@tearleads/client-sdk 0.1.61 → 0.1.63

package/workflows/principals/policyCache/index.d.ts

@@ -0,0 +1,20 @@
+import type { PrincipalPolicyBundleResponse, ReferencedPrincipalStateResponse } from "../../../internal/validators/response/index.js";
+import type { SecurityIncidentReporter } from "../../../data/shared/securityIncidents.js";
+import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
+import type { TrustedUserIdentityResolver } from "../../../data/trustedUserIdentity/index.js";
+import type { CurrentPrincipalPolicyReader } from "../currentPrincipalPolicyReader.js";
+export interface CacheReferencedPrincipalPoliciesOptions {
+    currentPolicyReader: CurrentPrincipalPolicyReader;
+    execSql: ExecSql;
+    log?: (message: string) => void;
+    organizationId: string;
+    reportSecurityIncident: SecurityIncidentReporter;
+    references: ReadonlyArray<ReferencedPrincipalStateResponse> | undefined;
+    resolveTrustedUserIdentity: TrustedUserIdentityResolver;
+    stillCurrent?: (() => boolean) | undefined;
+}
+export interface CachePrincipalPolicyBundlesOptions extends Omit<CacheReferencedPrincipalPoliciesOptions, "references"> {
+    bundles: ReadonlyArray<PrincipalPolicyBundleResponse> | undefined;
+}
+export declare function cacheReferencedPrincipalPolicies(input: CacheReferencedPrincipalPoliciesOptions): Promise<void>;
+export declare function cachePrincipalPolicyBundles({ bundles, currentPolicyReader, execSql, log, organizationId, reportSecurityIncident, resolveTrustedUserIdentity, stillCurrent, }: CachePrincipalPolicyBundlesOptions): Promise<void>;

package/workflows/principals/policyCache/index.js

@@ -0,0 +1,242 @@
+import { isProjectionVerificationCancelledError } from "../../../data/keyingProjectionVerification/index.js";
+import { reportAndRethrowKeyingVerificationError, rethrowKeyingVerificationError, } from "../../../data/keyingProjectionVerification/error.js";
+import { dedupeReferencedPrincipalStates } from "../../../data/keyingProjectionVerification/principalPolicyCache.js";
+import { loadPrincipalPolicyCheckpoint } from "../../../data/persistence/keyingCheckpointPersistence.js";
+import { ensurePrincipalPolicyTables } from "../../../data/persistence/principalPolicyPersistence.js";
+import { loadPrincipalPolicyBundleForReference } from "../../../data/persistence/principalPolicyReferencePersistence.js";
+import { principalPolicyReferenceFromBundle } from "../../../data/principals/principalPolicyAdminSigners.js";
+import { errorMessage } from "../../../data/shared/errorMessage.js";
+import { externalAdminPolicyPersistenceEntries, loadOrganizationExternalAdminPolicy, } from "../externalAdminPolicy.js";
+import { persistPrincipalPolicyCacheEntries, retryPrincipalPolicyCacheAdvance, } from "./principalPolicyCacheAdvance.js";
+import { scopeReferencedPolicyForCache } from "./principalPolicyCacheScope.js";
+import { validatePrincipalPolicyBundleForCache } from "./principalPolicyCacheValidation.js";
+import { createPolicyDirectoryLoader, directoryBindsGroupReference, } from "./principalPolicyOrganizationScope.js";
+function getReferencedPrincipalKey(reference) {
+    return `${reference.principalType}:${reference.principalId}`;
+}
+function getBundlePrincipalKey(bundle) {
+    return `${bundle.currentState.principalType}:${bundle.currentState.principalId}`;
+}
+function dedupePrincipalPolicyBundles(bundles) {
+    const bundlesByPrincipal = new Map();
+    for (const bundle of bundles) {
+        const key = getBundlePrincipalKey(bundle);
+        const previous = bundlesByPrincipal.get(key);
+        if (!previous ||
+            bundle.currentState.version > previous.currentState.version) {
+            bundlesByPrincipal.set(key, bundle);
+        }
+    }
+    return Array.from(bundlesByPrincipal.values());
+}
+async function cacheReferencedPrincipalPolicy(execSql, reader, reference, resolveTrustedUserIdentity, log, loadExternalAdminPolicy, organizationId, stillCurrent, loadDirectory, fresh) {
+    const localCheckpoint = await loadPrincipalPolicyCheckpoint(execSql, reference.principalType, reference.principalId);
+    // Only null is a recoverable local miss. Integrity failures remain typed and
+    // must escape rather than being hidden by a canonical network retry.
+    const cachedBundle = fresh
+        ? null
+        : await loadPrincipalPolicyBundleForReference(execSql, reference, localCheckpoint);
+    let bundle = cachedBundle ??
+        (await reader.getCurrentPrincipalPolicy(reference.principalType, reference.principalId));
+    if (!bundle) {
+        log?.(`Principal policy cache: failed to fetch ${getReferencedPrincipalKey(reference)}`);
+        return [];
+    }
+    let validation = await validatePrincipalPolicyBundleForCache({
+        bundle,
+        loadExternalAdminPolicy,
+        localCheckpoint,
+        reference,
+        resolveTrustedUserIdentity,
+    });
+    if (!validation.ok) {
+        throw validation.error;
+    }
+    const scoped = await scopeReferencedPolicyForCache({
+        bundle,
+        validation,
+        validationInput: {
+            loadExternalAdminPolicy,
+            localCheckpoint,
+            reference,
+            resolveTrustedUserIdentity,
+        },
+        loadDirectory,
+        organizationId,
+        reloadBundle: cachedBundle
+            ? () => reader.getCurrentPrincipalPolicy("group", reference.principalId)
+            : null,
+    });
+    if (!scoped) {
+        log?.(`Principal policy cache: signed organization directory does not cover ${getReferencedPrincipalKey(reference)}`);
+        return [];
+    }
+    bundle = scoped.bundle;
+    validation = scoped.validation;
+    const directory = scoped.directory;
+    const externalEntries = validation.externalAdminPolicy
+        ? externalAdminPolicyPersistenceEntries(validation.externalAdminPolicy).filter((entry) => !directory || entry.policy.principalType !== "organization")
+        : [];
+    const directoryEntries = directory
+        ? [{ bundle: directory.bundle, policy: directory.policy }]
+        : [];
+    await persistPrincipalPolicyCacheEntries({
+        entries: [
+            ...externalEntries,
+            ...directoryEntries,
+            { bundle, policy: validation.policy },
+        ],
+        execSql,
+        organizationId,
+        updatedAt: new Date().toISOString(),
+        stillCurrent,
+    });
+    return [...externalEntries.map(({ policy }) => policy), validation.policy];
+}
+async function cachePrincipalPolicyBundle(input) {
+    const reference = principalPolicyReferenceFromBundle(input.bundle);
+    // The API supplied this bundle after rejecting a write, but local storage is
+    // only updated after normal signature, signer, and checkpoint verification.
+    const localCheckpoint = await loadPrincipalPolicyCheckpoint(input.execSql, reference.principalType, reference.principalId);
+    const validation = await validatePrincipalPolicyBundleForCache({
+        bundle: input.bundle,
+        loadExternalAdminPolicy: input.loadExternalAdminPolicy,
+        localCheckpoint,
+        reference,
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+    });
+    if (!validation.ok) {
+        throw validation.error;
+    }
+    let directory = null;
+    if (reference.principalType === "group") {
+        directory = await input.loadDirectory(false);
+        if (!directoryBindsGroupReference(directory, validation.policy, reference))
+            directory = await input.loadDirectory(true);
+        if (!directoryBindsGroupReference(directory, validation.policy, reference)) {
+            input.log?.("Principal policy cache: signed organization directory does not cover supplied group");
+            return [];
+        }
+    }
+    else if (reference.principalId !== input.organizationId) {
+        return [];
+    }
+    const externalEntries = validation.externalAdminPolicy
+        ? externalAdminPolicyPersistenceEntries(validation.externalAdminPolicy).filter((entry) => !directory || entry.policy.principalType !== "organization")
+        : [];
+    const directoryEntries = directory
+        ? [{ bundle: directory.bundle, policy: directory.policy }]
+        : [];
+    await persistPrincipalPolicyCacheEntries({
+        entries: [
+            ...externalEntries,
+            ...directoryEntries,
+            { bundle: input.bundle, policy: validation.policy },
+        ],
+        execSql: input.execSql,
+        organizationId: input.organizationId,
+        updatedAt: new Date().toISOString(),
+        stillCurrent: input.stillCurrent,
+    });
+    return [...externalEntries.map(({ policy }) => policy), validation.policy];
+}
+async function runPrincipalPolicyCache(input) {
+    if (!input.items || input.items.length === 0) {
+        return [];
+    }
+    try {
+        await ensurePrincipalPolicyTables(input.execSql);
+        const uniqueItems = input.dedupe(input.items);
+        const loadDirectory = createPolicyDirectoryLoader(input);
+        let externalAdminPolicy = null;
+        const loadExternalAdminPolicy = () => {
+            externalAdminPolicy ??= loadOrganizationExternalAdminPolicy({
+                currentPolicyReader: input.currentPolicyReader,
+                execSql: input.execSql,
+                organizationId: input.organizationId,
+                resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+                stillCurrent: input.stillCurrent,
+            });
+            return externalAdminPolicy;
+        };
+        const results = await Promise.all(uniqueItems.map(async (item) => {
+            try {
+                return await retryPrincipalPolicyCacheAdvance((fresh) => {
+                    const reloadDirectory = createPolicyDirectoryLoader(input);
+                    let reloadedAuthority = null;
+                    return input.cacheItem(item, fresh
+                        ? () => (reloadedAuthority ??=
+                            loadOrganizationExternalAdminPolicy(input))
+                        : loadExternalAdminPolicy, fresh ? () => reloadDirectory(true) : loadDirectory, fresh);
+                });
+            }
+            catch (error) {
+                if (isProjectionVerificationCancelledError(error))
+                    return [];
+                await reportAndRethrowKeyingVerificationError(error, input.reportSecurityIncident, {
+                    objectId: input.itemKey(item),
+                    objectKind: "principal",
+                    operation: "principal.policy.cache",
+                    organizationId: input.organizationId,
+                });
+                const message = errorMessage(error);
+                input.log?.(`Principal policy cache: failed to store ${input.itemKey(item)}: ${message}`);
+                return [];
+            }
+        }));
+        return results.flat();
+    }
+    catch (error) {
+        if (isProjectionVerificationCancelledError(error))
+            return [];
+        // Per-item verification failures were reported above before reaching this
+        // initialization/aggregation boundary.
+        rethrowKeyingVerificationError(error);
+        const message = errorMessage(error);
+        input.log?.(`Principal policy cache: failed to initialize cache: ${message}`);
+        return [];
+    }
+}
+async function loadReferencedPrincipalPolicies({ currentPolicyReader, execSql, log, organizationId, reportSecurityIncident, references, resolveTrustedUserIdentity, stillCurrent, }) {
+    return runPrincipalPolicyCache({
+        cacheItem: (reference, loadExternalAdminPolicy, loadDirectory, fresh) => cacheReferencedPrincipalPolicy(execSql, currentPolicyReader, reference, resolveTrustedUserIdentity, log, loadExternalAdminPolicy, organizationId, stillCurrent, loadDirectory, fresh),
+        currentPolicyReader,
+        dedupe: dedupeReferencedPrincipalStates,
+        execSql,
+        itemKey: getReferencedPrincipalKey,
+        items: references,
+        log,
+        organizationId,
+        reportSecurityIncident,
+        resolveTrustedUserIdentity,
+        stillCurrent,
+    });
+}
+export async function cacheReferencedPrincipalPolicies(input) {
+    await loadReferencedPrincipalPolicies(input);
+}
+export async function cachePrincipalPolicyBundles({ bundles, currentPolicyReader, execSql, log, organizationId, reportSecurityIncident, resolveTrustedUserIdentity, stillCurrent, }) {
+    await runPrincipalPolicyCache({
+        cacheItem: (bundle, loadExternalAdminPolicy, loadDirectory) => cachePrincipalPolicyBundle({
+            bundle,
+            execSql,
+            loadExternalAdminPolicy,
+            loadDirectory,
+            log,
+            organizationId,
+            resolveTrustedUserIdentity,
+            stillCurrent,
+        }),
+        currentPolicyReader,
+        dedupe: dedupePrincipalPolicyBundles,
+        execSql,
+        itemKey: getBundlePrincipalKey,
+        items: bundles,
+        log,
+        organizationId,
+        reportSecurityIncident,
+        resolveTrustedUserIdentity,
+        stillCurrent,
+    });
+}
+//# sourceMappingURL=index.js.map

package/workflows/principals/policyCache/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,sCAAsC,EAAE,MAAM,4CAA4C,CAAC;AACpG,OAAO,EACL,uCAAuC,EACvC,8BAA8B,GAC/B,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,+BAA+B,EAAE,MAAM,iEAAiE,CAAC;AAClH,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,EAAE,2BAA2B,EAAE,MAAM,sDAAsD,CAAC;AACnG,OAAO,EAAE,qCAAqC,EAAE,MAAM,+DAA+D,CAAC;AACtH,OAAO,EAAE,kCAAkC,EAAE,MAAM,sDAAsD,CAAC;AAC1G,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAKjE,OAAO,EACL,qCAAqC,EACrC,mCAAmC,GAEpC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,kCAAkC,EAClC,gCAAgC,GACjC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,EAAE,qCAAqC,EAAE,MAAM,kCAAkC,CAAC;AACzF,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,GAG7B,MAAM,oCAAoC,CAAC;AAkB5C,SAAS,yBAAyB,CAChC,SAA2C;IAE3C,OAAO,GAAG,SAAS,CAAC,aAAa,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAqC;IAClE,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,aAAa,IAAI,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC;AACnF,CAAC;AAED,SAAS,4BAA4B,CACnC,OAAqD;IAErD,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAyC,CAAC;IAE5E,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7C,IACE,CAAC,QAAQ;YACT,MAAM,CAAC,YAAY,CAAC,OAAO,GAAG,QAAQ,CAAC,YAAY,CAAC,OAAO,EAC3D,CAAC;YACD,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,8BAA8B,CAC3C,OAAgB,EAChB,MAAoC,EACpC,SAA2C,EAC3C,0BAAuD,EACvD,GAA4C,EAC5C,uBAA0E,EAC1E,cAAsB,EACtB,YAAyC,EACzC,aAAoC,EACpC,KAAc;IAEd,MAAM,eAAe,GAAG,MAAM,6BAA6B,CACzD,OAAO,EACP,SAAS,CAAC,aAAa,EACvB,SAAS,CAAC,WAAW,CACtB,CAAC;IACF,6EAA6E;IAC7E,qEAAqE;IACrE,MAAM,YAAY,GAAG,KAAK;QACxB,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,MAAM,qCAAqC,CACzC,OAAO,EACP,SAAS,EACT,eAAe,CAChB,CAAC;IACN,IAAI,MAAM,GACR,YAAY;QACZ,CAAC,MAAM,MAAM,CAAC,yBAAyB,CACrC,SAAS,CAAC,aAAa,EACvB,SAAS,CAAC,WAAW,CACtB,CAAC,CAAC;IACL,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,GAAG,EAAE,CACH,2CAA2C,yBAAyB,CAAC,SAAS,CAAC,EAAE,CAClF,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,UAAU,GAAG,MAAM,qCAAqC,CAAC;QAC3D,MAAM;QACN,uBAAuB;QACvB,eAAe;QACf,SAAS;QACT,0BAA0B;KAC3B,CAAC,CAAC;IACH,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,MAAM,UAAU,CAAC,KAAK,CAAC;IACzB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAAC;QACjD,MAAM;QACN,UAAU;QACV,eAAe,EAAE;YACf,uBAAuB;YACvB,eAAe;YACf,SAAS;YACT,0BAA0B;SAC3B;QACD,aAAa;QACb,cAAc;QACd,YAAY,EAAE,YAAY;YACxB,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAAC,OAAO,EAAE,SAAS,CAAC,WAAW,CAAC;YACxE,CAAC,CAAC,IAAI;KACT,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,GAAG,EAAE,CACH,wEAAwE,yBAAyB,CAAC,SAAS,CAAC,EAAE,CAC/G,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IACvB,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IAC/B,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IACnC,MAAM,eAAe,GAAG,UAAU,CAAC,mBAAmB;QACpD,CAAC,CAAC,qCAAqC,CACnC,UAAU,CAAC,mBAAmB,CAC/B,CAAC,MAAM,CACN,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC,aAAa,KAAK,cAAc,CACvE;QACH,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,gBAAgB,GAAG,SAAS;QAChC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;QAC1D,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,kCAAkC,CAAC;QACvC,OAAO,EAAE;YACP,GAAG,eAAe;YAClB,GAAG,gBAAgB;YACnB,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE;SACtC;QACD,OAAO;QACP,cAAc;QACd,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,YAAY;KACb,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;AAC7E,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KASzC;IACC,MAAM,SAAS,GAAG,kCAAkC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACnE,6EAA6E;IAC7E,4EAA4E;IAC5E,MAAM,eAAe,GAAG,MAAM,6BAA6B,CACzD,KAAK,CAAC,OAAO,EACb,SAAS,CAAC,aAAa,EACvB,SAAS,CAAC,WAAW,CACtB,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,qCAAqC,CAAC;QAC7D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,eAAe;QACf,SAAS;QACT,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,MAAM,UAAU,CAAC,KAAK,CAAC;IACzB,CAAC;IAED,IAAI,SAAS,GAAmC,IAAI,CAAC;IACrD,IAAI,SAAS,CAAC,aAAa,KAAK,OAAO,EAAE,CAAC;QACxC,SAAS,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,4BAA4B,CAAC,SAAS,EAAE,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC;YACxE,SAAS,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAC9C,IACE,CAAC,4BAA4B,CAAC,SAAS,EAAE,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,EACtE,CAAC;YACD,KAAK,CAAC,GAAG,EAAE,CACT,qFAAqF,CACtF,CAAC;YACF,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;SAAM,IAAI,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1D,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,eAAe,GAAG,UAAU,CAAC,mBAAmB;QACpD,CAAC,CAAC,qCAAqC,CACnC,UAAU,CAAC,mBAAmB,CAC/B,CAAC,MAAM,CACN,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC,aAAa,KAAK,cAAc,CACvE;QACH,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,gBAAgB,GAAG,SAAS;QAChC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;QAC1D,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,kCAAkC,CAAC;QACvC,OAAO,EAAE;YACP,GAAG,eAAe;YAClB,GAAG,gBAAgB;YACnB,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE;SACpD;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;AAC7E,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAe,KAiBpD;IACC,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjD,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,aAAa,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,mBAAmB,GACrB,IAAI,CAAC;QACP,MAAM,uBAAuB,GAAG,GAAG,EAAE;YACnC,mBAAmB,KAAK,mCAAmC,CAAC;gBAC1D,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;gBAC9C,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,cAAc,EAAE,KAAK,CAAC,cAAc;gBAEpC,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;gBAC5D,YAAY,EAAE,KAAK,CAAC,YAAY;aACjC,CAAC,CAAC;YACH,OAAO,mBAAmB,CAAC;QAC7B,CAAC,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YAC7B,IAAI,CAAC;gBACH,OAAO,MAAM,gCAAgC,CAAC,CAAC,KAAK,EAAE,EAAE;oBACtD,MAAM,eAAe,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC;oBAC3D,IAAI,iBAAiB,GACnB,IAAI,CAAC;oBACP,OAAO,KAAK,CAAC,SAAS,CACpB,IAAI,EACJ,KAAK;wBACH,CAAC,CAAC,GAAG,EAAE,CACH,CAAC,iBAAiB;4BAChB,mCAAmC,CAAC,KAAK,CAAC,CAAC;wBACjD,CAAC,CAAC,uBAAuB,EAC3B,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,EACnD,KAAK,CACN,CAAC;gBACJ,CAAC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,sCAAsC,CAAC,KAAK,CAAC;oBAAE,OAAO,EAAE,CAAC;gBAC7D,MAAM,uCAAuC,CAC3C,KAAK,EACL,KAAK,CAAC,sBAAsB,EAC5B;oBACE,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;oBAC7B,UAAU,EAAE,WAAW;oBACvB,SAAS,EAAE,wBAAwB;oBACnC,cAAc,EAAE,KAAK,CAAC,cAAc;iBACrC,CACF,CAAC;gBACF,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpC,KAAK,CAAC,GAAG,EAAE,CACT,2CAA2C,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,OAAO,EAAE,CAC7E,CAAC;gBACF,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CACH,CAAC;QACF,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,sCAAsC,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAC7D,0EAA0E;QAC1E,uCAAuC;QACvC,8BAA8B,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QACpC,KAAK,CAAC,GAAG,EAAE,CACT,uDAAuD,OAAO,EAAE,CACjE,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,+BAA+B,CAAC,EAC7C,mBAAmB,EACnB,OAAO,EACP,GAAG,EACH,cAAc,EACd,sBAAsB,EACtB,UAAU,EACV,0BAA0B,EAC1B,YAAY,GAC4B;IAGxC,OAAO,uBAAuB,CAAC;QAC7B,SAAS,EAAE,CAAC,SAAS,EAAE,uBAAuB,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,CACtE,8BAA8B,CAC5B,OAAO,EACP,mBAAmB,EACnB,SAAS,EACT,0BAA0B,EAC1B,GAAG,EACH,uBAAuB,EACvB,cAAc,EACd,YAAY,EACZ,aAAa,EACb,KAAK,CACN;QACH,mBAAmB;QACnB,MAAM,EAAE,+BAA+B;QACvC,OAAO;QACP,OAAO,EAAE,yBAAyB;QAClC,KAAK,EAAE,UAAU;QACjB,GAAG;QACH,cAAc;QAEd,sBAAsB;QACtB,0BAA0B;QAC1B,YAAY;KACb,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAA8C;IAE9C,MAAM,+BAA+B,CAAC,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,EAChD,OAAO,EACP,mBAAmB,EACnB,OAAO,EACP,GAAG,EACH,cAAc,EACd,sBAAsB,EACtB,0BAA0B,EAC1B,YAAY,GACuB;IACnC,MAAM,uBAAuB,CAAC;QAC5B,SAAS,EAAE,CAAC,MAAM,EAAE,uBAAuB,EAAE,aAAa,EAAE,EAAE,CAC5D,0BAA0B,CAAC;YACzB,MAAM;YACN,OAAO;YACP,uBAAuB;YACvB,aAAa;YACb,GAAG;YACH,cAAc;YACd,0BAA0B;YAC1B,YAAY;SACb,CAAC;QACJ,mBAAmB;QACnB,MAAM,EAAE,4BAA4B;QACpC,OAAO;QACP,OAAO,EAAE,qBAAqB;QAC9B,KAAK,EAAE,OAAO;QACd,GAAG;QACH,cAAc;QAEd,sBAAsB;QACtB,0BAA0B;QAC1B,YAAY;KACb,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { VerifiedPrincipalPolicy } from \"@tearleads/crypto\";\nimport type {\n  PrincipalPolicyBundleResponse,\n  ReferencedPrincipalStateResponse,\n} from \"@tearleads/validators/response\";\nimport { isProjectionVerificationCancelledError } from \"../../../data/keyingProjectionVerification\";\nimport {\n  reportAndRethrowKeyingVerificationError,\n  rethrowKeyingVerificationError,\n} from \"../../../data/keyingProjectionVerification/error\";\nimport { dedupeReferencedPrincipalStates } from \"../../../data/keyingProjectionVerification/principalPolicyCache\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../../data/persistence/keyingCheckpointPersistence\";\nimport { ensurePrincipalPolicyTables } from \"../../../data/persistence/principalPolicyPersistence\";\nimport { loadPrincipalPolicyBundleForReference } from \"../../../data/persistence/principalPolicyReferencePersistence\";\nimport { principalPolicyReferenceFromBundle } from \"../../../data/principals/principalPolicyAdminSigners\";\nimport { errorMessage } from \"../../../data/shared/errorMessage\";\nimport type { SecurityIncidentReporter } from \"../../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../../data/trustedUserIdentity\";\nimport type { CurrentPrincipalPolicyReader } from \"../currentPrincipalPolicyReader\";\nimport {\n  externalAdminPolicyPersistenceEntries,\n  loadOrganizationExternalAdminPolicy,\n  type VerifiedExternalAdminPolicy,\n} from \"../externalAdminPolicy\";\nimport {\n  persistPrincipalPolicyCacheEntries,\n  retryPrincipalPolicyCacheAdvance,\n} from \"./principalPolicyCacheAdvance\";\nimport { scopeReferencedPolicyForCache } from \"./principalPolicyCacheScope\";\nimport { validatePrincipalPolicyBundleForCache } from \"./principalPolicyCacheValidation\";\nimport {\n  createPolicyDirectoryLoader,\n  directoryBindsGroupReference,\n  type PolicyDirectoryLoader,\n  type VerifiedPolicyDirectory,\n} from \"./principalPolicyOrganizationScope\";\n\nexport interface CacheReferencedPrincipalPoliciesOptions {\n  currentPolicyReader: CurrentPrincipalPolicyReader;\n  execSql: ExecSql;\n  log?: (message: string) => void;\n  organizationId: string;\n  reportSecurityIncident: SecurityIncidentReporter;\n  references: ReadonlyArray<ReferencedPrincipalStateResponse> | undefined;\n  resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  stillCurrent?: (() => boolean) | undefined;\n}\n\nexport interface CachePrincipalPolicyBundlesOptions\n  extends Omit<CacheReferencedPrincipalPoliciesOptions, \"references\"> {\n  bundles: ReadonlyArray<PrincipalPolicyBundleResponse> | undefined;\n}\n\nfunction getReferencedPrincipalKey(\n  reference: ReferencedPrincipalStateResponse,\n): string {\n  return `${reference.principalType}:${reference.principalId}`;\n}\n\nfunction getBundlePrincipalKey(bundle: PrincipalPolicyBundleResponse): string {\n  return `${bundle.currentState.principalType}:${bundle.currentState.principalId}`;\n}\n\nfunction dedupePrincipalPolicyBundles(\n  bundles: ReadonlyArray<PrincipalPolicyBundleResponse>,\n): PrincipalPolicyBundleResponse[] {\n  const bundlesByPrincipal = new Map<string, PrincipalPolicyBundleResponse>();\n\n  for (const bundle of bundles) {\n    const key = getBundlePrincipalKey(bundle);\n    const previous = bundlesByPrincipal.get(key);\n    if (\n      !previous ||\n      bundle.currentState.version > previous.currentState.version\n    ) {\n      bundlesByPrincipal.set(key, bundle);\n    }\n  }\n\n  return Array.from(bundlesByPrincipal.values());\n}\n\nasync function cacheReferencedPrincipalPolicy(\n  execSql: ExecSql,\n  reader: CurrentPrincipalPolicyReader,\n  reference: ReferencedPrincipalStateResponse,\n  resolveTrustedUserIdentity: TrustedUserIdentityResolver,\n  log: ((message: string) => void) | undefined,\n  loadExternalAdminPolicy: () => Promise<VerifiedExternalAdminPolicy | null>,\n  organizationId: string,\n  stillCurrent: (() => boolean) | undefined,\n  loadDirectory: PolicyDirectoryLoader,\n  fresh: boolean,\n): Promise<VerifiedPrincipalPolicy[]> {\n  const localCheckpoint = await loadPrincipalPolicyCheckpoint(\n    execSql,\n    reference.principalType,\n    reference.principalId,\n  );\n  // Only null is a recoverable local miss. Integrity failures remain typed and\n  // must escape rather than being hidden by a canonical network retry.\n  const cachedBundle = fresh\n    ? null\n    : await loadPrincipalPolicyBundleForReference(\n        execSql,\n        reference,\n        localCheckpoint,\n      );\n  let bundle =\n    cachedBundle ??\n    (await reader.getCurrentPrincipalPolicy(\n      reference.principalType,\n      reference.principalId,\n    ));\n  if (!bundle) {\n    log?.(\n      `Principal policy cache: failed to fetch ${getReferencedPrincipalKey(reference)}`,\n    );\n    return [];\n  }\n\n  let validation = await validatePrincipalPolicyBundleForCache({\n    bundle,\n    loadExternalAdminPolicy,\n    localCheckpoint,\n    reference,\n    resolveTrustedUserIdentity,\n  });\n  if (!validation.ok) {\n    throw validation.error;\n  }\n\n  const scoped = await scopeReferencedPolicyForCache({\n    bundle,\n    validation,\n    validationInput: {\n      loadExternalAdminPolicy,\n      localCheckpoint,\n      reference,\n      resolveTrustedUserIdentity,\n    },\n    loadDirectory,\n    organizationId,\n    reloadBundle: cachedBundle\n      ? () => reader.getCurrentPrincipalPolicy(\"group\", reference.principalId)\n      : null,\n  });\n  if (!scoped) {\n    log?.(\n      `Principal policy cache: signed organization directory does not cover ${getReferencedPrincipalKey(reference)}`,\n    );\n    return [];\n  }\n  bundle = scoped.bundle;\n  validation = scoped.validation;\n  const directory = scoped.directory;\n  const externalEntries = validation.externalAdminPolicy\n    ? externalAdminPolicyPersistenceEntries(\n        validation.externalAdminPolicy,\n      ).filter(\n        (entry) => !directory || entry.policy.principalType !== \"organization\",\n      )\n    : [];\n  const directoryEntries = directory\n    ? [{ bundle: directory.bundle, policy: directory.policy }]\n    : [];\n  await persistPrincipalPolicyCacheEntries({\n    entries: [\n      ...externalEntries,\n      ...directoryEntries,\n      { bundle, policy: validation.policy },\n    ],\n    execSql,\n    organizationId,\n    updatedAt: new Date().toISOString(),\n    stillCurrent,\n  });\n  return [...externalEntries.map(({ policy }) => policy), validation.policy];\n}\n\nasync function cachePrincipalPolicyBundle(input: {\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly execSql: ExecSql;\n  readonly loadExternalAdminPolicy: () => Promise<VerifiedExternalAdminPolicy | null>;\n  readonly log: ((message: string) => void) | undefined;\n  readonly loadDirectory: PolicyDirectoryLoader;\n  readonly organizationId: string;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<VerifiedPrincipalPolicy[]> {\n  const reference = principalPolicyReferenceFromBundle(input.bundle);\n  // The API supplied this bundle after rejecting a write, but local storage is\n  // only updated after normal signature, signer, and checkpoint verification.\n  const localCheckpoint = await loadPrincipalPolicyCheckpoint(\n    input.execSql,\n    reference.principalType,\n    reference.principalId,\n  );\n  const validation = await validatePrincipalPolicyBundleForCache({\n    bundle: input.bundle,\n    loadExternalAdminPolicy: input.loadExternalAdminPolicy,\n    localCheckpoint,\n    reference,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  if (!validation.ok) {\n    throw validation.error;\n  }\n\n  let directory: VerifiedPolicyDirectory | null = null;\n  if (reference.principalType === \"group\") {\n    directory = await input.loadDirectory(false);\n    if (!directoryBindsGroupReference(directory, validation.policy, reference))\n      directory = await input.loadDirectory(true);\n    if (\n      !directoryBindsGroupReference(directory, validation.policy, reference)\n    ) {\n      input.log?.(\n        \"Principal policy cache: signed organization directory does not cover supplied group\",\n      );\n      return [];\n    }\n  } else if (reference.principalId !== input.organizationId) {\n    return [];\n  }\n  const externalEntries = validation.externalAdminPolicy\n    ? externalAdminPolicyPersistenceEntries(\n        validation.externalAdminPolicy,\n      ).filter(\n        (entry) => !directory || entry.policy.principalType !== \"organization\",\n      )\n    : [];\n  const directoryEntries = directory\n    ? [{ bundle: directory.bundle, policy: directory.policy }]\n    : [];\n  await persistPrincipalPolicyCacheEntries({\n    entries: [\n      ...externalEntries,\n      ...directoryEntries,\n      { bundle: input.bundle, policy: validation.policy },\n    ],\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    updatedAt: new Date().toISOString(),\n    stillCurrent: input.stillCurrent,\n  });\n  return [...externalEntries.map(({ policy }) => policy), validation.policy];\n}\n\nasync function runPrincipalPolicyCache<Item, Result>(input: {\n  readonly cacheItem: (\n    item: Item,\n    loadExternalAdminPolicy: () => Promise<VerifiedExternalAdminPolicy | null>,\n    loadDirectory: PolicyDirectoryLoader,\n    fresh: boolean,\n  ) => Promise<readonly Result[]>;\n  readonly currentPolicyReader: CurrentPrincipalPolicyReader;\n  readonly dedupe: (items: ReadonlyArray<Item>) => Item[];\n  readonly execSql: ExecSql;\n  readonly itemKey: (item: Item) => string;\n  readonly items: ReadonlyArray<Item> | undefined;\n  readonly log: ((message: string) => void) | undefined;\n  readonly organizationId: string;\n  readonly reportSecurityIncident: SecurityIncidentReporter;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<Result[]> {\n  if (!input.items || input.items.length === 0) {\n    return [];\n  }\n\n  try {\n    await ensurePrincipalPolicyTables(input.execSql);\n    const uniqueItems = input.dedupe(input.items);\n    const loadDirectory = createPolicyDirectoryLoader(input);\n    let externalAdminPolicy: Promise<VerifiedExternalAdminPolicy | null> | null =\n      null;\n    const loadExternalAdminPolicy = () => {\n      externalAdminPolicy ??= loadOrganizationExternalAdminPolicy({\n        currentPolicyReader: input.currentPolicyReader,\n        execSql: input.execSql,\n        organizationId: input.organizationId,\n\n        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n        stillCurrent: input.stillCurrent,\n      });\n      return externalAdminPolicy;\n    };\n\n    const results = await Promise.all(\n      uniqueItems.map(async (item) => {\n        try {\n          return await retryPrincipalPolicyCacheAdvance((fresh) => {\n            const reloadDirectory = createPolicyDirectoryLoader(input);\n            let reloadedAuthority: Promise<VerifiedExternalAdminPolicy | null> | null =\n              null;\n            return input.cacheItem(\n              item,\n              fresh\n                ? () =>\n                    (reloadedAuthority ??=\n                      loadOrganizationExternalAdminPolicy(input))\n                : loadExternalAdminPolicy,\n              fresh ? () => reloadDirectory(true) : loadDirectory,\n              fresh,\n            );\n          });\n        } catch (error) {\n          if (isProjectionVerificationCancelledError(error)) return [];\n          await reportAndRethrowKeyingVerificationError(\n            error,\n            input.reportSecurityIncident,\n            {\n              objectId: input.itemKey(item),\n              objectKind: \"principal\",\n              operation: \"principal.policy.cache\",\n              organizationId: input.organizationId,\n            },\n          );\n          const message = errorMessage(error);\n          input.log?.(\n            `Principal policy cache: failed to store ${input.itemKey(item)}: ${message}`,\n          );\n          return [];\n        }\n      }),\n    );\n    return results.flat();\n  } catch (error) {\n    if (isProjectionVerificationCancelledError(error)) return [];\n    // Per-item verification failures were reported above before reaching this\n    // initialization/aggregation boundary.\n    rethrowKeyingVerificationError(error);\n    const message = errorMessage(error);\n    input.log?.(\n      `Principal policy cache: failed to initialize cache: ${message}`,\n    );\n    return [];\n  }\n}\n\nasync function loadReferencedPrincipalPolicies({\n  currentPolicyReader,\n  execSql,\n  log,\n  organizationId,\n  reportSecurityIncident,\n  references,\n  resolveTrustedUserIdentity,\n  stillCurrent,\n}: CacheReferencedPrincipalPoliciesOptions): Promise<\n  VerifiedPrincipalPolicy[]\n> {\n  return runPrincipalPolicyCache({\n    cacheItem: (reference, loadExternalAdminPolicy, loadDirectory, fresh) =>\n      cacheReferencedPrincipalPolicy(\n        execSql,\n        currentPolicyReader,\n        reference,\n        resolveTrustedUserIdentity,\n        log,\n        loadExternalAdminPolicy,\n        organizationId,\n        stillCurrent,\n        loadDirectory,\n        fresh,\n      ),\n    currentPolicyReader,\n    dedupe: dedupeReferencedPrincipalStates,\n    execSql,\n    itemKey: getReferencedPrincipalKey,\n    items: references,\n    log,\n    organizationId,\n\n    reportSecurityIncident,\n    resolveTrustedUserIdentity,\n    stillCurrent,\n  });\n}\n\nexport async function cacheReferencedPrincipalPolicies(\n  input: CacheReferencedPrincipalPoliciesOptions,\n): Promise<void> {\n  await loadReferencedPrincipalPolicies(input);\n}\n\nexport async function cachePrincipalPolicyBundles({\n  bundles,\n  currentPolicyReader,\n  execSql,\n  log,\n  organizationId,\n  reportSecurityIncident,\n  resolveTrustedUserIdentity,\n  stillCurrent,\n}: CachePrincipalPolicyBundlesOptions): Promise<void> {\n  await runPrincipalPolicyCache({\n    cacheItem: (bundle, loadExternalAdminPolicy, loadDirectory) =>\n      cachePrincipalPolicyBundle({\n        bundle,\n        execSql,\n        loadExternalAdminPolicy,\n        loadDirectory,\n        log,\n        organizationId,\n        resolveTrustedUserIdentity,\n        stillCurrent,\n      }),\n    currentPolicyReader,\n    dedupe: dedupePrincipalPolicyBundles,\n    execSql,\n    itemKey: getBundlePrincipalKey,\n    items: bundles,\n    log,\n    organizationId,\n\n    reportSecurityIncident,\n    resolveTrustedUserIdentity,\n    stillCurrent,\n  });\n}\n"]}

package/workflows/principals/policyCache/principalPolicyCacheAdvance.js

@@ -0,0 +1,39 @@
+import { KeyingVerificationError } from "../../../internal/crypto/index.js";
+import { persistVerifiedPrincipalPolicyBundlesAtomically } from "../../../data/persistence/keyingCheckpointAdvancePersistence.js";
+class PolicyCacheAdvanceRace extends Error {
+    verificationError;
+    constructor(verificationError) {
+        super(verificationError.message);
+        this.verificationError = verificationError;
+    }
+}
+/** Only a fully verified candidate losing the atomic commit race can retry. */
+export async function persistPrincipalPolicyCacheEntries(input) {
+    try {
+        await persistVerifiedPrincipalPolicyBundlesAtomically(input);
+    }
+    catch (error) {
+        if (error instanceof KeyingVerificationError && error.code === "rollback")
+            throw new PolicyCacheAdvanceRace(error);
+        throw error;
+    }
+}
+/** Discard stale snapshots once; the replacement must pass every normal check. */
+export async function retryPrincipalPolicyCacheAdvance(operation) {
+    try {
+        return await operation(false);
+    }
+    catch (error) {
+        if (!(error instanceof PolicyCacheAdvanceRace))
+            throw error;
+    }
+    try {
+        return await operation(true);
+    }
+    catch (error) {
+        throw error instanceof PolicyCacheAdvanceRace
+            ? error.verificationError
+            : error;
+    }
+}
+//# sourceMappingURL=principalPolicyCacheAdvance.js.map

package/workflows/principals/policyCache/principalPolicyCacheAdvance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalPolicyCacheAdvance.js","sourceRoot":"","sources":["principalPolicyCacheAdvance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,+CAA+C,EAAE,MAAM,8DAA8D,CAAC;AAE/H,MAAM,sBAAuB,SAAQ,KAAK;IACnB;IAArB,YAAqB,iBAA0C;QAC7D,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QADd,sBAAiB,GAAjB,iBAAiB,CAAyB;IAE/D,CAAC;CACF;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,KAA4E;IAE5E,IAAI,CAAC;QACH,MAAM,+CAA+C,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,uBAAuB,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU;YACvE,MAAM,IAAI,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,SAA8C;IAE9C,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,sBAAsB,CAAC;YAAE,MAAM,KAAK,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,KAAK,YAAY,sBAAsB;YAC3C,CAAC,CAAC,KAAK,CAAC,iBAAiB;YACzB,CAAC,CAAC,KAAK,CAAC;IACZ,CAAC;AACH,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { persistVerifiedPrincipalPolicyBundlesAtomically } from \"../../../data/persistence/keyingCheckpointAdvancePersistence\";\n\nclass PolicyCacheAdvanceRace extends Error {\n  constructor(readonly verificationError: KeyingVerificationError) {\n    super(verificationError.message);\n  }\n}\n\n/** Only a fully verified candidate losing the atomic commit race can retry. */\nexport async function persistPrincipalPolicyCacheEntries(\n  input: Parameters<typeof persistVerifiedPrincipalPolicyBundlesAtomically>[0],\n): Promise<void> {\n  try {\n    await persistVerifiedPrincipalPolicyBundlesAtomically(input);\n  } catch (error) {\n    if (error instanceof KeyingVerificationError && error.code === \"rollback\")\n      throw new PolicyCacheAdvanceRace(error);\n    throw error;\n  }\n}\n\n/** Discard stale snapshots once; the replacement must pass every normal check. */\nexport async function retryPrincipalPolicyCacheAdvance<Result>(\n  operation: (fresh: boolean) => Promise<Result>,\n): Promise<Result> {\n  try {\n    return await operation(false);\n  } catch (error) {\n    if (!(error instanceof PolicyCacheAdvanceRace)) throw error;\n  }\n  try {\n    return await operation(true);\n  } catch (error) {\n    throw error instanceof PolicyCacheAdvanceRace\n      ? error.verificationError\n      : error;\n  }\n}\n"]}

package/workflows/principals/policyCache/principalPolicyCacheValidation.js

@@ -0,0 +1,149 @@
+import { KeyingVerificationError, } from "../../../internal/crypto/index.js";
+import { verifyPrincipalPolicyBundleWithExternalOrganizationAdmins } from "../../../data/principals/principalPolicyAdminSigners.js";
+import { collectPrincipalPolicySignerPublicKeys, principalPolicyStates, } from "../policyVerification.js";
+function getBundleReferenceFailure(reference, bundle) {
+    const states = principalPolicyStates(bundle);
+    const hasReferencedPrincipal = states.some((state) => state.principalType === reference.principalType &&
+        state.principalId === reference.principalId);
+    if (!hasReferencedPrincipal) {
+        return {
+            code: "object_mismatch",
+            message: "bundle principal does not match referenced principal",
+        };
+    }
+    if (!states.some((state) => state.principalType === reference.principalType &&
+        state.principalId === reference.principalId &&
+        state.version === reference.version &&
+        state.keyEpoch === reference.keyEpoch &&
+        state.stateHash === reference.stateHash &&
+        state.keyFingerprint === reference.keyFingerprint)) {
+        return {
+            code: "hash_mismatch",
+            message: "bundle chain does not contain referenced principal",
+        };
+    }
+    if (bundle.currentMemberEnvelopes.principalType !==
+        bundle.currentState.principalType ||
+        bundle.currentMemberEnvelopes.principalId !==
+            bundle.currentState.principalId) {
+        return {
+            code: "object_mismatch",
+            message: "member envelope principal does not match current principal",
+        };
+    }
+    if (bundle.currentMemberEnvelopes.stateHash !== bundle.currentState.stateHash) {
+        return {
+            code: "hash_mismatch",
+            message: "member envelope state hash does not match current principal",
+        };
+    }
+    if (bundle.currentMemberEnvelopes.epoch !== bundle.currentState.keyEpoch) {
+        return {
+            code: "hash_mismatch",
+            message: "member envelope epoch does not match current principal",
+        };
+    }
+    if (bundle.currentPayload.principalType !== bundle.currentState.principalType ||
+        bundle.currentPayload.principalId !== bundle.currentState.principalId) {
+        return {
+            code: "object_mismatch",
+            message: "payload principal does not match current principal",
+        };
+    }
+    if (bundle.currentPayload.stateHash !== bundle.currentState.stateHash) {
+        return {
+            code: "hash_mismatch",
+            message: "payload state hash does not match current principal",
+        };
+    }
+    return null;
+}
+function getCheckpointFailure(checkpoint, bundle) {
+    if (!checkpoint) {
+        return null;
+    }
+    const current = bundle.currentState;
+    if (current.version < checkpoint.version) {
+        return {
+            code: "rollback",
+            message: "principal policy state is older than the local checkpoint",
+        };
+    }
+    if (current.version === checkpoint.version &&
+        current.stateHash !== checkpoint.stateHash) {
+        return {
+            code: "equivocation",
+            message: "principal policy state conflicts with the local checkpoint",
+        };
+    }
+    if (current.version === checkpoint.version) {
+        return null;
+    }
+    const checkpointState = principalPolicyStates(bundle).find((state) => state.version === checkpoint.version);
+    return checkpointState?.stateHash === checkpoint.stateHash
+        ? null
+        : {
+            code: "stale_predecessor",
+            message: "principal policy chain does not extend the local checkpoint",
+        };
+}
+function signerPublicKeyLoadFailure(code) {
+    switch (code) {
+        case "fingerprint-mismatch":
+            return {
+                code: "signer_mismatch",
+                message: "signer key fingerprint does not match state signer",
+            };
+        case "not-found":
+            // The identity source throws for transport failures, so an absent
+            // signer here is the server asserting the cited user does not exist.
+            return {
+                code: "missing_dependency",
+                message: "signer identity is unknown to the server",
+            };
+    }
+}
+function verificationError(failure) {
+    return new KeyingVerificationError(failure.code, failure.message);
+}
+export async function validatePrincipalPolicyBundleForCache(input) {
+    const referenceFailure = getBundleReferenceFailure(input.reference, input.bundle);
+    if (referenceFailure) {
+        return { error: verificationError(referenceFailure), ok: false };
+    }
+    const checkpointFailure = getCheckpointFailure(input.localCheckpoint, input.bundle);
+    if (checkpointFailure) {
+        return { error: verificationError(checkpointFailure), ok: false };
+    }
+    const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({
+        bundle: input.bundle,
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+    });
+    if ("error" in signerPublicKeys) {
+        return {
+            error: verificationError(signerPublicKeyLoadFailure(signerPublicKeys.error)),
+            ok: false,
+        };
+    }
+    let usedExternalAdminPolicy = false;
+    const verified = await verifyPrincipalPolicyBundleWithExternalOrganizationAdmins({
+        bundle: input.bundle,
+        expectedReference: input.reference,
+        loadExternalAuthority: async () => {
+            usedExternalAdminPolicy = true;
+            return ((await input.loadExternalAdminPolicy())?.externalAuthority ?? null);
+        },
+        localCheckpoint: input.localCheckpoint,
+        signerPublicKeys: signerPublicKeys.signerPublicKeys,
+    });
+    return verified.ok
+        ? {
+            externalAdminPolicy: usedExternalAdminPolicy
+                ? await input.loadExternalAdminPolicy()
+                : null,
+            ok: true,
+            policy: verified.value,
+        }
+        : { error: verified.error, ok: false };
+}
+//# sourceMappingURL=principalPolicyCacheValidation.js.map

package/workflows/principals/policyCache/principalPolicyCacheValidation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalPolicyCacheValidation.js","sourceRoot":"","sources":["principalPolicyCacheValidation.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,GAGxB,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EAAE,yDAAyD,EAAE,MAAM,sDAAsD,CAAC;AAGjI,OAAO,EACL,sCAAsC,EAEtC,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAO/B,SAAS,yBAAyB,CAChC,SAA2C,EAC3C,MAAqC;IAErC,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,sBAAsB,GAAG,MAAM,CAAC,IAAI,CACxC,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,aAAa;QAC/C,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW,CAC9C,CAAC;IACF,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC5B,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,sDAAsD;SAChE,CAAC;IACJ,CAAC;IACD,IACE,CAAC,MAAM,CAAC,IAAI,CACV,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,aAAa;QAC/C,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW;QAC3C,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,OAAO;QACnC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,QAAQ;QACrC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,SAAS;QACvC,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,cAAc,CACpD,EACD,CAAC;QACD,OAAO;YACL,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,oDAAoD;SAC9D,CAAC;IACJ,CAAC;IACD,IACE,MAAM,CAAC,sBAAsB,CAAC,aAAa;QACzC,MAAM,CAAC,YAAY,CAAC,aAAa;QACnC,MAAM,CAAC,sBAAsB,CAAC,WAAW;YACvC,MAAM,CAAC,YAAY,CAAC,WAAW,EACjC,CAAC;QACD,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,4DAA4D;SACtE,CAAC;IACJ,CAAC;IACD,IACE,MAAM,CAAC,sBAAsB,CAAC,SAAS,KAAK,MAAM,CAAC,YAAY,CAAC,SAAS,EACzE,CAAC;QACD,OAAO;YACL,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,6DAA6D;SACvE,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,sBAAsB,CAAC,KAAK,KAAK,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;QACzE,OAAO;YACL,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,wDAAwD;SAClE,CAAC;IACJ,CAAC;IACD,IACE,MAAM,CAAC,cAAc,CAAC,aAAa,KAAK,MAAM,CAAC,YAAY,CAAC,aAAa;QACzE,MAAM,CAAC,cAAc,CAAC,WAAW,KAAK,MAAM,CAAC,YAAY,CAAC,WAAW,EACrE,CAAC;QACD,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,oDAAoD;SAC9D,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,CAAC,SAAS,KAAK,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC;QACtE,OAAO;YACL,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,qDAAqD;SAC/D,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAC3B,UAA4C,EAC5C,MAAqC;IAErC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC;IACpC,IAAI,OAAO,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC;QACzC,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,2DAA2D;SACrE,CAAC;IACJ,CAAC;IACD,IACE,OAAO,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO;QACtC,OAAO,CAAC,SAAS,KAAK,UAAU,CAAC,SAAS,EAC1C,CAAC;QACD,OAAO;YACL,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,4DAA4D;SACtE,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,eAAe,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC,IAAI,CACxD,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO,CAChD,CAAC;IACF,OAAO,eAAe,EAAE,SAAS,KAAK,UAAU,CAAC,SAAS;QACxD,CAAC,CAAC,IAAI;QACN,CAAC,CAAC;YACE,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,6DAA6D;SACvE,CAAC;AACR,CAAC;AAED,SAAS,0BAA0B,CACjC,IAAiD;IAEjD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,sBAAsB;YACzB,OAAO;gBACL,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,oDAAoD;aAC9D,CAAC;QACJ,KAAK,WAAW;YACd,kEAAkE;YAClE,qEAAqE;YACrE,OAAO;gBACL,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,0CAA0C;aACpD,CAAC;IACN,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CACxB,OAAyC;IAEzC,OAAO,IAAI,uBAAuB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAAC,KAM3D;IAQC,MAAM,gBAAgB,GAAG,yBAAyB,CAChD,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,MAAM,CACb,CAAC;IACF,IAAI,gBAAgB,EAAE,CAAC;QACrB,OAAO,EAAE,KAAK,EAAE,iBAAiB,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACnE,CAAC;IACD,MAAM,iBAAiB,GAAG,oBAAoB,CAC5C,KAAK,CAAC,eAAe,EACrB,KAAK,CAAC,MAAM,CACb,CAAC;IACF,IAAI,iBAAiB,EAAE,CAAC;QACtB,OAAO,EAAE,KAAK,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACpE,CAAC;IACD,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;QACpE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,IAAI,OAAO,IAAI,gBAAgB,EAAE,CAAC;QAChC,OAAO;YACL,KAAK,EAAE,iBAAiB,CACtB,0BAA0B,CAAC,gBAAgB,CAAC,KAAK,CAAC,CACnD;YACD,EAAE,EAAE,KAAK;SACV,CAAC;IACJ,CAAC;IAED,IAAI,uBAAuB,GAAG,KAAK,CAAC;IACpC,MAAM,QAAQ,GACZ,MAAM,yDAAyD,CAAC;QAC9D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,iBAAiB,EAAE,KAAK,CAAC,SAAS;QAClC,qBAAqB,EAAE,KAAK,IAAI,EAAE;YAChC,uBAAuB,GAAG,IAAI,CAAC;YAC/B,OAAO,CACL,CAAC,MAAM,KAAK,CAAC,uBAAuB,EAAE,CAAC,EAAE,iBAAiB,IAAI,IAAI,CACnE,CAAC;QACJ,CAAC;QACD,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,gBAAgB,EAAE,gBAAgB,CAAC,gBAAgB;KACpD,CAAC,CAAC;IACL,OAAO,QAAQ,CAAC,EAAE;QAChB,CAAC,CAAC;YACE,mBAAmB,EAAE,uBAAuB;gBAC1C,CAAC,CAAC,MAAM,KAAK,CAAC,uBAAuB,EAAE;gBACvC,CAAC,CAAC,IAAI;YACR,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,QAAQ,CAAC,KAAK;SACvB;QACH,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;AAC3C,CAAC","sourcesContent":["import {\n  type KeyingVerificationCode,\n  KeyingVerificationError,\n  type PrincipalPolicyCheckpoint,\n  type VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type {\n  PrincipalPolicyBundleResponse,\n  ReferencedPrincipalStateResponse,\n} from \"@tearleads/validators/response\";\nimport { verifyPrincipalPolicyBundleWithExternalOrganizationAdmins } from \"../../../data/principals/principalPolicyAdminSigners\";\nimport type { TrustedUserIdentityResolver } from \"../../../data/trustedUserIdentity\";\nimport type { VerifiedExternalAdminPolicy } from \"../externalAdminPolicy\";\nimport {\n  collectPrincipalPolicySignerPublicKeys,\n  type PrincipalPolicySignerPublicKeyLoadErrorCode,\n  principalPolicyStates,\n} from \"../policyVerification\";\n\ninterface PrincipalPolicyValidationFailure {\n  readonly code: KeyingVerificationCode;\n  readonly message: string;\n}\n\nfunction getBundleReferenceFailure(\n  reference: ReferencedPrincipalStateResponse,\n  bundle: PrincipalPolicyBundleResponse,\n): PrincipalPolicyValidationFailure | null {\n  const states = principalPolicyStates(bundle);\n  const hasReferencedPrincipal = states.some(\n    (state) =>\n      state.principalType === reference.principalType &&\n      state.principalId === reference.principalId,\n  );\n  if (!hasReferencedPrincipal) {\n    return {\n      code: \"object_mismatch\",\n      message: \"bundle principal does not match referenced principal\",\n    };\n  }\n  if (\n    !states.some(\n      (state) =>\n        state.principalType === reference.principalType &&\n        state.principalId === reference.principalId &&\n        state.version === reference.version &&\n        state.keyEpoch === reference.keyEpoch &&\n        state.stateHash === reference.stateHash &&\n        state.keyFingerprint === reference.keyFingerprint,\n    )\n  ) {\n    return {\n      code: \"hash_mismatch\",\n      message: \"bundle chain does not contain referenced principal\",\n    };\n  }\n  if (\n    bundle.currentMemberEnvelopes.principalType !==\n      bundle.currentState.principalType ||\n    bundle.currentMemberEnvelopes.principalId !==\n      bundle.currentState.principalId\n  ) {\n    return {\n      code: \"object_mismatch\",\n      message: \"member envelope principal does not match current principal\",\n    };\n  }\n  if (\n    bundle.currentMemberEnvelopes.stateHash !== bundle.currentState.stateHash\n  ) {\n    return {\n      code: \"hash_mismatch\",\n      message: \"member envelope state hash does not match current principal\",\n    };\n  }\n  if (bundle.currentMemberEnvelopes.epoch !== bundle.currentState.keyEpoch) {\n    return {\n      code: \"hash_mismatch\",\n      message: \"member envelope epoch does not match current principal\",\n    };\n  }\n  if (\n    bundle.currentPayload.principalType !== bundle.currentState.principalType ||\n    bundle.currentPayload.principalId !== bundle.currentState.principalId\n  ) {\n    return {\n      code: \"object_mismatch\",\n      message: \"payload principal does not match current principal\",\n    };\n  }\n  if (bundle.currentPayload.stateHash !== bundle.currentState.stateHash) {\n    return {\n      code: \"hash_mismatch\",\n      message: \"payload state hash does not match current principal\",\n    };\n  }\n  return null;\n}\n\nfunction getCheckpointFailure(\n  checkpoint: PrincipalPolicyCheckpoint | null,\n  bundle: PrincipalPolicyBundleResponse,\n): PrincipalPolicyValidationFailure | null {\n  if (!checkpoint) {\n    return null;\n  }\n  const current = bundle.currentState;\n  if (current.version < checkpoint.version) {\n    return {\n      code: \"rollback\",\n      message: \"principal policy state is older than the local checkpoint\",\n    };\n  }\n  if (\n    current.version === checkpoint.version &&\n    current.stateHash !== checkpoint.stateHash\n  ) {\n    return {\n      code: \"equivocation\",\n      message: \"principal policy state conflicts with the local checkpoint\",\n    };\n  }\n  if (current.version === checkpoint.version) {\n    return null;\n  }\n  const checkpointState = principalPolicyStates(bundle).find(\n    (state) => state.version === checkpoint.version,\n  );\n  return checkpointState?.stateHash === checkpoint.stateHash\n    ? null\n    : {\n        code: \"stale_predecessor\",\n        message: \"principal policy chain does not extend the local checkpoint\",\n      };\n}\n\nfunction signerPublicKeyLoadFailure(\n  code: PrincipalPolicySignerPublicKeyLoadErrorCode,\n): PrincipalPolicyValidationFailure {\n  switch (code) {\n    case \"fingerprint-mismatch\":\n      return {\n        code: \"signer_mismatch\",\n        message: \"signer key fingerprint does not match state signer\",\n      };\n    case \"not-found\":\n      // The identity source throws for transport failures, so an absent\n      // signer here is the server asserting the cited user does not exist.\n      return {\n        code: \"missing_dependency\",\n        message: \"signer identity is unknown to the server\",\n      };\n  }\n}\n\nfunction verificationError(\n  failure: PrincipalPolicyValidationFailure,\n): KeyingVerificationError {\n  return new KeyingVerificationError(failure.code, failure.message);\n}\n\nexport async function validatePrincipalPolicyBundleForCache(input: {\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly loadExternalAdminPolicy: () => Promise<VerifiedExternalAdminPolicy | null>;\n  readonly localCheckpoint: PrincipalPolicyCheckpoint | null;\n  readonly reference: ReferencedPrincipalStateResponse;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}): Promise<\n  | {\n      readonly externalAdminPolicy: VerifiedExternalAdminPolicy | null;\n      readonly ok: true;\n      readonly policy: VerifiedPrincipalPolicy;\n    }\n  | { readonly error: KeyingVerificationError; readonly ok: false }\n> {\n  const referenceFailure = getBundleReferenceFailure(\n    input.reference,\n    input.bundle,\n  );\n  if (referenceFailure) {\n    return { error: verificationError(referenceFailure), ok: false };\n  }\n  const checkpointFailure = getCheckpointFailure(\n    input.localCheckpoint,\n    input.bundle,\n  );\n  if (checkpointFailure) {\n    return { error: verificationError(checkpointFailure), ok: false };\n  }\n  const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({\n    bundle: input.bundle,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  if (\"error\" in signerPublicKeys) {\n    return {\n      error: verificationError(\n        signerPublicKeyLoadFailure(signerPublicKeys.error),\n      ),\n      ok: false,\n    };\n  }\n\n  let usedExternalAdminPolicy = false;\n  const verified =\n    await verifyPrincipalPolicyBundleWithExternalOrganizationAdmins({\n      bundle: input.bundle,\n      expectedReference: input.reference,\n      loadExternalAuthority: async () => {\n        usedExternalAdminPolicy = true;\n        return (\n          (await input.loadExternalAdminPolicy())?.externalAuthority ?? null\n        );\n      },\n      localCheckpoint: input.localCheckpoint,\n      signerPublicKeys: signerPublicKeys.signerPublicKeys,\n    });\n  return verified.ok\n    ? {\n        externalAdminPolicy: usedExternalAdminPolicy\n          ? await input.loadExternalAdminPolicy()\n          : null,\n        ok: true,\n        policy: verified.value,\n      }\n    : { error: verified.error, ok: false };\n}\n"]}

package/workflows/principals/policyCache/principalPolicyOrganizationScope.js

@@ -0,0 +1,67 @@
+import { KeyingVerificationError, } from "../../../internal/crypto/index.js";
+import { loadPrincipalPolicyCheckpoint } from "../../../data/persistence/keyingCheckpointPersistence.js";
+import { principalPolicyHeadMeetsCheckpoint } from "../../../data/persistence/principalPolicyCheckpointSelection.js";
+import { loadPrincipalPolicyBundle } from "../../../data/persistence/principalPolicyPersistence.js";
+import { parseOrganizationAuthorityDescriptor, principalHeadMatchesReference, } from "../../../data/principals/organizationAuthorityDescriptor.js";
+import { verifyOrganizationAdminPolicy } from "../../../data/principals/principalPolicyAdminSigners.js";
+import { collectPrincipalPolicySignerPublicKeys } from "../policyVerification.js";
+export function directoryBindsGroupReference(directory, policy, reference) {
+    const head = directory?.descriptor.groupHeads.find((head) => head.principalId === reference.principalId);
+    // A newer directory head authenticates its verified predecessors too.
+    // Requiring equality with a historical manifest citation bricks old reads.
+    return (!!head &&
+        head.version >= reference.version &&
+        head.version === policy.version &&
+        [policy.state, ...(policy.history ?? []).map((entry) => entry.state)].some((state) => principalHeadMatchesReference(state, head)));
+}
+export function createPolicyDirectoryLoader(input) {
+    const memo = new Map();
+    const load = async (remote) => {
+        const checkpoint = await loadPrincipalPolicyCheckpoint(input.execSql, "organization", input.organizationId);
+        let bundle = remote
+            ? null
+            : await loadPrincipalPolicyBundle(input.execSql, "organization", input.organizationId);
+        if (bundle &&
+            !principalPolicyHeadMeetsCheckpoint(bundle.currentState, checkpoint))
+            bundle = null;
+        bundle ??= await input.currentPolicyReader.getCurrentPrincipalPolicy("organization", input.organizationId);
+        if (!bundle)
+            return null;
+        const signers = await collectPrincipalPolicySignerPublicKeys({
+            bundle,
+            resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+        });
+        if ("error" in signers) {
+            if (signers.error === "fingerprint-mismatch")
+                throw new KeyingVerificationError("signer_mismatch", "organization directory signer fingerprint does not match");
+            return null;
+        }
+        const verified = await verifyOrganizationAdminPolicy({
+            bundle,
+            localCheckpoint: checkpoint,
+            organizationId: input.organizationId,
+            signerPublicKeys: signers.signerPublicKeys,
+        });
+        if (!verified.ok)
+            throw verified.error;
+        let descriptor;
+        try {
+            descriptor = parseOrganizationAuthorityDescriptor(bundle.currentPayload.ciphertext);
+        }
+        catch {
+            throw new KeyingVerificationError("invalid_shape", "organization directory payload is invalid");
+        }
+        if (descriptor.organizationId !== input.organizationId)
+            throw new KeyingVerificationError("object_mismatch", "organization directory scope does not match");
+        return { bundle, policy: verified.value, descriptor };
+    };
+    return (remote) => {
+        let pending = memo.get(remote);
+        if (!pending) {
+            pending = load(remote);
+            memo.set(remote, pending);
+        }
+        return pending;
+    };
+}
+//# sourceMappingURL=principalPolicyOrganizationScope.js.map

package/workflows/principals/policyCache/principalPolicyOrganizationScope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalPolicyOrganizationScope.js","sourceRoot":"","sources":["principalPolicyOrganizationScope.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAGxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,EAAE,kCAAkC,EAAE,MAAM,8DAA8D,CAAC;AAClH,OAAO,EAAE,yBAAyB,EAAE,MAAM,sDAAsD,CAAC;AACjG,OAAO,EAEL,oCAAoC,EACpC,6BAA6B,GAC9B,MAAM,0DAA0D,CAAC;AAClE,OAAO,EAAE,6BAA6B,EAAE,MAAM,sDAAsD,CAAC;AAIrG,OAAO,EAAE,sCAAsC,EAAE,MAAM,uBAAuB,CAAC;AAY/E,MAAM,UAAU,4BAA4B,CAC1C,SAAyC,EACzC,MAA+B,EAC/B,SAAkC;IAElC,MAAM,IAAI,GAAG,SAAS,EAAE,UAAU,CAAC,UAAU,CAAC,IAAI,CAChD,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW,CACrD,CAAC;IACF,sEAAsE;IACtE,2EAA2E;IAC3E,OAAO,CACL,CAAC,CAAC,IAAI;QACN,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC,OAAO;QACjC,IAAI,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;QAC/B,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CACxE,CAAC,KAAK,EAAE,EAAE,CAAC,6BAA6B,CAAC,KAAK,EAAE,IAAI,CAAC,CACtD,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAK3C;IACC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAoD,CAAC;IACzE,MAAM,IAAI,GAAG,KAAK,EAChB,MAAe,EAC0B,EAAE;QAC3C,MAAM,UAAU,GAAG,MAAM,6BAA6B,CACpD,KAAK,CAAC,OAAO,EACb,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,IAAI,MAAM,GAAG,MAAM;YACjB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,MAAM,yBAAyB,CAC7B,KAAK,CAAC,OAAO,EACb,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;QACN,IACE,MAAM;YACN,CAAC,kCAAkC,CAAC,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC;YAEpE,MAAM,GAAG,IAAI,CAAC;QAChB,MAAM,KAAK,MAAM,KAAK,CAAC,mBAAmB,CAAC,yBAAyB,CAClE,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,OAAO,GAAG,MAAM,sCAAsC,CAAC;YAC3D,MAAM;YACN,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;SAC7D,CAAC,CAAC;QACH,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;YACvB,IAAI,OAAO,CAAC,KAAK,KAAK,sBAAsB;gBAC1C,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,0DAA0D,CAC3D,CAAC;YACJ,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC;YACnD,MAAM;YACN,eAAe,EAAE,UAAU;YAC3B,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;SAC3C,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;QACvC,IAAI,UAA2C,CAAC;QAChD,IAAI,CAAC;YACH,UAAU,GAAG,oCAAoC,CAC/C,MAAM,CAAC,cAAc,CAAC,UAAU,CACjC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,2CAA2C,CAC5C,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;YACpD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,6CAA6C,CAC9C,CAAC;QACJ,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC;IACxD,CAAC,CAAC;IACF,OAAO,CAAC,MAAM,EAAE,EAAE;QAChB,IAAI,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;YACvB,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC5B,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type ReferencedPrincipalHead,\n  type VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../../data/persistence/keyingCheckpointPersistence\";\nimport { principalPolicyHeadMeetsCheckpoint } from \"../../../data/persistence/principalPolicyCheckpointSelection\";\nimport { loadPrincipalPolicyBundle } from \"../../../data/persistence/principalPolicyPersistence\";\nimport {\n  type OrganizationAuthorityDescriptor,\n  parseOrganizationAuthorityDescriptor,\n  principalHeadMatchesReference,\n} from \"../../../data/principals/organizationAuthorityDescriptor\";\nimport { verifyOrganizationAdminPolicy } from \"../../../data/principals/principalPolicyAdminSigners\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../../data/trustedUserIdentity\";\nimport type { CurrentPrincipalPolicyReader } from \"../currentPrincipalPolicyReader\";\nimport { collectPrincipalPolicySignerPublicKeys } from \"../policyVerification\";\n\nexport interface VerifiedPolicyDirectory {\n  readonly bundle: PrincipalPolicyBundleResponse;\n  readonly policy: VerifiedPrincipalPolicy;\n  readonly descriptor: OrganizationAuthorityDescriptor;\n}\n\nexport type PolicyDirectoryLoader = (\n  remote: boolean,\n) => Promise<VerifiedPolicyDirectory | null>;\n\nexport function directoryBindsGroupReference(\n  directory: VerifiedPolicyDirectory | null,\n  policy: VerifiedPrincipalPolicy,\n  reference: ReferencedPrincipalHead,\n): boolean {\n  const head = directory?.descriptor.groupHeads.find(\n    (head) => head.principalId === reference.principalId,\n  );\n  // A newer directory head authenticates its verified predecessors too.\n  // Requiring equality with a historical manifest citation bricks old reads.\n  return (\n    !!head &&\n    head.version >= reference.version &&\n    head.version === policy.version &&\n    [policy.state, ...(policy.history ?? []).map((entry) => entry.state)].some(\n      (state) => principalHeadMatchesReference(state, head),\n    )\n  );\n}\n\nexport function createPolicyDirectoryLoader(input: {\n  readonly execSql: ExecSql;\n  readonly organizationId: string;\n  readonly currentPolicyReader: CurrentPrincipalPolicyReader;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}): PolicyDirectoryLoader {\n  const memo = new Map<boolean, Promise<VerifiedPolicyDirectory | null>>();\n  const load = async (\n    remote: boolean,\n  ): Promise<VerifiedPolicyDirectory | null> => {\n    const checkpoint = await loadPrincipalPolicyCheckpoint(\n      input.execSql,\n      \"organization\",\n      input.organizationId,\n    );\n    let bundle = remote\n      ? null\n      : await loadPrincipalPolicyBundle(\n          input.execSql,\n          \"organization\",\n          input.organizationId,\n        );\n    if (\n      bundle &&\n      !principalPolicyHeadMeetsCheckpoint(bundle.currentState, checkpoint)\n    )\n      bundle = null;\n    bundle ??= await input.currentPolicyReader.getCurrentPrincipalPolicy(\n      \"organization\",\n      input.organizationId,\n    );\n    if (!bundle) return null;\n    const signers = await collectPrincipalPolicySignerPublicKeys({\n      bundle,\n      resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    });\n    if (\"error\" in signers) {\n      if (signers.error === \"fingerprint-mismatch\")\n        throw new KeyingVerificationError(\n          \"signer_mismatch\",\n          \"organization directory signer fingerprint does not match\",\n        );\n      return null;\n    }\n    const verified = await verifyOrganizationAdminPolicy({\n      bundle,\n      localCheckpoint: checkpoint,\n      organizationId: input.organizationId,\n      signerPublicKeys: signers.signerPublicKeys,\n    });\n    if (!verified.ok) throw verified.error;\n    let descriptor: OrganizationAuthorityDescriptor;\n    try {\n      descriptor = parseOrganizationAuthorityDescriptor(\n        bundle.currentPayload.ciphertext,\n      );\n    } catch {\n      throw new KeyingVerificationError(\n        \"invalid_shape\",\n        \"organization directory payload is invalid\",\n      );\n    }\n    if (descriptor.organizationId !== input.organizationId)\n      throw new KeyingVerificationError(\n        \"object_mismatch\",\n        \"organization directory scope does not match\",\n      );\n    return { bundle, policy: verified.value, descriptor };\n  };\n  return (remote) => {\n    let pending = memo.get(remote);\n    if (!pending) {\n      pending = load(remote);\n      memo.set(remote, pending);\n    }\n    return pending;\n  };\n}\n"]}