@tearleads/client-sdk 0.1.61 → 0.1.63

package/workflows/organizations/groupMetadataAccess.js

@@ -1,114 +0,0 @@
-import { decryptGroupMetadata, readGroupMetadata, } from "../../internal/crypto/index.js";
-import { deriveOrganizationMetadataContainerSystemSlot } from "../../internal/validators/containerSystemSlot.js";
-import { getTargetContainerContext, readContainerState, } from "../../data/containers/shared/projection.js";
-import { unwrapContainerKekPath } from "../../data/documents/shared/containerKekPath.js";
-import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
-import { loadContainers } from "../../data/persistence/containers/containerPersistence.js";
-import { withMetadataRootReload } from "./groupMetadataErrors.js";
-/**
- * A group's signed name does not open under the metadata key it cites, or opens
- * to an invalid name. Every reader holding that key gets the same result. The
- * API checks the citation but can never check the ciphertext, so a dishonest
- * admin can sign such a name; directory walks isolate the group instead of
- * failing every name in the organization.
- */
-export class GroupMetadataUnreadableError extends Error {
-    constructor(groupId, cause) {
-        super(`Group ${groupId} metadata cannot be decrypted`, { cause });
-        this.name = "GroupMetadataUnreadableError";
-    }
-}
-function loadMetadataKeyring(input, containerId) {
-    return withMetadataRootReload(() => loadMetadataKeyringOnce(input, containerId), () => input.apiClient.evictContainerWriterProjection(containerId));
-}
-async function loadMetadataKeyringOnce(input, containerId) {
-    const projection = await input.apiClient.getContainerWriterProjection(containerId);
-    if (!projection)
-        return null;
-    if (projection.containerId !== containerId ||
-        projection.organizationId !== input.organizationId)
-        throw new Error("Group metadata container is unavailable");
-    const target = getTargetContainerContext(projection);
-    const state = readContainerState(target.manifest);
-    const slot = await deriveOrganizationMetadataContainerSystemSlot({
-        organizationId: input.organizationId,
-    });
-    if (state.organizationId !== input.organizationId ||
-        state.systemSlot !== slot ||
-        state.parentContainerId !== null)
-        throw new Error("Group metadata requires the signed organization metadata container");
-    await input.verifyMetadataContainer(state, projection.policyEvidence.organization?.head);
-    assertProjectionVerificationCurrent(input.stillCurrent);
-    const keys = await unwrapContainerKekPath({
-        ...input,
-        projection,
-        secretKey: input.targetSecretKey,
-    });
-    assertProjectionVerificationCurrent(input.stillCurrent);
-    const keyMaterial = keys.get(target.kek.containerKeyEpochId);
-    if (!keyMaterial)
-        throw new Error("Group metadata container key is unavailable");
-    return {
-        current: {
-            organizationId: input.organizationId,
-            containerId,
-            containerKeyEpochId: target.kek.containerKeyEpochId,
-            keyMaterial,
-        },
-        keys,
-    };
-}
-/** Uses the shared metadata container's authenticated keyring, including old epochs. */
-export function createGroupMetadataAccess(input) {
-    const loads = new Map();
-    function loaded(containerId) {
-        let pending = loads.get(containerId);
-        if (!pending) {
-            pending = loadMetadataKeyring(input, containerId);
-            loads.set(containerId, pending);
-        }
-        return pending;
-    }
-    const readName = async (bundle) => {
-        assertProjectionVerificationCurrent(input.stillCurrent);
-        const metadata = readGroupMetadata(bundle.currentPayload.ciphertext);
-        if ("role" in metadata)
-            return metadata.role === "admins" ? "Admins" : "Members";
-        if (metadata.organizationId !== input.organizationId ||
-            metadata.groupId !== bundle.currentState.principalId ||
-            bundle.currentState.principalType !== "group")
-            throw new Error("Group metadata scope does not match its signed group");
-        const keyring = await loaded(metadata.containerId);
-        const keyMaterial = keyring?.keys.get(metadata.containerKeyEpochId);
-        if (!keyMaterial)
-            throw new Error("Group metadata historical key is unavailable");
-        try {
-            return await decryptGroupMetadata({
-                key: { ...metadata, keyMaterial },
-                groupId: bundle.currentState.principalId,
-                payload: bundle.currentPayload.ciphertext,
-            });
-        }
-        catch (cause) {
-            throw new GroupMetadataUnreadableError(bundle.currentState.principalId, cause);
-        }
-    };
-    return {
-        readName,
-        async loadEncryptionKey() {
-            const slot = await deriveOrganizationMetadataContainerSystemSlot({
-                organizationId: input.organizationId,
-            });
-            const containers = await loadContainers(input.execSql);
-            const container = containers.find((row) => row.organizationId === input.organizationId &&
-                row.systemSlot === slot);
-            if (!container)
-                throw new Error("Organization metadata container has not been discovered");
-            const keyring = await loaded(container.id);
-            if (!keyring)
-                throw new Error("Group metadata container is unavailable");
-            return keyring.current;
-        },
-    };
-}
-//# sourceMappingURL=groupMetadataAccess.js.map

package/workflows/organizations/groupMetadataAccess.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"groupMetadataAccess.js","sourceRoot":"","sources":["groupMetadataAccess.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,oBAAoB,EAGpB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,6CAA6C,EAAE,MAAM,2CAA2C,CAAC;AAE1G,OAAO,EACL,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,8CAA8C,CAAC;AAKtF,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,cAAc,EAAE,MAAM,wDAAwD,CAAC;AAExF,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAwB/D;;;;;;GAMG;AACH,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACrD,YAAY,OAAe,EAAE,KAAc;QACzC,KAAK,CAAC,SAAS,OAAO,+BAA+B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AAED,SAAS,mBAAmB,CAC1B,KAA+B,EAC/B,WAAmB;IAEnB,OAAO,sBAAsB,CAC3B,GAAG,EAAE,CAAC,uBAAuB,CAAC,KAAK,EAAE,WAAW,CAAC,EACjD,GAAG,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,8BAA8B,CAAC,WAAW,CAAC,CAClE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,KAA+B,EAC/B,WAAmB;IAEnB,MAAM,UAAU,GACd,MAAM,KAAK,CAAC,SAAS,CAAC,4BAA4B,CAAC,WAAW,CAAC,CAAC;IAClE,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,IACE,UAAU,CAAC,WAAW,KAAK,WAAW;QACtC,UAAU,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QAElD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,6CAA6C,CAAC;QAC/D,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,IACE,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QAC7C,KAAK,CAAC,UAAU,KAAK,IAAI;QACzB,KAAK,CAAC,iBAAiB,KAAK,IAAI;QAEhC,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;IACJ,MAAM,KAAK,CAAC,uBAAuB,CACjC,KAAK,EACL,UAAU,CAAC,cAAc,CAAC,YAAY,EAAE,IAAI,CAC7C,CAAC;IACF,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC;QACxC,GAAG,KAAK;QACR,UAAU;QACV,SAAS,EAAE,KAAK,CAAC,eAAe;KACjC,CAAC,CAAC;IACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC7D,IAAI,CAAC,WAAW;QACd,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,OAAO;QACL,OAAO,EAAE;YACP,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,WAAW;YACX,mBAAmB,EAAE,MAAM,CAAC,GAAG,CAAC,mBAAmB;YACnD,WAAW;SACZ;QACD,IAAI;KACL,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,yBAAyB,CAAC,KAA+B;IACvE,MAAM,KAAK,GAAG,IAAI,GAAG,EAMlB,CAAC;IACJ,SAAS,MAAM,CAAC,WAAmB;QACjC,IAAI,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,mBAAmB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;YAClD,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,QAAQ,GAA0B,KAAK,EAAE,MAAM,EAAE,EAAE;QACvD,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QACrE,IAAI,MAAM,IAAI,QAAQ;YACpB,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3D,IACE,QAAQ,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;YAChD,QAAQ,CAAC,OAAO,KAAK,MAAM,CAAC,YAAY,CAAC,WAAW;YACpD,MAAM,CAAC,YAAY,CAAC,aAAa,KAAK,OAAO;YAE7C,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;QACpE,IAAI,CAAC,WAAW;YACd,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,IAAI,CAAC;YACH,OAAO,MAAM,oBAAoB,CAAC;gBAChC,GAAG,EAAE,EAAE,GAAG,QAAQ,EAAE,WAAW,EAAE;gBACjC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW;gBACxC,OAAO,EAAE,MAAM,CAAC,cAAc,CAAC,UAAU;aAC1C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,4BAA4B,CACpC,MAAM,CAAC,YAAY,CAAC,WAAW,EAC/B,KAAK,CACN,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;IACF,OAAO;QACL,QAAQ;QACR,KAAK,CAAC,iBAAiB;YACrB,MAAM,IAAI,GAAG,MAAM,6CAA6C,CAAC;gBAC/D,cAAc,EAAE,KAAK,CAAC,cAAc;aACrC,CAAC,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACvD,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAC/B,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;gBAC3C,GAAG,CAAC,UAAU,KAAK,IAAI,CAC1B,CAAC;YACF,IAAI,CAAC,SAAS;gBACZ,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;YACJ,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAC3C,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;YACzE,OAAO,OAAO,CAAC,OAAO,CAAC;QACzB,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import {\n  type ContainerAccessManifestState,\n  decryptGroupMetadata,\n  type GroupMetadataKey,\n  type ReferencedPrincipalHead,\n  readGroupMetadata,\n} from \"@tearleads/crypto\";\nimport { deriveOrganizationMetadataContainerSystemSlot } from \"@tearleads/validators/containerSystemSlot\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport {\n  getTargetContainerContext,\n  readContainerState,\n} from \"../../data/containers/shared/projection\";\nimport { unwrapContainerKekPath } from \"../../data/documents/shared/containerKekPath\";\nimport type {\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"../../data/keyingProjectionVerification\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { loadContainers } from \"../../data/persistence/containers/containerPersistence\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport { withMetadataRootReload } from \"./groupMetadataErrors\";\nimport type { GroupPolicyNameReader } from \"./principalPolicyRequest\";\n\nexport interface GroupMetadataAccessInput {\n  readonly apiClient: {\n    evictContainerWriterProjection(containerId: string): void;\n    getContainerWriterProjection(\n      containerId: string,\n    ): Promise<ContainerWriterProjectionResponse | null>;\n  };\n  readonly verifyMetadataContainer: (\n    state: ContainerAccessManifestState,\n    organizationReference?: ReferencedPrincipalHead | undefined,\n  ) => Promise<void>;\n  readonly execSql: ExecSql;\n  readonly organizationId: string;\n  readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n  readonly targetSecretKey: Uint8Array;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly warmReferencedPrincipalPolicies?:\n    | ReferencedPrincipalPolicyWarmer\n    | undefined;\n}\n\n/**\n * A group's signed name does not open under the metadata key it cites, or opens\n * to an invalid name. Every reader holding that key gets the same result. The\n * API checks the citation but can never check the ciphertext, so a dishonest\n * admin can sign such a name; directory walks isolate the group instead of\n * failing every name in the organization.\n */\nexport class GroupMetadataUnreadableError extends Error {\n  constructor(groupId: string, cause: unknown) {\n    super(`Group ${groupId} metadata cannot be decrypted`, { cause });\n    this.name = \"GroupMetadataUnreadableError\";\n  }\n}\n\nfunction loadMetadataKeyring(\n  input: GroupMetadataAccessInput,\n  containerId: string,\n) {\n  return withMetadataRootReload(\n    () => loadMetadataKeyringOnce(input, containerId),\n    () => input.apiClient.evictContainerWriterProjection(containerId),\n  );\n}\n\nasync function loadMetadataKeyringOnce(\n  input: GroupMetadataAccessInput,\n  containerId: string,\n) {\n  const projection =\n    await input.apiClient.getContainerWriterProjection(containerId);\n  if (!projection) return null;\n  if (\n    projection.containerId !== containerId ||\n    projection.organizationId !== input.organizationId\n  )\n    throw new Error(\"Group metadata container is unavailable\");\n  const target = getTargetContainerContext(projection);\n  const state = readContainerState(target.manifest);\n  const slot = await deriveOrganizationMetadataContainerSystemSlot({\n    organizationId: input.organizationId,\n  });\n  if (\n    state.organizationId !== input.organizationId ||\n    state.systemSlot !== slot ||\n    state.parentContainerId !== null\n  )\n    throw new Error(\n      \"Group metadata requires the signed organization metadata container\",\n    );\n  await input.verifyMetadataContainer(\n    state,\n    projection.policyEvidence.organization?.head,\n  );\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  const keys = await unwrapContainerKekPath({\n    ...input,\n    projection,\n    secretKey: input.targetSecretKey,\n  });\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  const keyMaterial = keys.get(target.kek.containerKeyEpochId);\n  if (!keyMaterial)\n    throw new Error(\"Group metadata container key is unavailable\");\n  return {\n    current: {\n      organizationId: input.organizationId,\n      containerId,\n      containerKeyEpochId: target.kek.containerKeyEpochId,\n      keyMaterial,\n    },\n    keys,\n  };\n}\n\n/** Uses the shared metadata container's authenticated keyring, including old epochs. */\nexport function createGroupMetadataAccess(input: GroupMetadataAccessInput) {\n  const loads = new Map<\n    string,\n    Promise<{\n      current: GroupMetadataKey;\n      keys: ReadonlyMap<string, Uint8Array>;\n    } | null>\n  >();\n  function loaded(containerId: string) {\n    let pending = loads.get(containerId);\n    if (!pending) {\n      pending = loadMetadataKeyring(input, containerId);\n      loads.set(containerId, pending);\n    }\n    return pending;\n  }\n  const readName: GroupPolicyNameReader = async (bundle) => {\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    const metadata = readGroupMetadata(bundle.currentPayload.ciphertext);\n    if (\"role\" in metadata)\n      return metadata.role === \"admins\" ? \"Admins\" : \"Members\";\n    if (\n      metadata.organizationId !== input.organizationId ||\n      metadata.groupId !== bundle.currentState.principalId ||\n      bundle.currentState.principalType !== \"group\"\n    )\n      throw new Error(\"Group metadata scope does not match its signed group\");\n    const keyring = await loaded(metadata.containerId);\n    const keyMaterial = keyring?.keys.get(metadata.containerKeyEpochId);\n    if (!keyMaterial)\n      throw new Error(\"Group metadata historical key is unavailable\");\n    try {\n      return await decryptGroupMetadata({\n        key: { ...metadata, keyMaterial },\n        groupId: bundle.currentState.principalId,\n        payload: bundle.currentPayload.ciphertext,\n      });\n    } catch (cause) {\n      throw new GroupMetadataUnreadableError(\n        bundle.currentState.principalId,\n        cause,\n      );\n    }\n  };\n  return {\n    readName,\n    async loadEncryptionKey(): Promise<GroupMetadataKey> {\n      const slot = await deriveOrganizationMetadataContainerSystemSlot({\n        organizationId: input.organizationId,\n      });\n      const containers = await loadContainers(input.execSql);\n      const container = containers.find(\n        (row) =>\n          row.organizationId === input.organizationId &&\n          row.systemSlot === slot,\n      );\n      if (!container)\n        throw new Error(\n          \"Organization metadata container has not been discovered\",\n        );\n      const keyring = await loaded(container.id);\n      if (!keyring) throw new Error(\"Group metadata container is unavailable\");\n      return keyring.current;\n    },\n  };\n}\n"]}

package/workflows/organizations/groupMetadataBinding.js

@@ -1,19 +0,0 @@
-import { readGroupMetadata } from "../../internal/crypto/index.js";
-/** Built-in labels derive from the role assigned by the signed organization. */
-export function assertGroupMetadataBinding(bundle, descriptor) {
-    const groupId = bundle.currentState.principalId;
-    const metadata = readGroupMetadata(bundle.currentPayload.ciphertext);
-    const expectedRole = groupId === descriptor.adminGroupId
-        ? "admins"
-        : groupId === descriptor.memberGroupId
-            ? "members"
-            : null;
-    if ("role" in metadata
-        ? metadata.role !== expectedRole
-        : expectedRole !== null ||
-            metadata.organizationId !== descriptor.organizationId ||
-            metadata.groupId !== groupId) {
-        throw new Error("Group metadata does not match the signed organization directory");
-    }
-}
-//# sourceMappingURL=groupMetadataBinding.js.map

package/workflows/organizations/groupMetadataBinding.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"groupMetadataBinding.js","sourceRoot":"","sources":["groupMetadataBinding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAItD,gFAAgF;AAChF,MAAM,UAAU,0BAA0B,CACxC,MAGC,EACD,UAA2C;IAE3C,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC;IAChD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IACrE,MAAM,YAAY,GAChB,OAAO,KAAK,UAAU,CAAC,YAAY;QACjC,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,OAAO,KAAK,UAAU,CAAC,aAAa;YACpC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,CAAC;IACb,IACE,MAAM,IAAI,QAAQ;QAChB,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;QAChC,CAAC,CAAC,YAAY,KAAK,IAAI;YACrB,QAAQ,CAAC,cAAc,KAAK,UAAU,CAAC,cAAc;YACrD,QAAQ,CAAC,OAAO,KAAK,OAAO,EAChC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import { readGroupMetadata } from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport type { OrganizationAuthorityDescriptor } from \"../../data/principals/organizationAuthorityDescriptor\";\n\n/** Built-in labels derive from the role assigned by the signed organization. */\nexport function assertGroupMetadataBinding(\n  bundle: Pick<\n    PrincipalPolicyBundleResponse,\n    \"currentState\" | \"currentPayload\"\n  >,\n  descriptor: OrganizationAuthorityDescriptor,\n): void {\n  const groupId = bundle.currentState.principalId;\n  const metadata = readGroupMetadata(bundle.currentPayload.ciphertext);\n  const expectedRole =\n    groupId === descriptor.adminGroupId\n      ? \"admins\"\n      : groupId === descriptor.memberGroupId\n        ? \"members\"\n        : null;\n  if (\n    \"role\" in metadata\n      ? metadata.role !== expectedRole\n      : expectedRole !== null ||\n        metadata.organizationId !== descriptor.organizationId ||\n        metadata.groupId !== groupId\n  ) {\n    throw new Error(\n      \"Group metadata does not match the signed organization directory\",\n    );\n  }\n}\n"]}

package/workflows/organizations/groupMetadataContainerAuthority.js

@@ -1,41 +0,0 @@
-import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
-import { loadPrincipalPolicyBundle } from "../../data/persistence/principalPolicyPersistence.js";
-import { principalHeadMatchesReference, requireOrganizationGroupHead, } from "../../data/principals/organizationAuthorityDescriptor.js";
-import { principalPolicyReferenceFromBundle } from "../../data/principals/principalPolicyAdminSigners.js";
-import { assertMetadataRootBinding } from "./groupMetadataRootBinding.js";
-import { verifyDirectoryGroup } from "./groupNameUniqueness.js";
-import { loadGroupNameDirectoryAuthority } from "./organizationGroupNamePolicies.js";
-/** A public system slot alone cannot bind a self-authorized root to an organization. */
-export function createGroupMetadataContainerVerifier(input) {
-    return async (state) => {
-        assertProjectionVerificationCurrent(input.stillCurrent);
-        const cached = await loadPrincipalPolicyBundle(input.execSql, "organization", input.organizationId);
-        let authority = await loadGroupNameDirectoryAuthority({
-            ...input,
-            organizationPolicyReference: cached
-                ? principalPolicyReferenceFromBundle(cached)
-                : null,
-        });
-        if (cached &&
-            authority &&
-            state.referencedPrincipalHeads.some((head) => !authority?.descriptor.groupHeads.some((known) => principalHeadMatchesReference(head, known)))) {
-            authority = await loadGroupNameDirectoryAuthority(input);
-        }
-        if (!authority)
-            throw new Error("Organization metadata authority is unavailable");
-        const memberHead = requireOrganizationGroupHead(authority.descriptor, authority.memberGroupId);
-        const members = await verifyDirectoryGroup({
-            ...input,
-            descriptor: authority.descriptor,
-            externalAuthority: authority.externalAuthority,
-        }, memberHead);
-        assertMetadataRootBinding({
-            authority,
-            members,
-            organizationId: input.organizationId,
-            state,
-        });
-        assertProjectionVerificationCurrent(input.stillCurrent);
-    };
-}
-//# sourceMappingURL=groupMetadataContainerAuthority.js.map

package/workflows/organizations/groupMetadataContainerAuthority.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"groupMetadataContainerAuthority.js","sourceRoot":"","sources":["groupMetadataContainerAuthority.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,yBAAyB,EAAE,MAAM,mDAAmD,CAAC;AAC9F,OAAO,EACL,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAEvG,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,+BAA+B,EAAE,MAAM,iCAAiC,CAAC;AAOlF,wFAAwF;AACxF,MAAM,UAAU,oCAAoC,CAAC,KAAY;IAC/D,OAAO,KAAK,EAAE,KAAmC,EAAiB,EAAE;QAClE,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAC5C,KAAK,CAAC,OAAO,EACb,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,IAAI,SAAS,GAAG,MAAM,+BAA+B,CAAC;YACpD,GAAG,KAAK;YACR,2BAA2B,EAAE,MAAM;gBACjC,CAAC,CAAC,kCAAkC,CAAC,MAAM,CAAC;gBAC5C,CAAC,CAAC,IAAI;SACT,CAAC,CAAC;QACH,IACE,MAAM;YACN,SAAS;YACT,KAAK,CAAC,wBAAwB,CAAC,IAAI,CACjC,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,SAAS,EAAE,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAC/C,6BAA6B,CAAC,IAAI,EAAE,KAAK,CAAC,CAC3C,CACJ,EACD,CAAC;YACD,SAAS,GAAG,MAAM,+BAA+B,CAAC,KAAK,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,CAAC,SAAS;YACZ,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,MAAM,UAAU,GAAG,4BAA4B,CAC7C,SAAS,CAAC,UAAU,EACpB,SAAS,CAAC,aAAa,CACxB,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,oBAAoB,CACxC;YACE,GAAG,KAAK;YACR,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;SAC/C,EACD,UAAU,CACX,CAAC;QACF,yBAAyB,CAAC;YACxB,SAAS;YACT,OAAO;YACP,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,KAAK;SACN,CAAC,CAAC;QACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC1D,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import type { ContainerAccessManifestState } from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { loadPrincipalPolicyBundle } from \"../../data/persistence/principalPolicyPersistence\";\nimport {\n  principalHeadMatchesReference,\n  requireOrganizationGroupHead,\n} from \"../../data/principals/organizationAuthorityDescriptor\";\nimport { principalPolicyReferenceFromBundle } from \"../../data/principals/principalPolicyAdminSigners\";\nimport type { SecurityIncidentReporter } from \"../../data/shared/securityIncidents\";\nimport { assertMetadataRootBinding } from \"./groupMetadataRootBinding\";\nimport { verifyDirectoryGroup } from \"./groupNameUniqueness\";\nimport { loadGroupNameDirectoryAuthority } from \"./organizationGroupNamePolicies\";\n\ntype Input = Omit<\n  Parameters<typeof loadGroupNameDirectoryAuthority>[0],\n  \"organizationPolicyReference\"\n> & { readonly reportSecurityIncident: SecurityIncidentReporter };\n\n/** A public system slot alone cannot bind a self-authorized root to an organization. */\nexport function createGroupMetadataContainerVerifier(input: Input) {\n  return async (state: ContainerAccessManifestState): Promise<void> => {\n    assertProjectionVerificationCurrent(input.stillCurrent);\n    const cached = await loadPrincipalPolicyBundle(\n      input.execSql,\n      \"organization\",\n      input.organizationId,\n    );\n    let authority = await loadGroupNameDirectoryAuthority({\n      ...input,\n      organizationPolicyReference: cached\n        ? principalPolicyReferenceFromBundle(cached)\n        : null,\n    });\n    if (\n      cached &&\n      authority &&\n      state.referencedPrincipalHeads.some(\n        (head) =>\n          !authority?.descriptor.groupHeads.some((known) =>\n            principalHeadMatchesReference(head, known),\n          ),\n      )\n    ) {\n      authority = await loadGroupNameDirectoryAuthority(input);\n    }\n    if (!authority)\n      throw new Error(\"Organization metadata authority is unavailable\");\n    const memberHead = requireOrganizationGroupHead(\n      authority.descriptor,\n      authority.memberGroupId,\n    );\n    const members = await verifyDirectoryGroup(\n      {\n        ...input,\n        descriptor: authority.descriptor,\n        externalAuthority: authority.externalAuthority,\n      },\n      memberHead,\n    );\n    assertMetadataRootBinding({\n      authority,\n      members,\n      organizationId: input.organizationId,\n      state,\n    });\n    assertProjectionVerificationCurrent(input.stillCurrent);\n  };\n}\n"]}

package/workflows/organizations/groupMetadataErrors.js

@@ -1,40 +0,0 @@
-import { KeyingVerificationError } from "../../internal/crypto/index.js";
-/**
- * The organization metadata root was read before a reserved-group commit that
- * the signed directory already reflects: each head it cites that differs from
- * the directory is a verified predecessor of the directory's head. That is an
- * honest read race, so readers reload the root rather than report tampering
- * (#2365 finding 22).
- */
-export class MetadataRootBehindDirectoryError extends Error {
-    constructor() {
-        super("Organization metadata root cites a superseded reserved-group head");
-        this.name = "MetadataRootBehindDirectoryError";
-    }
-}
-/**
- * Runs `load`, then once more after `evictRoot` if the root it read was
- * behind; `reread` tells `load` to skip any root it was handed. Honest servers
- * re-cite the reserved groups in the commit that advances them, so a root
- * still behind after a fresh read is an incident.
- */
-export async function withMetadataRootReload(load, evictRoot) {
-    try {
-        return await load(false);
-    }
-    catch (error) {
-        if (!(error instanceof MetadataRootBehindDirectoryError))
-            throw error;
-    }
-    evictRoot();
-    try {
-        return await load(true);
-    }
-    catch (error) {
-        if (error instanceof MetadataRootBehindDirectoryError) {
-            throw new KeyingVerificationError("object_mismatch", "Organization metadata root is still behind the signed directory after a reload");
-        }
-        throw error;
-    }
-}
-//# sourceMappingURL=groupMetadataErrors.js.map

package/workflows/organizations/groupMetadataRootBinding.js

@@ -1,51 +0,0 @@
-import { KeyingVerificationError, } from "../../internal/crypto/index.js";
-import { principalHeadMatchesReference, requireOrganizationGroupHead, } from "../../data/principals/organizationAuthorityDescriptor.js";
-import { principalPolicyEvidenceEntries } from "../../data/principals/principalPolicyEvidence.js";
-import { MetadataRootBehindDirectoryError } from "./groupMetadataErrors.js";
-/** Root bindings consume verified current grants and explicitly retained predecessor citations. */
-export function assertMetadataRootBinding(input) {
-    const { authority, state } = input;
-    const expected = [
-        {
-            policy: authority.adminPolicy,
-            id: authority.adminGroupId,
-            level: "admin",
-            grants: authority.adminPolicy.grants,
-        },
-        {
-            policy: input.members.policy,
-            id: authority.memberGroupId,
-            level: "read",
-            grants: input.members.policy.grants,
-        },
-    ];
-    const cited = (groupId) => state.referencedPrincipalHeads.find((head) => head.principalType === "group" && head.principalId === groupId);
-    const unbound = new KeyingVerificationError("object_mismatch", "Organization metadata root is not bound to the reserved group grants");
-    if (state.organizationId !== input.organizationId ||
-        state.parentContainerId !== null ||
-        state.directGrants.length !== 2 ||
-        state.referencedPrincipalHeads.length !== 2 ||
-        expected.some((role) => !principalHeadMatchesReference(role.policy.state, requireOrganizationGroupHead(authority.descriptor, role.id)) ||
-            !role.grants.some((grant) => grant.containerId === state.containerId &&
-                grant.accessLevel === role.level) ||
-            !state.directGrants.some((grant) => grant.subjectType === "group" &&
-                grant.subjectId === role.id &&
-                grant.accessLevel === role.level) ||
-            !cited(role.id)))
-        throw unbound;
-    const superseded = expected.flatMap((role) => {
-        const head = cited(role.id);
-        return head &&
-            !principalHeadMatchesReference(head, requireOrganizationGroupHead(authority.descriptor, role.id))
-            ? [{ policy: role.policy, head }]
-            : [];
-    });
-    if (superseded.length === 0)
-        return;
-    // A root read before a reserved-group commit cites a verified predecessor
-    // of the directory's head; any other head is not an honest race.
-    if (superseded.every(({ policy, head }) => principalPolicyEvidenceEntries(policy).some(({ state }) => principalHeadMatchesReference(state, head))))
-        throw new MetadataRootBehindDirectoryError();
-    throw unbound;
-}
-//# sourceMappingURL=groupMetadataRootBinding.js.map

package/workflows/organizations/groupMetadataRootBinding.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"groupMetadataRootBinding.js","sourceRoot":"","sources":["groupMetadataRootBinding.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAEL,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EAAE,8BAA8B,EAAE,MAAM,+CAA+C,CAAC;AAC/F,OAAO,EAAE,gCAAgC,EAAE,MAAM,uBAAuB,CAAC;AAEzE,mGAAmG;AACnG,MAAM,UAAU,yBAAyB,CAAC,KAUzC;IACC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACnC,MAAM,QAAQ,GAAG;QACf;YACE,MAAM,EAAE,SAAS,CAAC,WAAW;YAC7B,EAAE,EAAE,SAAS,CAAC,YAAY;YAC1B,KAAK,EAAE,OAAO;YACd,MAAM,EAAE,SAAS,CAAC,WAAW,CAAC,MAAM;SACrC;QACD;YACE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;YAC5B,EAAE,EAAE,SAAS,CAAC,aAAa;YAC3B,KAAK,EAAE,MAAM;YACb,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM;SACpC;KACF,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,OAAe,EAAE,EAAE,CAChC,KAAK,CAAC,wBAAwB,CAAC,IAAI,CACjC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,KAAK,OAAO,IAAI,IAAI,CAAC,WAAW,KAAK,OAAO,CACzE,CAAC;IACJ,MAAM,OAAO,GAAG,IAAI,uBAAuB,CACzC,iBAAiB,EACjB,sEAAsE,CACvE,CAAC;IACF,IACE,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QAC7C,KAAK,CAAC,iBAAiB,KAAK,IAAI;QAChC,KAAK,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;QAC/B,KAAK,CAAC,wBAAwB,CAAC,MAAM,KAAK,CAAC;QAC3C,QAAQ,CAAC,IAAI,CACX,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,6BAA6B,CAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,EACjB,4BAA4B,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,CAC5D;YACD,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACf,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;gBACvC,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,KAAK,CACnC;YACD,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CACtB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,OAAO;gBAC7B,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,EAAE;gBAC3B,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,KAAK,CACnC;YACD,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAClB;QAED,MAAM,OAAO,CAAC;IAChB,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5B,OAAO,IAAI;YACT,CAAC,6BAA6B,CAC5B,IAAI,EACJ,4BAA4B,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,CAC5D;YACD,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;YACjC,CAAC,CAAC,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IACH,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACpC,0EAA0E;IAC1E,iEAAiE;IACjE,IACE,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CACpC,8BAA8B,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CACxD,6BAA6B,CAAC,KAAK,EAAE,IAAI,CAAC,CAC3C,CACF;QAED,MAAM,IAAI,gCAAgC,EAAE,CAAC;IAC/C,MAAM,OAAO,CAAC;AAChB,CAAC","sourcesContent":["import {\n  type ContainerAccessManifestState,\n  KeyingVerificationError,\n  type PrincipalPolicyAuthorization,\n} from \"@tearleads/crypto\";\nimport {\n  type OrganizationAuthorityDescriptor,\n  principalHeadMatchesReference,\n  requireOrganizationGroupHead,\n} from \"../../data/principals/organizationAuthorityDescriptor\";\nimport { principalPolicyEvidenceEntries } from \"../../data/principals/principalPolicyEvidence\";\nimport { MetadataRootBehindDirectoryError } from \"./groupMetadataErrors\";\n\n/** Root bindings consume verified current grants and explicitly retained predecessor citations. */\nexport function assertMetadataRootBinding(input: {\n  readonly authority: {\n    readonly descriptor: OrganizationAuthorityDescriptor;\n    readonly adminGroupId: string;\n    readonly memberGroupId: string;\n    readonly adminPolicy: PrincipalPolicyAuthorization;\n  };\n  readonly members: { readonly policy: PrincipalPolicyAuthorization };\n  readonly organizationId: string;\n  readonly state: ContainerAccessManifestState;\n}): void {\n  const { authority, state } = input;\n  const expected = [\n    {\n      policy: authority.adminPolicy,\n      id: authority.adminGroupId,\n      level: \"admin\",\n      grants: authority.adminPolicy.grants,\n    },\n    {\n      policy: input.members.policy,\n      id: authority.memberGroupId,\n      level: \"read\",\n      grants: input.members.policy.grants,\n    },\n  ];\n  const cited = (groupId: string) =>\n    state.referencedPrincipalHeads.find(\n      (head) => head.principalType === \"group\" && head.principalId === groupId,\n    );\n  const unbound = new KeyingVerificationError(\n    \"object_mismatch\",\n    \"Organization metadata root is not bound to the reserved group grants\",\n  );\n  if (\n    state.organizationId !== input.organizationId ||\n    state.parentContainerId !== null ||\n    state.directGrants.length !== 2 ||\n    state.referencedPrincipalHeads.length !== 2 ||\n    expected.some(\n      (role) =>\n        !principalHeadMatchesReference(\n          role.policy.state,\n          requireOrganizationGroupHead(authority.descriptor, role.id),\n        ) ||\n        !role.grants.some(\n          (grant) =>\n            grant.containerId === state.containerId &&\n            grant.accessLevel === role.level,\n        ) ||\n        !state.directGrants.some(\n          (grant) =>\n            grant.subjectType === \"group\" &&\n            grant.subjectId === role.id &&\n            grant.accessLevel === role.level,\n        ) ||\n        !cited(role.id),\n    )\n  )\n    throw unbound;\n  const superseded = expected.flatMap((role) => {\n    const head = cited(role.id);\n    return head &&\n      !principalHeadMatchesReference(\n        head,\n        requireOrganizationGroupHead(authority.descriptor, role.id),\n      )\n      ? [{ policy: role.policy, head }]\n      : [];\n  });\n  if (superseded.length === 0) return;\n  // A root read before a reserved-group commit cites a verified predecessor\n  // of the directory's head; any other head is not an honest race.\n  if (\n    superseded.every(({ policy, head }) =>\n      principalPolicyEvidenceEntries(policy).some(({ state }) =>\n        principalHeadMatchesReference(state, head),\n      ),\n    )\n  )\n    throw new MetadataRootBehindDirectoryError();\n  throw unbound;\n}\n"]}

package/workflows/organizations/groupMetadataRuntime.js

@@ -1,47 +0,0 @@
-import { ProjectionDependencyUnavailableError } from "../../data/keyingProjectionVerification/dependencyUnavailable.js";
-import { createProjectionUserKeyResolver } from "../../data/keyingProjectionVerification/userKeyResolver.js";
-import { createRuntimePrincipalPolicyCurrentResolver, } from "../principals/runtimePolicyRecovery.js";
-import { createRuntimePrincipalPolicyWarmer } from "../principals/runtimePolicyWarmer.js";
-import { createCurrentGroupMetadataContainerVerifier } from "./currentGroupMetadataAuthority.js";
-import { createGroupMetadataAccess, } from "./groupMetadataAccess.js";
-export function createRuntimeGroupMetadataAccess(runtime, organizationId, stillCurrent, verifyMetadataContainer, currentRecovery) {
-    const targetSecretKey = runtime.crypto.encapsulationKeyPair?.secretKey;
-    if (!targetSecretKey)
-        throw new Error("Group metadata identity is locked");
-    // The signed metadata projection selects exact citations. Reuse matching
-    // private evidence with its dependencies and pins before bounded online reads.
-    const warmer = createRuntimePrincipalPolicyWarmer(runtime, {
-        preferLocalCurrent: true,
-    });
-    const resolveCurrentPolicy = currentRecovery?.resolveCurrentPolicy ??
-        createRuntimePrincipalPolicyCurrentResolver(runtime);
-    const authorityInput = {
-        apiClient: runtime.apiClient,
-        execSql: runtime.infra.execSql,
-        organizationId,
-        reportSecurityIncident: runtime.util.reportSecurityIncident,
-        resolveTrustedUserIdentity: runtime.resolveTrustedUserIdentity,
-        stillCurrent: stillCurrent ?? (() => true),
-    };
-    return createGroupMetadataAccess({
-        verifyMetadataContainer: verifyMetadataContainer ??
-            createCurrentGroupMetadataContainerVerifier({
-                ...authorityInput,
-                resolveCurrentPolicy: requireCurrentResolver(resolveCurrentPolicy),
-                recoveryBatch: currentRecovery?.recoveryBatch,
-            }),
-        apiClient: runtime.apiClient,
-        execSql: runtime.infra.execSql,
-        organizationId,
-        resolveProjectionUserKey: createProjectionUserKeyResolver(runtime),
-        targetSecretKey,
-        stillCurrent,
-        warmReferencedPrincipalPolicies: warmer,
-    });
-}
-function requireCurrentResolver(resolve) {
-    if (!resolve)
-        throw new ProjectionDependencyUnavailableError("Group metadata requires private paged recovery");
-    return resolve;
-}
-//# sourceMappingURL=groupMetadataRuntime.js.map

package/workflows/organizations/groupMetadataRuntime.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"groupMetadataRuntime.js","sourceRoot":"","sources":["groupMetadataRuntime.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EAAE,+BAA+B,EAAE,MAAM,yDAAyD,CAAC;AAI1G,OAAO,EACL,2CAA2C,GAE5C,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,kCAAkC,EAAE,MAAM,mCAAmC,CAAC;AACvF,OAAO,EAAE,2CAA2C,EAAE,MAAM,iCAAiC,CAAC;AAC9F,OAAO,EACL,yBAAyB,GAE1B,MAAM,uBAAuB,CAAC;AAmB/B,MAAM,UAAU,gCAAgC,CAC9C,OAA6B,EAC7B,cAAsB,EACtB,YAA4B,EAC5B,uBAA6E,EAC7E,eAKC;IAED,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,SAAS,CAAC;IACvE,IAAI,CAAC,eAAe;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAC3E,yEAAyE;IACzE,+EAA+E;IAC/E,MAAM,MAAM,GAAG,kCAAkC,CAAC,OAAO,EAAE;QACzD,kBAAkB,EAAE,IAAI;KACzB,CAAC,CAAC;IACH,MAAM,oBAAoB,GACxB,eAAe,EAAE,oBAAoB;QACrC,2CAA2C,CAAC,OAAO,CAAC,CAAC;IACvD,MAAM,cAAc,GAAG;QACrB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9B,cAAc;QACd,sBAAsB,EAAE,OAAO,CAAC,IAAI,CAAC,sBAAsB;QAC3D,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;QAC9D,YAAY,EAAE,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;KAC3C,CAAC;IACF,OAAO,yBAAyB,CAAC;QAC/B,uBAAuB,EACrB,uBAAuB;YACvB,2CAA2C,CAAC;gBAC1C,GAAG,cAAc;gBACjB,oBAAoB,EAAE,sBAAsB,CAAC,oBAAoB,CAAC;gBAClE,aAAa,EAAE,eAAe,EAAE,aAAa;aAC9C,CAAC;QACJ,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9B,cAAc;QACd,wBAAwB,EAAE,+BAA+B,CAAC,OAAO,CAAC;QAClE,eAAe;QACf,YAAY;QACZ,+BAA+B,EAAE,MAAM;KACxC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAAuE;IAEvE,IAAI,CAAC,OAAO;QACV,MAAM,IAAI,oCAAoC,CAC5C,gDAAgD,CACjD,CAAC;IACJ,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["import type { EncapsulationKeyPair } from \"@tearleads/crypto\";\nimport { ProjectionDependencyUnavailableError } from \"../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { createProjectionUserKeyResolver } from \"../../data/keyingProjectionVerification/userKeyResolver\";\nimport type { SecurityIncidentReporter } from \"../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\nimport {\n  createRuntimePrincipalPolicyCurrentResolver,\n  type PrincipalPolicyRecoveryRuntime,\n} from \"../principals/runtimePolicyRecovery\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../principals/runtimePolicyWarmer\";\nimport { createCurrentGroupMetadataContainerVerifier } from \"./currentGroupMetadataAuthority\";\nimport {\n  createGroupMetadataAccess,\n  type GroupMetadataAccessInput,\n} from \"./groupMetadataAccess\";\nimport type { PrincipalPolicyReadApi } from \"./groupPolicyMutationContext\";\n\ninterface GroupMetadataRuntime {\n  readonly state?: PrincipalPolicyRecoveryRuntime[\"state\"];\n  readonly apiClient: GroupMetadataAccessInput[\"apiClient\"] &\n    PrincipalPolicyReadApi &\n    PrincipalPolicyRecoveryRuntime[\"apiClient\"];\n  readonly crypto: {\n    readonly encapsulationKeyPair: EncapsulationKeyPair | null;\n  };\n  readonly infra: { readonly execSql: ExecSql };\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly util: {\n    readonly log: (message: string) => void;\n    readonly reportSecurityIncident: SecurityIncidentReporter;\n  };\n}\n\nexport function createRuntimeGroupMetadataAccess(\n  runtime: GroupMetadataRuntime,\n  organizationId: string,\n  stillCurrent?: () => boolean,\n  verifyMetadataContainer?: GroupMetadataAccessInput[\"verifyMetadataContainer\"],\n  currentRecovery?: {\n    readonly resolveCurrentPolicy: ReturnType<\n      typeof createRuntimePrincipalPolicyCurrentResolver\n    >;\n    readonly recoveryBatch: object;\n  },\n) {\n  const targetSecretKey = runtime.crypto.encapsulationKeyPair?.secretKey;\n  if (!targetSecretKey) throw new Error(\"Group metadata identity is locked\");\n  // The signed metadata projection selects exact citations. Reuse matching\n  // private evidence with its dependencies and pins before bounded online reads.\n  const warmer = createRuntimePrincipalPolicyWarmer(runtime, {\n    preferLocalCurrent: true,\n  });\n  const resolveCurrentPolicy =\n    currentRecovery?.resolveCurrentPolicy ??\n    createRuntimePrincipalPolicyCurrentResolver(runtime);\n  const authorityInput = {\n    apiClient: runtime.apiClient,\n    execSql: runtime.infra.execSql,\n    organizationId,\n    reportSecurityIncident: runtime.util.reportSecurityIncident,\n    resolveTrustedUserIdentity: runtime.resolveTrustedUserIdentity,\n    stillCurrent: stillCurrent ?? (() => true),\n  };\n  return createGroupMetadataAccess({\n    verifyMetadataContainer:\n      verifyMetadataContainer ??\n      createCurrentGroupMetadataContainerVerifier({\n        ...authorityInput,\n        resolveCurrentPolicy: requireCurrentResolver(resolveCurrentPolicy),\n        recoveryBatch: currentRecovery?.recoveryBatch,\n      }),\n    apiClient: runtime.apiClient,\n    execSql: runtime.infra.execSql,\n    organizationId,\n    resolveProjectionUserKey: createProjectionUserKeyResolver(runtime),\n    targetSecretKey,\n    stillCurrent,\n    warmReferencedPrincipalPolicies: warmer,\n  });\n}\n\nfunction requireCurrentResolver(\n  resolve: ReturnType<typeof createRuntimePrincipalPolicyCurrentResolver>,\n) {\n  if (!resolve)\n    throw new ProjectionDependencyUnavailableError(\n      \"Group metadata requires private paged recovery\",\n    );\n  return resolve;\n}\n"]}

package/workflows/organizations/groupNameUniqueness.js

@@ -1,151 +0,0 @@
-import { KeyingVerificationError, } from "../../internal/crypto/index.js";
-import { throwKeyingVerificationErrorWithContext } from "../../data/keyingProjectionVerification/error.js";
-import { loadPrincipalPolicyCheckpoint } from "../../data/persistence/keyingCheckpointPersistence.js";
-import { loadPrincipalPolicyBundleForReference } from "../../data/persistence/principalPolicyReferencePersistence.js";
-import { retainVerifiedPrincipalPolicyBundle } from "../../data/persistence/verifiedPrincipalPolicyRetentionPersistence.js";
-import { principalHeadMatchesReference, } from "../../data/principals/organizationAuthorityDescriptor.js";
-import { principalPolicyReferenceFromBundle, verifyPrincipalPolicyBundleWithExternalOrganizationAdmins, } from "../../data/principals/principalPolicyAdminSigners.js";
-import { collectPrincipalPolicySignerPublicKeys } from "../principals/policyVerification.js";
-import { GroupMetadataUnreadableError } from "./groupMetadataAccess.js";
-import { assertGroupMetadataBinding } from "./groupMetadataBinding.js";
-import { canonicalGroupNameKey, readGroupPolicyPayloadName, } from "./principalPolicyRequest.js";
-/**
- * Loads one directory group at its committed head: from the local retained
- * bundles when they already hold that head, and from the API otherwise.
- */
-async function loadDirectoryGroupBundle(input, head) {
-    const localCheckpoint = await loadPrincipalPolicyCheckpoint(input.execSql, "group", head.principalId);
-    const cached = await loadPrincipalPolicyBundleForReference(input.execSql, head, localCheckpoint);
-    const bundle = cached ??
-        (await input.apiClient.getCurrentPrincipalPolicy("group", head.principalId));
-    if (!bundle) {
-        throw new Error(`Organization directory group ${head.principalId} could not be loaded`);
-    }
-    if (!principalHeadMatchesReference(principalPolicyReferenceFromBundle(bundle), head)) {
-        // Head drift is reachable by a concurrent admin mutation, so it is a
-        // plain error to retry on, not an incident (as in the share path). The
-        // typed errors stay for signature and projection failures.
-        throw new Error("Organization directory group policy does not match the signed organization directory");
-    }
-    return { bundle, localCheckpoint };
-}
-/**
- * A bundle served from local retention was verified when it was retained, and
- * is verified again here on purpose: the re-check costs local CPU only, and it
- * keeps the name a group vouches for independent of what any earlier caller
- * trusted at retention time.
- */
-export async function verifyDirectoryGroup(input, head) {
-    const { bundle, localCheckpoint } = await loadDirectoryGroupBundle(input, head);
-    const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({
-        bundle,
-        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
-    });
-    if ("error" in signerPublicKeys) {
-        throw new Error(`Organization directory group signer key could not be loaded (${signerPublicKeys.error})`);
-    }
-    const verified = await verifyPrincipalPolicyBundleWithExternalOrganizationAdmins({
-        bundle,
-        expectedReference: head,
-        loadExternalAuthority: async () => input.externalAuthority,
-        localCheckpoint,
-        signerPublicKeys: signerPublicKeys.signerPublicKeys,
-    });
-    if (!verified.ok) {
-        throwKeyingVerificationErrorWithContext(verified.error, "Organization directory group verification failed");
-    }
-    assertGroupMetadataBinding(bundle, input.descriptor);
-    const name = await readDirectoryGroupName(input, bundle);
-    return {
-        bundle,
-        name,
-        nameKey: name === null ? null : canonicalGroupNameKey(name),
-        policy: verified.value,
-    };
-}
-/**
- * A verified group whose name no member can open has no name to select by. The
- * walk isolates it rather than failing every name in the organization, but it
- * still records the incident: only a dishonest admin signs such a name.
- */
-export async function readDirectoryGroupName(input, bundle) {
-    try {
-        return await readGroupPolicyPayloadName(bundle, input.readEncryptedName);
-    }
-    catch (error) {
-        if (!(error instanceof GroupMetadataUnreadableError))
-            throw error;
-        await input.reportSecurityIncident(new KeyingVerificationError("invalid_shape", "Signed group name does not open under the cited metadata key"), {
-            evidenceHashes: { stateHash: bundle.currentState.stateHash },
-            objectId: bundle.currentState.principalId,
-            objectKind: "principal",
-            operation: "organization.groupName",
-            organizationId: input.organizationId,
-        });
-        return null;
-    }
-}
-/**
- * Signed group names are the only authenticated label a member can choose a
- * group by, and the API does not make them unique within an organization. So
- * uniqueness is enforced here, where a name enters: before an admin signs a
- * new group, every group committed in the signed organization directory
- * (the reserved Admins and Members groups included) is loaded, verified
- * against its directory head, and its committed name compared by canonical
- * key. A share then needs only the target's verified name. A compromised
- * server cannot mint a signed group, so it cannot create the duplicate this
- * check refuses.
- *
- * The walk is fail-closed: one group that cannot be loaded or verified blocks
- * the creation, since an unverifiable group could carry any name. A verified
- * group whose name does not decrypt is skipped: no member can open that name,
- * so it cannot collide with one. It runs the
- * loads in parallel and retains every verified bundle, so a later creation
- * finds unchanged groups locally and fetches only those whose head moved.
- */
-const DIRECTORY_WALK_CONCURRENCY = 4;
-/** Runs `work` over `items` with at most `limit` in flight, keeping order. */
-async function mapWithConcurrency(items, limit, work) {
-    const results = [];
-    let next = 0;
-    const worker = async () => {
-        for (;;) {
-            const index = next++;
-            const item = items[index];
-            if (index >= items.length || item === undefined)
-                return;
-            results[index] = await work(item);
-        }
-    };
-    await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker));
-    return results;
-}
-export async function assertGroupNameUniqueInDirectory(input) {
-    const nameKey = canonicalGroupNameKey(input.name);
-    // Each verified bundle is retained as soon as it verifies, so a failure
-    // later in the walk (or a taken name) still leaves the cache warm for the
-    // retry. Retention runs in a transaction on the shared connection, so the
-    // writes are chained one after another while the loads stay concurrent.
-    const retainedAt = new Date().toISOString();
-    let retention = Promise.resolve();
-    const verifyAndRetain = async (head) => {
-        const group = await verifyDirectoryGroup(input, head);
-        retention = retention.then(() => retainVerifiedPrincipalPolicyBundle({
-            bundle: group.bundle,
-            execSql: input.execSql,
-            organizationId: input.organizationId,
-            policy: group.policy,
-            updatedAt: retainedAt,
-        }));
-        await retention;
-        return group;
-    };
-    const groups = await mapWithConcurrency(input.descriptor.groupHeads, DIRECTORY_WALK_CONCURRENCY, verifyAndRetain);
-    // A taken name is user input to correct, not evidence of tampering, so this
-    // is a plain error: group creation runs under security-incident reporting,
-    // which records every KeyingVerificationError.
-    if (groups.some((group) => group.nameKey === nameKey)) {
-        throw new Error("Another signed group in this organization already carries this name");
-    }
-}
-//# sourceMappingURL=groupNameUniqueness.js.map

package/workflows/organizations/groupNameUniqueness.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"groupNameUniqueness.js","sourceRoot":"","sources":["groupNameUniqueness.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAGxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,uCAAuC,EAAE,MAAM,+CAA+C,CAAC;AACxG,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,qCAAqC,EAAE,MAAM,4DAA4D,CAAC;AACnH,OAAO,EAAE,mCAAmC,EAAE,MAAM,oEAAoE,CAAC;AACzH,OAAO,EAEL,6BAA6B,GAC9B,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EACL,kCAAkC,EAClC,yDAAyD,GAC1D,MAAM,mDAAmD,CAAC;AAK3D,OAAO,EAAE,sCAAsC,EAAE,MAAM,kCAAkC,CAAC;AAC1F,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EACL,qBAAqB,EAErB,0BAA0B,GAC3B,MAAM,0BAA0B,CAAC;AAuBlC;;;GAGG;AACH,KAAK,UAAU,wBAAwB,CACrC,KAA8B,EAC9B,IAAwB;IAExB,MAAM,eAAe,GAAG,MAAM,6BAA6B,CACzD,KAAK,CAAC,OAAO,EACb,OAAO,EACP,IAAI,CAAC,WAAW,CACjB,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,qCAAqC,CACxD,KAAK,CAAC,OAAO,EACb,IAAI,EACJ,eAAe,CAChB,CAAC;IACF,MAAM,MAAM,GACV,MAAM;QACN,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,yBAAyB,CAC9C,OAAO,EACP,IAAI,CAAC,WAAW,CACjB,CAAC,CAAC;IACL,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,gCAAgC,IAAI,CAAC,WAAW,sBAAsB,CACvE,CAAC;IACJ,CAAC;IACD,IACE,CAAC,6BAA6B,CAC5B,kCAAkC,CAAC,MAAM,CAAC,EAC1C,IAAI,CACL,EACD,CAAC;QACD,qEAAqE;QACrE,uEAAuE;QACvE,2DAA2D;QAC3D,MAAM,IAAI,KAAK,CACb,sFAAsF,CACvF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAA8B,EAC9B,IAAwB;IAExB,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,wBAAwB,CAChE,KAAK,EACL,IAAI,CACL,CAAC;IACF,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;QACpE,MAAM;QACN,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,IAAI,OAAO,IAAI,gBAAgB,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,gEAAgE,gBAAgB,CAAC,KAAK,GAAG,CAC1F,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GACZ,MAAM,yDAAyD,CAAC;QAC9D,MAAM;QACN,iBAAiB,EAAE,IAAI;QACvB,qBAAqB,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,iBAAiB;QAC1D,eAAe;QACf,gBAAgB,EAAE,gBAAgB,CAAC,gBAAgB;KACpD,CAAC,CAAC;IACL,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,uCAAuC,CACrC,QAAQ,CAAC,KAAK,EACd,kDAAkD,CACnD,CAAC;IACJ,CAAC;IACD,0BAA0B,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACzD,OAAO;QACL,MAAM;QACN,IAAI;QACJ,OAAO,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC;QAC3D,MAAM,EAAE,QAAQ,CAAC,KAAK;KACvB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAGC,EACD,MAAwD;IAExD,IAAI,CAAC;QACH,OAAO,MAAM,0BAA0B,CAAC,MAAM,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,4BAA4B,CAAC;YAAE,MAAM,KAAK,CAAC;QAClE,MAAM,KAAK,CAAC,sBAAsB,CAChC,IAAI,uBAAuB,CACzB,eAAe,EACf,8DAA8D,CAC/D,EACD;YACE,cAAc,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE;YAC5D,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW;YACzC,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,wBAAwB;YACnC,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CACF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,0BAA0B,GAAG,CAAC,CAAC;AAErC,8EAA8E;AAC9E,KAAK,UAAU,kBAAkB,CAC/B,KAAuB,EACvB,KAAa,EACb,IAA6B;IAE7B,MAAM,OAAO,GAAQ,EAAE,CAAC;IACxB,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE;QACxB,SAAS,CAAC;YACR,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO;YACxD,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;IACH,CAAC,CAAC;IACF,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAC9D,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAA0D;IAE1D,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClD,wEAAwE;IACxE,0EAA0E;IAC1E,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,SAAS,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IACjD,MAAM,eAAe,GAAG,KAAK,EAC3B,IAAwB,EACS,EAAE;QACnC,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACtD,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,CAC9B,mCAAmC,CAAC;YAClC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS,EAAE,UAAU;SACtB,CAAC,CACH,CAAC;QACF,MAAM,SAAS,CAAC;QAChB,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,kBAAkB,CACrC,KAAK,CAAC,UAAU,CAAC,UAAU,EAC3B,0BAA0B,EAC1B,eAAe,CAChB,CAAC;IACF,4EAA4E;IAC5E,2EAA2E;IAC3E,+CAA+C;IAC/C,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type PrincipalPolicyExternalAuthority,\n  type VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { throwKeyingVerificationErrorWithContext } from \"../../data/keyingProjectionVerification/error\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../data/persistence/keyingCheckpointPersistence\";\nimport { loadPrincipalPolicyBundleForReference } from \"../../data/persistence/principalPolicyReferencePersistence\";\nimport { retainVerifiedPrincipalPolicyBundle } from \"../../data/persistence/verifiedPrincipalPolicyRetentionPersistence\";\nimport {\n  type OrganizationAuthorityDescriptor,\n  principalHeadMatchesReference,\n} from \"../../data/principals/organizationAuthorityDescriptor\";\nimport {\n  principalPolicyReferenceFromBundle,\n  verifyPrincipalPolicyBundleWithExternalOrganizationAdmins,\n} from \"../../data/principals/principalPolicyAdminSigners\";\nimport type { SecurityIncidentReporter } from \"../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../data/trustedUserIdentity\";\nimport type { CurrentPrincipalPolicyReader } from \"../principals/currentPrincipalPolicyReader\";\nimport { collectPrincipalPolicySignerPublicKeys } from \"../principals/policyVerification\";\nimport { GroupMetadataUnreadableError } from \"./groupMetadataAccess\";\nimport { assertGroupMetadataBinding } from \"./groupMetadataBinding\";\nimport {\n  canonicalGroupNameKey,\n  type GroupPolicyNameReader,\n  readGroupPolicyPayloadName,\n} from \"./principalPolicyRequest\";\n\nexport interface DirectoryGroupWalkInput {\n  readonly readEncryptedName?: GroupPolicyNameReader | undefined;\n  readonly apiClient: CurrentPrincipalPolicyReader;\n  readonly descriptor: OrganizationAuthorityDescriptor;\n  readonly execSql: ExecSql;\n  readonly externalAuthority: PrincipalPolicyExternalAuthority;\n  readonly organizationId: string;\n  readonly reportSecurityIncident: SecurityIncidentReporter;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}\n\ntype DirectoryGroupHead = OrganizationAuthorityDescriptor[\"groupHeads\"][number];\n\ninterface VerifiedDirectoryGroup {\n  readonly bundle: PrincipalPolicyBundleResponse;\n  /** Null when the signed name does not decrypt for any member. */\n  readonly name: string | null;\n  readonly nameKey: string | null;\n  readonly policy: VerifiedPrincipalPolicy;\n}\n\n/**\n * Loads one directory group at its committed head: from the local retained\n * bundles when they already hold that head, and from the API otherwise.\n */\nasync function loadDirectoryGroupBundle(\n  input: DirectoryGroupWalkInput,\n  head: DirectoryGroupHead,\n) {\n  const localCheckpoint = await loadPrincipalPolicyCheckpoint(\n    input.execSql,\n    \"group\",\n    head.principalId,\n  );\n  const cached = await loadPrincipalPolicyBundleForReference(\n    input.execSql,\n    head,\n    localCheckpoint,\n  );\n  const bundle =\n    cached ??\n    (await input.apiClient.getCurrentPrincipalPolicy(\n      \"group\",\n      head.principalId,\n    ));\n  if (!bundle) {\n    throw new Error(\n      `Organization directory group ${head.principalId} could not be loaded`,\n    );\n  }\n  if (\n    !principalHeadMatchesReference(\n      principalPolicyReferenceFromBundle(bundle),\n      head,\n    )\n  ) {\n    // Head drift is reachable by a concurrent admin mutation, so it is a\n    // plain error to retry on, not an incident (as in the share path). The\n    // typed errors stay for signature and projection failures.\n    throw new Error(\n      \"Organization directory group policy does not match the signed organization directory\",\n    );\n  }\n  return { bundle, localCheckpoint };\n}\n\n/**\n * A bundle served from local retention was verified when it was retained, and\n * is verified again here on purpose: the re-check costs local CPU only, and it\n * keeps the name a group vouches for independent of what any earlier caller\n * trusted at retention time.\n */\nexport async function verifyDirectoryGroup(\n  input: DirectoryGroupWalkInput,\n  head: DirectoryGroupHead,\n): Promise<VerifiedDirectoryGroup> {\n  const { bundle, localCheckpoint } = await loadDirectoryGroupBundle(\n    input,\n    head,\n  );\n  const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({\n    bundle,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  if (\"error\" in signerPublicKeys) {\n    throw new Error(\n      `Organization directory group signer key could not be loaded (${signerPublicKeys.error})`,\n    );\n  }\n  const verified =\n    await verifyPrincipalPolicyBundleWithExternalOrganizationAdmins({\n      bundle,\n      expectedReference: head,\n      loadExternalAuthority: async () => input.externalAuthority,\n      localCheckpoint,\n      signerPublicKeys: signerPublicKeys.signerPublicKeys,\n    });\n  if (!verified.ok) {\n    throwKeyingVerificationErrorWithContext(\n      verified.error,\n      \"Organization directory group verification failed\",\n    );\n  }\n  assertGroupMetadataBinding(bundle, input.descriptor);\n  const name = await readDirectoryGroupName(input, bundle);\n  return {\n    bundle,\n    name,\n    nameKey: name === null ? null : canonicalGroupNameKey(name),\n    policy: verified.value,\n  };\n}\n\n/**\n * A verified group whose name no member can open has no name to select by. The\n * walk isolates it rather than failing every name in the organization, but it\n * still records the incident: only a dishonest admin signs such a name.\n */\nexport async function readDirectoryGroupName(\n  input: Pick<\n    DirectoryGroupWalkInput,\n    \"readEncryptedName\" | \"reportSecurityIncident\" | \"organizationId\"\n  >,\n  bundle: Parameters<typeof readGroupPolicyPayloadName>[0],\n): Promise<string | null> {\n  try {\n    return await readGroupPolicyPayloadName(bundle, input.readEncryptedName);\n  } catch (error) {\n    if (!(error instanceof GroupMetadataUnreadableError)) throw error;\n    await input.reportSecurityIncident(\n      new KeyingVerificationError(\n        \"invalid_shape\",\n        \"Signed group name does not open under the cited metadata key\",\n      ),\n      {\n        evidenceHashes: { stateHash: bundle.currentState.stateHash },\n        objectId: bundle.currentState.principalId,\n        objectKind: \"principal\",\n        operation: \"organization.groupName\",\n        organizationId: input.organizationId,\n      },\n    );\n    return null;\n  }\n}\n\n/**\n * Signed group names are the only authenticated label a member can choose a\n * group by, and the API does not make them unique within an organization. So\n * uniqueness is enforced here, where a name enters: before an admin signs a\n * new group, every group committed in the signed organization directory\n * (the reserved Admins and Members groups included) is loaded, verified\n * against its directory head, and its committed name compared by canonical\n * key. A share then needs only the target's verified name. A compromised\n * server cannot mint a signed group, so it cannot create the duplicate this\n * check refuses.\n *\n * The walk is fail-closed: one group that cannot be loaded or verified blocks\n * the creation, since an unverifiable group could carry any name. A verified\n * group whose name does not decrypt is skipped: no member can open that name,\n * so it cannot collide with one. It runs the\n * loads in parallel and retains every verified bundle, so a later creation\n * finds unchanged groups locally and fetches only those whose head moved.\n */\nconst DIRECTORY_WALK_CONCURRENCY = 4;\n\n/** Runs `work` over `items` with at most `limit` in flight, keeping order. */\nasync function mapWithConcurrency<T, R>(\n  items: ReadonlyArray<T>,\n  limit: number,\n  work: (item: T) => Promise<R>,\n): Promise<R[]> {\n  const results: R[] = [];\n  let next = 0;\n  const worker = async () => {\n    for (;;) {\n      const index = next++;\n      const item = items[index];\n      if (index >= items.length || item === undefined) return;\n      results[index] = await work(item);\n    }\n  };\n  await Promise.all(\n    Array.from({ length: Math.min(limit, items.length) }, worker),\n  );\n  return results;\n}\n\nexport async function assertGroupNameUniqueInDirectory(\n  input: DirectoryGroupWalkInput & { readonly name: string },\n): Promise<void> {\n  const nameKey = canonicalGroupNameKey(input.name);\n  // Each verified bundle is retained as soon as it verifies, so a failure\n  // later in the walk (or a taken name) still leaves the cache warm for the\n  // retry. Retention runs in a transaction on the shared connection, so the\n  // writes are chained one after another while the loads stay concurrent.\n  const retainedAt = new Date().toISOString();\n  let retention: Promise<void> = Promise.resolve();\n  const verifyAndRetain = async (\n    head: DirectoryGroupHead,\n  ): Promise<VerifiedDirectoryGroup> => {\n    const group = await verifyDirectoryGroup(input, head);\n    retention = retention.then(() =>\n      retainVerifiedPrincipalPolicyBundle({\n        bundle: group.bundle,\n        execSql: input.execSql,\n        organizationId: input.organizationId,\n        policy: group.policy,\n        updatedAt: retainedAt,\n      }),\n    );\n    await retention;\n    return group;\n  };\n  const groups = await mapWithConcurrency(\n    input.descriptor.groupHeads,\n    DIRECTORY_WALK_CONCURRENCY,\n    verifyAndRetain,\n  );\n  // A taken name is user input to correct, not evidence of tampering, so this\n  // is a plain error: group creation runs under security-incident reporting,\n  // which records every KeyingVerificationError.\n  if (groups.some((group) => group.nameKey === nameKey)) {\n    throw new Error(\n      \"Another signed group in this organization already carries this name\",\n    );\n  }\n}\n"]}

package/workflows/organizations/groupPolicyHistoryPage.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"groupPolicyHistoryPage.js","sourceRoot":"","sources":["groupPolicyHistoryPage.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAG1E,oFAAoF;AACpF,MAAM,UAAU,uCAAuC,CAAC,KAIvD;IACC,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IACvB,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,WAAW,EAAE,KAAK,CAAC,OAAO;QAC1B,aAAa,EAAE,OAAO;QACtB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,OAAO,EAAE,IAAI,CAAC,OAAO;aAClB,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YACtB,OAAO,EAAE,8BAA8B,CAAC;gBACtC,OAAO,EAAE,KAAK,CAAC,UAAU;gBACzB,QAAQ,EACN,CAAC,KAAK,KAAK,CAAC;oBACV,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU;oBAC9B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,IAAI,EAAE;aACjD,CAAC;YACF,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;YAChC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;YAC9B,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;YACpC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;YAC9B,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY;YACtC,wBAAwB,EAAE,KAAK,CAAC,KAAK,CAAC,wBAAwB;YAC9D,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;YAChC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO;SAC7B,CAAC,CAAC;aACF,OAAO,EAAE;KACb,CAAC;AACJ,CAAC","sourcesContent":["import type { RecoveredPrincipalHistoryPage } from \"../principals/loadRecoveredPrincipalHistoryPage\";\nimport { diffPrincipalProjectionMembers } from \"./policyHistoryReadModel\";\nimport type { OrganizationGroupPolicyHistory } from \"./policyHistoryTypes\";\n\n/** Keep a page boundary's actual predecessor when describing membership changes. */\nexport function buildOrganizationGroupPolicyHistoryPage(input: {\n  readonly groupId: string;\n  readonly organizationId: string;\n  readonly page: RecoveredPrincipalHistoryPage;\n}): OrganizationGroupPolicyHistory {\n  const { page } = input;\n  return {\n    groupId: input.groupId,\n    organizationId: input.organizationId,\n    principalId: input.groupId,\n    principalType: \"group\",\n    nextBeforeVersion: page.nextBeforeVersion,\n    entries: page.entries\n      .map((entry, index) => ({\n        changes: diffPrincipalProjectionMembers({\n          current: entry.projection,\n          previous:\n            (index === 0\n              ? page.predecessor?.projection\n              : page.entries[index - 1]?.projection) ?? [],\n        }),\n        createdAt: entry.state.createdAt,\n        keyEpoch: entry.state.keyEpoch,\n        memberCount: entry.state.memberCount,\n        signedAt: entry.state.signedAt,\n        signerUserId: entry.state.signerUserId,\n        signerUserKeyFingerprint: entry.state.signerUserKeyFingerprint,\n        stateHash: entry.state.stateHash,\n        version: entry.state.version,\n      }))\n      .reverse(),\n  };\n}\n"]}