicKey,
+    ]);
+    if (!targetEnvelope) {
+        throw new Error("Failed to wrap group key for target user");
+    }
+    const memberEnvelopes = [
+        ...input.currentPolicy.currentMemberEnvelopes.envelopes.filter((envelope) => envelope.userId !== targetKey),
+        {
+            userId: input.targetUser.userId,
+            memberKeyFingerprint: input.targetUser.encapsulationKeyFingerprint,
+            kemCipherText: bytesToBase64(targetEnvelope.kemCipherText),
+            wrappedKey: bytesToBase64(targetEnvelope.wrappedKey),
+        },
+    ];
+    return signedGroupPolicyRequest({
+        currentPolicy: input.currentPolicy,
+        encapsulationPublicKey: input.currentPolicy.currentState.encapsulationPublicKey,
+        externalAuthority: null,
+        keyEpoch: input.currentPolicy.currentState.keyEpoch,
+        keyFingerprint: input.currentPolicy.currentState.keyFingerprint,
+        grants: input.currentPolicy.currentGrants,
+        memberEnvelopes,
+        payloadCiphertext: input.currentPolicy.currentPayload.ciphertext,
+        principalId: input.currentPolicy.currentState.principalId,
+        projection,
+        signedAt: new Date().toISOString(),
+        signerUserId: input.signerUserId,
+        signingFingerprint: input.signingFingerprint,
+        signingKeyPair: input.signingKeyPair,
+    });
+}
+export async function buildAddGroupUserPolicyRequest(input) {
+    input = {
+        ...input,
+        currentUsers: structuredClone(input.currentUsers),
+        currentUserSecretKey: input.currentUserSecretKey.slice(),
+        targetUser: structuredClone(input.targetUser),
+    };
+    try {
+        return await withVerifiedGroupMutation(input, async (input) => {
+            const targetKey = input.targetUser.userId;
+            const currentProjection = input.currentPolicy.currentProjection;
+            if (currentProjection.some((member) => member.userId === targetKey)) {
+                throw new Error("User is already a group member");
+            }
+            const projection = [
+                ...currentProjection,
+                userProjectionMember(input.targetUser.userId, input.isOrganizationAdminsGroup ? "admin" : "member"),
+            ];
+            return isDirectGroupAdmin(input.currentPolicy, input.signerUserId)
+                ? buildDirectAdminAddGroupUserPolicyRequest(input, projection, targetKey)
+                : buildRotatedKeyGroupPolicyRequest(input, projection, [
+                    ...input.currentUsers,
+                    input.targetUser,
+                ]);
+        });
+    }
+    finally {
+        input.currentUserSecretKey.fill(0);
+    }
+}
+export async function buildRemoveGroupUserPolicyRequest(input) {
+    input = { ...input, remainingUsers: structuredClone(input.remainingUsers) };
+    return withVerifiedGroupMutation(input, async (input) => {
+        const key = input.removedUserId;
+        const projection = input.currentPolicy.currentProjection.filter((member) => member.userId !== key);
+        if (projection.length === input.currentPolicy.currentProjection.length) {
+            throw new Error("User is not a group member");
+        }
+        if (hasAdmin(input.currentPolicy.currentProjection) &&
+            !hasAdmin(projection)) {
+            throw new Error("Cannot remove the last group admin");
+        }
+        return buildRotatedKeyGroupPolicyRequest(input, projection, input.remainingUsers);
+    });
+}
+export async function buildGroupAccessSetShrinkPolicyRequest(input) {
+    input = { ...input, currentUsers: structuredClone(input.currentUsers) };
+    return withVerifiedGroupMutation(input, async (input) => {
+        return buildRotatedKeyGroupPolicyRequest(input, [...input.currentPolicy.currentProjection], input.currentUsers, input.currentPolicy.currentGrants.filter((grant) => grant.containerId !== input.revokedContainerId));
+    });
+}
+/** Signs a complete successor grant projection without rotating group key material. */
+export async function buildSetGroupContainerGrantPolicyRequest(input) {
+    return withVerifiedGroupMutation(input, async (input) => {
+        const grants = [
+            ...input.currentPolicy.currentGrants.filter((grant) => grant.containerId !== input.containerId),
+            { accessLevel: input.accessLevel, containerId: input.containerId },
+        ];
+        return signedGroupPolicyRequest({
+            currentPolicy: input.currentPolicy,
+            encapsulationPublicKey: input.currentPolicy.currentState.encapsulationPublicKey,
+            externalAuthority: isDirectGroupAdmin(input.currentPolicy, input.signerUserId)
+                ? null
+                : requireExternalAuthority(input.externalAuthority).currentHead,
+            keyEpoch: input.currentPolicy.currentState.keyEpoch,
+            keyFingerprint: input.currentPolicy.currentState.keyFingerprint,
+            grants,
+            memberEnvelopes: input.currentPolicy.currentMemberEnvelopes.envelopes,
+            payloadCiphertext: input.currentPolicy.currentPayload.ciphertext,
+            principalId: input.currentPolicy.currentState.principalId,
+            projection: input.currentPolicy.currentProjection,
+            signedAt: new Date().toISOString(),
+            signerUserId: input.signerUserId,
+            signingFingerprint: input.signingFingerprint,
+            signingKeyPair: input.signingKeyPair,
+        });
+    });
+}
+//# sourceMappingURL=groupPolicyRequests.js.map

package/workflows/organizations/groupPolicy/groupPolicyRequests.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"groupPolicyRequests.js","sourceRoot":"","sources":["groupPolicyRequests.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EAEvB,aAAa,EACb,SAAS,EACT,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAMpD,OAAO,EAAE,8BAA8B,EAAE,MAAM,iDAAiD,CAAC;AAGjG,OAAO,EACL,+BAA+B,EAC/B,kBAAkB,GACnB,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAEL,yBAAyB,GAC1B,MAAM,+BAA+B,CAAC;AASvC;;;;;;GAMG;AACH,KAAK,UAAU,+BAA+B,CAC5C,KAAmC;IAEnC,MAAM,KAAK,GAAG,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC;IAC/C,MAAM,KAAK,CAAC,sBAAsB,EAAE,CAClC,IAAI,uBAAuB,CACzB,iBAAiB,EACjB,gEAAgE,CACjE,EACD;QACE,cAAc,EAAE;YACd,uBAAuB,EAAE,KAAK,CAAC,cAAc;YAC7C,kBAAkB,EAAE,KAAK,CAAC,SAAS;SACpC;QACD,QAAQ,EAAE,KAAK,CAAC,WAAW;QAC3B,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,gCAAgC;KAC5C,CACF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CACf,UAA2D;IAE3D,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,wBAAwB,CAC/B,SAAuD;IAEvD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,iCAAiC,CAC9C,KAAwC,EACxC,UAA2D,EAC3D,KAAyC,EACzC,MAAM,GAAG,KAAK,CAAC,aAAa,CAAC,aAAa;IAE1C,MAAM,QAAQ,GAAG,yBAAyB,EAAE,CAAC;IAC7C,MAAM,eAAe,GAAG,MAAM,+BAA+B,CAAC;QAC5D,UAAU;QACV,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,KAAK;KACN,CAAC,CAAC;IACH,OAAO,wBAAwB,CAAC;QAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,sBAAsB,EAAE,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;QACzD,iBAAiB,EAAE,kBAAkB,CACnC,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,YAAY,CACnB;YACC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,WAAW;QACjE,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,QAAQ,GAAG,CAAC;QACvD,cAAc,EAAE,MAAM,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;QACvD,MAAM;QACN,eAAe;QACf,iBAAiB,EAAE,KAAK,CAAC,aAAa,CAAC,cAAc,CAAC,UAAU;QAChE,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,WAAW;QACzD,UAAU;QACV,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,yCAAyC,CACtD,KAAmC,EACnC,UAA2D,EAC3D,SAAiB;IAEjB,MAAM,cAAc,GAAG,MAAM,SAAS,CACpC,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,sBAAsB,CAAC,SAAS,CAAC,EACxE,KAAK,CAAC,oBAAoB,CAC3B,CAAC;IACF,IACE,CAAC,CAAC,MAAM,8BAA8B,CACpC,cAAc,EACd,KAAK,CAAC,aAAa,CAAC,YAAY,CACjC,CAAC,EACF,CAAC;QACD,MAAM,+BAA+B,CAAC,KAAK,CAAC,CAAC;QAC7C,OAAO,iCAAiC,CAAC,KAAK,EAAE,UAAU,EAAE;YAC1D,GAAG,KAAK,CAAC,YAAY;YACrB,KAAK,CAAC,UAAU;SACjB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,CAAC,cAAc,CAAC,GAAG,MAAM,oBAAoB,CAAC,cAAc,EAAE;QAClE,KAAK,CAAC,UAAU,CAAC,sBAAsB;KACxC,CAAC,CAAC;IAEH,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,eAAe,GAAG;QACtB,GAAG,KAAK,CAAC,aAAa,CAAC,sBAAsB,CAAC,SAAS,CAAC,MAAM,CAC5D,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAC5C;QACD;YACE,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM;YAC/B,oBAAoB,EAAE,KAAK,CAAC,UAAU,CAAC,2BAA2B;YAClE,aAAa,EAAE,aAAa,CAAC,cAAc,CAAC,aAAa,CAAC;YAC1D,UAAU,EAAE,aAAa,CAAC,cAAc,CAAC,UAAU,CAAC;SACrD;KACF,CAAC;IACF,OAAO,wBAAwB,CAAC;QAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,sBAAsB,EACpB,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,sBAAsB;QACzD,iBAAiB,EAAE,IAAI;QACvB,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,QAAQ;QACnD,cAAc,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,cAAc;QAC/D,MAAM,EAAE,KAAK,CAAC,aAAa,CAAC,aAAa;QACzC,eAAe;QACf,iBAAiB,EAAE,KAAK,CAAC,aAAa,CAAC,cAAc,CAAC,UAAU;QAChE,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,WAAW;QACzD,UAAU;QACV,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAAmC;IAEnC,KAAK,GAAG;QACN,GAAG,KAAK;QACR,YAAY,EAAE,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC;QACjD,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,CAAC,KAAK,EAAE;QACxD,UAAU,EAAE,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC;KAC9C,CAAC;IACF,IAAI,CAAC;QACH,OAAO,MAAM,yBAAyB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAC5D,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;YAC1C,MAAM,iBAAiB,GAAG,KAAK,CAAC,aAAa,CAAC,iBAAiB,CAAC;YAChE,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,EAAE,CAAC;gBACpE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YAED,MAAM,UAAU,GAAG;gBACjB,GAAG,iBAAiB;gBACpB,oBAAoB,CAClB,KAAK,CAAC,UAAU,CAAC,MAAM,EACvB,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CACrD;aACF,CAAC;YAEF,OAAO,kBAAkB,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,YAAY,CAAC;gBAChE,CAAC,CAAC,yCAAyC,CACvC,KAAK,EACL,UAAU,EACV,SAAS,CACV;gBACH,CAAC,CAAC,iCAAiC,CAAC,KAAK,EAAE,UAAU,EAAE;oBACnD,GAAG,KAAK,CAAC,YAAY;oBACrB,KAAK,CAAC,UAAU;iBACjB,CAAC,CAAC;QACT,CAAC,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,KAGC;IAED,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,eAAe,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;IAC5E,OAAO,yBAAyB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QACtD,MAAM,GAAG,GAAG,KAAK,CAAC,aAAa,CAAC;QAChC,MAAM,UAAU,GAAG,KAAK,CAAC,aAAa,CAAC,iBAAiB,CAAC,MAAM,CAC7D,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,GAAG,CAClC,CAAC;QAEF,IAAI,UAAU,CAAC,MAAM,KAAK,KAAK,CAAC,aAAa,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,IACE,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,iBAAiB,CAAC;YAC/C,CAAC,QAAQ,CAAC,UAAU,CAAC,EACrB,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QAED,OAAO,iCAAiC,CACtC,KAAK,EACL,UAAU,EACV,KAAK,CAAC,cAAc,CACrB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,KAGC;IAED,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;IACxE,OAAO,yBAAyB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QACtD,OAAO,iCAAiC,CACtC,KAAK,EACL,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,iBAAiB,CAAC,EAC1C,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,aAAa,CAAC,aAAa,CAAC,MAAM,CACtC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,kBAAkB,CAC1D,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,wCAAwC,CAC5D,KAGC;IAED,OAAO,yBAAyB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QACtD,MAAM,MAAM,GAAG;YACb,GAAG,KAAK,CAAC,aAAa,CAAC,aAAa,CAAC,MAAM,CACzC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CACnD;YACD,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE;SACnE,CAAC;QACF,OAAO,wBAAwB,CAAC;YAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,sBAAsB,EACpB,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,sBAAsB;YACzD,iBAAiB,EAAE,kBAAkB,CACnC,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,YAAY,CACnB;gBACC,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,WAAW;YACjE,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,QAAQ;YACnD,cAAc,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,cAAc;YAC/D,MAAM;YACN,eAAe,EAAE,KAAK,CAAC,aAAa,CAAC,sBAAsB,CAAC,SAAS;YACrE,iBAAiB,EAAE,KAAK,CAAC,aAAa,CAAC,cAAc,CAAC,UAAU;YAChE,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,WAAW;YACzD,UAAU,EAAE,KAAK,CAAC,aAAa,CAAC,iBAAiB;YACjD,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAClC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  generateKemSeedAndKeyPair,\n  KeyingVerificationError,\n  type PrincipalPolicyExternalAuthority,\n  toFingerprint,\n  unwrapDek,\n  wrapDekForRecipients,\n} from \"@tearleads/crypto\";\nimport { bytesToBase64 } from \"@tearleads/encoding\";\nimport type {\n  PrincipalContainerGrantRequest,\n  PrincipalProjectionMemberRequest,\n  PutPrincipalPolicyRequest,\n} from \"@tearleads/validators/request\";\nimport { principalSecretKeyMatchesState } from \"../../../data/principals/principalKeyValidation\";\nimport type { SecurityIncidentReporter } from \"../../../data/shared/securityIncidents\";\nimport type { TrustedUserIdentity } from \"../../../data/trustedUserIdentity\";\nimport {\n  rewrapProjectionMemberEnvelopes,\n  toRecipientEntries,\n} from \"../principalPolicy/principalPolicyRecipients\";\nimport {\n  signedGroupPolicyRequest,\n  userProjectionMember,\n} from \"../principalPolicy/principalPolicyRequest\";\nimport { isDirectGroupAdmin } from \"./groupMutationAuthorization\";\nimport {\n  type BuildGroupMembershipMutationInput,\n  withVerifiedGroupMutation,\n} from \"./groupPolicyMutationEvidence\";\n\ntype BuildAddGroupUserPolicyInput = BuildGroupMembershipMutationInput & {\n  readonly currentUsers: ReadonlyArray<TrustedUserIdentity>;\n  readonly currentUserSecretKey: Uint8Array;\n  readonly reportSecurityIncident?: SecurityIncidentReporter | undefined;\n  readonly targetUser: TrustedUserIdentity;\n};\n\n/**\n * The signed policy commits both the group's public key and the member\n * envelopes that are supposed to wrap its secret. An envelope that unwraps to\n * a different secret means a prior admin (or the server) published a policy\n * whose envelopes do not match its signed key. Rotating repairs the group, but\n * the mismatch is evidence and is recorded before the repair proceeds.\n */\nasync function reportPrincipalEnvelopeMismatch(\n  input: BuildAddGroupUserPolicyInput,\n): Promise<void> {\n  const state = input.currentPolicy.currentState;\n  await input.reportSecurityIncident?.(\n    new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Group member envelope does not unwrap the signed principal key\",\n    ),\n    {\n      evidenceHashes: {\n        principalKeyFingerprint: state.keyFingerprint,\n        principalStateHash: state.stateHash,\n      },\n      objectId: state.principalId,\n      objectKind: \"principal\",\n      operation: \"group.policy.envelope_mismatch\",\n    },\n  );\n}\n\nfunction hasAdmin(\n  projection: ReadonlyArray<PrincipalProjectionMemberRequest>,\n): boolean {\n  return projection.some((member) => member.role === \"admin\");\n}\n\nfunction requireExternalAuthority(\n  authority: PrincipalPolicyExternalAuthority | undefined,\n): PrincipalPolicyExternalAuthority {\n  if (!authority) {\n    throw new Error(\"External principal authority could not be verified\");\n  }\n  return authority;\n}\n\nasync function buildRotatedKeyGroupPolicyRequest(\n  input: BuildGroupMembershipMutationInput,\n  projection: ReadonlyArray<PrincipalProjectionMemberRequest>,\n  users: ReadonlyArray<TrustedUserIdentity>,\n  grants = input.currentPolicy.currentGrants,\n): Promise<PutPrincipalPolicyRequest> {\n  const groupKem = generateKemSeedAndKeyPair();\n  const memberEnvelopes = await rewrapProjectionMemberEnvelopes({\n    projection,\n    secretKey: groupKem.secretKey,\n    users,\n  });\n  return signedGroupPolicyRequest({\n    currentPolicy: input.currentPolicy,\n    encapsulationPublicKey: bytesToBase64(groupKem.publicKey),\n    externalAuthority: isDirectGroupAdmin(\n      input.currentPolicy,\n      input.signerUserId,\n    )\n      ? null\n      : requireExternalAuthority(input.externalAuthority).currentHead,\n    keyEpoch: input.currentPolicy.currentState.keyEpoch + 1,\n    keyFingerprint: await toFingerprint(groupKem.publicKey),\n    grants,\n    memberEnvelopes,\n    payloadCiphertext: input.currentPolicy.currentPayload.ciphertext,\n    principalId: input.currentPolicy.currentState.principalId,\n    projection,\n    signedAt: new Date().toISOString(),\n    signerUserId: input.signerUserId,\n    signingFingerprint: input.signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  });\n}\n\nasync function buildDirectAdminAddGroupUserPolicyRequest(\n  input: BuildAddGroupUserPolicyInput,\n  projection: ReadonlyArray<PrincipalProjectionMemberRequest>,\n  targetKey: string,\n): Promise<PutPrincipalPolicyRequest> {\n  const groupSecretKey = await unwrapDek(\n    toRecipientEntries(input.currentPolicy.currentMemberEnvelopes.envelopes),\n    input.currentUserSecretKey,\n  );\n  if (\n    !(await principalSecretKeyMatchesState(\n      groupSecretKey,\n      input.currentPolicy.currentState,\n    ))\n  ) {\n    await reportPrincipalEnvelopeMismatch(input);\n    return buildRotatedKeyGroupPolicyRequest(input, projection, [\n      ...input.currentUsers,\n      input.targetUser,\n    ]);\n  }\n  const [targetEnvelope] = await wrapDekForRecipients(groupSecretKey, [\n    input.targetUser.encapsulationPublicKey,\n  ]);\n\n  if (!targetEnvelope) {\n    throw new Error(\"Failed to wrap group key for target user\");\n  }\n\n  const memberEnvelopes = [\n    ...input.currentPolicy.currentMemberEnvelopes.envelopes.filter(\n      (envelope) => envelope.userId !== targetKey,\n    ),\n    {\n      userId: input.targetUser.userId,\n      memberKeyFingerprint: input.targetUser.encapsulationKeyFingerprint,\n      kemCipherText: bytesToBase64(targetEnvelope.kemCipherText),\n      wrappedKey: bytesToBase64(targetEnvelope.wrappedKey),\n    },\n  ];\n  return signedGroupPolicyRequest({\n    currentPolicy: input.currentPolicy,\n    encapsulationPublicKey:\n      input.currentPolicy.currentState.encapsulationPublicKey,\n    externalAuthority: null,\n    keyEpoch: input.currentPolicy.currentState.keyEpoch,\n    keyFingerprint: input.currentPolicy.currentState.keyFingerprint,\n    grants: input.currentPolicy.currentGrants,\n    memberEnvelopes,\n    payloadCiphertext: input.currentPolicy.currentPayload.ciphertext,\n    principalId: input.currentPolicy.currentState.principalId,\n    projection,\n    signedAt: new Date().toISOString(),\n    signerUserId: input.signerUserId,\n    signingFingerprint: input.signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  });\n}\n\nexport async function buildAddGroupUserPolicyRequest(\n  input: BuildAddGroupUserPolicyInput,\n): Promise<PutPrincipalPolicyRequest> {\n  input = {\n    ...input,\n    currentUsers: structuredClone(input.currentUsers),\n    currentUserSecretKey: input.currentUserSecretKey.slice(),\n    targetUser: structuredClone(input.targetUser),\n  };\n  try {\n    return await withVerifiedGroupMutation(input, async (input) => {\n      const targetKey = input.targetUser.userId;\n      const currentProjection = input.currentPolicy.currentProjection;\n      if (currentProjection.some((member) => member.userId === targetKey)) {\n        throw new Error(\"User is already a group member\");\n      }\n\n      const projection = [\n        ...currentProjection,\n        userProjectionMember(\n          input.targetUser.userId,\n          input.isOrganizationAdminsGroup ? \"admin\" : \"member\",\n        ),\n      ];\n\n      return isDirectGroupAdmin(input.currentPolicy, input.signerUserId)\n        ? buildDirectAdminAddGroupUserPolicyRequest(\n            input,\n            projection,\n            targetKey,\n          )\n        : buildRotatedKeyGroupPolicyRequest(input, projection, [\n            ...input.currentUsers,\n            input.targetUser,\n          ]);\n    });\n  } finally {\n    input.currentUserSecretKey.fill(0);\n  }\n}\n\nexport async function buildRemoveGroupUserPolicyRequest(\n  input: BuildGroupMembershipMutationInput & {\n    readonly remainingUsers: ReadonlyArray<TrustedUserIdentity>;\n    readonly removedUserId: string;\n  },\n): Promise<PutPrincipalPolicyRequest> {\n  input = { ...input, remainingUsers: structuredClone(input.remainingUsers) };\n  return withVerifiedGroupMutation(input, async (input) => {\n    const key = input.removedUserId;\n    const projection = input.currentPolicy.currentProjection.filter(\n      (member) => member.userId !== key,\n    );\n\n    if (projection.length === input.currentPolicy.currentProjection.length) {\n      throw new Error(\"User is not a group member\");\n    }\n\n    if (\n      hasAdmin(input.currentPolicy.currentProjection) &&\n      !hasAdmin(projection)\n    ) {\n      throw new Error(\"Cannot remove the last group admin\");\n    }\n\n    return buildRotatedKeyGroupPolicyRequest(\n      input,\n      projection,\n      input.remainingUsers,\n    );\n  });\n}\n\nexport async function buildGroupAccessSetShrinkPolicyRequest(\n  input: BuildGroupMembershipMutationInput & {\n    readonly currentUsers: ReadonlyArray<TrustedUserIdentity>;\n    readonly revokedContainerId: string;\n  },\n): Promise<PutPrincipalPolicyRequest> {\n  input = { ...input, currentUsers: structuredClone(input.currentUsers) };\n  return withVerifiedGroupMutation(input, async (input) => {\n    return buildRotatedKeyGroupPolicyRequest(\n      input,\n      [...input.currentPolicy.currentProjection],\n      input.currentUsers,\n      input.currentPolicy.currentGrants.filter(\n        (grant) => grant.containerId !== input.revokedContainerId,\n      ),\n    );\n  });\n}\n\n/** Signs a complete successor grant projection without rotating group key material. */\nexport async function buildSetGroupContainerGrantPolicyRequest(\n  input: BuildGroupMembershipMutationInput & {\n    readonly accessLevel: PrincipalContainerGrantRequest[\"accessLevel\"];\n    readonly containerId: string;\n  },\n): Promise<PutPrincipalPolicyRequest> {\n  return withVerifiedGroupMutation(input, async (input) => {\n    const grants = [\n      ...input.currentPolicy.currentGrants.filter(\n        (grant) => grant.containerId !== input.containerId,\n      ),\n      { accessLevel: input.accessLevel, containerId: input.containerId },\n    ];\n    return signedGroupPolicyRequest({\n      currentPolicy: input.currentPolicy,\n      encapsulationPublicKey:\n        input.currentPolicy.currentState.encapsulationPublicKey,\n      externalAuthority: isDirectGroupAdmin(\n        input.currentPolicy,\n        input.signerUserId,\n      )\n        ? null\n        : requireExternalAuthority(input.externalAuthority).currentHead,\n      keyEpoch: input.currentPolicy.currentState.keyEpoch,\n      keyFingerprint: input.currentPolicy.currentState.keyFingerprint,\n      grants,\n      memberEnvelopes: input.currentPolicy.currentMemberEnvelopes.envelopes,\n      payloadCiphertext: input.currentPolicy.currentPayload.ciphertext,\n      principalId: input.currentPolicy.currentState.principalId,\n      projection: input.currentPolicy.currentProjection,\n      signedAt: new Date().toISOString(),\n      signerUserId: input.signerUserId,\n      signingFingerprint: input.signingFingerprint,\n      signingKeyPair: input.signingKeyPair,\n    });\n  });\n}\n"]}

package/workflows/organizations/groupPolicy/groupPolicyVerification.js

@@ -0,0 +1,74 @@
+import { verifyPrincipalPolicyBundle, } from "../../../internal/crypto/index.js";
+import { throwKeyingVerificationErrorWithContext } from "../../../data/keyingProjectionVerification/error.js";
+import { loadPrincipalPolicyCheckpoint } from "../../../data/persistence/keyingCheckpointPersistence.js";
+import { verifyPrincipalPolicyBundleWithExternalOrganizationAdmins } from "../../../data/principals/principalPolicyAdminSigners.js";
+import { collectPrincipalPolicySignerPublicKeys, } from "../../principals/policyVerification.js";
+function signerPublicKeyLoadErrorMessage(code) {
+    switch (code) {
+        case "fingerprint-mismatch":
+            return "Group policy signer key fingerprint mismatch";
+        case "not-found":
+            return "Group policy signer key could not be loaded";
+    }
+}
+function groupPolicyReference(bundle) {
+    const state = bundle.currentState;
+    return {
+        principalType: "group",
+        principalId: state.principalId,
+        version: state.version,
+        keyEpoch: state.keyEpoch,
+        stateHash: state.stateHash,
+        keyFingerprint: state.keyFingerprint,
+    };
+}
+export async function collectGroupPolicySignerPublicKeys(input) {
+    const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({
+        bundle: input.bundle,
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+    });
+    if ("error" in signerPublicKeys) {
+        throw new Error(signerPublicKeyLoadErrorMessage(signerPublicKeys.error));
+    }
+    return signerPublicKeys.signerPublicKeys;
+}
+export async function verifyGroupPolicy(input) {
+    const verified = await verifyPrincipalPolicyBundle({
+        bundle: input.currentPolicy,
+        ...(input.externalAuthority
+            ? { externalAuthority: input.externalAuthority }
+            : {}),
+        expectedReference: groupPolicyReference(input.currentPolicy),
+        localCheckpoint: input.localPolicyCheckpoint,
+        signerPublicKeys: input.signerPublicKeys,
+    });
+    if (!verified.ok) {
+        throwKeyingVerificationErrorWithContext(verified.error, "Group policy verification failed");
+    }
+    return verified.value;
+}
+export async function verifyGroupPolicyWithExternalOrganizationAdmins(input) {
+    const verified = await verifyPrincipalPolicyBundleWithExternalOrganizationAdmins({
+        bundle: input.currentPolicy,
+        expectedReference: groupPolicyReference(input.currentPolicy),
+        loadExternalAuthority: input.loadExternalAuthority,
+        localCheckpoint: input.localPolicyCheckpoint,
+        signerPublicKeys: input.signerPublicKeys,
+    });
+    if (!verified.ok) {
+        throwKeyingVerificationErrorWithContext(verified.error, "Group policy verification failed");
+    }
+    return verified.value;
+}
+export async function prepareGroupPolicyVerification(input) {
+    const principalId = input.currentPolicy.currentState.principalId;
+    const localPolicyCheckpoint = await loadPrincipalPolicyCheckpoint(input.execSql, "group", principalId);
+    return {
+        currentPolicySignerPublicKeys: await collectGroupPolicySignerPublicKeys({
+            bundle: input.currentPolicy,
+            resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+        }),
+        localPolicyCheckpoint,
+    };
+}
+//# sourceMappingURL=groupPolicyVerification.js.map