npm - @tearleads/client-sdk - Versions diffs - 0.1.62 → 0.1.63 - Mend

@tearleads/client-sdk 0.1.62 → 0.1.63

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (653) hide show

package/workflows/organizations/{groupPolicyRequests.js → groupPolicy/groupPolicyRequests.js} RENAMED Viewed

@@ -1,10 +1,10 @@
-import { generateKemSeedAndKeyPair, KeyingVerificationError, toFingerprint, unwrapDek, wrapDekForRecipients, } from "../../internal/crypto/index.js";
-import { bytesToBase64 } from "../../internal/encoding/index.js";
-import { principalSecretKeyMatchesState } from "../../data/principals/principalKeyValidation.js";
+import { generateKemSeedAndKeyPair, KeyingVerificationError, toFingerprint, unwrapDek, wrapDekForRecipients, } from "../../../internal/crypto/index.js";
+import { bytesToBase64 } from "../../../internal/encoding/index.js";
+import { principalSecretKeyMatchesState } from "../../../data/principals/principalKeyValidation.js";
+import { rewrapProjectionMemberEnvelopes, toRecipientEntries, } from "../principalPolicy/principalPolicyRecipients.js";
+import { signedGroupPolicyRequest, userProjectionMember, } from "../principalPolicy/principalPolicyRequest.js";
 import { isDirectGroupAdmin } from "./groupMutationAuthorization.js";
 import { withVerifiedGroupMutation, } from "./groupPolicyMutationEvidence.js";
-import { rewrapProjectionMemberEnvelopes, toRecipientEntries, } from "./principalPolicyRecipients.js";
-import { signedGroupPolicyRequest, userProjectionMember, } from "./principalPolicyRequest.js";
 /**
  * The signed policy commits both the group's public key and the member
  * envelopes that are supposed to wrap its secret. An envelope that unwraps to

package/workflows/organizations/groupPolicy/groupPolicyRequests.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"groupPolicyRequests.js","sourceRoot":"","sources":["groupPolicyRequests.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EAEvB,aAAa,EACb,SAAS,EACT,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAMpD,OAAO,EAAE,8BAA8B,EAAE,MAAM,iDAAiD,CAAC;AAGjG,OAAO,EACL,+BAA+B,EAC/B,kBAAkB,GACnB,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAEL,yBAAyB,GAC1B,MAAM,+BAA+B,CAAC;AASvC;;;;;;GAMG;AACH,KAAK,UAAU,+BAA+B,CAC5C,KAAmC;IAEnC,MAAM,KAAK,GAAG,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC;IAC/C,MAAM,KAAK,CAAC,sBAAsB,EAAE,CAClC,IAAI,uBAAuB,CACzB,iBAAiB,EACjB,gEAAgE,CACjE,EACD;QACE,cAAc,EAAE;YACd,uBAAuB,EAAE,KAAK,CAAC,cAAc;YAC7C,kBAAkB,EAAE,KAAK,CAAC,SAAS;SACpC;QACD,QAAQ,EAAE,KAAK,CAAC,WAAW;QAC3B,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,gCAAgC;KAC5C,CACF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CACf,UAA2D;IAE3D,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,wBAAwB,CAC/B,SAAuD;IAEvD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,iCAAiC,CAC9C,KAAwC,EACxC,UAA2D,EAC3D,KAAyC,EACzC,MAAM,GAAG,KAAK,CAAC,aAAa,CAAC,aAAa;IAE1C,MAAM,QAAQ,GAAG,yBAAyB,EAAE,CAAC;IAC7C,MAAM,eAAe,GAAG,MAAM,+BAA+B,CAAC;QAC5D,UAAU;QACV,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,KAAK;KACN,CAAC,CAAC;IACH,OAAO,wBAAwB,CAAC;QAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,sBAAsB,EAAE,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;QACzD,iBAAiB,EAAE,kBAAkB,CACnC,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,YAAY,CACnB;YACC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,WAAW;QACjE,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,QAAQ,GAAG,CAAC;QACvD,cAAc,EAAE,MAAM,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;QACvD,MAAM;QACN,eAAe;QACf,iBAAiB,EAAE,KAAK,CAAC,aAAa,CAAC,cAAc,CAAC,UAAU;QAChE,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,WAAW;QACzD,UAAU;QACV,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,yCAAyC,CACtD,KAAmC,EACnC,UAA2D,EAC3D,SAAiB;IAEjB,MAAM,cAAc,GAAG,MAAM,SAAS,CACpC,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,sBAAsB,CAAC,SAAS,CAAC,EACxE,KAAK,CAAC,oBAAoB,CAC3B,CAAC;IACF,IACE,CAAC,CAAC,MAAM,8BAA8B,CACpC,cAAc,EACd,KAAK,CAAC,aAAa,CAAC,YAAY,CACjC,CAAC,EACF,CAAC;QACD,MAAM,+BAA+B,CAAC,KAAK,CAAC,CAAC;QAC7C,OAAO,iCAAiC,CAAC,KAAK,EAAE,UAAU,EAAE;YAC1D,GAAG,KAAK,CAAC,YAAY;YACrB,KAAK,CAAC,UAAU;SACjB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,CAAC,cAAc,CAAC,GAAG,MAAM,oBAAoB,CAAC,cAAc,EAAE;QAClE,KAAK,CAAC,UAAU,CAAC,sBAAsB;KACxC,CAAC,CAAC;IAEH,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,eAAe,GAAG;QACtB,GAAG,KAAK,CAAC,aAAa,CAAC,sBAAsB,CAAC,SAAS,CAAC,MAAM,CAC5D,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAC5C;QACD;YACE,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM;YAC/B,oBAAoB,EAAE,KAAK,CAAC,UAAU,CAAC,2BAA2B;YAClE,aAAa,EAAE,aAAa,CAAC,cAAc,CAAC,aAAa,CAAC;YAC1D,UAAU,EAAE,aAAa,CAAC,cAAc,CAAC,UAAU,CAAC;SACrD;KACF,CAAC;IACF,OAAO,wBAAwB,CAAC;QAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,sBAAsB,EACpB,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,sBAAsB;QACzD,iBAAiB,EAAE,IAAI;QACvB,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,QAAQ;QACnD,cAAc,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,cAAc;QAC/D,MAAM,EAAE,KAAK,CAAC,aAAa,CAAC,aAAa;QACzC,eAAe;QACf,iBAAiB,EAAE,KAAK,CAAC,aAAa,CAAC,cAAc,CAAC,UAAU;QAChE,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,WAAW;QACzD,UAAU;QACV,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAAmC;IAEnC,KAAK,GAAG;QACN,GAAG,KAAK;QACR,YAAY,EAAE,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC;QACjD,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,CAAC,KAAK,EAAE;QACxD,UAAU,EAAE,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC;KAC9C,CAAC;IACF,IAAI,CAAC;QACH,OAAO,MAAM,yBAAyB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAC5D,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;YAC1C,MAAM,iBAAiB,GAAG,KAAK,CAAC,aAAa,CAAC,iBAAiB,CAAC;YAChE,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,EAAE,CAAC;gBACpE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YAED,MAAM,UAAU,GAAG;gBACjB,GAAG,iBAAiB;gBACpB,oBAAoB,CAClB,KAAK,CAAC,UAAU,CAAC,MAAM,EACvB,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CACrD;aACF,CAAC;YAEF,OAAO,kBAAkB,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,YAAY,CAAC;gBAChE,CAAC,CAAC,yCAAyC,CACvC,KAAK,EACL,UAAU,EACV,SAAS,CACV;gBACH,CAAC,CAAC,iCAAiC,CAAC,KAAK,EAAE,UAAU,EAAE;oBACnD,GAAG,KAAK,CAAC,YAAY;oBACrB,KAAK,CAAC,UAAU;iBACjB,CAAC,CAAC;QACT,CAAC,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,KAGC;IAED,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,eAAe,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;IAC5E,OAAO,yBAAyB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QACtD,MAAM,GAAG,GAAG,KAAK,CAAC,aAAa,CAAC;QAChC,MAAM,UAAU,GAAG,KAAK,CAAC,aAAa,CAAC,iBAAiB,CAAC,MAAM,CAC7D,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,GAAG,CAClC,CAAC;QAEF,IAAI,UAAU,CAAC,MAAM,KAAK,KAAK,CAAC,aAAa,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,IACE,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,iBAAiB,CAAC;YAC/C,CAAC,QAAQ,CAAC,UAAU,CAAC,EACrB,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QAED,OAAO,iCAAiC,CACtC,KAAK,EACL,UAAU,EACV,KAAK,CAAC,cAAc,CACrB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,KAGC;IAED,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;IACxE,OAAO,yBAAyB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QACtD,OAAO,iCAAiC,CACtC,KAAK,EACL,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,iBAAiB,CAAC,EAC1C,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,aAAa,CAAC,aAAa,CAAC,MAAM,CACtC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,kBAAkB,CAC1D,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,wCAAwC,CAC5D,KAGC;IAED,OAAO,yBAAyB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QACtD,MAAM,MAAM,GAAG;YACb,GAAG,KAAK,CAAC,aAAa,CAAC,aAAa,CAAC,MAAM,CACzC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CACnD;YACD,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE;SACnE,CAAC;QACF,OAAO,wBAAwB,CAAC;YAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,sBAAsB,EACpB,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,sBAAsB;YACzD,iBAAiB,EAAE,kBAAkB,CACnC,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,YAAY,CACnB;gBACC,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,WAAW;YACjE,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,QAAQ;YACnD,cAAc,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,cAAc;YAC/D,MAAM;YACN,eAAe,EAAE,KAAK,CAAC,aAAa,CAAC,sBAAsB,CAAC,SAAS;YACrE,iBAAiB,EAAE,KAAK,CAAC,aAAa,CAAC,cAAc,CAAC,UAAU;YAChE,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,WAAW;YACzD,UAAU,EAAE,KAAK,CAAC,aAAa,CAAC,iBAAiB;YACjD,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAClC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n generateKemSeedAndKeyPair,\n KeyingVerificationError,\n type PrincipalPolicyExternalAuthority,\n toFingerprint,\n unwrapDek,\n wrapDekForRecipients,\n} from \"@tearleads/crypto\";\nimport { bytesToBase64 } from \"@tearleads/encoding\";\nimport type {\n PrincipalContainerGrantRequest,\n PrincipalProjectionMemberRequest,\n PutPrincipalPolicyRequest,\n} from \"@tearleads/validators/request\";\nimport { principalSecretKeyMatchesState } from \"../../../data/principals/principalKeyValidation\";\nimport type { SecurityIncidentReporter } from \"../../../data/shared/securityIncidents\";\nimport type { TrustedUserIdentity } from \"../../../data/trustedUserIdentity\";\nimport {\n rewrapProjectionMemberEnvelopes,\n toRecipientEntries,\n} from \"../principalPolicy/principalPolicyRecipients\";\nimport {\n signedGroupPolicyRequest,\n userProjectionMember,\n} from \"../principalPolicy/principalPolicyRequest\";\nimport { isDirectGroupAdmin } from \"./groupMutationAuthorization\";\nimport {\n type BuildGroupMembershipMutationInput,\n withVerifiedGroupMutation,\n} from \"./groupPolicyMutationEvidence\";\n\ntype BuildAddGroupUserPolicyInput = BuildGroupMembershipMutationInput & {\n readonly currentUsers: ReadonlyArray<TrustedUserIdentity>;\n readonly currentUserSecretKey: Uint8Array;\n readonly reportSecurityIncident?: SecurityIncidentReporter | undefined;\n readonly targetUser: TrustedUserIdentity;\n};\n\n/**\n * The signed policy commits both the group's public key and the member\n * envelopes that are supposed to wrap its secret. An envelope that unwraps to\n * a different secret means a prior admin (or the server) published a policy\n * whose envelopes do not match its signed key. Rotating repairs the group, but\n * the mismatch is evidence and is recorded before the repair proceeds.\n */\nasync function reportPrincipalEnvelopeMismatch(\n input: BuildAddGroupUserPolicyInput,\n): Promise<void> {\n const state = input.currentPolicy.currentState;\n await input.reportSecurityIncident?.(\n new KeyingVerificationError(\n \"object_mismatch\",\n \"Group member envelope does not unwrap the signed principal key\",\n ),\n {\n evidenceHashes: {\n principalKeyFingerprint: state.keyFingerprint,\n principalStateHash: state.stateHash,\n },\n objectId: state.principalId,\n objectKind: \"principal\",\n operation: \"group.policy.envelope_mismatch\",\n },\n );\n}\n\nfunction hasAdmin(\n projection: ReadonlyArray<PrincipalProjectionMemberRequest>,\n): boolean {\n return projection.some((member) => member.role === \"admin\");\n}\n\nfunction requireExternalAuthority(\n authority: PrincipalPolicyExternalAuthority | undefined,\n): PrincipalPolicyExternalAuthority {\n if (!authority) {\n throw new Error(\"External principal authority could not be verified\");\n }\n return authority;\n}\n\nasync function buildRotatedKeyGroupPolicyRequest(\n input: BuildGroupMembershipMutationInput,\n projection: ReadonlyArray<PrincipalProjectionMemberRequest>,\n users: ReadonlyArray<TrustedUserIdentity>,\n grants = input.currentPolicy.currentGrants,\n): Promise<PutPrincipalPolicyRequest> {\n const groupKem = generateKemSeedAndKeyPair();\n const memberEnvelopes = await rewrapProjectionMemberEnvelopes({\n projection,\n secretKey: groupKem.secretKey,\n users,\n });\n return signedGroupPolicyRequest({\n currentPolicy: input.currentPolicy,\n encapsulationPublicKey: bytesToBase64(groupKem.publicKey),\n externalAuthority: isDirectGroupAdmin(\n input.currentPolicy,\n input.signerUserId,\n )\n ? null\n : requireExternalAuthority(input.externalAuthority).currentHead,\n keyEpoch: input.currentPolicy.currentState.keyEpoch + 1,\n keyFingerprint: await toFingerprint(groupKem.publicKey),\n grants,\n memberEnvelopes,\n payloadCiphertext: input.currentPolicy.currentPayload.ciphertext,\n principalId: input.currentPolicy.currentState.principalId,\n projection,\n signedAt: new Date().toISOString(),\n signerUserId: input.signerUserId,\n signingFingerprint: input.signingFingerprint,\n signingKeyPair: input.signingKeyPair,\n });\n}\n\nasync function buildDirectAdminAddGroupUserPolicyRequest(\n input: BuildAddGroupUserPolicyInput,\n projection: ReadonlyArray<PrincipalProjectionMemberRequest>,\n targetKey: string,\n): Promise<PutPrincipalPolicyRequest> {\n const groupSecretKey = await unwrapDek(\n toRecipientEntries(input.currentPolicy.currentMemberEnvelopes.envelopes),\n input.currentUserSecretKey,\n );\n if (\n !(await principalSecretKeyMatchesState(\n groupSecretKey,\n input.currentPolicy.currentState,\n ))\n ) {\n await reportPrincipalEnvelopeMismatch(input);\n return buildRotatedKeyGroupPolicyRequest(input, projection, [\n ...input.currentUsers,\n input.targetUser,\n ]);\n }\n const [targetEnvelope] = await wrapDekForRecipients(groupSecretKey, [\n input.targetUser.encapsulationPublicKey,\n ]);\n\n if (!targetEnvelope) {\n throw new Error(\"Failed to wrap group key for target user\");\n }\n\n const memberEnvelopes = [\n ...input.currentPolicy.currentMemberEnvelopes.envelopes.filter(\n (envelope) => envelope.userId !== targetKey,\n ),\n {\n userId: input.targetUser.userId,\n memberKeyFingerprint: input.targetUser.encapsulationKeyFingerprint,\n kemCipherText: bytesToBase64(targetEnvelope.kemCipherText),\n wrappedKey: bytesToBase64(targetEnvelope.wrappedKey),\n },\n ];\n return signedGroupPolicyRequest({\n currentPolicy: input.currentPolicy,\n encapsulationPublicKey:\n input.currentPolicy.currentState.encapsulationPublicKey,\n externalAuthority: null,\n keyEpoch: input.currentPolicy.currentState.keyEpoch,\n keyFingerprint: input.currentPolicy.currentState.keyFingerprint,\n grants: input.currentPolicy.currentGrants,\n memberEnvelopes,\n payloadCiphertext: input.currentPolicy.currentPayload.ciphertext,\n principalId: input.currentPolicy.currentState.principalId,\n projection,\n signedAt: new Date().toISOString(),\n signerUserId: input.signerUserId,\n signingFingerprint: input.signingFingerprint,\n signingKeyPair: input.signingKeyPair,\n });\n}\n\nexport async function buildAddGroupUserPolicyRequest(\n input: BuildAddGroupUserPolicyInput,\n): Promise<PutPrincipalPolicyRequest> {\n input = {\n ...input,\n currentUsers: structuredClone(input.currentUsers),\n currentUserSecretKey: input.currentUserSecretKey.slice(),\n targetUser: structuredClone(input.targetUser),\n };\n try {\n return await withVerifiedGroupMutation(input, async (input) => {\n const targetKey = input.targetUser.userId;\n const currentProjection = input.currentPolicy.currentProjection;\n if (currentProjection.some((member) => member.userId === targetKey)) {\n throw new Error(\"User is already a group member\");\n }\n\n const projection = [\n ...currentProjection,\n userProjectionMember(\n input.targetUser.userId,\n input.isOrganizationAdminsGroup ? \"admin\" : \"member\",\n ),\n ];\n\n return isDirectGroupAdmin(input.currentPolicy, input.signerUserId)\n ? buildDirectAdminAddGroupUserPolicyRequest(\n input,\n projection,\n targetKey,\n )\n : buildRotatedKeyGroupPolicyRequest(input, projection, [\n ...input.currentUsers,\n input.targetUser,\n ]);\n });\n } finally {\n input.currentUserSecretKey.fill(0);\n }\n}\n\nexport async function buildRemoveGroupUserPolicyRequest(\n input: BuildGroupMembershipMutationInput & {\n readonly remainingUsers: ReadonlyArray<TrustedUserIdentity>;\n readonly removedUserId: string;\n },\n): Promise<PutPrincipalPolicyRequest> {\n input = { ...input, remainingUsers: structuredClone(input.remainingUsers) };\n return withVerifiedGroupMutation(input, async (input) => {\n const key = input.removedUserId;\n const projection = input.currentPolicy.currentProjection.filter(\n (member) => member.userId !== key,\n );\n\n if (projection.length === input.currentPolicy.currentProjection.length) {\n throw new Error(\"User is not a group member\");\n }\n\n if (\n hasAdmin(input.currentPolicy.currentProjection) &&\n !hasAdmin(projection)\n ) {\n throw new Error(\"Cannot remove the last group admin\");\n }\n\n return buildRotatedKeyGroupPolicyRequest(\n input,\n projection,\n input.remainingUsers,\n );\n });\n}\n\nexport async function buildGroupAccessSetShrinkPolicyRequest(\n input: BuildGroupMembershipMutationInput & {\n readonly currentUsers: ReadonlyArray<TrustedUserIdentity>;\n readonly revokedContainerId: string;\n },\n): Promise<PutPrincipalPolicyRequest> {\n input = { ...input, currentUsers: structuredClone(input.currentUsers) };\n return withVerifiedGroupMutation(input, async (input) => {\n return buildRotatedKeyGroupPolicyRequest(\n input,\n [...input.currentPolicy.currentProjection],\n input.currentUsers,\n input.currentPolicy.currentGrants.filter(\n (grant) => grant.containerId !== input.revokedContainerId,\n ),\n );\n });\n}\n\n/** Signs a complete successor grant projection without rotating group key material. */\nexport async function buildSetGroupContainerGrantPolicyRequest(\n input: BuildGroupMembershipMutationInput & {\n readonly accessLevel: PrincipalContainerGrantRequest[\"accessLevel\"];\n readonly containerId: string;\n },\n): Promise<PutPrincipalPolicyRequest> {\n return withVerifiedGroupMutation(input, async (input) => {\n const grants = [\n ...input.currentPolicy.currentGrants.filter(\n (grant) => grant.containerId !== input.containerId,\n ),\n { accessLevel: input.accessLevel, containerId: input.containerId },\n ];\n return signedGroupPolicyRequest({\n currentPolicy: input.currentPolicy,\n encapsulationPublicKey:\n input.currentPolicy.currentState.encapsulationPublicKey,\n externalAuthority: isDirectGroupAdmin(\n input.currentPolicy,\n input.signerUserId,\n )\n ? null\n : requireExternalAuthority(input.externalAuthority).currentHead,\n keyEpoch: input.currentPolicy.currentState.keyEpoch,\n keyFingerprint: input.currentPolicy.currentState.keyFingerprint,\n grants,\n memberEnvelopes: input.currentPolicy.currentMemberEnvelopes.envelopes,\n payloadCiphertext: input.currentPolicy.currentPayload.ciphertext,\n principalId: input.currentPolicy.currentState.principalId,\n projection: input.currentPolicy.currentProjection,\n signedAt: new Date().toISOString(),\n signerUserId: input.signerUserId,\n signingFingerprint: input.signingFingerprint,\n signingKeyPair: input.signingKeyPair,\n });\n });\n}\n"]}

package/workflows/organizations/{groupPolicyVerification.js → groupPolicy/groupPolicyVerification.js} RENAMED Viewed

@@ -1,8 +1,8 @@
-import { verifyPrincipalPolicyBundle, } from "../../internal/crypto/index.js";
-import { throwKeyingVerificationErrorWithContext } from "../../data/keyingProjectionVerification/error.js";
-import { loadPrincipalPolicyCheckpoint } from "../../data/persistence/keyingCheckpointPersistence.js";
-import { verifyPrincipalPolicyBundleWithExternalOrganizationAdmins } from "../../data/principals/principalPolicyAdminSigners.js";
-import { collectPrincipalPolicySignerPublicKeys, } from "../principals/policyVerification.js";
+import { verifyPrincipalPolicyBundle, } from "../../../internal/crypto/index.js";
+import { throwKeyingVerificationErrorWithContext } from "../../../data/keyingProjectionVerification/error.js";
+import { loadPrincipalPolicyCheckpoint } from "../../../data/persistence/keyingCheckpointPersistence.js";
+import { verifyPrincipalPolicyBundleWithExternalOrganizationAdmins } from "../../../data/principals/principalPolicyAdminSigners.js";
+import { collectPrincipalPolicySignerPublicKeys, } from "../../principals/policyVerification.js";
 function signerPublicKeyLoadErrorMessage(code) {
     switch (code) {
         case "fingerprint-mismatch":

package/workflows/organizations/groupPolicy/groupPolicyVerification.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"groupPolicyVerification.js","sourceRoot":"","sources":["groupPolicyVerification.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,uCAAuC,EAAE,MAAM,kDAAkD,CAAC;AAC3G,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,EAAE,yDAAyD,EAAE,MAAM,sDAAsD,CAAC;AAGjI,OAAO,EACL,sCAAsC,GAEvC,MAAM,qCAAqC,CAAC;AAE7C,SAAS,+BAA+B,CACtC,IAAiD;IAEjD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,sBAAsB;YACzB,OAAO,8CAA8C,CAAC;QACxD,KAAK,WAAW;YACd,OAAO,6CAA6C,CAAC;IACzD,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC3B,MAAqC;IAErC,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC;IAClC,OAAO;QACL,aAAa,EAAE,OAAO;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAGxD;IACC,MAAM,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;QACpE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IAEH,IAAI,OAAO,IAAI,gBAAgB,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,gBAAgB,CAAC,gBAAgB,CAAC;AAC3C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAKvC;IACC,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC;QACjD,MAAM,EAAE,KAAK,CAAC,aAAa;QAC3B,GAAG,CAAC,KAAK,CAAC,iBAAiB;YACzB,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE;YAChD,CAAC,CAAC,EAAE,CAAC;QACP,iBAAiB,EAAE,oBAAoB,CAAC,KAAK,CAAC,aAAa,CAAC;QAC5D,eAAe,EAAE,KAAK,CAAC,qBAAqB;QAC5C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,uCAAuC,CACrC,QAAQ,CAAC,KAAK,EACd,kCAAkC,CACnC,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+CAA+C,CAAC,KAKrE;IACC,MAAM,QAAQ,GACZ,MAAM,yDAAyD,CAAC;QAC9D,MAAM,EAAE,KAAK,CAAC,aAAa;QAC3B,iBAAiB,EAAE,oBAAoB,CAAC,KAAK,CAAC,aAAa,CAAC;QAC5D,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,eAAe,EAAE,KAAK,CAAC,qBAAqB;QAC5C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IACL,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,uCAAuC,CACrC,QAAQ,CAAC,KAAK,EACd,kCAAkC,CACnC,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAIpD;IAIC,MAAM,WAAW,GAAG,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,WAAW,CAAC;IACjE,MAAM,qBAAqB,GAAG,MAAM,6BAA6B,CAC/D,KAAK,CAAC,OAAO,EACb,OAAO,EACP,WAAW,CACZ,CAAC;IAEF,OAAO;QACL,6BAA6B,EAAE,MAAM,kCAAkC,CAAC;YACtE,MAAM,EAAE,KAAK,CAAC,aAAa;YAC3B,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;SAC7D,CAAC;QACF,qBAAqB;KACtB,CAAC;AACJ,CAAC","sourcesContent":["import {\n type KeyingVerificationResult,\n type PrincipalPolicyCheckpoint,\n type PrincipalPolicyExternalAuthority,\n type PrincipalPolicySignerPublicKey,\n type ReferencedPrincipalHead,\n type VerifiedPrincipalPolicy,\n verifyPrincipalPolicyBundle,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { throwKeyingVerificationErrorWithContext } from \"../../../data/keyingProjectionVerification/error\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../../data/persistence/keyingCheckpointPersistence\";\nimport { verifyPrincipalPolicyBundleWithExternalOrganizationAdmins } from \"../../../data/principals/principalPolicyAdminSigners\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../../data/trustedUserIdentity\";\nimport {\n collectPrincipalPolicySignerPublicKeys,\n type PrincipalPolicySignerPublicKeyLoadErrorCode,\n} from \"../../principals/policyVerification\";\n\nfunction signerPublicKeyLoadErrorMessage(\n code: PrincipalPolicySignerPublicKeyLoadErrorCode,\n): string {\n switch (code) {\n case \"fingerprint-mismatch\":\n return \"Group policy signer key fingerprint mismatch\";\n case \"not-found\":\n return \"Group policy signer key could not be loaded\";\n }\n}\n\nfunction groupPolicyReference(\n bundle: PrincipalPolicyBundleResponse,\n): ReferencedPrincipalHead {\n const state = bundle.currentState;\n return {\n principalType: \"group\",\n principalId: state.principalId,\n version: state.version,\n keyEpoch: state.keyEpoch,\n stateHash: state.stateHash,\n keyFingerprint: state.keyFingerprint,\n };\n}\n\nexport async function collectGroupPolicySignerPublicKeys(input: {\n readonly bundle: PrincipalPolicyBundleResponse;\n readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}): Promise<PrincipalPolicySignerPublicKey[]> {\n const signerPublicKeys = await collectPrincipalPolicySignerPublicKeys({\n bundle: input.bundle,\n resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n });\n\n if (\"error\" in signerPublicKeys) {\n throw new Error(signerPublicKeyLoadErrorMessage(signerPublicKeys.error));\n }\n\n return signerPublicKeys.signerPublicKeys;\n}\n\nexport async function verifyGroupPolicy(input: {\n readonly externalAuthority?: PrincipalPolicyExternalAuthority;\n readonly currentPolicy: PrincipalPolicyBundleResponse;\n readonly localPolicyCheckpoint: PrincipalPolicyCheckpoint | null;\n readonly signerPublicKeys: readonly PrincipalPolicySignerPublicKey[];\n}): Promise<VerifiedPrincipalPolicy> {\n const verified = await verifyPrincipalPolicyBundle({\n bundle: input.currentPolicy,\n ...(input.externalAuthority\n ? { externalAuthority: input.externalAuthority }\n : {}),\n expectedReference: groupPolicyReference(input.currentPolicy),\n localCheckpoint: input.localPolicyCheckpoint,\n signerPublicKeys: input.signerPublicKeys,\n });\n\n if (!verified.ok) {\n throwKeyingVerificationErrorWithContext(\n verified.error,\n \"Group policy verification failed\",\n );\n }\n\n return verified.value;\n}\n\nexport async function verifyGroupPolicyWithExternalOrganizationAdmins(input: {\n readonly currentPolicy: PrincipalPolicyBundleResponse;\n readonly loadExternalAuthority: () => Promise<PrincipalPolicyExternalAuthority | null>;\n readonly localPolicyCheckpoint: PrincipalPolicyCheckpoint | null;\n readonly signerPublicKeys: readonly PrincipalPolicySignerPublicKey[];\n}): Promise<VerifiedPrincipalPolicy> {\n const verified: KeyingVerificationResult<VerifiedPrincipalPolicy> =\n await verifyPrincipalPolicyBundleWithExternalOrganizationAdmins({\n bundle: input.currentPolicy,\n expectedReference: groupPolicyReference(input.currentPolicy),\n loadExternalAuthority: input.loadExternalAuthority,\n localCheckpoint: input.localPolicyCheckpoint,\n signerPublicKeys: input.signerPublicKeys,\n });\n if (!verified.ok) {\n throwKeyingVerificationErrorWithContext(\n verified.error,\n \"Group policy verification failed\",\n );\n }\n return verified.value;\n}\n\nexport async function prepareGroupPolicyVerification(input: {\n readonly currentPolicy: PrincipalPolicyBundleResponse;\n readonly execSql: ExecSql;\n readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}): Promise<{\n readonly currentPolicySignerPublicKeys: readonly PrincipalPolicySignerPublicKey[];\n readonly localPolicyCheckpoint: PrincipalPolicyCheckpoint | null;\n}> {\n const principalId = input.currentPolicy.currentState.principalId;\n const localPolicyCheckpoint = await loadPrincipalPolicyCheckpoint(\n input.execSql,\n \"group\",\n principalId,\n );\n\n return {\n currentPolicySignerPublicKeys: await collectGroupPolicySignerPublicKeys({\n bundle: input.currentPolicy,\n resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n }),\n localPolicyCheckpoint,\n };\n}\n"]}

package/workflows/organizations/{submitGroupPolicyCommit.d.ts → groupPolicy/submitGroupPolicyCommit.d.ts} RENAMED Viewed

@@ -1,6 +1,6 @@
-import type { ContainerMutationRequest, PutPrincipalPolicyRequest } from "../../internal/validators/request/index.js";
-import { type CommitOrganizationGroupPolicyResponse } from "../../internal/validators/response/index.js";
-import type { PrincipalPolicyReadWriteApi } from "./principalPolicyApi.js";
+import type { ContainerMutationRequest, PutPrincipalPolicyRequest } from "../../../internal/validators/request/index.js";
+import { type CommitOrganizationGroupPolicyResponse } from "../../../internal/validators/response/index.js";
+import type { PrincipalPolicyReadWriteApi } from "../principalPolicy/principalPolicyApi.js";
 /**
  * Commit, answering one refusal: a rematerialized rekey or revoke that would
  * strand a level above a directly granted container is refused with the

package/workflows/organizations/{submitGroupPolicyCommit.js → groupPolicy/submitGroupPolicyCommit.js} RENAMED Viewed

@@ -1,4 +1,4 @@
-import { CONTAINER_MUTATION_ERROR_CODES, } from "../../internal/validators/response/index.js";
+import { CONTAINER_MUTATION_ERROR_CODES, } from "../../../internal/validators/response/index.js";
 /**
  * Commit, answering one refusal: a rematerialized rekey or revoke that would
  * strand a level above a directly granted container is refused with the

package/workflows/organizations/groupPolicy/submitGroupPolicyCommit.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"submitGroupPolicyCommit.js","sourceRoot":"","sources":["submitGroupPolicyCommit.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,8BAA8B,GAE/B,MAAM,gCAAgC,CAAC;AAGxC;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAa7C;IACC,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,CAAC;QAClB,WAAW,EAAE,KAAK,CAAC,OAAO;QAC1B,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,kBAAkB,EAAE,KAAK,CAAC,mBAAmB;KAC9C,CAAC,CAAC;IACH,MAAM,EAAE,mCAAmC,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC;IAChE,IAAI,CAAC,mCAAmC,EAAE,CAAC;QACzC,OAAO,KAAK,CAAC,SAAS,CAAC,6BAA6B,CAClD,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,OAAO,EACb,IAAI,EAAE,CACP,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,mCAAmC,CAAC,IAAI,CAC1D,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,OAAO,EACb,IAAI,EAAE,EACN,EAAE,YAAY,EAAE,KAAK,EAAE,CACxB,CAAC;IACF,IAAI,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC;IAChC,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB;QAClC,MAAM,IAAI,KAAK,CACb,KAAK,CAAC,OAAO;YACX,4DAA4D,CAC/D,CAAC;IACJ,IACE,KAAK,CAAC,aAAa;QACnB,KAAK,CAAC,IAAI,KAAK,8BAA8B,CAAC,wBAAwB,EACtE,CAAC;QACD,MAAM,IAAI,KAAK,CACb,4FAA4F,CAC7F,CAAC;IACJ,CAAC;IACD,IACE,CAAC,KAAK,CAAC,qBAAqB;QAC5B,KAAK,CAAC,IAAI,KAAK,8BAA8B,CAAC,wBAAwB;QACtE,CAAC,KAAK,CAAC,oBAAoB,EAAE,MAAM,EACnC,CAAC;QACD,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAA4C,CAAC;IACjD,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,KAAK,CAAC,qBAAqB,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC1E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,wEAAwE;QACxE,qEAAqE;QACrE,kDAAkD;QAClD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;YAAE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QACvD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,2EAA2E;IAC3E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,kBAAkB,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,mCAAmC,CAAC,IAAI,CAC3D,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,OAAO,EACb,IAAI,EAAE,EACN,EAAE,YAAY,EAAE,KAAK,EAAE,CACxB,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW;YAAE,OAAO,IAAI,CAAC;QAC7C,IAAI,MAAM,CAAC,IAAI,KAAK,iBAAiB;YACnC,MAAM,IAAI,KAAK,CACb,MAAM,CAAC,OAAO;gBACZ,4DAA4D,CAC/D,CAAC;QACJ,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC","sourcesContent":["import type {\n ContainerMutationRequest,\n PutPrincipalPolicyRequest,\n} from \"@tearleads/validators/request\";\nimport {\n CONTAINER_MUTATION_ERROR_CODES,\n type CommitOrganizationGroupPolicyResponse,\n} from \"@tearleads/validators/response\";\nimport type { PrincipalPolicyReadWriteApi } from \"../principalPolicy/principalPolicyApi\";\n\n/**\n * Commit, answering one refusal: a rematerialized rekey or revoke that would\n * strand a level above a directly granted container is refused with the\n * descendant rekeys it must carry. The refused attempt rolled back whole, so\n * the served heads still stand; the batch is signed again with the named\n * levels woven in, replaces the container mutations, and the commit is retried\n * once. A second refusal means the tree moved underneath, and the caller's own\n * retry starts from a fresh policy.\n */\nexport async function submitGroupPolicyCommit(input: {\n readonly apiClient: PrincipalPolicyReadWriteApi;\n readonly carryDescendantRekeys?:\n | ((\n requiredContainerIds: readonly string[],\n ) => Promise<readonly ContainerMutationRequest[]>)\n | undefined;\n readonly groupId: string;\n readonly organizationId: string;\n readonly organizationRequest: PutPrincipalPolicyRequest;\n readonly memberRequest?: PutPrincipalPolicyRequest | undefined;\n readonly request: PutPrincipalPolicyRequest;\n readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<CommitOrganizationGroupPolicyResponse | null> {\n const body = () => ({\n groupPolicy: input.request,\n ...(input.memberRequest ? { memberPolicy: input.memberRequest } : {}),\n organizationPolicy: input.organizationRequest,\n });\n const { commitOrganizationGroupPolicyResult } = input.apiClient;\n if (!commitOrganizationGroupPolicyResult) {\n return input.apiClient.commitOrganizationGroupPolicy(\n input.organizationId,\n input.groupId,\n body(),\n );\n }\n const first = await commitOrganizationGroupPolicyResult.call(\n input.apiClient,\n input.organizationId,\n input.groupId,\n body(),\n { reportErrors: false },\n );\n if (first.ok) return first.data;\n if (first.kind === \"cancelled\") return null;\n if (first.kind === \"outcome-unknown\")\n throw new Error(\n first.message ??\n \"Policy request may have committed; refresh before retrying\",\n );\n if (\n input.memberRequest &&\n first.code === CONTAINER_MUTATION_ERROR_CODES.descendantRekeysRequired\n ) {\n throw new Error(\n \"Repair the affected container keys before retrying enrollment; no memberships were changed\",\n );\n }\n if (\n !input.carryDescendantRekeys ||\n first.code !== CONTAINER_MUTATION_ERROR_CODES.descendantRekeysRequired ||\n !first.requiredContainerIds?.length\n ) {\n first.report?.();\n return null;\n }\n let carried: readonly ContainerMutationRequest[];\n try {\n carried = await input.carryDescendantRekeys(first.requiredContainerIds);\n } catch (error) {\n // The refusal was answerable, and the answer failed: surface both. Once\n // the generation that owned the attempt is gone, only the failure is\n // surfaced; a superseded refusal is not an error.\n if (input.stillCurrent?.() !== false) first.report?.();\n throw error;\n }\n if (input.stillCurrent?.() === false) return null;\n // Nothing signed means the same refusal again; report the one already had.\n if (carried.length === 0) {\n first.report?.();\n return null;\n }\n input.request.containerMutations = [...carried];\n const second = await commitOrganizationGroupPolicyResult.call(\n input.apiClient,\n input.organizationId,\n input.groupId,\n body(),\n { reportErrors: false },\n );\n if (!second.ok) {\n if (second.kind === \"cancelled\") return null;\n if (second.kind === \"outcome-unknown\")\n throw new Error(\n second.message ??\n \"Policy request may have committed; refresh before retrying\",\n );\n second.report?.();\n return null;\n }\n return second.data;\n}\n"]}

package/workflows/organizations/{createCurrentOrganizationGroup.js → groups/createCurrentOrganizationGroup.js} RENAMED Viewed

@@ -1,13 +1,13 @@
-import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
-import { advanceKeyingCheckpointsAtomically } from "../../data/persistence/keyingCheckpointAdvancePersistence.js";
-import { principalPolicyReferenceFromBundle } from "../../data/principals/principalPolicyAdminSigners.js";
-import { assertGroupMetadataBinding } from "./groupMetadataBinding.js";
-import { readDirectoryGroupName } from "./groupNameUniqueness.js";
-import { acknowledgeInitialGroupPolicy } from "./groupPolicyMutationAcknowledgement.js";
-import { groupPolicyMutationHead } from "./groupPolicyMutationHead.js";
+import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
+import { advanceKeyingCheckpointsAtomically } from "../../../data/persistence/keyingCheckpointAdvancePersistence.js";
+import { principalPolicyReferenceFromBundle } from "../../../data/principals/principalPolicyAdminSigners.js";
+import { assertGroupMetadataBinding } from "../groupMetadata/groupMetadataBinding.js";
+import { readDirectoryGroupName } from "../groupNames/groupNameUniqueness.js";
+import { acknowledgeInitialGroupPolicy } from "../groupPolicy/groupPolicyMutationAcknowledgement.js";
+import { groupPolicyMutationHead } from "../groupPolicy/groupPolicyMutationHead.js";
+import { buildInitialGroupPolicyRequest, canonicalGroupNameKey, } from "../principalPolicy/principalPolicyRequest.js";
+import { projectionUserIds, resolveRequiredUserIdentities, } from "../trustedOrganizationUsers.js";
 import { buildOrganizationGroupDirectoryPolicyRequest, replaceOrganizationGroupHead, } from "./organizationGroupDirectory.js";
-import { buildInitialGroupPolicyRequest, canonicalGroupNameKey, } from "./principalPolicyRequest.js";
-import { projectionUserIds, resolveRequiredUserIdentities, } from "./trustedOrganizationUsers.js";
 /** Create from bounded current evidence and publish its genuine genesis with the directory. */
 export async function createCurrentOrganizationGroup(input) {
     const { context } = input;

package/workflows/organizations/groups/createCurrentOrganizationGroup.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"createCurrentOrganizationGroup.js","sourceRoot":"","sources":["createCurrentOrganizationGroup.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AACvG,OAAO,EAAE,kCAAkC,EAAE,MAAM,8DAA8D,CAAC;AAClH,OAAO,EAAE,kCAAkC,EAAE,MAAM,sDAAsD,CAAC;AAK1G,OAAO,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AACnF,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAC3E,OAAO,EAAE,6BAA6B,EAAE,MAAM,mDAAmD,CAAC;AAElG,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAEjF,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,GACtB,MAAM,2CAA2C,CAAC;AAEnD,OAAO,EACL,iBAAiB,EACjB,6BAA6B,GAC9B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,4CAA4C,EAC5C,4BAA4B,GAC7B,MAAM,8BAA8B,CAAC;AAEtC,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAgBpD;IACC,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC1B,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClD,6EAA6E;IAC7E,+EAA+E;IAC/E,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxD,MAAM,YAAY,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QAC1E,mCAAmC,CAAC,YAAY,CAAC,CAAC;QAClD,0BAA0B,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,MAAM,sBAAsB,CACvC,EAAE,GAAG,KAAK,EAAE,iBAAiB,EAAE,KAAK,CAAC,cAAc,CAAC,QAAQ,EAAE,EAC9D,KAAK,CAAC,OAAO,CACd,CAAC;QACF,uEAAuE;QACvE,0EAA0E;QAC1E,MAAM,kCAAkC,CAAC;YACvC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC;YAC/C,YAAY;SACb,CAAC,CAAC;QACH,IAAI,IAAI,KAAK,IAAI,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,OAAO;YAC1D,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;IACN,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC;QACnD,GAAG,KAAK;QACR,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE;QAC5B,oBAAoB,EAAE,KAAK;QAC3B,iBAAiB,EAAE;YACjB,GAAG,kCAAkC,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;YAC7D,aAAa,EAAE,OAAO;SACvB;QACD,WAAW,EAAE,MAAM,KAAK,CAAC,cAAc,CAAC,iBAAiB,EAAE;KAC5D,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,uBAAuB,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACvE,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;IACzD,MAAM,mBAAmB,GACvB,MAAM,4CAA4C,CAAC;QACjD,GAAG,KAAK;QACR,aAAa,EAAE,OAAO,CAAC,SAAS,CAAC,OAAO;QACxC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,UAAU,EAAE,4BAA4B,CAAC;YACvC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,QAAQ,EAAE,IAAI;SACf,CAAC;QACF,eAAe;QACf,UAAU,EAAE,MAAM,6BAA6B,CAAC;YAC9C,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;YAC5D,OAAO,EAAE,iBAAiB,CAAC,eAAe,CAAC;SAC5C,CAAC;KACH,CAAC,CAAC;IACL,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,uBAAuB,CAC1D,KAAK,CAAC,cAAc,EACpB,EAAE,GAAG,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,CACxD,CAAC;IACF,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC3D,2EAA2E;IAC3E,6EAA6E;IAC7E,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,6BAA6B,CAAC;QACrD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO;QACP,QAAQ,EAAE,MAAM,CAAC,KAAK;QACtB,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC,CAAC;IACH,MAAM,EAAE,cAAc,EAAE,eAAe,EAAE,GAAG,OAAO,EAAE,GAAG,MAAM,CAAC;IAC/D,MAAM,OAAO,CAAC,kBAAkB,CAAC;QAC/B,OAAO,EAAE,OAAO,CAAC,kBAAkB;QACnC,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,kBAAkB,EAAE,EAAE,EAAE;QAChD,mBAAmB;QACnB,oBAAoB,EAAE,MAAM,CAAC,kBAAkB;KAChD,CAAC,CAAC;IACH,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;AAC7E,CAAC","sourcesContent":["import type { EncapsulationKeyPair, SigningKeyPair } from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport { advanceKeyingCheckpointsAtomically } from \"../../../data/persistence/keyingCheckpointAdvancePersistence\";\nimport { principalPolicyReferenceFromBundle } from \"../../../data/principals/principalPolicyAdminSigners\";\nimport type { SecurityIncidentReporter } from \"../../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../../data/trustedUserIdentity\";\nimport type { createGroupMetadataAccess } from \"../groupMetadata/groupMetadataAccess\";\nimport { assertGroupMetadataBinding } from \"../groupMetadata/groupMetadataBinding\";\nimport { readDirectoryGroupName } from \"../groupNames/groupNameUniqueness\";\nimport { acknowledgeInitialGroupPolicy } from \"../groupPolicy/groupPolicyMutationAcknowledgement\";\nimport type { OrganizationPrincipalPolicyApi } from \"../groupPolicy/groupPolicyMutationContext\";\nimport { groupPolicyMutationHead } from \"../groupPolicy/groupPolicyMutationHead\";\nimport type { CurrentOrganizationMutationContext } from \"../principalMutations/runtimeCurrentOrganizationMutation\";\nimport {\n buildInitialGroupPolicyRequest,\n canonicalGroupNameKey,\n} from \"../principalPolicy/principalPolicyRequest\";\nimport type { OrganizationGroupSummary } from \"../readModel\";\nimport {\n projectionUserIds,\n resolveRequiredUserIdentities,\n} from \"../trustedOrganizationUsers\";\nimport {\n buildOrganizationGroupDirectoryPolicyRequest,\n replaceOrganizationGroupHead,\n} from \"./organizationGroupDirectory\";\n\n/** Create from bounded current evidence and publish its genuine genesis with the directory. */\nexport async function createCurrentOrganizationGroup(input: {\n readonly apiClient: Pick<\n OrganizationPrincipalPolicyApi,\n \"createOrganizationGroup\"\n >;\n readonly context: CurrentOrganizationMutationContext;\n readonly creatorEncapsulationKeyPair: EncapsulationKeyPair;\n readonly execSql: ExecSql;\n readonly metadataAccess: ReturnType<typeof createGroupMetadataAccess>;\n readonly name: string;\n readonly organizationId: string;\n readonly reportSecurityIncident: SecurityIncidentReporter;\n readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n readonly signerUserId: string;\n readonly signingFingerprint: string;\n readonly signingKeyPair: SigningKeyPair;\n}): Promise<OrganizationGroupSummary> {\n const { context } = input;\n assertProjectionVerificationCurrent(context.stillCurrent);\n const nameKey = canonicalGroupNameKey(input.name);\n // Each current recovery is queued by organization. Retain verified heads one\n // at a time so the walk stays bounded without collecting full group histories.\n for (const head of context.descriptor.groupHeads) {\n const group = await context.readGroup(head.principalId);\n const stillCurrent = () => context.stillCurrent() && group.stillCurrent();\n assertProjectionVerificationCurrent(stillCurrent);\n assertGroupMetadataBinding(group.current, context.descriptor);\n const name = await readDirectoryGroupName(\n { ...input, readEncryptedName: input.metadataAccess.readName },\n group.current,\n );\n // Remember independently verified heads even if uniqueness or dispatch\n // later fails; these are observed policies, never speculative successors.\n await advanceKeyingCheckpointsAtomically({\n execSql: input.execSql,\n organizationId: input.organizationId,\n access: [],\n policies: [...group.dependencies, group.policy],\n stillCurrent,\n });\n if (name !== null && canonicalGroupNameKey(name) === nameKey)\n throw new Error(\n \"Another signed group in this organization already carries this name\",\n );\n }\n const request = await buildInitialGroupPolicyRequest({\n ...input,\n groupId: crypto.randomUUID(),\n includeSignerAsAdmin: false,\n externalAuthority: {\n ...principalPolicyReferenceFromBundle(context.admins.current),\n principalType: \"group\",\n },\n metadataKey: await input.metadataAccess.loadEncryptionKey(),\n });\n const head = await groupPolicyMutationHead(request.initialGroupPolicy);\n const adminProjection = context.admins.policy.projection;\n const organizationRequest =\n await buildOrganizationGroupDirectoryPolicyRequest({\n ...input,\n currentPolicy: context.directory.current,\n descriptor: context.descriptor,\n groupHeads: replaceOrganizationGroupHead({\n descriptor: context.descriptor,\n nextHead: head,\n }),\n adminProjection,\n adminUsers: await resolveRequiredUserIdentities({\n resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n userIds: projectionUserIds(adminProjection),\n }),\n });\n assertProjectionVerificationCurrent(context.stillCurrent);\n const stored = await input.apiClient.createOrganizationGroup(\n input.organizationId,\n { ...request, organizationPolicy: organizationRequest },\n );\n assertProjectionVerificationCurrent(context.stillCurrent);\n if (!stored) throw new Error(\"Group could not be created\");\n // Genesis really has one signed state. Reconstruct only the exact authored\n // artifacts whose commitments match the summary, then verify them privately.\n const { bundle } = await acknowledgeInitialGroupPolicy({\n organizationId: input.organizationId,\n request,\n response: stored.group,\n stateHash: head.stateHash,\n });\n const { previousStates: _previousStates, ...current } = bundle;\n await context.retainCreatedGroup({\n request: request.initialGroupPolicy,\n response: { ...current, containerMutations: [] },\n organizationRequest,\n organizationResponse: stored.organizationPolicy,\n });\n assertProjectionVerificationCurrent(context.stillCurrent);\n return { ...stored.group, name: input.name.trim(), nameUnreadable: false };\n}\n"]}

package/workflows/organizations/{deleteCurrentOrganizationGroup.js → groups/deleteCurrentOrganizationGroup.js} RENAMED Viewed

@@ -1,6 +1,6 @@
-import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
+import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
+import { projectionUserIds, resolveRequiredUserIdentities, } from "../trustedOrganizationUsers.js";
 import { buildOrganizationGroupDirectoryPolicyRequest, removeOrganizationGroupHead, } from "./organizationGroupDirectory.js";
-import { projectionUserIds, resolveRequiredUserIdentities, } from "./trustedOrganizationUsers.js";
 /** Delete against a verified directory without loading the removed group's history. */
 export async function deleteCurrentOrganizationGroup(input) {
     const { context } = input;

package/workflows/organizations/groups/deleteCurrentOrganizationGroup.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"deleteCurrentOrganizationGroup.js","sourceRoot":"","sources":["deleteCurrentOrganizationGroup.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AAGvG,OAAO,EACL,iBAAiB,EACjB,6BAA6B,GAC9B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,4CAA4C,EAC5C,2BAA2B,GAC5B,MAAM,8BAA8B,CAAC;AAEtC,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAYpD;IACC,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC1B,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;IACzD,MAAM,OAAO,GAAG,MAAM,4CAA4C,CAAC;QACjE,GAAG,KAAK;QACR,eAAe;QACf,UAAU,EAAE,MAAM,6BAA6B,CAAC;YAC9C,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;YAC5D,OAAO,EAAE,iBAAiB,CAAC,eAAe,CAAC;SAC5C,CAAC;QACF,aAAa,EAAE,OAAO,CAAC,SAAS,CAAC,OAAO;QACxC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,UAAU,EAAE,2BAA2B,CAAC;YACtC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;KACH,CAAC,CAAC;IACH,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,uBAAuB,CAC1D,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,OAAO,EACb,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAChC,CAAC;IACF,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC3D,IACE,MAAM,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QAC9C,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QAEhC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,MAAM,OAAO,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAClE,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import type { SigningKeyPair } from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport type { TrustedUserIdentityResolver } from \"../../../data/trustedUserIdentity\";\nimport type { CurrentOrganizationMutationContext } from \"../principalMutations/runtimeCurrentOrganizationMutation\";\nimport {\n projectionUserIds,\n resolveRequiredUserIdentities,\n} from \"../trustedOrganizationUsers\";\nimport type { deleteOrganizationGroup } from \"./deleteOrganizationGroup\";\nimport {\n buildOrganizationGroupDirectoryPolicyRequest,\n removeOrganizationGroupHead,\n} from \"./organizationGroupDirectory\";\n\n/** Delete against a verified directory without loading the removed group's history. */\nexport async function deleteCurrentOrganizationGroup(input: {\n readonly apiClient: Pick<\n Parameters<typeof deleteOrganizationGroup>[0][\"apiClient\"],\n \"deleteOrganizationGroup\"\n >;\n readonly context: CurrentOrganizationMutationContext;\n readonly groupId: string;\n readonly organizationId: string;\n readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n readonly signerUserId: string;\n readonly signingFingerprint: string;\n readonly signingKeyPair: SigningKeyPair;\n}) {\n const { context } = input;\n assertProjectionVerificationCurrent(context.stillCurrent);\n const adminProjection = context.admins.policy.projection;\n const request = await buildOrganizationGroupDirectoryPolicyRequest({\n ...input,\n adminProjection,\n adminUsers: await resolveRequiredUserIdentities({\n resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n userIds: projectionUserIds(adminProjection),\n }),\n currentPolicy: context.directory.current,\n descriptor: context.descriptor,\n groupHeads: removeOrganizationGroupHead({\n descriptor: context.descriptor,\n groupId: input.groupId,\n }),\n });\n assertProjectionVerificationCurrent(context.stillCurrent);\n const stored = await input.apiClient.deleteOrganizationGroup(\n input.organizationId,\n input.groupId,\n { organizationPolicy: request },\n );\n assertProjectionVerificationCurrent(context.stillCurrent);\n if (!stored) throw new Error(\"Group could not be deleted\");\n if (\n stored.organizationId !== input.organizationId ||\n stored.groupId !== input.groupId\n )\n throw new Error(\"Group deletion response target mismatch\");\n await context.retainDirectory(request, stored.organizationPolicy);\n assertProjectionVerificationCurrent(context.stillCurrent);\n return stored;\n}\n"]}

package/workflows/organizations/{deleteOrganizationGroup.d.ts → groups/deleteOrganizationGroup.d.ts} RENAMED Viewed

@@ -1,9 +1,9 @@
-import type { SigningKeyPair } from "../../internal/crypto/index.js";
-import type { DeleteOrganizationGroupRequest } from "../../internal/validators/request/index.js";
-import type { DeleteOrganizationGroupResponse } from "../../internal/validators/response/index.js";
-import type { ExecSql } from "../../data/sqlite/sqlSchema.js";
-import type { TrustedUserIdentityResolver } from "../../data/trustedUserIdentity/index.js";
-import type { PrincipalPolicyReadApi } from "./groupPolicyMutationContext.js";
+import type { SigningKeyPair } from "../../../internal/crypto/index.js";
+import type { DeleteOrganizationGroupRequest } from "../../../internal/validators/request/index.js";
+import type { DeleteOrganizationGroupResponse } from "../../../internal/validators/response/index.js";
+import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
+import type { TrustedUserIdentityResolver } from "../../../data/trustedUserIdentity/index.js";
+import type { PrincipalPolicyReadApi } from "../groupPolicy/groupPolicyMutationContext.js";
 export declare function deleteOrganizationGroup(input: {
     readonly apiClient: PrincipalPolicyReadApi & {
         deleteOrganizationGroup: (organizationId: string, groupId: string, request: DeleteOrganizationGroupRequest) => Promise<DeleteOrganizationGroupResponse | null>;

package/workflows/organizations/{deleteOrganizationGroup.js → groups/deleteOrganizationGroup.js} RENAMED Viewed

@@ -1,10 +1,10 @@
-import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
-import { persistLocallyAcknowledgedPrincipalPolicyBundles } from "../../data/persistence/locallyAcknowledgedCheckpointPersistence.js";
-import { loadOrganizationExternalAdminPolicy } from "../principals/externalAdminPolicy.js";
-import { acknowledgeGroupPolicyState, buildAcknowledgedGroupPolicyBundle, } from "./groupPolicyMutationAcknowledgement.js";
-import { groupPolicyMutationHead } from "./groupPolicyMutationHead.js";
+import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
+import { persistLocallyAcknowledgedPrincipalPolicyBundles } from "../../../data/persistence/locallyAcknowledgedCheckpointPersistence.js";
+import { loadOrganizationExternalAdminPolicy } from "../../principals/externalAdminPolicy.js";
+import { acknowledgeGroupPolicyState, buildAcknowledgedGroupPolicyBundle, } from "../groupPolicy/groupPolicyMutationAcknowledgement.js";
+import { groupPolicyMutationHead } from "../groupPolicy/groupPolicyMutationHead.js";
+import { projectionUserIds, resolveRequiredUserIdentities, } from "../trustedOrganizationUsers.js";
 import { buildOrganizationGroupDirectoryPolicyRequest, removeOrganizationGroupHead, } from "./organizationGroupDirectory.js";
-import { projectionUserIds, resolveRequiredUserIdentities, } from "./trustedOrganizationUsers.js";
 export async function deleteOrganizationGroup(input) {
     const stillCurrent = input.stillCurrent;
     assertProjectionVerificationCurrent(stillCurrent);

package/workflows/organizations/groups/deleteOrganizationGroup.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"deleteOrganizationGroup.js","sourceRoot":"","sources":["deleteOrganizationGroup.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AACvG,OAAO,EAAE,gDAAgD,EAAE,MAAM,oEAAoE,CAAC;AAGtI,OAAO,EAAE,mCAAmC,EAAE,MAAM,sCAAsC,CAAC;AAC3F,OAAO,EACL,2BAA2B,EAC3B,kCAAkC,GACnC,MAAM,mDAAmD,CAAC;AAE3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EACL,iBAAiB,EACjB,6BAA6B,GAC9B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,4CAA4C,EAC5C,2BAA2B,GAC5B,MAAM,8BAA8B,CAAC;AAEtC,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAgB7C;IACC,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IACxC,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,KAAK,CAAC,SAAS,CAAC,+BAA+B,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC9E,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,mBAAmB,GAAG,MAAM,mCAAmC,CAAC;QACpE,mBAAmB,EAAE,KAAK,CAAC,SAAS;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,YAAY;KACb,CAAC,CAAC;IACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,CAAC,mBAAmB,EAAE,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,eAAe,GAAG,mBAAmB,CAAC,WAAW,CAAC,iBAAiB,CAAC;IAC1E,MAAM,UAAU,GAAG,MAAM,6BAA6B,CAAC;QACrD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,OAAO,EAAE,iBAAiB,CAAC,eAAe,CAAC;KAC5C,CAAC,CAAC;IACH,MAAM,mBAAmB,GACvB,MAAM,4CAA4C,CAAC;QACjD,eAAe;QACf,UAAU;QACV,aAAa,EAAE,mBAAmB,CAAC,MAAM;QACzC,UAAU,EAAE,mBAAmB,CAAC,UAAU;QAC1C,UAAU,EAAE,2BAA2B,CAAC;YACtC,UAAU,EAAE,mBAAmB,CAAC,UAAU;YAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;QACF,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACL,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,uBAAuB,CAC1D,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,OAAO,EACb,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,CAC5C,CAAC;IACF,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,IACE,MAAM,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QAC9C,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,EAChC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,gBAAgB,GAAG,MAAM,uBAAuB,CAAC,mBAAmB,CAAC,CAAC;IAC5E,MAAM,kBAAkB,GAAG,MAAM,2BAA2B,CAAC;QAC3D,aAAa,EAAE,mBAAmB,CAAC,MAAM;QACzC,YAAY,EAAE,gBAAgB;QAC9B,OAAO,EAAE,mBAAmB;QAC5B,QAAQ,EAAE,MAAM,CAAC,kBAAkB,CAAC,YAAY;KACjD,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,kCAAkC,CAAC;QAC5D,aAAa,EAAE,mBAAmB,CAAC,MAAM;QACzC,YAAY,EAAE,gBAAgB;QAC9B,OAAO,EAAE,mBAAmB;QAC5B,QAAQ,EAAE,MAAM,CAAC,kBAAkB;KACpC,CAAC,CAAC;IACH,MAAM,gDAAgD,CAAC;QACrD,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QACrE,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,YAAY;KACb,CAAC,CAAC;IACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import type { SigningKeyPair } from \"@tearleads/crypto\";\nimport type { DeleteOrganizationGroupRequest } from \"@tearleads/validators/request\";\nimport type { DeleteOrganizationGroupResponse } from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport { persistLocallyAcknowledgedPrincipalPolicyBundles } from \"../../../data/persistence/locallyAcknowledgedCheckpointPersistence\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../../data/trustedUserIdentity\";\nimport { loadOrganizationExternalAdminPolicy } from \"../../principals/externalAdminPolicy\";\nimport {\n acknowledgeGroupPolicyState,\n buildAcknowledgedGroupPolicyBundle,\n} from \"../groupPolicy/groupPolicyMutationAcknowledgement\";\nimport type { PrincipalPolicyReadApi } from \"../groupPolicy/groupPolicyMutationContext\";\nimport { groupPolicyMutationHead } from \"../groupPolicy/groupPolicyMutationHead\";\nimport {\n projectionUserIds,\n resolveRequiredUserIdentities,\n} from \"../trustedOrganizationUsers\";\nimport {\n buildOrganizationGroupDirectoryPolicyRequest,\n removeOrganizationGroupHead,\n} from \"./organizationGroupDirectory\";\n\nexport async function deleteOrganizationGroup(input: {\n readonly apiClient: PrincipalPolicyReadApi & {\n deleteOrganizationGroup: (\n organizationId: string,\n groupId: string,\n request: DeleteOrganizationGroupRequest,\n ) => Promise<DeleteOrganizationGroupResponse | null>;\n };\n readonly execSql: ExecSql;\n readonly groupId: string;\n readonly organizationId: string;\n readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n readonly signerUserId: string;\n readonly signingFingerprint: string;\n readonly signingKeyPair: SigningKeyPair;\n readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<DeleteOrganizationGroupResponse> {\n const stillCurrent = input.stillCurrent;\n assertProjectionVerificationCurrent(stillCurrent);\n await input.apiClient.recoverPendingPrincipalMutation?.(input.organizationId);\n assertProjectionVerificationCurrent(stillCurrent);\n const externalAdminPolicy = await loadOrganizationExternalAdminPolicy({\n currentPolicyReader: input.apiClient,\n execSql: input.execSql,\n organizationId: input.organizationId,\n resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n stillCurrent,\n });\n assertProjectionVerificationCurrent(stillCurrent);\n if (!externalAdminPolicy?.signerUserIds.includes(input.signerUserId)) {\n throw new Error(\"Organization admin authority could not be verified\");\n }\n const adminProjection = externalAdminPolicy.adminBundle.currentProjection;\n const adminUsers = await resolveRequiredUserIdentities({\n resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n userIds: projectionUserIds(adminProjection),\n });\n const organizationRequest =\n await buildOrganizationGroupDirectoryPolicyRequest({\n adminProjection,\n adminUsers,\n currentPolicy: externalAdminPolicy.bundle,\n descriptor: externalAdminPolicy.descriptor,\n groupHeads: removeOrganizationGroupHead({\n descriptor: externalAdminPolicy.descriptor,\n groupId: input.groupId,\n }),\n signerUserId: input.signerUserId,\n signingFingerprint: input.signingFingerprint,\n signingKeyPair: input.signingKeyPair,\n });\n assertProjectionVerificationCurrent(stillCurrent);\n const stored = await input.apiClient.deleteOrganizationGroup(\n input.organizationId,\n input.groupId,\n { organizationPolicy: organizationRequest },\n );\n assertProjectionVerificationCurrent(stillCurrent);\n if (!stored) {\n throw new Error(\"Group could not be deleted\");\n }\n if (\n stored.organizationId !== input.organizationId ||\n stored.groupId !== input.groupId\n ) {\n throw new Error(\"Group deletion response target mismatch\");\n }\n const organizationHead = await groupPolicyMutationHead(organizationRequest);\n const organizationPolicy = await acknowledgeGroupPolicyState({\n currentPolicy: externalAdminPolicy.bundle,\n expectedHead: organizationHead,\n request: organizationRequest,\n response: stored.organizationPolicy.currentState,\n });\n const organizationBundle = buildAcknowledgedGroupPolicyBundle({\n currentPolicy: externalAdminPolicy.bundle,\n expectedHead: organizationHead,\n request: organizationRequest,\n response: stored.organizationPolicy,\n });\n await persistLocallyAcknowledgedPrincipalPolicyBundles({\n entries: [{ bundle: organizationBundle, policy: organizationPolicy }],\n execSql: input.execSql,\n organizationId: input.organizationId,\n updatedAt: new Date().toISOString(),\n stillCurrent,\n });\n assertProjectionVerificationCurrent(stillCurrent);\n return stored;\n}\n"]}

package/workflows/organizations/{groupCreation.d.ts → groups/groupCreation.d.ts} RENAMED Viewed

@@ -1,10 +1,10 @@
-import type { EncapsulationKeyPair, SigningKeyPair } from "../../internal/crypto/index.js";
-import type { SecurityIncidentReporter } from "../../data/shared/securityIncidents.js";
-import type { ExecSql } from "../../data/sqlite/sqlSchema.js";
-import type { TrustedUserIdentityResolver } from "../../data/trustedUserIdentity/index.js";
-import type { createGroupMetadataAccess } from "./groupMetadataAccess.js";
-import { type OrganizationPrincipalPolicyApi } from "./groupPolicyMutationContext.js";
-import type { OrganizationGroupSummary } from "./readModel.js";
+import type { EncapsulationKeyPair, SigningKeyPair } from "../../../internal/crypto/index.js";
+import type { SecurityIncidentReporter } from "../../../data/shared/securityIncidents.js";
+import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
+import type { TrustedUserIdentityResolver } from "../../../data/trustedUserIdentity/index.js";
+import type { createGroupMetadataAccess } from "../groupMetadata/groupMetadataAccess.js";
+import { type OrganizationPrincipalPolicyApi } from "../groupPolicy/groupPolicyMutationContext.js";
+import type { OrganizationGroupSummary } from "../readModel/index.js";
 export declare function createOrganizationGroup(input: {
     readonly metadataAccess: ReturnType<typeof createGroupMetadataAccess>;
     readonly apiClient: OrganizationPrincipalPolicyApi;

package/workflows/organizations/{groupCreation.js → groups/groupCreation.js} RENAMED Viewed

@@ -1,8 +1,8 @@
-import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
-import { loadOrganizationExternalAdminPolicy } from "../principals/externalAdminPolicy.js";
-import { cacheGroupPolicy, } from "./groupPolicyMutationContext.js";
+import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
+import { loadOrganizationExternalAdminPolicy } from "../../principals/externalAdminPolicy.js";
+import { cacheGroupPolicy, } from "../groupPolicy/groupPolicyMutationContext.js";
+import { buildInitialGroupPolicyRequest } from "../principalPolicy/principalPolicyRequest.js";
 import { commitCreatedGroupToDirectory } from "./organizationGroupDirectory.js";
-import { buildInitialGroupPolicyRequest } from "./principalPolicyRequest.js";
 export async function createOrganizationGroup(input) {
     assertProjectionVerificationCurrent(input.stillCurrent);
     await input.apiClient.recoverPendingPrincipalMutation?.(input.organizationId);

package/workflows/organizations/groups/groupCreation.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"groupCreation.js","sourceRoot":"","sources":["groupCreation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AAIvG,OAAO,EAAE,mCAAmC,EAAE,MAAM,sCAAsC,CAAC;AAE3F,OAAO,EACL,gBAAgB,GAEjB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAE3F,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAE7E,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAa7C;IACC,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,KAAK,CAAC,SAAS,CAAC,+BAA+B,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC9E,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,mBAAmB,GAAG,MAAM,mCAAmC,CAAC;QACpE,mBAAmB,EAAE,KAAK,CAAC,SAAS;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC;QACnD,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,iBAAiB,EAAE,mBAAmB,CAAC,iBAAiB,CAAC,WAAW;QACpE,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE;QAC5B,oBAAoB,EAAE,KAAK;QAC3B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,MAAM,KAAK,CAAC,cAAc,CAAC,iBAAiB,EAAE;QAC3D,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,MAAM,6BAA6B,CAAC;QACxE,GAAG,KAAK;QACR,mBAAmB;QACnB,iBAAiB,EAAE,KAAK,CAAC,cAAc,CAAC,QAAQ;QAChD,OAAO;KACR,CAAC,CAAC;IACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,gBAAgB,CAAC;QACrB,2BAA2B,EAAE;YAC3B,SAAS,EAAE,OAAO,CAAC,kBAAkB,CAAC,eAAe;YACrD,KAAK,EAAE,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,QAAQ;YAChD,WAAW,EAAE,OAAO,CAAC,OAAO;YAC5B,aAAa,EAAE,OAAO;YACtB,SAAS,EAAE,YAAY,CAAC,SAAS;SAClC;QACD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,mBAAmB,EAAE,YAAY;QACjC,iBAAiB,EAAE,mBAAmB,CAAC,iBAAiB;QACxD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,qBAAqB,EAAE;YACrB,WAAW,EAAE,OAAO,CAAC,OAAO;YAC5B,aAAa,EAAE,OAAO;YACtB,SAAS,EAAE,YAAY,CAAC,SAAS;YACjC,OAAO,EAAE,YAAY,CAAC,OAAO;SAC9B;QACD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;AACtE,CAAC","sourcesContent":["import type { EncapsulationKeyPair, SigningKeyPair } from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport type { SecurityIncidentReporter } from \"../../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../../data/trustedUserIdentity\";\nimport { loadOrganizationExternalAdminPolicy } from \"../../principals/externalAdminPolicy\";\nimport type { createGroupMetadataAccess } from \"../groupMetadata/groupMetadataAccess\";\nimport {\n cacheGroupPolicy,\n type OrganizationPrincipalPolicyApi,\n} from \"../groupPolicy/groupPolicyMutationContext\";\nimport { buildInitialGroupPolicyRequest } from \"../principalPolicy/principalPolicyRequest\";\nimport type { OrganizationGroupSummary } from \"../readModel\";\nimport { commitCreatedGroupToDirectory } from \"./organizationGroupDirectory\";\n\nexport async function createOrganizationGroup(input: {\n readonly metadataAccess: ReturnType<typeof createGroupMetadataAccess>;\n readonly apiClient: OrganizationPrincipalPolicyApi;\n readonly creatorEncapsulationKeyPair: EncapsulationKeyPair;\n readonly execSql: ExecSql;\n readonly name: string;\n readonly organizationId: string;\n readonly reportSecurityIncident: SecurityIncidentReporter;\n readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n readonly signerUserId: string;\n readonly signingFingerprint: string;\n readonly signingKeyPair: SigningKeyPair;\n readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<OrganizationGroupSummary> {\n assertProjectionVerificationCurrent(input.stillCurrent);\n await input.apiClient.recoverPendingPrincipalMutation?.(input.organizationId);\n assertProjectionVerificationCurrent(input.stillCurrent);\n const externalAdminPolicy = await loadOrganizationExternalAdminPolicy({\n currentPolicyReader: input.apiClient,\n execSql: input.execSql,\n organizationId: input.organizationId,\n resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n stillCurrent: input.stillCurrent,\n });\n assertProjectionVerificationCurrent(input.stillCurrent);\n if (!externalAdminPolicy) {\n throw new Error(\"Organization admin authority could not be verified\");\n }\n if (!externalAdminPolicy.signerUserIds.includes(input.signerUserId)) {\n throw new Error(\"Organization admin authority could not be verified\");\n }\n const request = await buildInitialGroupPolicyRequest({\n creatorEncapsulationKeyPair: input.creatorEncapsulationKeyPair,\n externalAuthority: externalAdminPolicy.externalAuthority.currentHead,\n groupId: crypto.randomUUID(),\n includeSignerAsAdmin: false,\n name: input.name,\n metadataKey: await input.metadataAccess.loadEncryptionKey(),\n signerUserId: input.signerUserId,\n signingFingerprint: input.signingFingerprint,\n signingKeyPair: input.signingKeyPair,\n });\n const { group, head: expectedHead } = await commitCreatedGroupToDirectory({\n ...input,\n externalAdminPolicy,\n readEncryptedName: input.metadataAccess.readName,\n request,\n });\n assertProjectionVerificationCurrent(input.stillCurrent);\n await cacheGroupPolicy({\n acknowledgedMemberEnvelopes: {\n envelopes: request.initialGroupPolicy.memberEnvelopes,\n epoch: request.initialGroupPolicy.state.keyEpoch,\n principalId: request.groupId,\n principalType: \"group\",\n stateHash: expectedHead.stateHash,\n },\n apiClient: input.apiClient,\n execSql: input.execSql,\n expectedCurrentHead: expectedHead,\n externalAuthority: externalAdminPolicy.externalAuthority,\n groupId: group.groupId,\n localPolicyCheckpoint: {\n principalId: request.groupId,\n principalType: \"group\",\n stateHash: expectedHead.stateHash,\n version: expectedHead.version,\n },\n organizationId: input.organizationId,\n resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n stillCurrent: input.stillCurrent,\n });\n assertProjectionVerificationCurrent(input.stillCurrent);\n return { ...group, name: input.name.trim(), nameUnreadable: false };\n}\n"]}

package/workflows/organizations/{organizationGroupDirectory.js → groups/organizationGroupDirectory.js} RENAMED Viewed

@@ -1,13 +1,13 @@
-import { buildPrincipalStateSigningInput, generateKemSeedAndKeyPair, normalizePrincipalProjectionMembers, signPrincipalState, toFingerprint, } from "../../internal/crypto/index.js";
-import { bytesToBase64 } from "../../internal/encoding/index.js";
-import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
-import { persistLocallyAcknowledgedPrincipalPolicyBundles } from "../../data/persistence/locallyAcknowledgedCheckpointPersistence.js";
-import { encodeOrganizationAuthorityDescriptor, normalizeOrganizationGroupHeads, } from "../../data/principals/organizationAuthorityDescriptor.js";
-import { assertGroupNameUniqueInDirectory } from "./groupNameUniqueness.js";
-import { acknowledgeGroupPolicyState, acknowledgeInitialGroupPolicy, buildAcknowledgedGroupPolicyBundle, } from "./groupPolicyMutationAcknowledgement.js";
-import { groupPolicyMutationHead } from "./groupPolicyMutationHead.js";
-import { rewrapProjectionMemberEnvelopes } from "./principalPolicyRecipients.js";
-import { projectionUserIds, resolveRequiredUserIdentities, } from "./trustedOrganizationUsers.js";
+import { buildPrincipalStateSigningInput, generateKemSeedAndKeyPair, normalizePrincipalProjectionMembers, signPrincipalState, toFingerprint, } from "../../../internal/crypto/index.js";
+import { bytesToBase64 } from "../../../internal/encoding/index.js";
+import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
+import { persistLocallyAcknowledgedPrincipalPolicyBundles } from "../../../data/persistence/locallyAcknowledgedCheckpointPersistence.js";
+import { encodeOrganizationAuthorityDescriptor, normalizeOrganizationGroupHeads, } from "../../../data/principals/organizationAuthorityDescriptor.js";
+import { assertGroupNameUniqueInDirectory } from "../groupNames/groupNameUniqueness.js";
+import { acknowledgeGroupPolicyState, acknowledgeInitialGroupPolicy, buildAcknowledgedGroupPolicyBundle, } from "../groupPolicy/groupPolicyMutationAcknowledgement.js";
+import { groupPolicyMutationHead } from "../groupPolicy/groupPolicyMutationHead.js";
+import { rewrapProjectionMemberEnvelopes } from "../principalPolicy/principalPolicyRecipients.js";
+import { projectionUserIds, resolveRequiredUserIdentities, } from "../trustedOrganizationUsers.js";
 function organizationGroupHead(head) {
     if (head.principalType !== "group") {
         throw new Error("Organization directory can contain only group heads");

package/workflows/organizations/groups/organizationGroupDirectory.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"organizationGroupDirectory.js","sourceRoot":"","sources":["organizationGroupDirectory.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,EAC/B,yBAAyB,EACzB,mCAAmC,EAGnC,kBAAkB,EAClB,aAAa,GACd,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AASpD,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AACvG,OAAO,EAAE,gDAAgD,EAAE,MAAM,oEAAoE,CAAC;AACtI,OAAO,EACL,qCAAqC,EACrC,+BAA+B,GAGhC,MAAM,0DAA0D,CAAC;AAQlE,OAAO,EAAE,gCAAgC,EAAE,MAAM,mCAAmC,CAAC;AACrF,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAC7B,kCAAkC,GACnC,MAAM,mDAAmD,CAAC;AAE3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,+BAA+B,EAAE,MAAM,8CAA8C,CAAC;AAK/F,OAAO,EACL,iBAAiB,EACjB,6BAA6B,GAC9B,MAAM,6BAA6B,CAAC;AAErC,SAAS,qBAAqB,CAC5B,IAA6B;IAE7B,IAAI,IAAI,CAAC,aAAa,KAAK,OAAO,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,KAG5C;IACC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvD,OAAO,+BAA+B,CAAC;QACrC,GAAG,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,CACnC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,CACpD;QACD,QAAQ;KACT,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAG3C;IACC,IACE,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,UAAU,CAAC,YAAY;QAC/C,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,UAAU,CAAC,aAAa,EAChD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,CACnD,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,OAAO,CAC7C,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,KAAK,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,+BAA+B,CAAC,UAAU,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4CAA4C,CAAC,KASlE;IACC,MAAM,UAAU,GAAG,mCAAmC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAC9E,IACE,UAAU,CAAC,MAAM,KAAK,CAAC;QACvB,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,EACpD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,eAAe,GAAG,yBAAyB,EAAE,CAAC;IACpD,MAAM,eAAe,GAAG,MAAM,+BAA+B,CAAC;QAC5D,UAAU;QACV,SAAS,EAAE,eAAe,CAAC,SAAS;QACpC,KAAK,EAAE,KAAK,CAAC,UAAU;KACxB,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,qCAAqC,CAAC;QAC9D,GAAG,KAAK,CAAC,UAAU;QACnB,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,kBAAkB,CACpC,MAAM,+BAA+B,CAAC;QACpC,aAAa,EAAE,cAAc;QAC7B,WAAW,EAAE,KAAK,CAAC,UAAU,CAAC,cAAc;QAC5C,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,OAAO,GAAG,CAAC;QACrD,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,SAAS;QACzD,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,QAAQ,GAAG,CAAC;QACvD,sBAAsB,EAAE,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC;QAChE,cAAc,EAAE,MAAM,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC;QAC9D,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAChE,eAAe;QACf,UAAU;QACV,MAAM,EAAE,EAAE;QACV,iBAAiB;QACjB,iBAAiB,EAAE,IAAI;QACvB,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,wBAAwB,EAAE,KAAK,CAAC,kBAAkB;KACnD,CAAC,EACF,KAAK,CAAC,cAAc,CAAC,iBAAiB,CACvC,CAAC;IAEF,OAAO;QACL,gBAAgB,EAAE;YAChB,WAAW,EAAE,aAAa;YAC1B,UAAU,EAAE,iBAAiB;YAC7B,cAAc,EAAE,KAAK,CAAC,qBAAqB;SAC5C;QACD,MAAM,EAAE,EAAE;QACV,eAAe;QACf,UAAU;QACV,KAAK;KACN,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAgBnD;IAIC,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,4EAA4E;IAC5E,+BAA+B;IAC/B,MAAM,gCAAgC,CAAC;QACrC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,mBAAmB,CAAC,UAAU;QAChD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,iBAAiB,EAAE,KAAK,CAAC,mBAAmB,CAAC,iBAAiB;QAC9D,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,MAAM,uBAAuB,CAChD,KAAK,CAAC,OAAO,CAAC,kBAAkB,CACjC,CAAC;IACF,MAAM,eAAe,GACnB,KAAK,CAAC,mBAAmB,CAAC,WAAW,CAAC,iBAAiB,CAAC;IAC1D,MAAM,UAAU,GAAG,MAAM,6BAA6B,CAAC;QACrD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,OAAO,EAAE,iBAAiB,CAAC,eAAe,CAAC;KAC5C,CAAC,CAAC;IACH,MAAM,mBAAmB,GACvB,MAAM,4CAA4C,CAAC;QACjD,eAAe;QACf,UAAU;QACV,aAAa,EAAE,KAAK,CAAC,mBAAmB,CAAC,MAAM;QAC/C,UAAU,EAAE,KAAK,CAAC,mBAAmB,CAAC,UAAU;QAChD,UAAU,EAAE;YACV,GAAG,KAAK,CAAC,mBAAmB,CAAC,UAAU,CAAC,UAAU;YAClD,qBAAqB,CAAC,YAAY,CAAC;SACpC;QACD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACL,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,uBAAuB,CAC1D,KAAK,CAAC,cAAc,EACpB,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,CAC9D,CAAC;IACF,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,6BAA6B,CAAC;QACvD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,MAAM,CAAC,KAAK;QACtB,SAAS,EAAE,YAAY,CAAC,SAAS;KAClC,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,MAAM,uBAAuB,CAAC,mBAAmB,CAAC,CAAC;IAC5E,MAAM,kBAAkB,GAAG,MAAM,2BAA2B,CAAC;QAC3D,aAAa,EAAE,KAAK,CAAC,mBAAmB,CAAC,MAAM;QAC/C,YAAY,EAAE,gBAAgB;QAC9B,OAAO,EAAE,mBAAmB;QAC5B,QAAQ,EAAE,MAAM,CAAC,kBAAkB,CAAC,YAAY;KACjD,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,kCAAkC,CAAC;QAC5D,aAAa,EAAE,KAAK,CAAC,mBAAmB,CAAC,MAAM;QAC/C,YAAY,EAAE,gBAAgB;QAC9B,OAAO,EAAE,mBAAmB;QAC5B,QAAQ,EAAE,MAAM,CAAC,kBAAkB;KACpC,CAAC,CAAC;IACH,MAAM,gDAAgD,CAAC;QACrD,OAAO,EAAE;YACP,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE;YAC5D,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;SAC3D;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AACrD,CAAC","sourcesContent":["import {\n buildPrincipalStateSigningInput,\n generateKemSeedAndKeyPair,\n normalizePrincipalProjectionMembers,\n type ReferencedPrincipalHead,\n type SigningKeyPair,\n signPrincipalState,\n toFingerprint,\n} from \"@tearleads/crypto\";\nimport { bytesToBase64 } from \"@tearleads/encoding\";\nimport type {\n PrincipalProjectionMemberRequest,\n PutPrincipalPolicyRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n OrganizationGroupSummaryResponse,\n PrincipalPolicyBundleResponse,\n} from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport { persistLocallyAcknowledgedPrincipalPolicyBundles } from \"../../../data/persistence/locallyAcknowledgedCheckpointPersistence\";\nimport {\n encodeOrganizationAuthorityDescriptor,\n normalizeOrganizationGroupHeads,\n type OrganizationAuthorityDescriptor,\n type OrganizationGroupHead,\n} from \"../../../data/principals/organizationAuthorityDescriptor\";\nimport type { SecurityIncidentReporter } from \"../../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport type {\n TrustedUserIdentity,\n TrustedUserIdentityResolver,\n} from \"../../../data/trustedUserIdentity\";\nimport type { loadOrganizationExternalAdminPolicy } from \"../../principals/externalAdminPolicy\";\nimport { assertGroupNameUniqueInDirectory } from \"../groupNames/groupNameUniqueness\";\nimport {\n acknowledgeGroupPolicyState,\n acknowledgeInitialGroupPolicy,\n buildAcknowledgedGroupPolicyBundle,\n} from \"../groupPolicy/groupPolicyMutationAcknowledgement\";\nimport type { OrganizationPrincipalPolicyApi } from \"../groupPolicy/groupPolicyMutationContext\";\nimport { groupPolicyMutationHead } from \"../groupPolicy/groupPolicyMutationHead\";\nimport { rewrapProjectionMemberEnvelopes } from \"../principalPolicy/principalPolicyRecipients\";\nimport type {\n buildInitialGroupPolicyRequest,\n GroupPolicyNameReader,\n} from \"../principalPolicy/principalPolicyRequest\";\nimport {\n projectionUserIds,\n resolveRequiredUserIdentities,\n} from \"../trustedOrganizationUsers\";\n\nfunction organizationGroupHead(\n head: ReferencedPrincipalHead,\n): OrganizationGroupHead {\n if (head.principalType !== \"group\") {\n throw new Error(\"Organization directory can contain only group heads\");\n }\n return { ...head, principalType: \"group\" };\n}\n\nexport function replaceOrganizationGroupHead(input: {\n readonly descriptor: OrganizationAuthorityDescriptor;\n readonly nextHead: ReferencedPrincipalHead;\n}): OrganizationGroupHead[] {\n const nextHead = organizationGroupHead(input.nextHead);\n return normalizeOrganizationGroupHeads([\n ...input.descriptor.groupHeads.filter(\n (head) => head.principalId !== nextHead.principalId,\n ),\n nextHead,\n ]);\n}\n\nexport function removeOrganizationGroupHead(input: {\n readonly descriptor: OrganizationAuthorityDescriptor;\n readonly groupId: string;\n}): OrganizationGroupHead[] {\n if (\n input.groupId === input.descriptor.adminGroupId ||\n input.groupId === input.descriptor.memberGroupId\n ) {\n throw new Error(\"Built-in groups cannot be removed from the directory\");\n }\n const groupHeads = input.descriptor.groupHeads.filter(\n (head) => head.principalId !== input.groupId,\n );\n if (groupHeads.length === input.descriptor.groupHeads.length) {\n throw new Error(\"Organization directory does not commit the deleted group\");\n }\n return normalizeOrganizationGroupHeads(groupHeads);\n}\n\nexport async function buildOrganizationGroupDirectoryPolicyRequest(input: {\n readonly adminProjection: readonly PrincipalProjectionMemberRequest[];\n readonly adminUsers: readonly TrustedUserIdentity[];\n readonly currentPolicy: Pick<PrincipalPolicyBundleResponse, \"currentState\">;\n readonly descriptor: OrganizationAuthorityDescriptor;\n readonly groupHeads: readonly OrganizationGroupHead[];\n readonly signerUserId: string;\n readonly signingFingerprint: string;\n readonly signingKeyPair: SigningKeyPair;\n}): Promise<PutPrincipalPolicyRequest> {\n const projection = normalizePrincipalProjectionMembers(input.adminProjection);\n if (\n projection.length === 0 ||\n projection.some((member) => member.role !== \"admin\")\n ) {\n throw new Error(\"Organization policy must mirror the Admins projection\");\n }\n const organizationKem = generateKemSeedAndKeyPair();\n const memberEnvelopes = await rewrapProjectionMemberEnvelopes({\n projection,\n secretKey: organizationKem.secretKey,\n users: input.adminUsers,\n });\n const payloadCiphertext = encodeOrganizationAuthorityDescriptor({\n ...input.descriptor,\n groupHeads: input.groupHeads,\n });\n const state = await signPrincipalState(\n await buildPrincipalStateSigningInput({\n principalType: \"organization\",\n principalId: input.descriptor.organizationId,\n version: input.currentPolicy.currentState.version + 1,\n prevStateHash: input.currentPolicy.currentState.stateHash,\n keyEpoch: input.currentPolicy.currentState.keyEpoch + 1,\n encapsulationPublicKey: bytesToBase64(organizationKem.publicKey),\n keyFingerprint: await toFingerprint(organizationKem.publicKey),\n members: projection.map((member) => ({ userId: member.userId })),\n memberEnvelopes,\n projection,\n grants: [],\n payloadCiphertext,\n externalAuthority: null,\n signedAt: new Date().toISOString(),\n signerUserId: input.signerUserId,\n signerUserKeyFingerprint: input.signingFingerprint,\n }),\n input.signingKeyPair.signingPrivateKey,\n );\n\n return {\n encryptedPayload: {\n cipherSuite: \"aes-256-gcm\",\n ciphertext: payloadCiphertext,\n ciphertextHash: state.payloadCiphertextHash,\n },\n grants: [],\n memberEnvelopes,\n projection,\n state,\n };\n}\n\nexport async function commitCreatedGroupToDirectory(input: {\n readonly stillCurrent?: (() => boolean) | undefined;\n readonly name: string;\n readonly readEncryptedName?: GroupPolicyNameReader;\n readonly apiClient: OrganizationPrincipalPolicyApi;\n readonly execSql: ExecSql;\n readonly externalAdminPolicy: NonNullable<\n Awaited<ReturnType<typeof loadOrganizationExternalAdminPolicy>>\n >;\n readonly organizationId: string;\n readonly reportSecurityIncident: SecurityIncidentReporter;\n readonly request: Awaited<ReturnType<typeof buildInitialGroupPolicyRequest>>;\n readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n readonly signerUserId: string;\n readonly signingFingerprint: string;\n readonly signingKeyPair: SigningKeyPair;\n}): Promise<{\n readonly group: OrganizationGroupSummaryResponse;\n readonly head: ReferencedPrincipalHead;\n}> {\n assertProjectionVerificationCurrent(input.stillCurrent);\n // Signed group names are unique per organization; refuse a collision before\n // anything reaches the server.\n await assertGroupNameUniqueInDirectory({\n apiClient: input.apiClient,\n descriptor: input.externalAdminPolicy.descriptor,\n execSql: input.execSql,\n externalAuthority: input.externalAdminPolicy.externalAuthority,\n name: input.name,\n readEncryptedName: input.readEncryptedName,\n organizationId: input.organizationId,\n reportSecurityIncident: input.reportSecurityIncident,\n resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n });\n const expectedHead = await groupPolicyMutationHead(\n input.request.initialGroupPolicy,\n );\n const adminProjection =\n input.externalAdminPolicy.adminBundle.currentProjection;\n const adminUsers = await resolveRequiredUserIdentities({\n resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n userIds: projectionUserIds(adminProjection),\n });\n const organizationRequest =\n await buildOrganizationGroupDirectoryPolicyRequest({\n adminProjection,\n adminUsers,\n currentPolicy: input.externalAdminPolicy.bundle,\n descriptor: input.externalAdminPolicy.descriptor,\n groupHeads: [\n ...input.externalAdminPolicy.descriptor.groupHeads,\n organizationGroupHead(expectedHead),\n ],\n signerUserId: input.signerUserId,\n signingFingerprint: input.signingFingerprint,\n signingKeyPair: input.signingKeyPair,\n });\n assertProjectionVerificationCurrent(input.stillCurrent);\n const stored = await input.apiClient.createOrganizationGroup(\n input.organizationId,\n { ...input.request, organizationPolicy: organizationRequest },\n );\n assertProjectionVerificationCurrent(input.stillCurrent);\n if (!stored) {\n throw new Error(\"Group could not be created\");\n }\n const acknowledged = await acknowledgeInitialGroupPolicy({\n organizationId: input.organizationId,\n request: input.request,\n response: stored.group,\n stateHash: expectedHead.stateHash,\n });\n const organizationHead = await groupPolicyMutationHead(organizationRequest);\n const organizationPolicy = await acknowledgeGroupPolicyState({\n currentPolicy: input.externalAdminPolicy.bundle,\n expectedHead: organizationHead,\n request: organizationRequest,\n response: stored.organizationPolicy.currentState,\n });\n const organizationBundle = buildAcknowledgedGroupPolicyBundle({\n currentPolicy: input.externalAdminPolicy.bundle,\n expectedHead: organizationHead,\n request: organizationRequest,\n response: stored.organizationPolicy,\n });\n await persistLocallyAcknowledgedPrincipalPolicyBundles({\n entries: [\n { bundle: acknowledged.bundle, policy: acknowledged.policy },\n { bundle: organizationBundle, policy: organizationPolicy },\n ],\n execSql: input.execSql,\n organizationId: input.organizationId,\n updatedAt: new Date().toISOString(),\n stillCurrent: input.stillCurrent,\n });\n assertProjectionVerificationCurrent(input.stillCurrent);\n return { group: stored.group, head: expectedHead };\n}\n"]}

package/workflows/organizations/index.d.ts CHANGED Viewed

@@ -4,19 +4,19 @@ export type { AuthoredPrincipalMutation, PrincipalMutationJournalScope, } from "
 export { UnreadablePrincipalMutationError } from "../../data/principals/principalMutationJournalRecord.js";
 export { cancelStripeSubscription, checkNativePurchaseEligibility, claimNativeOrganizationSubscription, createStripeCheckout, createStripeCheckoutSession, loadOrganizationBilling, loadOrganizationBillingHistory, loadOrganizationBillingManagementUrl, loadStripeCheckoutOptions, type OrganizationBilling, type OrganizationBillingHistory, type OrganizationBillingHistoryEntry, type OrganizationBillingManagementUrl, type OrganizationBillingView, type OrganizationNativePurchaseEligibility, resolveOrganizationBillingView, type StripeCheckoutIntent, type StripeCheckoutOptions, startOrganizationTrial, } from "./billing.js";
 export { revokeOrganizationContainerGrant } from "./containerGrantRevocation.js";
-export { type CreateOrganizationApi, type CreateOrganizationInput, createOrganization, } from "./createOrganization.js";
-export { loadLocalOrganizationDataUsage, type OrganizationDataUsage, type ReconcileOrganizationDataUsageInput, reconcileOrganizationDataUsage, } from "./dataUsageReadModel.js";
-export { deleteOrganizationGroup } from "./deleteOrganizationGroup.js";
-export { GroupMembershipNameMismatchError } from "./groupMembershipName.js";
-export { type LocalOrganizationSummary, listLocalOrganizations, } from "./listLocalOrganizations.js";
-export { loadLocalOrganizationContainerGrants, loadLocalOrganizationGroupContainers, loadLocalOrganizationGroupPolicyHistory, loadLocalOrganizationPolicyHistory, loadLocalOrganizationPolicyReference, loadLocalOrganizationUserDetail, } from "./localReadModelDetails.js";
+export { GroupMembershipNameMismatchError } from "./groupNames/groupMembershipName.js";
+export { deleteOrganizationGroup } from "./groups/deleteOrganizationGroup.js";
 export { buildOrganizationProfileDocumentPatch, createInitializedOrganizationProfileDocument, DEFAULT_PERSONAL_ORGANIZATION_PROFILE_NAME, getOrganizationProfileDocumentLocalId, ORGANIZATION_PROFILE_DOCUMENT_KIND, readOrganizationProfileName, } from "./organizationProfile.js";
 export { type ImportedOrganizationUser, importOrganizationUser, } from "./organizationUserImport.js";
-export { abandonJournaledPrincipalMutation, discardUnreadableJournaledPrincipalMutation, readJournaledPrincipalMutation, } from "./principalMutationJournalManagement.js";
-export { type PrincipalMutationJournalContext, PrincipalMutationOutcomeUnknownError, recoverJournaledPrincipalMutation, submitJournaledPrincipalMutation, } from "./principalMutationJournalSession.js";
-export type { PrincipalMutationResponse } from "./principalOperationReceipt.js";
-export { addOrganizationGroupUser, buildInitialGroupPolicyRequest, buildInitialMemberGroupPolicyRequest, createOrganizationGroup, removeOrganizationGroupUser, rotateOrganizationGroupForAccessSetShrink, } from "./principalPolicy.js";
-export { buildOrganizationGroupPolicyHistory, type OrganizationContainerGrant, type OrganizationContainerGrants, type OrganizationDirectory, type OrganizationDirectoryAndGroups, type OrganizationDirectoryUser, type OrganizationGroupContainer, type OrganizationGroupContainers, type OrganizationGroupDetails, type OrganizationGroupMember, type OrganizationGroupMembers, type OrganizationGroupPolicyHistory, type OrganizationGroupPolicyHistoryEntry, type OrganizationGroupSummary, type OrganizationPolicyGrantChange, type OrganizationPolicyGroupChange, type OrganizationPolicyHistory, type OrganizationPolicyHistoryEntry, type OrganizationPrincipalMemberChange, type OrganizationPrincipalMemberChangeType, type OrganizationPrincipalPolicyHistory, type OrganizationPrincipalPolicyHistoryEntry, type OrganizationProfile, type OrganizationUserDetail, updateOrganizationProfile, updateOrganizationRosterEntry, } from "./readModel.js";
-export { loadLocalOrganizationDirectoryAndGroups, loadLocalOrganizationGroupMembers, type ReconcileOrganizationDirectoryAndGroupsInput, reconcileOrganizationDirectoryAndGroups, } from "./readModelProjection.js";
-export { type AcknowledgedPrincipalCurrentInput, type AcknowledgedPrincipalCurrentRetirement, retainAcknowledgedPrincipalCurrents, } from "./retainAcknowledgedPrincipalCurrents.js";
+export { abandonJournaledPrincipalMutation, discardUnreadableJournaledPrincipalMutation, readJournaledPrincipalMutation, } from "./principalMutations/principalMutationJournalManagement.js";
+export { type PrincipalMutationJournalContext, PrincipalMutationOutcomeUnknownError, recoverJournaledPrincipalMutation, submitJournaledPrincipalMutation, } from "./principalMutations/principalMutationJournalSession.js";
+export type { PrincipalMutationResponse } from "./principalMutations/principalOperationReceipt.js";
+export { type AcknowledgedPrincipalCurrentInput, type AcknowledgedPrincipalCurrentRetirement, retainAcknowledgedPrincipalCurrents, } from "./principalMutations/retainAcknowledgedPrincipalCurrents.js";
+export { addOrganizationGroupUser, buildInitialGroupPolicyRequest, buildInitialMemberGroupPolicyRequest, createOrganizationGroup, removeOrganizationGroupUser, rotateOrganizationGroupForAccessSetShrink, } from "./principalPolicy/index.js";
+export { type CreateOrganizationApi, type CreateOrganizationInput, createOrganization, } from "./provisioning/createOrganization.js";
+export { buildOrganizationGroupPolicyHistory, type OrganizationContainerGrant, type OrganizationContainerGrants, type OrganizationDirectory, type OrganizationDirectoryAndGroups, type OrganizationDirectoryUser, type OrganizationGroupContainer, type OrganizationGroupContainers, type OrganizationGroupDetails, type OrganizationGroupMember, type OrganizationGroupMembers, type OrganizationGroupPolicyHistory, type OrganizationGroupPolicyHistoryEntry, type OrganizationGroupSummary, type OrganizationPolicyGrantChange, type OrganizationPolicyGroupChange, type OrganizationPolicyHistory, type OrganizationPolicyHistoryEntry, type OrganizationPrincipalMemberChange, type OrganizationPrincipalMemberChangeType, type OrganizationPrincipalPolicyHistory, type OrganizationPrincipalPolicyHistoryEntry, type OrganizationProfile, type OrganizationUserDetail, updateOrganizationProfile, updateOrganizationRosterEntry, } from "./readModel/index.js";
+export { loadLocalOrganizationDataUsage, type OrganizationDataUsage, type ReconcileOrganizationDataUsageInput, reconcileOrganizationDataUsage, } from "./readModel/dataUsageReadModel.js";
+export { type LocalOrganizationSummary, listLocalOrganizations, } from "./readModel/listLocalOrganizations.js";
+export { loadLocalOrganizationContainerGrants, loadLocalOrganizationGroupContainers, loadLocalOrganizationGroupPolicyHistory, loadLocalOrganizationPolicyHistory, loadLocalOrganizationPolicyReference, loadLocalOrganizationUserDetail, } from "./readModel/localReadModelDetails.js";
+export { loadLocalOrganizationDirectoryAndGroups, loadLocalOrganizationGroupMembers, type ReconcileOrganizationDirectoryAndGroupsInput, reconcileOrganizationDirectoryAndGroups, } from "./readModel/readModelProjection.js";
 export { buildRosterProfileDocumentPatch, createInitializedRosterProfileDocument, deriveOrganizationMetadataContainerSystemSlot, deriveOrganizationRosterProfileContainerSystemSlot, getRosterProfileDocumentLocalId, ORGANIZATION_METADATA_CONTAINER_NAME, ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME, ROSTER_PROFILE_DOCUMENT_KIND, } from "./rosterProfileContainer.js";

package/workflows/organizations/index.js CHANGED Viewed

@@ -3,19 +3,19 @@ export { PendingPrincipalMutationError } from "../../data/persistence/principalM
 export { UnreadablePrincipalMutationError } from "../../data/principals/principalMutationJournalRecord.js";
 export { cancelStripeSubscription, checkNativePurchaseEligibility, claimNativeOrganizationSubscription, createStripeCheckout, createStripeCheckoutSession, loadOrganizationBilling, loadOrganizationBillingHistory, loadOrganizationBillingManagementUrl, loadStripeCheckoutOptions, resolveOrganizationBillingView, startOrganizationTrial, } from "./billing.js";
 export { revokeOrganizationContainerGrant } from "./containerGrantRevocation.js";
-export { createOrganization, } from "./createOrganization.js";
-export { loadLocalOrganizationDataUsage, reconcileOrganizationDataUsage, } from "./dataUsageReadModel.js";
-export { deleteOrganizationGroup } from "./deleteOrganizationGroup.js";
-export { GroupMembershipNameMismatchError } from "./groupMembershipName.js";
-export { listLocalOrganizations, } from "./listLocalOrganizations.js";
-export { loadLocalOrganizationContainerGrants, loadLocalOrganizationGroupContainers, loadLocalOrganizationGroupPolicyHistory, loadLocalOrganizationPolicyHistory, loadLocalOrganizationPolicyReference, loadLocalOrganizationUserDetail, } from "./localReadModelDetails.js";
+export { GroupMembershipNameMismatchError } from "./groupNames/groupMembershipName.js";
+export { deleteOrganizationGroup } from "./groups/deleteOrganizationGroup.js";
 export { buildOrganizationProfileDocumentPatch, createInitializedOrganizationProfileDocument, DEFAULT_PERSONAL_ORGANIZATION_PROFILE_NAME, getOrganizationProfileDocumentLocalId, ORGANIZATION_PROFILE_DOCUMENT_KIND, readOrganizationProfileName, } from "./organizationProfile.js";
 export { importOrganizationUser, } from "./organizationUserImport.js";
-export { abandonJournaledPrincipalMutation, discardUnreadableJournaledPrincipalMutation, readJournaledPrincipalMutation, } from "./principalMutationJournalManagement.js";
-export { PrincipalMutationOutcomeUnknownError, recoverJournaledPrincipalMutation, submitJournaledPrincipalMutation, } from "./principalMutationJournalSession.js";
-export { addOrganizationGroupUser, buildInitialGroupPolicyRequest, buildInitialMemberGroupPolicyRequest, createOrganizationGroup, removeOrganizationGroupUser, rotateOrganizationGroupForAccessSetShrink, } from "./principalPolicy.js";
-export { buildOrganizationGroupPolicyHistory, updateOrganizationProfile, updateOrganizationRosterEntry, } from "./readModel.js";
-export { loadLocalOrganizationDirectoryAndGroups, loadLocalOrganizationGroupMembers, reconcileOrganizationDirectoryAndGroups, } from "./readModelProjection.js";
-export { retainAcknowledgedPrincipalCurrents, } from "./retainAcknowledgedPrincipalCurrents.js";
+export { abandonJournaledPrincipalMutation, discardUnreadableJournaledPrincipalMutation, readJournaledPrincipalMutation, } from "./principalMutations/principalMutationJournalManagement.js";
+export { PrincipalMutationOutcomeUnknownError, recoverJournaledPrincipalMutation, submitJournaledPrincipalMutation, } from "./principalMutations/principalMutationJournalSession.js";
+export { retainAcknowledgedPrincipalCurrents, } from "./principalMutations/retainAcknowledgedPrincipalCurrents.js";
+export { addOrganizationGroupUser, buildInitialGroupPolicyRequest, buildInitialMemberGroupPolicyRequest, createOrganizationGroup, removeOrganizationGroupUser, rotateOrganizationGroupForAccessSetShrink, } from "./principalPolicy/index.js";
+export { createOrganization, } from "./provisioning/createOrganization.js";
+export { buildOrganizationGroupPolicyHistory, updateOrganizationProfile, updateOrganizationRosterEntry, } from "./readModel/index.js";
+export { loadLocalOrganizationDataUsage, reconcileOrganizationDataUsage, } from "./readModel/dataUsageReadModel.js";
+export { listLocalOrganizations, } from "./readModel/listLocalOrganizations.js";
+export { loadLocalOrganizationContainerGrants, loadLocalOrganizationGroupContainers, loadLocalOrganizationGroupPolicyHistory, loadLocalOrganizationPolicyHistory, loadLocalOrganizationPolicyReference, loadLocalOrganizationUserDetail, } from "./readModel/localReadModelDetails.js";
+export { loadLocalOrganizationDirectoryAndGroups, loadLocalOrganizationGroupMembers, reconcileOrganizationDirectoryAndGroups, } from "./readModel/readModelProjection.js";
 export { buildRosterProfileDocumentPatch, createInitializedRosterProfileDocument, deriveOrganizationMetadataContainerSystemSlot, deriveOrganizationRosterProfileContainerSystemSlot, getRosterProfileDocumentLocalId, ORGANIZATION_METADATA_CONTAINER_NAME, ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME, ROSTER_PROFILE_DOCUMENT_KIND, } from "./rosterProfileContainer.js";
 //# sourceMappingURL=index.js.map

package/workflows/organizations/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,0CAA0C,GAC3C,MAAM,wEAAwE,CAAC;AAChF,OAAO,EAAE,6BAA6B,EAAE,MAAM,4DAA4D,CAAC;AAK3G,OAAO,EAAE,gCAAgC,EAAE,MAAM,sDAAsD,CAAC;AACxG,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,mCAAmC,EACnC,oBAAoB,EACpB,2BAA2B,EAC3B,uBAAuB,EACvB,8BAA8B,EAC9B,oCAAoC,EACpC,yBAAyB,EAOzB,8BAA8B,EAG9B,sBAAsB,GACvB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,gCAAgC,EAAE,MAAM,4BAA4B,CAAC;AAC9E,OAAO,~~EAGL,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,8BAA8B,EAG9B,8BAA8B,GAC/B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,~~EAAE,~~uBAAuB~~,EAAE,MAAM,~~2BAA2B~~,CAAC;~~AACpE~~,OAAO,EAAE,~~gCAAgC~~,EAAE,MAAM,~~uBAAuB,CAAC;AACzE,OAAO,EAEL,sBAAsB,GACvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,oCAAoC,EACpC,oCAAoC,EACpC,uCAAuC,EACvC,~~kCAAkC,~~EAClC,oCAAoC,EACpC,+BAA+B,GAChC,MAAM,yBAAyB,~~CAAC;~~AACjC~~,OAAO,EACL,qCAAqC,EACrC,4CAA4C,EAC5C,0CAA0C,EAC1C,qCAAqC,EACrC,kCAAkC,EAClC,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,sBAAsB,GACvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,iCAAiC,EACjC,2CAA2C,EAC3C,8BAA8B,GAC/B,MAAM,~~sCAAsC~~,CAAC;~~AAC9C~~,OAAO,EAEL,oCAAoC,EACpC,iCAAiC,EACjC,gCAAgC,GACjC,MAAM,mCAAmC,CAAC;~~AAE3C~~,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,oCAAoC,EACpC,uBAAuB,EACvB,2BAA2B,EAC3B,yCAAyC,GAC1C,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,mCAAmC,EAwBnC,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,uCAAuC,EACvC,~~iCAAiC~~,~~EAEjC~~,~~uCAAuC~~,~~GACxC~~,MAAM,~~uBAAuB~~,CAAC;~~AAC/B~~,OAAO,~~EAGL~~,~~mCAAmC~~,~~GACpC~~,~~MAAM~~,uCAAuC,CAAC;~~AAC/C~~,OAAO,EACL,+BAA+B,EAC/B,sCAAsC,EACtC,6CAA6C,EAC7C,kDAAkD,EAClD,+BAA+B,EAC/B,oCAAoC,EACpC,0CAA0C,EAC1C,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC","sourcesContent":["export {\n type OrganizationReadModelInvalidationListener,\n subscribeOrganizationReadModelInvalidation,\n} from \"../../data/persistence/organizations/organizationReadModelInvalidation\";\nexport { PendingPrincipalMutationError } from \"../../data/persistence/principalMutationJournalPersistence\";\nexport type {\n AuthoredPrincipalMutation,\n PrincipalMutationJournalScope,\n} from \"../../data/principals/principalMutationJournal\";\nexport { UnreadablePrincipalMutationError } from \"../../data/principals/principalMutationJournalRecord\";\nexport {\n cancelStripeSubscription,\n checkNativePurchaseEligibility,\n claimNativeOrganizationSubscription,\n createStripeCheckout,\n createStripeCheckoutSession,\n loadOrganizationBilling,\n loadOrganizationBillingHistory,\n loadOrganizationBillingManagementUrl,\n loadStripeCheckoutOptions,\n type OrganizationBilling,\n type OrganizationBillingHistory,\n type OrganizationBillingHistoryEntry,\n type OrganizationBillingManagementUrl,\n type OrganizationBillingView,\n type OrganizationNativePurchaseEligibility,\n resolveOrganizationBillingView,\n type StripeCheckoutIntent,\n type StripeCheckoutOptions,\n startOrganizationTrial,\n} from \"./billing\";\nexport { revokeOrganizationContainerGrant } from \"./containerGrantRevocation\";\nexport {~~\n type~~ ~~CreateOrganizationApi,\n type~~ ~~CreateOrganizationInput,\n createOrganization,\n~~} from \"./~~createOrganization~~\";\nexport {~~\n loadLocalOrganizationDataUsage,\n type~~ ~~OrganizationDataUsage,\n type ReconcileOrganizationDataUsageInput,\n reconcileOrganizationDataUsage,\n} from \"./dataUsageReadModel\";\nexport {~~ deleteOrganizationGroup } from \"./deleteOrganizationGroup\";\nexport { ~~GroupMembershipNameMismatchError } from~~ \~~"./groupMembershipName\";\nexport {\~~n type LocalOrganizationSummary,\n listLocalOrganizations,\n} from \"./listLocalOrganizations\";\nexport {\n loadLocalOrganizationContainerGrants,\n loadLocalOrganizationGroupContainers,\n loadLocalOrganizationGroupPolicyHistory,\n loadLocalOrganizationPolicyHistory,\n loadLocalOrganizationPolicyReference,\n loadLocalOrganizationUserDetail,\n} from \"./localReadModelDetails\";\nexport {\n buildOrganizationProfileDocumentPatch,\n createInitializedOrganizationProfileDocument,\n DEFAULT_PERSONAL_ORGANIZATION_PROFILE_NAME,\n getOrganizationProfileDocumentLocalId,\n ORGANIZATION_PROFILE_DOCUMENT_KIND,\n readOrganizationProfileName,\n} from \"./organizationProfile\";\nexport {\n type ImportedOrganizationUser,\n importOrganizationUser,\n} from \"./organizationUserImport\";\nexport {\n abandonJournaledPrincipalMutation,\n discardUnreadableJournaledPrincipalMutation,\n readJournaledPrincipalMutation,\n} from \"./principalMutationJournalManagement\";\nexport {\n type PrincipalMutationJournalContext,\n PrincipalMutationOutcomeUnknownError,\n recoverJournaledPrincipalMutation,\n submitJournaledPrincipalMutation,\n} from \"./principalMutationJournalSession\";\nexport type { PrincipalMutationResponse } from \"./principalOperationReceipt\";\nexport {\n addOrganizationGroupUser,\n buildInitialGroupPolicyRequest,\n buildInitialMemberGroupPolicyRequest,\n createOrganizationGroup,\n removeOrganizationGroupUser,\n rotateOrganizationGroupForAccessSetShrink,\n} from \"./principalPolicy\";\nexport {\n buildOrganizationGroupPolicyHistory,\n type OrganizationContainerGrant,\n type OrganizationContainerGrants,\n type OrganizationDirectory,\n type OrganizationDirectoryAndGroups,\n type OrganizationDirectoryUser,\n type OrganizationGroupContainer,\n type OrganizationGroupContainers,\n type OrganizationGroupDetails,\n type OrganizationGroupMember,\n type OrganizationGroupMembers,\n type OrganizationGroupPolicyHistory,\n type OrganizationGroupPolicyHistoryEntry,\n type OrganizationGroupSummary,\n type OrganizationPolicyGrantChange,\n type OrganizationPolicyGroupChange,\n type OrganizationPolicyHistory,\n type OrganizationPolicyHistoryEntry,\n type OrganizationPrincipalMemberChange,\n type OrganizationPrincipalMemberChangeType,\n type OrganizationPrincipalPolicyHistory,\n type OrganizationPrincipalPolicyHistoryEntry,\n type OrganizationProfile,\n type OrganizationUserDetail,\n updateOrganizationProfile,\n updateOrganizationRosterEntry,\n} from \"./readModel\";\nexport {\n ~~loadLocalOrganizationDirectoryAndGroups~~,\n ~~loadLocalOrganizationGroupMembers~~,\n type ~~ReconcileOrganizationDirectoryAndGroupsInput~~,\n ~~reconcileOrganizationDirectoryAndGroups~~,\n} from \"./~~readModelProjection~~\";\nexport {\n type ~~AcknowledgedPrincipalCurrentInput~~,\n type ~~AcknowledgedPrincipalCurrentRetirement~~,\n ~~retainAcknowledgedPrincipalCurrents~~,\n} from \"./~~retainAcknowledgedPrincipalCurrents~~\";\nexport {\n buildRosterProfileDocumentPatch,\n createInitializedRosterProfileDocument,\n deriveOrganizationMetadataContainerSystemSlot,\n deriveOrganizationRosterProfileContainerSystemSlot,\n getRosterProfileDocumentLocalId,\n ORGANIZATION_METADATA_CONTAINER_NAME,\n ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME,\n ROSTER_PROFILE_DOCUMENT_KIND,\n} from \"./rosterProfileContainer\";\n"]}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,0CAA0C,GAC3C,MAAM,wEAAwE,CAAC;AAChF,OAAO,EAAE,6BAA6B,EAAE,MAAM,4DAA4D,CAAC;AAK3G,OAAO,EAAE,gCAAgC,EAAE,MAAM,sDAAsD,CAAC;AACxG,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,mCAAmC,EACnC,oBAAoB,EACpB,2BAA2B,EAC3B,uBAAuB,EACvB,8BAA8B,EAC9B,oCAAoC,EACpC,yBAAyB,EAOzB,8BAA8B,EAG9B,sBAAsB,GACvB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,gCAAgC,EAAE,MAAM,4BAA4B,CAAC;AAC9E,OAAO,EAAE,gCAAgC,EAAE,MAAM,kCAAkC,CAAC;AACpF,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EACL,qCAAqC,EACrC,4CAA4C,EAC5C,0CAA0C,EAC1C,qCAAqC,EACrC,kCAAkC,EAClC,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,sBAAsB,GACvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,iCAAiC,EACjC,2CAA2C,EAC3C,8BAA8B,GAC/B,MAAM,yDAAyD,CAAC;AACjE,OAAO,EAEL,oCAAoC,EACpC,iCAAiC,EACjC,gCAAgC,GACjC,MAAM,sDAAsD,CAAC;AAE9D,OAAO,EAGL,mCAAmC,GACpC,MAAM,0DAA0D,CAAC;AAClE,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,oCAAoC,EACpC,uBAAuB,EACvB,2BAA2B,EAC3B,yCAAyC,GAC1C,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAGL,kBAAkB,GACnB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,mCAAmC,EAwBnC,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,8BAA8B,EAG9B,8BAA8B,GAC/B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAEL,sBAAsB,GACvB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,oCAAoC,EACpC,oCAAoC,EACpC,uCAAuC,EACvC,kCAAkC,EAClC,oCAAoC,EACpC,+BAA+B,GAChC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,uCAAuC,EACvC,iCAAiC,EAEjC,uCAAuC,GACxC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,+BAA+B,EAC/B,sCAAsC,EACtC,6CAA6C,EAC7C,kDAAkD,EAClD,+BAA+B,EAC/B,oCAAoC,EACpC,0CAA0C,EAC1C,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC","sourcesContent":["export {\n type OrganizationReadModelInvalidationListener,\n subscribeOrganizationReadModelInvalidation,\n} from \"../../data/persistence/organizations/organizationReadModelInvalidation\";\nexport { PendingPrincipalMutationError } from \"../../data/persistence/principalMutationJournalPersistence\";\nexport type {\n AuthoredPrincipalMutation,\n PrincipalMutationJournalScope,\n} from \"../../data/principals/principalMutationJournal\";\nexport { UnreadablePrincipalMutationError } from \"../../data/principals/principalMutationJournalRecord\";\nexport {\n cancelStripeSubscription,\n checkNativePurchaseEligibility,\n claimNativeOrganizationSubscription,\n createStripeCheckout,\n createStripeCheckoutSession,\n loadOrganizationBilling,\n loadOrganizationBillingHistory,\n loadOrganizationBillingManagementUrl,\n loadStripeCheckoutOptions,\n type OrganizationBilling,\n type OrganizationBillingHistory,\n type OrganizationBillingHistoryEntry,\n type OrganizationBillingManagementUrl,\n type OrganizationBillingView,\n type OrganizationNativePurchaseEligibility,\n resolveOrganizationBillingView,\n type StripeCheckoutIntent,\n type StripeCheckoutOptions,\n startOrganizationTrial,\n} from \"./billing\";\nexport { revokeOrganizationContainerGrant } from \"./containerGrantRevocation\";\nexport { GroupMembershipNameMismatchError } from \"./groupNames/groupMembershipName\";\nexport { deleteOrganizationGroup } from \"./groups/deleteOrganizationGroup\";\nexport {\n buildOrganizationProfileDocumentPatch,\n createInitializedOrganizationProfileDocument,\n DEFAULT_PERSONAL_ORGANIZATION_PROFILE_NAME,\n getOrganizationProfileDocumentLocalId,\n ORGANIZATION_PROFILE_DOCUMENT_KIND,\n readOrganizationProfileName,\n} from \"./organizationProfile\";\nexport {\n type ImportedOrganizationUser,\n importOrganizationUser,\n} from \"./organizationUserImport\";\nexport {\n abandonJournaledPrincipalMutation,\n discardUnreadableJournaledPrincipalMutation,\n readJournaledPrincipalMutation,\n} from \"./principalMutations/principalMutationJournalManagement\";\nexport {\n type PrincipalMutationJournalContext,\n PrincipalMutationOutcomeUnknownError,\n recoverJournaledPrincipalMutation,\n submitJournaledPrincipalMutation,\n} from \"./principalMutations/principalMutationJournalSession\";\nexport type { PrincipalMutationResponse } from \"./principalMutations/principalOperationReceipt\";\nexport {\n type AcknowledgedPrincipalCurrentInput,\n type AcknowledgedPrincipalCurrentRetirement,\n retainAcknowledgedPrincipalCurrents,\n} from \"./principalMutations/retainAcknowledgedPrincipalCurrents\";\nexport {\n addOrganizationGroupUser,\n buildInitialGroupPolicyRequest,\n buildInitialMemberGroupPolicyRequest,\n createOrganizationGroup,\n removeOrganizationGroupUser,\n rotateOrganizationGroupForAccessSetShrink,\n} from \"./principalPolicy\";\nexport {\n type CreateOrganizationApi,\n type CreateOrganizationInput,\n createOrganization,\n} from \"./provisioning/createOrganization\";\nexport {\n buildOrganizationGroupPolicyHistory,\n type OrganizationContainerGrant,\n type OrganizationContainerGrants,\n type OrganizationDirectory,\n type OrganizationDirectoryAndGroups,\n type OrganizationDirectoryUser,\n type OrganizationGroupContainer,\n type OrganizationGroupContainers,\n type OrganizationGroupDetails,\n type OrganizationGroupMember,\n type OrganizationGroupMembers,\n type OrganizationGroupPolicyHistory,\n type OrganizationGroupPolicyHistoryEntry,\n type OrganizationGroupSummary,\n type OrganizationPolicyGrantChange,\n type OrganizationPolicyGroupChange,\n type OrganizationPolicyHistory,\n type OrganizationPolicyHistoryEntry,\n type OrganizationPrincipalMemberChange,\n type OrganizationPrincipalMemberChangeType,\n type OrganizationPrincipalPolicyHistory,\n type OrganizationPrincipalPolicyHistoryEntry,\n type OrganizationProfile,\n type OrganizationUserDetail,\n updateOrganizationProfile,\n updateOrganizationRosterEntry,\n} from \"./readModel\";\nexport {\n loadLocalOrganizationDataUsage,\n type OrganizationDataUsage,\n type ReconcileOrganizationDataUsageInput,\n reconcileOrganizationDataUsage,\n} from \"./readModel/dataUsageReadModel\";\nexport {\n type LocalOrganizationSummary,\n listLocalOrganizations,\n} from \"./readModel/listLocalOrganizations\";\nexport {\n loadLocalOrganizationContainerGrants,\n loadLocalOrganizationGroupContainers,\n loadLocalOrganizationGroupPolicyHistory,\n loadLocalOrganizationPolicyHistory,\n loadLocalOrganizationPolicyReference,\n loadLocalOrganizationUserDetail,\n} from \"./readModel/localReadModelDetails\";\nexport {\n loadLocalOrganizationDirectoryAndGroups,\n loadLocalOrganizationGroupMembers,\n type ReconcileOrganizationDirectoryAndGroupsInput,\n reconcileOrganizationDirectoryAndGroups,\n} from \"./readModel/readModelProjection\";\nexport {\n buildRosterProfileDocumentPatch,\n createInitializedRosterProfileDocument,\n deriveOrganizationMetadataContainerSystemSlot,\n deriveOrganizationRosterProfileContainerSystemSlot,\n getRosterProfileDocumentLocalId,\n ORGANIZATION_METADATA_CONTAINER_NAME,\n ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME,\n ROSTER_PROFILE_DOCUMENT_KIND,\n} from \"./rosterProfileContainer\";\n"]}

package/workflows/organizations/policyHistory/groupPolicyHistoryPage.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"groupPolicyHistoryPage.js","sourceRoot":"","sources":["groupPolicyHistoryPage.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAG1E,oFAAoF;AACpF,MAAM,UAAU,uCAAuC,CAAC,KAIvD;IACC,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IACvB,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,WAAW,EAAE,KAAK,CAAC,OAAO;QAC1B,aAAa,EAAE,OAAO;QACtB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,OAAO,EAAE,IAAI,CAAC,OAAO;aAClB,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YACtB,OAAO,EAAE,8BAA8B,CAAC;gBACtC,OAAO,EAAE,KAAK,CAAC,UAAU;gBACzB,QAAQ,EACN,CAAC,KAAK,KAAK,CAAC;oBACV,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU;oBAC9B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,IAAI,EAAE;aACjD,CAAC;YACF,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;YAChC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;YAC9B,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;YACpC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;YAC9B,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY;YACtC,wBAAwB,EAAE,KAAK,CAAC,KAAK,CAAC,wBAAwB;YAC9D,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;YAChC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO;SAC7B,CAAC,CAAC;aACF,OAAO,EAAE;KACb,CAAC;AACJ,CAAC","sourcesContent":["import type { RecoveredPrincipalHistoryPage } from \"../../principals/historyRecovery/loadRecoveredPrincipalHistoryPage\";\nimport { diffPrincipalProjectionMembers } from \"./policyHistoryReadModel\";\nimport type { OrganizationGroupPolicyHistory } from \"./policyHistoryTypes\";\n\n/** Keep a page boundary's actual predecessor when describing membership changes. */\nexport function buildOrganizationGroupPolicyHistoryPage(input: {\n readonly groupId: string;\n readonly organizationId: string;\n readonly page: RecoveredPrincipalHistoryPage;\n}): OrganizationGroupPolicyHistory {\n const { page } = input;\n return {\n groupId: input.groupId,\n organizationId: input.organizationId,\n principalId: input.groupId,\n principalType: \"group\",\n nextBeforeVersion: page.nextBeforeVersion,\n entries: page.entries\n .map((entry, index) => ({\n changes: diffPrincipalProjectionMembers({\n current: entry.projection,\n previous:\n (index === 0\n ? page.predecessor?.projection\n : page.entries[index - 1]?.projection) ?? [],\n }),\n createdAt: entry.state.createdAt,\n keyEpoch: entry.state.keyEpoch,\n memberCount: entry.state.memberCount,\n signedAt: entry.state.signedAt,\n signerUserId: entry.state.signerUserId,\n signerUserKeyFingerprint: entry.state.signerUserKeyFingerprint,\n stateHash: entry.state.stateHash,\n version: entry.state.version,\n }))\n .reverse(),\n };\n}\n"]}

package/workflows/organizations/{loadPolicyHistoryDetails.js → policyHistory/loadPolicyHistoryDetails.js} RENAMED Viewed

@@ -1,9 +1,9 @@
-import { ProjectionDependencyUnavailableError } from "../../data/keyingProjectionVerification/dependencyUnavailable.js";
-import { reportKeyingVerificationErrorInCauseChain } from "../../data/keyingProjectionVerification/error.js";
-import { loadLocalOrganizationPolicyReference } from "./localReadModelDetails.js";
+import { ProjectionDependencyUnavailableError } from "../../../data/keyingProjectionVerification/dependencyUnavailable.js";
+import { reportKeyingVerificationErrorInCauseChain } from "../../../data/keyingProjectionVerification/error.js";
+import { loadLocalOrganizationPolicyReference } from "../readModel/localReadModelDetails.js";
+import { captureOrganizationPresentationAccessAttempt, isOrganizationPresentationAccessAttemptCurrent, isOrganizationPresentationAccessReadable, } from "../readModel/organizationPresentationAccessState.js";
+import { isOrganizationPresentationAccessDeniedFailure } from "../readModel/organizationPresentationFailures.js";
 import { buildDetailedOrganizationPolicyHistory } from "./organizationPolicyHistoryDetails.js";
-import { captureOrganizationPresentationAccessAttempt, isOrganizationPresentationAccessAttemptCurrent, isOrganizationPresentationAccessReadable, } from "./organizationPresentationAccessState.js";
-import { isOrganizationPresentationAccessDeniedFailure } from "./organizationPresentationFailures.js";
 import { denyPolicyHistoryAccess } from "./policyHistoryAccessDenial.js";
 import { cachePolicyHistory, loadCachedPolicyHistory, } from "./policyHistoryCache.js";
 export async function loadPolicyHistoryDetails(input) {

package/workflows/organizations/policyHistory/loadPolicyHistoryDetails.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"loadPolicyHistoryDetails.js","sourceRoot":"","sources":["loadPolicyHistoryDetails.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oCAAoC,EAAE,MAAM,kEAAkE,CAAC;AACxH,OAAO,EAAE,yCAAyC,EAAE,MAAM,kDAAkD,CAAC;AAM7G,OAAO,EAAE,oCAAoC,EAAE,MAAM,oCAAoC,CAAC;AAC1F,OAAO,EACL,4CAA4C,EAC5C,8CAA8C,EAC9C,wCAAwC,GACzC,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,6CAA6C,EAAE,MAAM,+CAA+C,CAAC;AAC9G,OAAO,EAAE,sCAAsC,EAAE,MAAM,oCAAoC,CAAC;AAC5F,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EACL,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAG9B,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAkB9C;IACC,MAAM,MAAM,GAAG,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;IAClE,MAAM,OAAO,GAAG,4CAA4C,CAC1D,MAAM,EACN,WAAW,CACZ,CAAC;IACF,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,KAAK,CAAC,YAAY,EAAE;QACpB,8CAA8C,CAAC,MAAM,EAAE,OAAO,CAAC;QAC/D,wCAAwC,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAChE,IAAI,CAAC,OAAO,EAAE;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,aAAa,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG;QACZ,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM;QACN,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS;QAC/B,aAAa;KACd,CAAC;IACF,MAAM,MAAM,GAAG,KAAK,EAAE,OAAkC,EAAE,EAAE;QAC1D,MAAM,MAAM,GAAG,MAAM,oCAAoC,CAAC;YACxD,GAAG,KAAK;YACR,aAAa,EAAE,cAAc;YAC7B,WAAW,EAAE,KAAK,CAAC,cAAc;SAClC,CAAC,CAAC;QACH,OAAO,OAAO,EAAE,IAAI,MAAM,EAAE,SAAS,KAAK,KAAK,CAAC,IAAI,CAAC,SAAS;YAC5D,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,IAAI,CAAC;IACX,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,kCAAkC,CACvE,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,IAAI,CAAC,SAAS,EACpB,EAAE,aAAa,EAAE,YAAY,EAAE,KAAK,EAAE,CACvC,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE;YAAE,OAAO,IAAI,CAAC;QACvC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,6CAA6C,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5D,MAAM,uBAAuB,CAAC,MAAM,CAAC,CAAC;gBACtC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,QAAQ,CAAC,MAAM,EAAE,CAAC;YAClB,IAAI,KAAK,CAAC,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACvD,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,sCAAsC,CAAC;YAC3D,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,QAAQ,CAAC,IAAI;YACvB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,YAAY,EAAE,OAAO;SACtB,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,QAAQ,KAAK,OAAO;YACtB,kBAAkB,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACrD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,CAAC,KAAK,CAAC,SAAS;YAChB,KAAK,YAAY,oCAAoC;YAErD,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/B,MAAM,yCAAyC,CAC7C,KAAK,EACL,KAAK,CAAC,sBAAsB,EAC5B;YACE,QAAQ,EAAE,KAAK,CAAC,cAAc;YAC9B,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,kCAAkC;YAC7C,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CACF,CAAC;QACF,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport type { ReferencedPrincipalHead } from \"@tearleads/crypto\";\nimport { ProjectionDependencyUnavailableError } from \"../../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { reportKeyingVerificationErrorInCauseChain } from \"../../../data/keyingProjectionVerification/error\";\nimport type { ReferencedPrincipalPolicyWarmer } from \"../../../data/keyingProjectionVerification/types\";\nimport type { DomainScope } from \"../../../data/shared/domainScope\";\nimport type { SecurityIncidentReporter } from \"../../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport type { RecoveredPrincipalHistoryPage } from \"../../principals/historyRecovery/loadRecoveredPrincipalHistoryPage\";\nimport { loadLocalOrganizationPolicyReference } from \"../readModel/localReadModelDetails\";\nimport {\n captureOrganizationPresentationAccessAttempt,\n isOrganizationPresentationAccessAttemptCurrent,\n isOrganizationPresentationAccessReadable,\n} from \"../readModel/organizationPresentationAccessState\";\nimport { isOrganizationPresentationAccessDeniedFailure } from \"../readModel/organizationPresentationFailures\";\nimport { buildDetailedOrganizationPolicyHistory } from \"./organizationPolicyHistoryDetails\";\nimport { denyPolicyHistoryAccess } from \"./policyHistoryAccessDenial\";\nimport {\n cachePolicyHistory,\n loadCachedPolicyHistory,\n} from \"./policyHistoryCache\";\nimport type { OrganizationPolicyHistory } from \"./policyHistoryTypes\";\n\nexport async function loadPolicyHistoryDetails(input: {\n apiClient: Pick<ApiClient, \"getOrganizationPolicyHistoryResult\">;\n currentUserId: string;\n domainScope: DomainScope;\n execSql: ExecSql;\n organizationId: string;\n head: ReferencedPrincipalHead;\n page: RecoveredPrincipalHistoryPage;\n history: OrganizationPolicyHistory;\n resolveHistory: NonNullable<\n ReferencedPrincipalPolicyWarmer[\"resolveProjectionHistory\"]\n >;\n stillCurrent: () => boolean;\n online: boolean;\n olderPage: boolean;\n reportSecurityIncident?: SecurityIncidentReporter | undefined;\n // Forwarded to denyPolicyHistoryAccess to report failed durable cleanup.\n logError: (message: string | Error, cause?: unknown) => void;\n}): Promise<OrganizationPolicyHistory | null> {\n const access = { ...input, requesterUserId: input.currentUserId };\n const attempt = captureOrganizationPresentationAccessAttempt(\n access,\n \"readModel\",\n );\n const current = () =>\n input.stillCurrent() &&\n isOrganizationPresentationAccessAttemptCurrent(access, attempt) &&\n isOrganizationPresentationAccessReadable(access, \"readModel\");\n if (!current()) return null;\n const beforeVersion = (input.page.entries.at(-1)?.state.version ?? 0) + 1;\n const cache = {\n domainScope: input.domainScope,\n access,\n stateHash: input.head.stateHash,\n beforeVersion,\n };\n const retain = async (history: OrganizationPolicyHistory) => {\n const latest = await loadLocalOrganizationPolicyReference({\n ...input,\n principalType: \"organization\",\n principalId: input.organizationId,\n });\n return current() && latest?.stateHash === input.head.stateHash\n ? history\n : null;\n };\n const cached = loadCachedPolicyHistory(cache);\n if (cached) return retain(cached);\n if (!input.online) return retain(input.history);\n try {\n const response = await input.apiClient.getOrganizationPolicyHistoryResult(\n input.organizationId,\n input.head.stateHash,\n { beforeVersion, reportErrors: false },\n );\n if (!input.stillCurrent()) return null;\n if (!response.ok) {\n if (isOrganizationPresentationAccessDeniedFailure(response)) {\n await denyPolicyHistoryAccess(access);\n return null;\n }\n response.report();\n if (input.olderPage) throw new Error(response.message);\n return retain(input.history);\n }\n const history = await buildDetailedOrganizationPolicyHistory({\n head: input.head,\n page: input.page,\n evidence: response.data,\n resolveHistory: input.resolveHistory,\n stillCurrent: current,\n });\n const retained = await retain(history);\n if (retained === history)\n cachePolicyHistory({ ...cache, attempt, history });\n return retained;\n } catch (error) {\n if (\n !input.olderPage &&\n error instanceof ProjectionDependencyUnavailableError\n )\n return retain(input.history);\n await reportKeyingVerificationErrorInCauseChain(\n error,\n input.reportSecurityIncident,\n {\n objectId: input.organizationId,\n objectKind: \"principal\",\n operation: \"organization.policy_history.load\",\n organizationId: input.organizationId,\n },\n );\n throw error;\n }\n}\n"]}

package/workflows/organizations/{organizationPolicyHistoryDetails.js → policyHistory/organizationPolicyHistoryDetails.js} RENAMED Viewed

@@ -1,5 +1,5 @@
-import { principalPolicyMatchesReference, } from "../../internal/crypto/index.js";
-import { assertProjectionVerificationCurrent, } from "../../data/keyingProjectionVerification/types.js";
+import { principalPolicyMatchesReference, } from "../../../internal/crypto/index.js";
+import { assertProjectionVerificationCurrent, } from "../../../data/keyingProjectionVerification/types.js";
 import { buildOrganizationGroupPolicyHistoryPage } from "./groupPolicyHistoryPage.js";
 import { verifyOrganizationPolicyHistory } from "./organizationPolicyHistoryVerification.js";
 import { diffPrincipalProjectionMembers, } from "./policyHistoryReadModel.js";