@tearleads/client-sdk 0.1.61 → 0.1.63

package/workflows/organizations/principalPolicy/index.js

@@ -0,0 +1,256 @@
+export { createOrganizationGroup } from "../groups/groupCreation.js";
+import { assertGroupMembershipName } from "../groupNames/groupMembershipName.js";
+import { prepareAuthoredGroupPolicy } from "../groupPolicy/groupPolicyMutationAcknowledgement.js";
+import { cacheGroupPolicy, commitGroupPolicyMutation, loadGroupPolicyMutationContext, } from "../groupPolicy/groupPolicyMutationContext.js";
+import { groupPolicyMutationHead } from "../groupPolicy/groupPolicyMutationHead.js";
+import { buildAddGroupUserPolicyRequest, buildGroupAccessSetShrinkPolicyRequest, buildRemoveGroupUserPolicyRequest, buildSetGroupContainerGrantPolicyRequest, } from "../groupPolicy/groupPolicyRequests.js";
+import { buildOrganizationGroupDirectoryPolicyRequest, replaceOrganizationGroupHead, } from "../groups/organizationGroupDirectory.js";
+import { projectionUserIds, resolveRequiredUserIdentities, } from "../trustedOrganizationUsers.js";
+import { buildInitialGroupPolicyRequest, buildInitialMemberGroupPolicyRequest, } from "./principalPolicyRequest.js";
+export { buildInitialGroupPolicyRequest, buildInitialMemberGroupPolicyRequest };
+function createPolicyMutationCommitGuard(assertCanCommit) {
+    if (!assertCanCommit)
+        return undefined;
+    return () => {
+        assertCanCommit();
+        return true;
+    };
+}
+/**
+ * Plan the container mutations the policy change rematerializes and place their
+ * requests on the policy request. A bare request list has nothing to
+ * acknowledge or carry; a prepared batch does both.
+ */
+async function prepareGroupContainerMutations(input, expectedHead) {
+    if (!input.prepareContainerMutations)
+        return null;
+    const prepared = await input.prepareContainerMutations({
+        currentPolicy: input.currentPolicy,
+        nextPolicy: await prepareAuthoredGroupPolicy({
+            currentPolicy: input.currentPolicy,
+            expectedHead,
+            request: input.request,
+        }),
+    });
+    if ("requests" in prepared) {
+        input.request.containerMutations = [...prepared.requests];
+        return prepared;
+    }
+    input.request.containerMutations = [...prepared];
+    return {};
+}
+async function commitAndCacheGroupPolicyMutation(input) {
+    const stillCurrent = createPolicyMutationCommitGuard(input.assertCanCommit);
+    const expectedHead = await groupPolicyMutationHead(input.request);
+    input.beforePolicyCommit?.(expectedHead);
+    const containerMutations = await prepareGroupContainerMutations(input, expectedHead);
+    const nextAdminProjection = input.policyContext.isOrganizationAdminsGroup
+        ? input.request.projection
+        : input.policyContext.adminPolicyBundle.currentProjection;
+    const adminUsers = await resolveRequiredUserIdentities({
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+        userIds: projectionUserIds(nextAdminProjection),
+    });
+    const organizationRequest = await buildOrganizationGroupDirectoryPolicyRequest({
+        adminProjection: nextAdminProjection,
+        adminUsers,
+        currentPolicy: input.policyContext.organizationPolicyBundle,
+        descriptor: input.policyContext.organizationDescriptor,
+        groupHeads: replaceOrganizationGroupHead({
+            descriptor: input.policyContext.organizationDescriptor,
+            nextHead: expectedHead,
+        }),
+        signerUserId: input.policyContext.signerUserId,
+        signingFingerprint: input.policyContext.signingFingerprint,
+        signingKeyPair: input.policyContext.signingKeyPair,
+    });
+    input.assertCanCommit?.();
+    const acknowledgedBundle = await commitGroupPolicyMutation({
+        apiClient: input.apiClient,
+        carryDescendantRekeys: containerMutations?.carry,
+        retiredContainerIds: () => containerMutations?.retiredContainerIds ?? [],
+        currentPolicy: input.currentPolicy,
+        execSql: input.execSql,
+        expectedHead,
+        groupId: input.groupId,
+        organizationId: input.organizationId,
+        organizationPolicy: input.policyContext.organizationPolicyBundle,
+        organizationRequest,
+        request: input.request,
+        stillCurrent,
+    });
+    input.assertCanCommit?.();
+    if (containerMutations?.acknowledge) {
+        await containerMutations.acknowledge(acknowledgedBundle.containerMutations, stillCurrent);
+    }
+    input.assertCanCommit?.();
+    await input.afterPolicyCommitBeforeCache?.();
+    input.assertCanCommit?.();
+    await cacheGroupPolicy({
+        acknowledgedMemberEnvelopes: acknowledgedBundle.currentMemberEnvelopes,
+        apiClient: input.apiClient,
+        execSql: input.execSql,
+        expectedCurrentHead: expectedHead,
+        externalAuthority: input.externalAuthority,
+        groupId: input.groupId,
+        localPolicyCheckpoint: {
+            principalId: expectedHead.principalId,
+            principalType: expectedHead.principalType,
+            stateHash: expectedHead.stateHash,
+            version: expectedHead.version,
+        },
+        organizationId: input.organizationId,
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+        stillCurrent,
+    });
+    input.assertCanCommit?.();
+    return acknowledgedBundle;
+}
+export async function addOrganizationGroupUser(input) {
+    const policyContext = await loadGroupPolicyMutationContext(input);
+    await assertGroupMembershipName(policyContext.currentPolicy, input.expectedGroupName, input.readEncryptedName);
+    const identities = await resolveRequiredUserIdentities({
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+        userIds: [
+            ...projectionUserIds(policyContext.currentPolicy.currentProjection),
+            input.targetUserId,
+        ],
+    });
+    const targetUser = identities.find((identity) => identity.userId === input.targetUserId);
+    if (!targetUser) {
+        throw new Error(`User identity could not be loaded for ${input.targetUserId}`);
+    }
+    const request = await buildAddGroupUserPolicyRequest({
+        ...policyContext,
+        currentUserSecretKey: input.currentUserSecretKey,
+        currentUsers: identities.filter((identity) => identity.userId !== input.targetUserId),
+        reportSecurityIncident: input.reportSecurityIncident,
+        targetUser,
+    });
+    return commitAndCacheGroupPolicyMutation({
+        afterPolicyCommitBeforeCache: input.afterPolicyCommitBeforeCache,
+        apiClient: input.apiClient,
+        beforePolicyCommit: (head) => input.beforePolicyCommit(head, {
+            adminGroupId: policyContext.adminGroupId,
+            memberGroupId: policyContext.memberGroupId,
+        }),
+        currentPolicy: policyContext.currentPolicy,
+        execSql: input.execSql,
+        externalAuthority: policyContext.externalAuthority,
+        groupId: input.groupId,
+        prepareContainerMutations: input.prepareContainerMutations,
+        request,
+        organizationId: input.organizationId,
+        policyContext,
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+    });
+}
+export async function removeOrganizationGroupUser(input) {
+    const policyContext = await loadGroupPolicyMutationContext(input);
+    await assertGroupMembershipName(policyContext.currentPolicy, input.expectedGroupName, input.readEncryptedName);
+    const removedKey = input.removedUserId;
+    const projection = policyContext.currentPolicy.currentProjection.filter((member) => member.userId !== removedKey);
+    if (projection.length === policyContext.currentPolicy.currentProjection.length) {
+        throw new Error("User is not a group member");
+    }
+    const remainingUsers = await resolveRequiredUserIdentities({
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+        userIds: projectionUserIds(projection),
+    });
+    const request = await buildRemoveGroupUserPolicyRequest({
+        ...policyContext,
+        remainingUsers,
+        removedUserId: input.removedUserId,
+    });
+    return commitAndCacheGroupPolicyMutation({
+        afterPolicyCommitBeforeCache: input.afterPolicyCommitBeforeCache,
+        apiClient: input.apiClient,
+        beforePolicyCommit: (head) => input.beforePolicyCommit(head, {
+            adminGroupId: policyContext.adminGroupId,
+            memberGroupId: policyContext.memberGroupId,
+        }),
+        currentPolicy: policyContext.currentPolicy,
+        execSql: input.execSql,
+        externalAuthority: policyContext.externalAuthority,
+        groupId: input.groupId,
+        prepareContainerMutations: input.prepareContainerMutations,
+        request,
+        organizationId: input.organizationId,
+        policyContext,
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+    });
+}
+/**
+ * Adds or changes one container in the group's signed complete grant set and
+ * commits every resulting container rematerialization in the same request.
+ */
+export async function setOrganizationGroupContainerGrant(input) {
+    const policyContext = await loadGroupPolicyMutationContext({
+        apiClient: input.apiClient,
+        execSql: input.execSql,
+        groupId: input.groupId,
+        organizationId: input.organizationId,
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+        signerUserId: input.signerUserId,
+        signingFingerprint: input.signingFingerprint,
+        signingKeyPair: input.signingKeyPair,
+    });
+    const request = await buildSetGroupContainerGrantPolicyRequest({
+        ...policyContext,
+        accessLevel: input.accessLevel,
+        containerId: input.containerId,
+    });
+    return commitAndCacheGroupPolicyMutation({
+        apiClient: input.apiClient,
+        assertCanCommit: input.assertCanCommit,
+        currentPolicy: policyContext.currentPolicy,
+        execSql: input.execSql,
+        externalAuthority: policyContext.externalAuthority,
+        groupId: input.groupId,
+        prepareContainerMutations: input.prepareContainerMutations,
+        request,
+        organizationId: input.organizationId,
+        policyContext,
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+    });
+}
+/**
+ * A group losing a container grant rotates its own key in the same request as
+ * that container revoke and the rekeys of all remaining grants. This prevents
+ * a later member from using the group's still-current key to open a retained
+ * wrap from before the revoke.
+ */
+export async function rotateOrganizationGroupForAccessSetShrink(input) {
+    const policyContext = await loadGroupPolicyMutationContext({
+        apiClient: input.apiClient,
+        execSql: input.execSql,
+        groupId: input.groupId,
+        organizationId: input.organizationId,
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+        signerUserId: input.signerUserId,
+        signingFingerprint: input.signingFingerprint,
+        signingKeyPair: input.signingKeyPair,
+    });
+    const currentUsers = await resolveRequiredUserIdentities({
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+        userIds: projectionUserIds(policyContext.currentPolicy.currentProjection),
+    });
+    const request = await buildGroupAccessSetShrinkPolicyRequest({
+        ...policyContext,
+        currentUsers,
+        revokedContainerId: input.revokedContainerId,
+    });
+    return commitAndCacheGroupPolicyMutation({
+        apiClient: input.apiClient,
+        currentPolicy: policyContext.currentPolicy,
+        execSql: input.execSql,
+        externalAuthority: policyContext.externalAuthority,
+        groupId: input.groupId,
+        prepareContainerMutations: input.prepareContainerMutations,
+        request,
+        organizationId: input.organizationId,
+        policyContext,
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+    });
+}
+//# sourceMappingURL=index.js.map

package/workflows/organizations/principalPolicy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAoBlE,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,0BAA0B,EAAE,MAAM,mDAAmD,CAAC;AAC/F,OAAO,EACL,gBAAgB,EAChB,yBAAyB,EACzB,8BAA8B,GAE/B,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EACL,8BAA8B,EAC9B,sCAAsC,EACtC,iCAAiC,EACjC,wCAAwC,GACzC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,4CAA4C,EAC5C,4BAA4B,GAC7B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,iBAAiB,EACjB,6BAA6B,GAC9B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,8BAA8B,EAC9B,oCAAoC,GACrC,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,8BAA8B,EAAE,oCAAoC,EAAE,CAAC;AA8ChF,SAAS,+BAA+B,CACtC,eAAyC;IAEzC,IAAI,CAAC,eAAe;QAAE,OAAO,SAAS,CAAC;IACvC,OAAO,GAAG,EAAE;QACV,eAAe,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,8BAA8B,CAC3C,KAA6C,EAC7C,YAAqC;IAErC,IAAI,CAAC,KAAK,CAAC,yBAAyB;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,yBAAyB,CAAC;QACrD,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,UAAU,EAAE,MAAM,0BAA0B,CAAC;YAC3C,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,YAAY;YACZ,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;KACH,CAAC,CAAC;IACH,IAAI,UAAU,IAAI,QAAQ,EAAE,CAAC;QAC3B,KAAK,CAAC,OAAO,CAAC,kBAAkB,GAAG,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC1D,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,kBAAkB,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;IACjD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,KAAK,UAAU,iCAAiC,CAC9C,KAA6C;IAE7C,MAAM,YAAY,GAAG,+BAA+B,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAC5E,MAAM,YAAY,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClE,KAAK,CAAC,kBAAkB,EAAE,CAAC,YAAY,CAAC,CAAC;IACzC,MAAM,kBAAkB,GAAG,MAAM,8BAA8B,CAC7D,KAAK,EACL,YAAY,CACb,CAAC;IACF,MAAM,mBAAmB,GAAG,KAAK,CAAC,aAAa,CAAC,yBAAyB;QACvE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU;QAC1B,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,iBAAiB,CAAC,iBAAiB,CAAC;IAC5D,MAAM,UAAU,GAAG,MAAM,6BAA6B,CAAC;QACrD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,OAAO,EAAE,iBAAiB,CAAC,mBAAmB,CAAC;KAChD,CAAC,CAAC;IACH,MAAM,mBAAmB,GACvB,MAAM,4CAA4C,CAAC;QACjD,eAAe,EAAE,mBAAmB;QACpC,UAAU;QACV,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,wBAAwB;QAC3D,UAAU,EAAE,KAAK,CAAC,aAAa,CAAC,sBAAsB;QACtD,UAAU,EAAE,4BAA4B,CAAC;YACvC,UAAU,EAAE,KAAK,CAAC,aAAa,CAAC,sBAAsB;YACtD,QAAQ,EAAE,YAAY;SACvB,CAAC;QACF,YAAY,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY;QAC9C,kBAAkB,EAAE,KAAK,CAAC,aAAa,CAAC,kBAAkB;QAC1D,cAAc,EAAE,KAAK,CAAC,aAAa,CAAC,cAAc;KACnD,CAAC,CAAC;IACL,KAAK,CAAC,eAAe,EAAE,EAAE,CAAC;IAC1B,MAAM,kBAAkB,GAAG,MAAM,yBAAyB,CAAC;QACzD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,qBAAqB,EAAE,kBAAkB,EAAE,KAAK;QAChD,mBAAmB,EAAE,GAAG,EAAE,CAAC,kBAAkB,EAAE,mBAAmB,IAAI,EAAE;QACxE,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY;QACZ,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,kBAAkB,EAAE,KAAK,CAAC,aAAa,CAAC,wBAAwB;QAChE,mBAAmB;QACnB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY;KACb,CAAC,CAAC;IACH,KAAK,CAAC,eAAe,EAAE,EAAE,CAAC;IAC1B,IAAI,kBAAkB,EAAE,WAAW,EAAE,CAAC;QACpC,MAAM,kBAAkB,CAAC,WAAW,CAClC,kBAAkB,CAAC,kBAAkB,EACrC,YAAY,CACb,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,eAAe,EAAE,EAAE,CAAC;IAC1B,MAAM,KAAK,CAAC,4BAA4B,EAAE,EAAE,CAAC;IAC7C,KAAK,CAAC,eAAe,EAAE,EAAE,CAAC;IAC1B,MAAM,gBAAgB,CAAC;QACrB,2BAA2B,EAAE,kBAAkB,CAAC,sBAAsB;QACtE,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,mBAAmB,EAAE,YAAY;QACjC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,qBAAqB,EAAE;YACrB,WAAW,EAAE,YAAY,CAAC,WAAW;YACrC,aAAa,EAAE,YAAY,CAAC,aAAa;YACzC,SAAS,EAAE,YAAY,CAAC,SAAS;YACjC,OAAO,EAAE,YAAY,CAAC,OAAO;SAC9B;QACD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,YAAY;KACb,CAAC,CAAC;IACH,KAAK,CAAC,eAAe,EAAE,EAAE,CAAC;IAC1B,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAyB9C;IACC,MAAM,aAAa,GAAG,MAAM,8BAA8B,CAAC,KAAK,CAAC,CAAC;IAClE,MAAM,yBAAyB,CAC7B,aAAa,CAAC,aAAa,EAC3B,KAAK,CAAC,iBAAiB,EACvB,KAAK,CAAC,iBAAiB,CACxB,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,6BAA6B,CAAC;QACrD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,OAAO,EAAE;YACP,GAAG,iBAAiB,CAAC,aAAa,CAAC,aAAa,CAAC,iBAAiB,CAAC;YACnE,KAAK,CAAC,YAAY;SACnB;KACF,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAChC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,YAAY,CACrD,CAAC;IACF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,yCAAyC,KAAK,CAAC,YAAY,EAAE,CAC9D,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC;QACnD,GAAG,aAAa;QAChB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,YAAY,EAAE,UAAU,CAAC,MAAM,CAC7B,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,YAAY,CACrD;QACD,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,UAAU;KACX,CAAC,CAAC;IACH,OAAO,iCAAiC,CAAC;QACvC,4BAA4B,EAAE,KAAK,CAAC,4BAA4B;QAChE,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,kBAAkB,EAAE,CAAC,IAAI,EAAE,EAAE,CAC3B,KAAK,CAAC,kBAAkB,CAAC,IAAI,EAAE;YAC7B,YAAY,EAAE,aAAa,CAAC,YAAY;YACxC,aAAa,EAAE,aAAa,CAAC,aAAa;SAC3C,CAAC;QACJ,aAAa,EAAE,aAAa,CAAC,aAAa;QAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,iBAAiB,EAAE,aAAa,CAAC,iBAAiB;QAClD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;QAC1D,OAAO;QACP,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,aAAa;QACb,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAuBjD;IACC,MAAM,aAAa,GAAG,MAAM,8BAA8B,CAAC,KAAK,CAAC,CAAC;IAClE,MAAM,yBAAyB,CAC7B,aAAa,CAAC,aAAa,EAC3B,KAAK,CAAC,iBAAiB,EACvB,KAAK,CAAC,iBAAiB,CACxB,CAAC;IACF,MAAM,UAAU,GAAG,KAAK,CAAC,aAAa,CAAC;IACvC,MAAM,UAAU,GAAG,aAAa,CAAC,aAAa,CAAC,iBAAiB,CAAC,MAAM,CACrE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,UAAU,CACzC,CAAC;IACF,IACE,UAAU,CAAC,MAAM,KAAK,aAAa,CAAC,aAAa,CAAC,iBAAiB,CAAC,MAAM,EAC1E,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,6BAA6B,CAAC;QACzD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,OAAO,EAAE,iBAAiB,CAAC,UAAU,CAAC;KACvC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,iCAAiC,CAAC;QACtD,GAAG,aAAa;QAChB,cAAc;QACd,aAAa,EAAE,KAAK,CAAC,aAAa;KACnC,CAAC,CAAC;IACH,OAAO,iCAAiC,CAAC;QACvC,4BAA4B,EAAE,KAAK,CAAC,4BAA4B;QAChE,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,kBAAkB,EAAE,CAAC,IAAI,EAAE,EAAE,CAC3B,KAAK,CAAC,kBAAkB,CAAC,IAAI,EAAE;YAC7B,YAAY,EAAE,aAAa,CAAC,YAAY;YACxC,aAAa,EAAE,aAAa,CAAC,aAAa;SAC3C,CAAC;QACJ,aAAa,EAAE,aAAa,CAAC,aAAa;QAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,iBAAiB,EAAE,aAAa,CAAC,iBAAiB;QAClD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;QAC1D,OAAO;QACP,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,aAAa;QACb,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAaxD;IACC,MAAM,aAAa,GAAG,MAAM,8BAA8B,CAAC;QACzD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,wCAAwC,CAAC;QAC7D,GAAG,aAAa;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC,CAAC;IACH,OAAO,iCAAiC,CAAC;QACvC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,aAAa,EAAE,aAAa,CAAC,aAAa;QAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,iBAAiB,EAAE,aAAa,CAAC,iBAAiB;QAClD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;QAC1D,OAAO;QACP,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,aAAa;QACb,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAAC,KAW/D;IACC,MAAM,aAAa,GAAG,MAAM,8BAA8B,CAAC;QACzD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,MAAM,6BAA6B,CAAC;QACvD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,OAAO,EAAE,iBAAiB,CAAC,aAAa,CAAC,aAAa,CAAC,iBAAiB,CAAC;KAC1E,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,sCAAsC,CAAC;QAC3D,GAAG,aAAa;QAChB,YAAY;QACZ,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAC7C,CAAC,CAAC;IACH,OAAO,iCAAiC,CAAC;QACvC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,aAAa,EAAE,aAAa,CAAC,aAAa;QAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,iBAAiB,EAAE,aAAa,CAAC,iBAAiB;QAClD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;QAC1D,OAAO;QACP,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,aAAa;QACb,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;AACL,CAAC","sourcesContent":["export { createOrganizationGroup } from \"../groups/groupCreation\";\n\nimport type {\n  PrincipalPolicyExternalAuthority,\n  ReferencedPrincipalHead,\n  SigningKeyPair,\n  VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type {\n  ContainerMutationRequest,\n  PutPrincipalPolicyRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n  ContainerMutationResponse,\n  PrincipalPolicyBundleResponse,\n  PrincipalPolicyMutationResponse,\n} from \"@tearleads/validators/response\";\nimport type { SecurityIncidentReporter } from \"../../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../../data/trustedUserIdentity\";\nimport { assertGroupMembershipName } from \"../groupNames/groupMembershipName\";\nimport { prepareAuthoredGroupPolicy } from \"../groupPolicy/groupPolicyMutationAcknowledgement\";\nimport {\n  cacheGroupPolicy,\n  commitGroupPolicyMutation,\n  loadGroupPolicyMutationContext,\n  type PrincipalPolicyReadWriteApi,\n} from \"../groupPolicy/groupPolicyMutationContext\";\nimport { groupPolicyMutationHead } from \"../groupPolicy/groupPolicyMutationHead\";\nimport {\n  buildAddGroupUserPolicyRequest,\n  buildGroupAccessSetShrinkPolicyRequest,\n  buildRemoveGroupUserPolicyRequest,\n  buildSetGroupContainerGrantPolicyRequest,\n} from \"../groupPolicy/groupPolicyRequests\";\nimport {\n  buildOrganizationGroupDirectoryPolicyRequest,\n  replaceOrganizationGroupHead,\n} from \"../groups/organizationGroupDirectory\";\nimport {\n  projectionUserIds,\n  resolveRequiredUserIdentities,\n} from \"../trustedOrganizationUsers\";\nimport type { GroupPolicyNameReader } from \"./principalPolicyRequest\";\nimport {\n  buildInitialGroupPolicyRequest,\n  buildInitialMemberGroupPolicyRequest,\n} from \"./principalPolicyRequest\";\n\nexport { buildInitialGroupPolicyRequest, buildInitialMemberGroupPolicyRequest };\n\ninterface PreparedGroupContainerMutations {\n  readonly retiredContainerIds: readonly string[];\n  readonly acknowledge: (\n    responses: readonly ContainerMutationResponse[],\n    stillCurrent?: (() => boolean) | undefined,\n  ) => Promise<void>;\n  /** Sign the descendant rekeys a refused commit named; see `carry` there. */\n  readonly carry?:\n    | ((\n        requiredContainerIds: readonly string[],\n      ) => Promise<readonly ContainerMutationRequest[]>)\n    | undefined;\n  readonly requests: readonly ContainerMutationRequest[];\n}\n\ntype PrepareGroupContainerMutations = (input: {\n  readonly currentPolicy: PrincipalPolicyBundleResponse;\n  readonly nextPolicy: VerifiedPrincipalPolicy;\n}) => Promise<\n  readonly ContainerMutationRequest[] | PreparedGroupContainerMutations\n>;\n\ninterface CommitAndCacheGroupPolicyMutationInput {\n  readonly afterPolicyCommitBeforeCache?: (() => Promise<void>) | undefined;\n  readonly apiClient: PrincipalPolicyReadWriteApi;\n  readonly assertCanCommit?: (() => void) | undefined;\n  readonly beforePolicyCommit?:\n    | ((head: ReferencedPrincipalHead) => void)\n    | undefined;\n  readonly currentPolicy: PrincipalPolicyBundleResponse;\n  readonly execSql: ExecSql;\n  readonly externalAuthority: PrincipalPolicyExternalAuthority | undefined;\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly policyContext: Awaited<\n    ReturnType<typeof loadGroupPolicyMutationContext>\n  >;\n  readonly prepareContainerMutations?:\n    | PrepareGroupContainerMutations\n    | undefined;\n  readonly request: PutPrincipalPolicyRequest;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}\n\nfunction createPolicyMutationCommitGuard(\n  assertCanCommit: (() => void) | undefined,\n): (() => boolean) | undefined {\n  if (!assertCanCommit) return undefined;\n  return () => {\n    assertCanCommit();\n    return true;\n  };\n}\n\n/**\n * Plan the container mutations the policy change rematerializes and place their\n * requests on the policy request. A bare request list has nothing to\n * acknowledge or carry; a prepared batch does both.\n */\nasync function prepareGroupContainerMutations(\n  input: CommitAndCacheGroupPolicyMutationInput,\n  expectedHead: ReferencedPrincipalHead,\n): Promise<Partial<PreparedGroupContainerMutations> | null> {\n  if (!input.prepareContainerMutations) return null;\n  const prepared = await input.prepareContainerMutations({\n    currentPolicy: input.currentPolicy,\n    nextPolicy: await prepareAuthoredGroupPolicy({\n      currentPolicy: input.currentPolicy,\n      expectedHead,\n      request: input.request,\n    }),\n  });\n  if (\"requests\" in prepared) {\n    input.request.containerMutations = [...prepared.requests];\n    return prepared;\n  }\n  input.request.containerMutations = [...prepared];\n  return {};\n}\n\nasync function commitAndCacheGroupPolicyMutation(\n  input: CommitAndCacheGroupPolicyMutationInput,\n): Promise<PrincipalPolicyBundleResponse & PrincipalPolicyMutationResponse> {\n  const stillCurrent = createPolicyMutationCommitGuard(input.assertCanCommit);\n  const expectedHead = await groupPolicyMutationHead(input.request);\n  input.beforePolicyCommit?.(expectedHead);\n  const containerMutations = await prepareGroupContainerMutations(\n    input,\n    expectedHead,\n  );\n  const nextAdminProjection = input.policyContext.isOrganizationAdminsGroup\n    ? input.request.projection\n    : input.policyContext.adminPolicyBundle.currentProjection;\n  const adminUsers = await resolveRequiredUserIdentities({\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    userIds: projectionUserIds(nextAdminProjection),\n  });\n  const organizationRequest =\n    await buildOrganizationGroupDirectoryPolicyRequest({\n      adminProjection: nextAdminProjection,\n      adminUsers,\n      currentPolicy: input.policyContext.organizationPolicyBundle,\n      descriptor: input.policyContext.organizationDescriptor,\n      groupHeads: replaceOrganizationGroupHead({\n        descriptor: input.policyContext.organizationDescriptor,\n        nextHead: expectedHead,\n      }),\n      signerUserId: input.policyContext.signerUserId,\n      signingFingerprint: input.policyContext.signingFingerprint,\n      signingKeyPair: input.policyContext.signingKeyPair,\n    });\n  input.assertCanCommit?.();\n  const acknowledgedBundle = await commitGroupPolicyMutation({\n    apiClient: input.apiClient,\n    carryDescendantRekeys: containerMutations?.carry,\n    retiredContainerIds: () => containerMutations?.retiredContainerIds ?? [],\n    currentPolicy: input.currentPolicy,\n    execSql: input.execSql,\n    expectedHead,\n    groupId: input.groupId,\n    organizationId: input.organizationId,\n    organizationPolicy: input.policyContext.organizationPolicyBundle,\n    organizationRequest,\n    request: input.request,\n    stillCurrent,\n  });\n  input.assertCanCommit?.();\n  if (containerMutations?.acknowledge) {\n    await containerMutations.acknowledge(\n      acknowledgedBundle.containerMutations,\n      stillCurrent,\n    );\n  }\n  input.assertCanCommit?.();\n  await input.afterPolicyCommitBeforeCache?.();\n  input.assertCanCommit?.();\n  await cacheGroupPolicy({\n    acknowledgedMemberEnvelopes: acknowledgedBundle.currentMemberEnvelopes,\n    apiClient: input.apiClient,\n    execSql: input.execSql,\n    expectedCurrentHead: expectedHead,\n    externalAuthority: input.externalAuthority,\n    groupId: input.groupId,\n    localPolicyCheckpoint: {\n      principalId: expectedHead.principalId,\n      principalType: expectedHead.principalType,\n      stateHash: expectedHead.stateHash,\n      version: expectedHead.version,\n    },\n    organizationId: input.organizationId,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    stillCurrent,\n  });\n  input.assertCanCommit?.();\n  return acknowledgedBundle;\n}\n\nexport async function addOrganizationGroupUser(input: {\n  readonly afterPolicyCommitBeforeCache?: (() => Promise<void>) | undefined;\n  readonly apiClient: PrincipalPolicyReadWriteApi;\n  readonly currentUserSecretKey: Uint8Array;\n  readonly execSql: ExecSql;\n  readonly expectedGroupName: string;\n  readonly readEncryptedName?: GroupPolicyNameReader;\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly reportSecurityIncident?: SecurityIncidentReporter | undefined;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n  readonly targetUserId: string;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly beforePolicyCommit: (\n    head: ReferencedPrincipalHead,\n    authority: {\n      readonly adminGroupId: string;\n      readonly memberGroupId: string;\n    },\n  ) => void;\n  readonly prepareContainerMutations?:\n    | PrepareGroupContainerMutations\n    | undefined;\n}): Promise<PrincipalPolicyBundleResponse & PrincipalPolicyMutationResponse> {\n  const policyContext = await loadGroupPolicyMutationContext(input);\n  await assertGroupMembershipName(\n    policyContext.currentPolicy,\n    input.expectedGroupName,\n    input.readEncryptedName,\n  );\n  const identities = await resolveRequiredUserIdentities({\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    userIds: [\n      ...projectionUserIds(policyContext.currentPolicy.currentProjection),\n      input.targetUserId,\n    ],\n  });\n  const targetUser = identities.find(\n    (identity) => identity.userId === input.targetUserId,\n  );\n  if (!targetUser) {\n    throw new Error(\n      `User identity could not be loaded for ${input.targetUserId}`,\n    );\n  }\n  const request = await buildAddGroupUserPolicyRequest({\n    ...policyContext,\n    currentUserSecretKey: input.currentUserSecretKey,\n    currentUsers: identities.filter(\n      (identity) => identity.userId !== input.targetUserId,\n    ),\n    reportSecurityIncident: input.reportSecurityIncident,\n    targetUser,\n  });\n  return commitAndCacheGroupPolicyMutation({\n    afterPolicyCommitBeforeCache: input.afterPolicyCommitBeforeCache,\n    apiClient: input.apiClient,\n    beforePolicyCommit: (head) =>\n      input.beforePolicyCommit(head, {\n        adminGroupId: policyContext.adminGroupId,\n        memberGroupId: policyContext.memberGroupId,\n      }),\n    currentPolicy: policyContext.currentPolicy,\n    execSql: input.execSql,\n    externalAuthority: policyContext.externalAuthority,\n    groupId: input.groupId,\n    prepareContainerMutations: input.prepareContainerMutations,\n    request,\n    organizationId: input.organizationId,\n    policyContext,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n}\n\nexport async function removeOrganizationGroupUser(input: {\n  readonly afterPolicyCommitBeforeCache?: (() => Promise<void>) | undefined;\n  readonly apiClient: PrincipalPolicyReadWriteApi;\n  readonly execSql: ExecSql;\n  readonly expectedGroupName: string;\n  readonly readEncryptedName?: GroupPolicyNameReader;\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly removedUserId: string;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n  readonly beforePolicyCommit: (\n    head: ReferencedPrincipalHead,\n    authority: {\n      readonly adminGroupId: string;\n      readonly memberGroupId: string;\n    },\n  ) => void;\n  readonly prepareContainerMutations?:\n    | PrepareGroupContainerMutations\n    | undefined;\n}): Promise<PrincipalPolicyBundleResponse & PrincipalPolicyMutationResponse> {\n  const policyContext = await loadGroupPolicyMutationContext(input);\n  await assertGroupMembershipName(\n    policyContext.currentPolicy,\n    input.expectedGroupName,\n    input.readEncryptedName,\n  );\n  const removedKey = input.removedUserId;\n  const projection = policyContext.currentPolicy.currentProjection.filter(\n    (member) => member.userId !== removedKey,\n  );\n  if (\n    projection.length === policyContext.currentPolicy.currentProjection.length\n  ) {\n    throw new Error(\"User is not a group member\");\n  }\n  const remainingUsers = await resolveRequiredUserIdentities({\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    userIds: projectionUserIds(projection),\n  });\n  const request = await buildRemoveGroupUserPolicyRequest({\n    ...policyContext,\n    remainingUsers,\n    removedUserId: input.removedUserId,\n  });\n  return commitAndCacheGroupPolicyMutation({\n    afterPolicyCommitBeforeCache: input.afterPolicyCommitBeforeCache,\n    apiClient: input.apiClient,\n    beforePolicyCommit: (head) =>\n      input.beforePolicyCommit(head, {\n        adminGroupId: policyContext.adminGroupId,\n        memberGroupId: policyContext.memberGroupId,\n      }),\n    currentPolicy: policyContext.currentPolicy,\n    execSql: input.execSql,\n    externalAuthority: policyContext.externalAuthority,\n    groupId: input.groupId,\n    prepareContainerMutations: input.prepareContainerMutations,\n    request,\n    organizationId: input.organizationId,\n    policyContext,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n}\n\n/**\n * Adds or changes one container in the group's signed complete grant set and\n * commits every resulting container rematerialization in the same request.\n */\nexport async function setOrganizationGroupContainerGrant(input: {\n  readonly accessLevel: \"admin\" | \"read\" | \"write\";\n  readonly apiClient: PrincipalPolicyReadWriteApi;\n  readonly assertCanCommit?: (() => void) | undefined;\n  readonly containerId: string;\n  readonly execSql: ExecSql;\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly prepareContainerMutations: PrepareGroupContainerMutations;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n}): Promise<PrincipalPolicyBundleResponse & PrincipalPolicyMutationResponse> {\n  const policyContext = await loadGroupPolicyMutationContext({\n    apiClient: input.apiClient,\n    execSql: input.execSql,\n    groupId: input.groupId,\n    organizationId: input.organizationId,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    signerUserId: input.signerUserId,\n    signingFingerprint: input.signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  });\n  const request = await buildSetGroupContainerGrantPolicyRequest({\n    ...policyContext,\n    accessLevel: input.accessLevel,\n    containerId: input.containerId,\n  });\n  return commitAndCacheGroupPolicyMutation({\n    apiClient: input.apiClient,\n    assertCanCommit: input.assertCanCommit,\n    currentPolicy: policyContext.currentPolicy,\n    execSql: input.execSql,\n    externalAuthority: policyContext.externalAuthority,\n    groupId: input.groupId,\n    prepareContainerMutations: input.prepareContainerMutations,\n    request,\n    organizationId: input.organizationId,\n    policyContext,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n}\n\n/**\n * A group losing a container grant rotates its own key in the same request as\n * that container revoke and the rekeys of all remaining grants. This prevents\n * a later member from using the group's still-current key to open a retained\n * wrap from before the revoke.\n */\nexport async function rotateOrganizationGroupForAccessSetShrink(input: {\n  readonly apiClient: PrincipalPolicyReadWriteApi;\n  readonly execSql: ExecSql;\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly revokedContainerId: string;\n  readonly prepareContainerMutations: PrepareGroupContainerMutations;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n}): Promise<PrincipalPolicyBundleResponse & PrincipalPolicyMutationResponse> {\n  const policyContext = await loadGroupPolicyMutationContext({\n    apiClient: input.apiClient,\n    execSql: input.execSql,\n    groupId: input.groupId,\n    organizationId: input.organizationId,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    signerUserId: input.signerUserId,\n    signingFingerprint: input.signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  });\n  const currentUsers = await resolveRequiredUserIdentities({\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    userIds: projectionUserIds(policyContext.currentPolicy.currentProjection),\n  });\n  const request = await buildGroupAccessSetShrinkPolicyRequest({\n    ...policyContext,\n    currentUsers,\n    revokedContainerId: input.revokedContainerId,\n  });\n  return commitAndCacheGroupPolicyMutation({\n    apiClient: input.apiClient,\n    currentPolicy: policyContext.currentPolicy,\n    execSql: input.execSql,\n    externalAuthority: policyContext.externalAuthority,\n    groupId: input.groupId,\n    prepareContainerMutations: input.prepareContainerMutations,\n    request,\n    organizationId: input.organizationId,\n    policyContext,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n}\n"]}

package/workflows/organizations/principalPolicy/principalPolicyApi.d.ts

@@ -0,0 +1,33 @@
+import type { RequestFailureKind } from "../../../internal/api-client/index.js";
+import type { CommitOrganizationGroupPolicyRequest, CreateOrganizationGroupWithPolicyRequest } from "../../../internal/validators/request/index.js";
+import type { CommitOrganizationGroupPolicyResponse, CreateOrganizationGroupResponse } from "../../../internal/validators/response/index.js";
+import type { CurrentPrincipalPolicyReader } from "../../principals/currentPrincipalPolicyReader.js";
+export interface PrincipalPolicyReadApi extends CurrentPrincipalPolicyReader {
+    /** Resolve authored work before reading the state for a new mutation. */
+    readonly recoverPendingPrincipalMutation?: ((organizationId: string) => Promise<void>) | undefined;
+}
+export interface PrincipalPolicyReadWriteApi extends PrincipalPolicyReadApi {
+    commitOrganizationGroupPolicy: (organizationId: string, groupId: string, input: CommitOrganizationGroupPolicyRequest) => Promise<CommitOrganizationGroupPolicyResponse | null>;
+    /**
+     * Optional status-bearing variant. A rematerialized rotation the server
+     * refuses for stranding a granted path names the descendant rekeys the batch
+     * must carry; without this the refusal is a plain failure.
+     */
+    commitOrganizationGroupPolicyResult?: (organizationId: string, groupId: string, input: CommitOrganizationGroupPolicyRequest, options?: {
+        readonly reportErrors?: boolean | undefined;
+    }) => Promise<{
+        readonly ok: true;
+        readonly data: CommitOrganizationGroupPolicyResponse;
+    } | {
+        readonly ok: false;
+        readonly kind?: RequestFailureKind | undefined;
+        readonly message?: string | undefined;
+        readonly code?: string | undefined;
+        readonly report?: (() => void) | undefined;
+        readonly requiredContainerIds?: readonly string[] | undefined;
+        readonly status: number | null;
+    }>;
+}
+export interface OrganizationPrincipalPolicyApi extends PrincipalPolicyReadApi {
+    createOrganizationGroup: (organizationId: string, input: CreateOrganizationGroupWithPolicyRequest) => Promise<CreateOrganizationGroupResponse | null>;
+}

package/workflows/organizations/principalPolicy/principalPolicyApi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalPolicyApi.js","sourceRoot":"","sources":["principalPolicyApi.ts"],"names":[],"mappings":"","sourcesContent":["import type { RequestFailureKind } from \"@tearleads/api-client\";\nimport type {\n  CommitOrganizationGroupPolicyRequest,\n  CreateOrganizationGroupWithPolicyRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n  CommitOrganizationGroupPolicyResponse,\n  CreateOrganizationGroupResponse,\n} from \"@tearleads/validators/response\";\nimport type { CurrentPrincipalPolicyReader } from \"../../principals/currentPrincipalPolicyReader\";\n\nexport interface PrincipalPolicyReadApi extends CurrentPrincipalPolicyReader {\n  /** Resolve authored work before reading the state for a new mutation. */\n  readonly recoverPendingPrincipalMutation?:\n    | ((organizationId: string) => Promise<void>)\n    | undefined;\n}\n\nexport interface PrincipalPolicyReadWriteApi extends PrincipalPolicyReadApi {\n  commitOrganizationGroupPolicy: (\n    organizationId: string,\n    groupId: string,\n    input: CommitOrganizationGroupPolicyRequest,\n  ) => Promise<CommitOrganizationGroupPolicyResponse | null>;\n  /**\n   * Optional status-bearing variant. A rematerialized rotation the server\n   * refuses for stranding a granted path names the descendant rekeys the batch\n   * must carry; without this the refusal is a plain failure.\n   */\n  commitOrganizationGroupPolicyResult?: (\n    organizationId: string,\n    groupId: string,\n    input: CommitOrganizationGroupPolicyRequest,\n    options?: { readonly reportErrors?: boolean | undefined },\n  ) => Promise<\n    | {\n        readonly ok: true;\n        readonly data: CommitOrganizationGroupPolicyResponse;\n      }\n    | {\n        readonly ok: false;\n        readonly kind?: RequestFailureKind | undefined;\n        readonly message?: string | undefined;\n        readonly code?: string | undefined;\n        readonly report?: (() => void) | undefined;\n        readonly requiredContainerIds?: readonly string[] | undefined;\n        readonly status: number | null;\n      }\n  >;\n}\n\nexport interface OrganizationPrincipalPolicyApi extends PrincipalPolicyReadApi {\n  createOrganizationGroup: (\n    organizationId: string,\n    input: CreateOrganizationGroupWithPolicyRequest,\n  ) => Promise<CreateOrganizationGroupResponse | null>;\n}\n"]}

package/workflows/organizations/principalPolicy/principalPolicyReceiptArtifacts.js

@@ -0,0 +1,74 @@
+import { compareCanonicalStrings, normalizePrincipalContainerGrants, normalizePrincipalProjectionMembers, } from "../../../internal/crypto/index.js";
+import { canonicalKeyingJsonString } from "../../../data/keying/canonicalJson.js";
+function sortedCanonicalValues(values, label) {
+    return [...values].sort((left, right) => compareCanonicalStrings(canonicalKeyingJsonString(left, label), canonicalKeyingJsonString(right, label)));
+}
+export function assertGroupPolicyEnvelopesMatchAcknowledgement(expected, observed) {
+    const normalized = (value) => ({
+        ...value,
+        envelopes: sortedCanonicalValues(value.envelopes, "principal member envelope"),
+    });
+    if (canonicalKeyingJsonString(normalized(expected), "acknowledged group member envelopes") !==
+        canonicalKeyingJsonString(normalized(observed), "observed group member envelopes")) {
+        throw new Error("Group member envelopes changed after acknowledgement");
+    }
+}
+function assertContainerMutationAcknowledgements(input) {
+    if (!input.responses || input.responses.length !== input.requests.length) {
+        throw new Error("Group policy container acknowledgement batch is incomplete");
+    }
+    for (const [index, request] of input.requests.entries()) {
+        const response = input.responses[index];
+        if (!response) {
+            throw new Error("Group policy container acknowledgement batch is incomplete");
+        }
+        const expected = {
+            body: request.body,
+            event: request.event,
+            keyEpoch: request.keyEpoch,
+            manifest: request.manifest,
+            wraps: sortedCanonicalValues(request.wraps, "authored container wrap"),
+        };
+        const observed = {
+            body: response.accessManifest.event.body,
+            event: response.accessManifest.event.event,
+            keyEpoch: response.containerKek.keyEpoch,
+            manifest: response.accessManifest.manifest,
+            wraps: sortedCanonicalValues(response.containerKek.wraps, "stored container wrap"),
+        };
+        if (canonicalKeyingJsonString(observed, "stored group policy container mutation") !==
+            canonicalKeyingJsonString(expected, "authored group policy container mutation")) {
+            throw new Error("Group policy container acknowledgement mismatch");
+        }
+    }
+}
+/** Compare receipt artifacts without manufacturing predecessor history or pins. */
+export function assertPrincipalPolicyReceiptArtifacts(input) {
+    assertContainerMutationAcknowledgements({
+        requests: input.request.containerMutations ?? [],
+        responses: input.response.containerMutations,
+    });
+    const { createdAt: _payloadCreatedAt, ...observedPayload } = input.response.currentPayload;
+    const expectedPayload = {
+        principalType: input.request.state.principalType,
+        principalId: input.request.state.principalId,
+        stateHash: input.expectedHead.stateHash,
+        ...input.request.encryptedPayload,
+    };
+    if (canonicalKeyingJsonString(observedPayload, "stored group policy payload") !==
+        canonicalKeyingJsonString(expectedPayload, "authored group policy payload") ||
+        canonicalKeyingJsonString(normalizePrincipalProjectionMembers(input.response.currentProjection), "stored group policy projection") !==
+            canonicalKeyingJsonString(normalizePrincipalProjectionMembers(input.request.projection), "authored group policy projection") ||
+        canonicalKeyingJsonString(normalizePrincipalContainerGrants(input.response.currentGrants), "stored group policy grants") !==
+            canonicalKeyingJsonString(normalizePrincipalContainerGrants(input.request.grants), "authored group policy grants")) {
+        throw new Error("Group policy bundle acknowledgement mismatch");
+    }
+    assertGroupPolicyEnvelopesMatchAcknowledgement({
+        principalType: input.request.state.principalType,
+        principalId: input.request.state.principalId,
+        stateHash: input.expectedHead.stateHash,
+        epoch: input.request.state.keyEpoch,
+        envelopes: input.request.memberEnvelopes,
+    }, input.response.currentMemberEnvelopes);
+}
+//# sourceMappingURL=principalPolicyReceiptArtifacts.js.map

package/workflows/organizations/principalPolicy/principalPolicyReceiptArtifacts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalPolicyReceiptArtifacts.js","sourceRoot":"","sources":["principalPolicyReceiptArtifacts.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,iCAAiC,EACjC,mCAAmC,GAEpC,MAAM,mBAAmB,CAAC;AAO3B,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAE/E,SAAS,qBAAqB,CAAI,MAAoB,EAAE,KAAa;IACnE,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACtC,uBAAuB,CACrB,yBAAyB,CAAC,IAAI,EAAE,KAAK,CAAC,EACtC,yBAAyB,CAAC,KAAK,EAAE,KAAK,CAAC,CACxC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8CAA8C,CAC5D,QAAiD,EACjD,QAAiD;IAEjD,MAAM,UAAU,GAAG,CAAC,KAA8C,EAAE,EAAE,CAAC,CAAC;QACtE,GAAG,KAAK;QACR,SAAS,EAAE,qBAAqB,CAC9B,KAAK,CAAC,SAAS,EACf,2BAA2B,CAC5B;KACF,CAAC,CAAC;IACH,IACE,yBAAyB,CACvB,UAAU,CAAC,QAAQ,CAAC,EACpB,qCAAqC,CACtC;QACD,yBAAyB,CACvB,UAAU,CAAC,QAAQ,CAAC,EACpB,iCAAiC,CAClC,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,SAAS,uCAAuC,CAAC,KAKhD;IACC,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QACxD,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG;YACf,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,KAAK,EAAE,qBAAqB,CAAC,OAAO,CAAC,KAAK,EAAE,yBAAyB,CAAC;SACvE,CAAC;QACF,MAAM,QAAQ,GAAG;YACf,IAAI,EAAE,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI;YACxC,KAAK,EAAE,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK;YAC1C,QAAQ,EAAE,QAAQ,CAAC,YAAY,CAAC,QAAQ;YACxC,QAAQ,EAAE,QAAQ,CAAC,cAAc,CAAC,QAAQ;YAC1C,KAAK,EAAE,qBAAqB,CAC1B,QAAQ,CAAC,YAAY,CAAC,KAAK,EAC3B,uBAAuB,CACxB;SACF,CAAC;QACF,IACE,yBAAyB,CACvB,QAAQ,EACR,wCAAwC,CACzC;YACD,yBAAyB,CACvB,QAAQ,EACR,0CAA0C,CAC3C,EACD,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,qCAAqC,CAAC,KAIrD;IACC,uCAAuC,CAAC;QACtC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE;QAChD,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,kBAAkB;KAC7C,CAAC,CAAC;IACH,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE,GAAG,eAAe,EAAE,GACxD,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC;IAChC,MAAM,eAAe,GAAG;QACtB,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa;QAChD,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW;QAC5C,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,SAAS;QACvC,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB;KAClC,CAAC;IAEF,IACE,yBAAyB,CACvB,eAAe,EACf,6BAA6B,CAC9B;QACC,yBAAyB,CACvB,eAAe,EACf,+BAA+B,CAChC;QACH,yBAAyB,CACvB,mCAAmC,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EACrE,gCAAgC,CACjC;YACC,yBAAyB,CACvB,mCAAmC,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAC7D,kCAAkC,CACnC;QACH,yBAAyB,CACvB,iCAAiC,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,EAC/D,4BAA4B,CAC7B;YACC,yBAAyB,CACvB,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EACvD,8BAA8B,CAC/B,EACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,8CAA8C,CAC5C;QACE,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa;QAChD,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW;QAC5C,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,SAAS;QACvC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ;QACnC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,eAAe;KACzC,EACD,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CACtC,CAAC;AACJ,CAAC","sourcesContent":["import {\n  compareCanonicalStrings,\n  normalizePrincipalContainerGrants,\n  normalizePrincipalProjectionMembers,\n  type ReferencedPrincipalHead,\n} from \"@tearleads/crypto\";\nimport type { PutPrincipalPolicyRequest } from \"@tearleads/validators/request\";\nimport type {\n  ContainerMutationResponse,\n  CurrentPrincipalMemberEnvelopesResponse,\n  PrincipalPolicyMutationResponse,\n} from \"@tearleads/validators/response\";\nimport { canonicalKeyingJsonString } from \"../../../data/keying/canonicalJson\";\n\nfunction sortedCanonicalValues<T>(values: readonly T[], label: string): T[] {\n  return [...values].sort((left, right) =>\n    compareCanonicalStrings(\n      canonicalKeyingJsonString(left, label),\n      canonicalKeyingJsonString(right, label),\n    ),\n  );\n}\n\nexport function assertGroupPolicyEnvelopesMatchAcknowledgement(\n  expected: CurrentPrincipalMemberEnvelopesResponse,\n  observed: CurrentPrincipalMemberEnvelopesResponse,\n): void {\n  const normalized = (value: CurrentPrincipalMemberEnvelopesResponse) => ({\n    ...value,\n    envelopes: sortedCanonicalValues(\n      value.envelopes,\n      \"principal member envelope\",\n    ),\n  });\n  if (\n    canonicalKeyingJsonString(\n      normalized(expected),\n      \"acknowledged group member envelopes\",\n    ) !==\n    canonicalKeyingJsonString(\n      normalized(observed),\n      \"observed group member envelopes\",\n    )\n  ) {\n    throw new Error(\"Group member envelopes changed after acknowledgement\");\n  }\n}\n\nfunction assertContainerMutationAcknowledgements(input: {\n  readonly requests: readonly NonNullable<\n    PutPrincipalPolicyRequest[\"containerMutations\"]\n  >[number][];\n  readonly responses: readonly ContainerMutationResponse[] | undefined;\n}): void {\n  if (!input.responses || input.responses.length !== input.requests.length) {\n    throw new Error(\n      \"Group policy container acknowledgement batch is incomplete\",\n    );\n  }\n  for (const [index, request] of input.requests.entries()) {\n    const response = input.responses[index];\n    if (!response) {\n      throw new Error(\n        \"Group policy container acknowledgement batch is incomplete\",\n      );\n    }\n    const expected = {\n      body: request.body,\n      event: request.event,\n      keyEpoch: request.keyEpoch,\n      manifest: request.manifest,\n      wraps: sortedCanonicalValues(request.wraps, \"authored container wrap\"),\n    };\n    const observed = {\n      body: response.accessManifest.event.body,\n      event: response.accessManifest.event.event,\n      keyEpoch: response.containerKek.keyEpoch,\n      manifest: response.accessManifest.manifest,\n      wraps: sortedCanonicalValues(\n        response.containerKek.wraps,\n        \"stored container wrap\",\n      ),\n    };\n    if (\n      canonicalKeyingJsonString(\n        observed,\n        \"stored group policy container mutation\",\n      ) !==\n      canonicalKeyingJsonString(\n        expected,\n        \"authored group policy container mutation\",\n      )\n    ) {\n      throw new Error(\"Group policy container acknowledgement mismatch\");\n    }\n  }\n}\n\n/** Compare receipt artifacts without manufacturing predecessor history or pins. */\nexport function assertPrincipalPolicyReceiptArtifacts(input: {\n  readonly expectedHead: ReferencedPrincipalHead;\n  readonly request: PutPrincipalPolicyRequest;\n  readonly response: PrincipalPolicyMutationResponse;\n}): void {\n  assertContainerMutationAcknowledgements({\n    requests: input.request.containerMutations ?? [],\n    responses: input.response.containerMutations,\n  });\n  const { createdAt: _payloadCreatedAt, ...observedPayload } =\n    input.response.currentPayload;\n  const expectedPayload = {\n    principalType: input.request.state.principalType,\n    principalId: input.request.state.principalId,\n    stateHash: input.expectedHead.stateHash,\n    ...input.request.encryptedPayload,\n  };\n\n  if (\n    canonicalKeyingJsonString(\n      observedPayload,\n      \"stored group policy payload\",\n    ) !==\n      canonicalKeyingJsonString(\n        expectedPayload,\n        \"authored group policy payload\",\n      ) ||\n    canonicalKeyingJsonString(\n      normalizePrincipalProjectionMembers(input.response.currentProjection),\n      \"stored group policy projection\",\n    ) !==\n      canonicalKeyingJsonString(\n        normalizePrincipalProjectionMembers(input.request.projection),\n        \"authored group policy projection\",\n      ) ||\n    canonicalKeyingJsonString(\n      normalizePrincipalContainerGrants(input.response.currentGrants),\n      \"stored group policy grants\",\n    ) !==\n      canonicalKeyingJsonString(\n        normalizePrincipalContainerGrants(input.request.grants),\n        \"authored group policy grants\",\n      )\n  ) {\n    throw new Error(\"Group policy bundle acknowledgement mismatch\");\n  }\n\n  assertGroupPolicyEnvelopesMatchAcknowledgement(\n    {\n      principalType: input.request.state.principalType,\n      principalId: input.request.state.principalId,\n      stateHash: input.expectedHead.stateHash,\n      epoch: input.request.state.keyEpoch,\n      envelopes: input.request.memberEnvelopes,\n    },\n    input.response.currentMemberEnvelopes,\n  );\n}\n"]}

package/workflows/organizations/principalPolicy/principalPolicyRecipients.js

@@ -0,0 +1,43 @@
+import { wrapDekForRecipients } from "../../../internal/crypto/index.js";
+import { base64ToBytes, bytesToBase64 } from "../../../internal/encoding/index.js";
+function toPrincipalMemberEnvelopeRequest(input) {
+    return {
+        userId: input.userId,
+        memberKeyFingerprint: input.envelope.keyFingerprint,
+        kemCipherText: bytesToBase64(input.envelope.kemCipherText),
+        wrappedKey: bytesToBase64(input.envelope.wrappedKey),
+    };
+}
+export function toRecipientEntries(envelopes) {
+    return envelopes.map((envelope) => ({
+        keyFingerprint: envelope.memberKeyFingerprint,
+        kemCipherText: base64ToBytes(envelope.kemCipherText),
+        wrappedKey: base64ToBytes(envelope.wrappedKey),
+    }));
+}
+/** Every projected member is a user, so there is no group recipient branch. */
+function toRekeyRecipientEntries(input) {
+    const usersById = new Map(input.users.map((user) => [user.userId, user]));
+    return input.projection.map((member) => {
+        const user = usersById.get(member.userId);
+        if (!user) {
+            throw new Error(`Missing recipient key for user ${member.userId}`);
+        }
+        return {
+            encapsulationPublicKey: user.encapsulationPublicKey,
+            userId: user.userId,
+        };
+    });
+}
+export async function rewrapProjectionMemberEnvelopes(input) {
+    const recipients = toRekeyRecipientEntries(input);
+    if (recipients.length === 0) {
+        return [];
+    }
+    const wrappedRecipients = await wrapDekForRecipients(input.secretKey, recipients.map((recipient) => recipient.encapsulationPublicKey));
+    return wrappedRecipients.map((envelope, index) => toPrincipalMemberEnvelopeRequest({
+        envelope,
+        userId: recipients[index]?.userId ?? "",
+    }));
+}
+//# sourceMappingURL=principalPolicyRecipients.js.map

package/workflows/organizations/principalPolicy/principalPolicyRecipients.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalPolicyRecipients.js","sourceRoot":"","sources":["principalPolicyRecipients.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAanE,SAAS,gCAAgC,CAAC,KAOzC;IACC,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,oBAAoB,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc;QACnD,aAAa,EAAE,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC1D,UAAU,EAAE,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;KACrD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,SAAyD;IAEzD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAClC,cAAc,EAAE,QAAQ,CAAC,oBAAoB;QAC7C,aAAa,EAAE,aAAa,CAAC,QAAQ,CAAC,aAAa,CAAC;QACpD,UAAU,EAAE,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC;KAC/C,CAAC,CAAC,CAAC;AACN,CAAC;AAED,+EAA+E;AAC/E,SAAS,uBAAuB,CAAC,KAGhC;IACC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAE1E,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,kCAAkC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,OAAO;YACL,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;YACnD,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAIrD;IACC,MAAM,UAAU,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAClD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,iBAAiB,GAAG,MAAM,oBAAoB,CAClD,KAAK,CAAC,SAAS,EACf,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAChE,CAAC;IAEF,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAC/C,gCAAgC,CAAC;QAC/B,QAAQ;QACR,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,EAAE;KACxC,CAAC,CACH,CAAC;AACJ,CAAC","sourcesContent":["import { wrapDekForRecipients } from \"@tearleads/crypto\";\nimport { base64ToBytes, bytesToBase64 } from \"@tearleads/encoding\";\nimport type {\n  PrincipalMemberEnvelopeRequest,\n  PrincipalProjectionMemberRequest,\n} from \"@tearleads/validators/request\";\nimport type { PrincipalMemberEnvelopeResponse } from \"@tearleads/validators/response\";\nimport type { TrustedUserIdentity } from \"../../../data/trustedUserIdentity\";\n\ntype PrincipalRekeyRecipient = {\n  readonly encapsulationPublicKey: Uint8Array;\n  readonly userId: string;\n};\n\nfunction toPrincipalMemberEnvelopeRequest(input: {\n  readonly envelope: {\n    readonly keyFingerprint: string;\n    readonly kemCipherText: Uint8Array;\n    readonly wrappedKey: Uint8Array;\n  };\n  readonly userId: string;\n}): PrincipalMemberEnvelopeRequest {\n  return {\n    userId: input.userId,\n    memberKeyFingerprint: input.envelope.keyFingerprint,\n    kemCipherText: bytesToBase64(input.envelope.kemCipherText),\n    wrappedKey: bytesToBase64(input.envelope.wrappedKey),\n  };\n}\n\nexport function toRecipientEntries(\n  envelopes: ReadonlyArray<PrincipalMemberEnvelopeResponse>,\n) {\n  return envelopes.map((envelope) => ({\n    keyFingerprint: envelope.memberKeyFingerprint,\n    kemCipherText: base64ToBytes(envelope.kemCipherText),\n    wrappedKey: base64ToBytes(envelope.wrappedKey),\n  }));\n}\n\n/** Every projected member is a user, so there is no group recipient branch. */\nfunction toRekeyRecipientEntries(input: {\n  readonly projection: ReadonlyArray<PrincipalProjectionMemberRequest>;\n  readonly users: ReadonlyArray<TrustedUserIdentity>;\n}): PrincipalRekeyRecipient[] {\n  const usersById = new Map(input.users.map((user) => [user.userId, user]));\n\n  return input.projection.map((member) => {\n    const user = usersById.get(member.userId);\n    if (!user) {\n      throw new Error(`Missing recipient key for user ${member.userId}`);\n    }\n\n    return {\n      encapsulationPublicKey: user.encapsulationPublicKey,\n      userId: user.userId,\n    };\n  });\n}\n\nexport async function rewrapProjectionMemberEnvelopes(input: {\n  readonly projection: ReadonlyArray<PrincipalProjectionMemberRequest>;\n  readonly secretKey: Uint8Array;\n  readonly users: ReadonlyArray<TrustedUserIdentity>;\n}): Promise<PrincipalMemberEnvelopeRequest[]> {\n  const recipients = toRekeyRecipientEntries(input);\n  if (recipients.length === 0) {\n    return [];\n  }\n  const wrappedRecipients = await wrapDekForRecipients(\n    input.secretKey,\n    recipients.map((recipient) => recipient.encapsulationPublicKey),\n  );\n\n  return wrappedRecipients.map((envelope, index) =>\n    toPrincipalMemberEnvelopeRequest({\n      envelope,\n      userId: recipients[index]?.userId ?? \"\",\n    }),\n  );\n}\n"]}

package/workflows/organizations/principalPolicy/principalPolicyRequest.d.ts

@@ -0,0 +1,68 @@
+import { type EncapsulationKeyPair, type GroupMetadataKey, type PrincipalContainerGrant, type PrincipalPolicyExternalAuthority, type SigningKeyPair } from "../../../internal/crypto/index.js";
+import type { CreateOrganizationGroupRequest, PrincipalMemberEnvelopeRequest, PrincipalProjectionMemberRequest, PutPrincipalPolicyRequest } from "../../../internal/validators/request/index.js";
+import type { PrincipalPolicyBundleResponse } from "../../../internal/validators/response/index.js";
+interface BuildInitialGroupPolicyInput {
+    readonly creatorEncapsulationKeyPair: EncapsulationKeyPair;
+    readonly externalAuthority?: PrincipalPolicyExternalAuthority["currentHead"] | null;
+    readonly groupId: string;
+    readonly grants?: readonly PrincipalContainerGrant[] | undefined;
+    readonly includeSignerAsAdmin?: boolean;
+    readonly name: string;
+    readonly metadataKey?: GroupMetadataKey;
+    readonly builtinRole?: "admins" | "members";
+    readonly signerUserId: string;
+    readonly signingFingerprint: string;
+    readonly signingKeyPair: SigningKeyPair;
+}
+export declare function userProjectionMember(userId: string, role: "member" | "admin"): PrincipalProjectionMemberRequest;
+/**
+ * The comparison key for a group display name: width- and compatibility-
+ * normalized, stripped of control, format, and default-ignorable characters,
+ * whitespace-collapsed, and case-folded. Two names that a user cannot tell
+ * apart in a picker must compare equal, or a look-alike name would slip past
+ * the share-time binding. Cross-script homoglyphs (Latin "A" against Greek
+ * "Α") are not folded: that needs the UTS #39 confusables table, and both
+ * names would still have to be signed groups the organization's own admins
+ * created.
+ */
+export declare function canonicalGroupNameKey(name: string): string;
+type GroupPolicyNameInput = Pick<PrincipalPolicyBundleResponse, "currentState" | "currentPayload">;
+export type GroupPolicyNameReader = (bundle: GroupPolicyNameInput) => Promise<string>;
+/** Read only after the policy and its organization-directory binding verify. */
+export declare function readGroupPolicyPayloadName(bundle: GroupPolicyNameInput, readEncryptedName?: GroupPolicyNameReader): Promise<string>;
+/** One binding predicate for every operation selected by a read-model label. */
+export declare function groupPolicyNameMismatch(bundle: GroupPolicyNameInput, expectedGroupName: string, readEncryptedName?: GroupPolicyNameReader): Promise<"forbidden_characters" | "name_mismatch" | null>;
+export declare function signedGroupPolicyRequest(input: {
+    readonly currentPolicy?: Pick<PrincipalPolicyBundleResponse, "currentState">;
+    readonly encapsulationPublicKey: string;
+    readonly externalAuthority: PrincipalPolicyExternalAuthority["currentHead"] | null;
+    readonly keyEpoch: number;
+    readonly keyFingerprint: string;
+    readonly grants: ReadonlyArray<PrincipalContainerGrant>;
+    readonly memberEnvelopes: ReadonlyArray<PrincipalMemberEnvelopeRequest>;
+    readonly payloadCiphertext: string;
+    readonly principalId: string;
+    readonly projection: ReadonlyArray<PrincipalProjectionMemberRequest>;
+    readonly signedAt: string;
+    readonly signerUserId: string;
+    readonly signingFingerprint: string;
+    readonly signingKeyPair: SigningKeyPair;
+}): Promise<PutPrincipalPolicyRequest>;
+export declare function buildInitialGroupPolicyRequest(input: BuildInitialGroupPolicyInput): Promise<CreateOrganizationGroupRequest>;
+/**
+ * Members at bootstrap holds the registering user alone.
+ *
+ * It used to also contain the Admins group as a nested member, so that admins
+ * were implicitly members. Principals contain only users now, so an admin is an
+ * ordinary Members entry — and bootstrap has exactly one user, who is that
+ * admin.
+ */
+export declare function buildInitialMemberGroupPolicyRequest(input: {
+    readonly creatorEncapsulationKeyPair: EncapsulationKeyPair;
+    readonly groupId: string;
+    readonly grants?: readonly PrincipalContainerGrant[] | undefined;
+    readonly signerUserId: string;
+    readonly signingFingerprint: string;
+    readonly signingKeyPair: SigningKeyPair;
+}): Promise<CreateOrganizationGroupRequest>;
+export {};