npm - @tearleads/client-sdk - Versions diffs - 0.1.62 → 0.1.64 - Mend

@tearleads/client-sdk 0.1.62 → 0.1.64

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1588) hide show

package/client/organizations/currentPrincipalMutations.js CHANGED Viewed

@@ -1,9 +1,9 @@
 import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
-import { commitCurrentGroupPolicyMutation } from "../../workflows/organizations/commitCurrentGroupPolicyMutation.js";
-import { assertGroupMembershipName } from "../../workflows/organizations/groupMembershipName.js";
-import { createRuntimeGroupMetadataAccess } from "../../workflows/organizations/groupMetadataRuntime.js";
-import { buildAddGroupUserPolicyRequest, buildGroupAccessSetShrinkPolicyRequest, buildRemoveGroupUserPolicyRequest, } from "../../workflows/organizations/groupPolicyRequests.js";
-import { createRuntimeCurrentGroupMutation, } from "../../workflows/organizations/runtimeCurrentGroupMutation.js";
+import { createRuntimeGroupMetadataAccess } from "../../workflows/organizations/groupMetadata/groupMetadataRuntime.js";
+import { assertGroupMembershipName } from "../../workflows/organizations/groupNames/groupMembershipName.js";
+import { commitCurrentGroupPolicyMutation } from "../../workflows/organizations/groupPolicy/commitCurrentGroupPolicyMutation.js";
+import { buildAddGroupUserPolicyRequest, buildGroupAccessSetShrinkPolicyRequest, buildRemoveGroupUserPolicyRequest, } from "../../workflows/organizations/groupPolicy/groupPolicyRequests.js";
+import { createRuntimeCurrentGroupMutation, } from "../../workflows/organizations/principalMutations/runtimeCurrentGroupMutation.js";
 import { projectionUserIds, resolveRequiredUserIdentities, } from "../../workflows/organizations/trustedOrganizationUsers.js";
 import { preparePrincipalContainerMutations } from "./principalContainerMutations.js";
 export function createCurrentPrincipalMutation(input) {

package/client/organizations/currentPrincipalMutations.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"currentPrincipalMutations.js","sourceRoot":"","sources":["currentPrincipalMutations.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,gCAAgC,EAAE,MAAM,gEAAgE,CAAC;AAClH,OAAO,EAAE,yBAAyB,EAAE,MAAM,mDAAmD,CAAC;AAC9F,OAAO,EAAE,gCAAgC,EAAE,MAAM,oDAAoD,CAAC;AACtG,OAAO,EACL,8BAA8B,EAC9B,sCAAsC,EACtC,iCAAiC,GAClC,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EACL,iCAAiC,GAElC,MAAM,2DAA2D,CAAC;AACnE,OAAO,EACL,iBAAiB,EACjB,6BAA6B,GAC9B,MAAM,wDAAwD,CAAC;AAEhE,OAAO,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AAyBnF,MAAM,UAAU,8BAA8B,CAC5C,KAAoC;IAEpC,MAAM,MAAM,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChE,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO,CAAC,OAAe,EAAE,QAA8B,EAAE,EAAE,CACzD,MAAM,CACJ;QACE,OAAO;QACP,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,aAAa,GAAG,KAAK,EACzB,QAA4C,EAC5C,MAA4B,EAC5B,EAAE,CAAC,CAAC;YACJ,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE,MAAM,2BAA2B,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC;YACnE,yBAAyB,EAAE,CACzB,UAEkB,EAClB,SAEiB,EACjB,EAAE,CACF,kCAAkC,CAAC;gBACjC,SAAS;gBACT,aAAa,EAAE,QAAQ,CAAC,aAAa;gBACrC,UAAU;gBACV,OAAO,EAAE,QAAQ,CAAC,aAAa,CAAC,YAAY,CAAC,WAAW;gBACxD,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,YAAY,EAAE,QAAQ,CAAC,YAAY;gBACnC,sBAAsB,EAAE,KAAK,CAAC,YAAY;gBAC1C,+BAA+B,EAC7B,QAAQ,CAAC,+BAA+B;gBAC1C,kBAAkB,EAChB,MAAM,CAAC,IAAI,KAAK,QAAQ;oBACtB,CAAC,CAAC,MAAM,CAAC,kBAAkB;oBAC3B,CAAC,CAAC,SAAS;aAChB,CAAC;SACL,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACvD,IAAI,MAA6D,CAAC;QAClE,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,IAAI,OAAO,KAAK,OAAO,CAAC,aAAa,EAAE,CAAC;YACjE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YAC/D,IACE,CAAC,OAAO,CAAC,aAAa,CAAC,iBAAiB,CAAC,IAAI,CAC3C,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,YAAY,CAClD,EACD,CAAC;gBACD,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE;oBACpC,GAAG,QAAQ;oBACX,iBAAiB,EAAE,SAAS;iBAC7B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,MAAM,gCAAgC,CAAC;YACtD,GAAG,KAAK;YACR,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;YAClC,OAAO;YACP,GAAG,OAAO;YACV,MAAM;YACN,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;SACrE,CAAC,CAAC;QACH,OAAO;YACL,QAAQ;YACR,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC;SAC1B,CAAC;IACJ,CAAC,CACF,CAAC;AACN,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,KAAoC,EACpC,OAA2C,EAC3C,QAA8B;IAE9B,MAAM,MAAM,GAAG;QACb,GAAG,OAAO;QACV,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;IACF,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,yBAAyB,CAC7B,OAAO,CAAC,aAAa,EACrB,QAAQ,CAAC,iBAAiB,EAC1B,gCAAgC,CAC9B,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,OAAO,CAAC,YAAY,EACpB,OAAO,CAAC,uBAAuB,CAChC,CAAC,QAAQ,CACX,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,CAAC,OAA0B,EAAE,EAAE,CAClD,6BAA6B,CAAC;QAC5B,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;QACpE,OAAO;KACR,CAAC,CAAC;IACL,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,iBAAiB,CAAC;IAC3D,IAAI,OAAkC,CAAC;IACvC,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC5B,MAAM,oBAAoB,GACxB,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,SAAS,CAAC;QACvD,IAAI,CAAC,oBAAoB;YACvB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC;YACpC,GAAG,iBAAiB,CAAC,UAAU,CAAC;YAChC,QAAQ,CAAC,YAAY;SACtB,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAChC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,YAAY,CACxD,CAAC;QACF,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACzE,OAAO,GAAG,MAAM,8BAA8B,CAAC;YAC7C,GAAG,MAAM;YACT,oBAAoB;YACpB,UAAU;YACV,YAAY,EAAE,UAAU,CAAC,MAAM,CAC7B,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,YAAY,CACxD;YACD,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;SAClE,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,GAAG,MAAM,iCAAiC,CAAC;YAChD,GAAG,MAAM;YACT,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,cAAc,EAAE,MAAM,YAAY,CAChC,iBAAiB,CACf,UAAU,CAAC,MAAM,CACf,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,aAAa,CACrD,CACF,CACF;SACF,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,MAAM,sCAAsC,CAAC;YACrD,GAAG,MAAM;YACT,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;YAC/C,YAAY,EAAE,MAAM,YAAY,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;SAChE,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["import type { SigningKeyPair } from \"@tearleads/crypto\";\nimport type { PutPrincipalPolicyRequest } from \"@tearleads/validators/request\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { commitCurrentGroupPolicyMutation } from \"../../workflows/organizations/commitCurrentGroupPolicyMutation\";\nimport { assertGroupMembershipName } from \"../../workflows/organizations/groupMembershipName\";\nimport { createRuntimeGroupMetadataAccess } from \"../../workflows/organizations/groupMetadataRuntime\";\nimport {\n buildAddGroupUserPolicyRequest,\n buildGroupAccessSetShrinkPolicyRequest,\n buildRemoveGroupUserPolicyRequest,\n} from \"../../workflows/organizations/groupPolicyRequests\";\nimport {\n createRuntimeCurrentGroupMutation,\n type RuntimeCurrentGroupMutationContext,\n} from \"../../workflows/organizations/runtimeCurrentGroupMutation\";\nimport {\n projectionUserIds,\n resolveRequiredUserIdentities,\n} from \"../../workflows/organizations/trustedOrganizationUsers\";\nimport type { InternalWorkflowRuntimeInput } from \"../runtime/workflowRuntime\";\nimport { preparePrincipalContainerMutations } from \"./principalContainerMutations\";\n\ntype CurrentGroupMutation =\n \| {\n readonly kind: \"add\";\n readonly expectedGroupName: string;\n readonly targetUserId: string;\n }\n \| {\n readonly kind: \"remove\";\n readonly expectedGroupName: string;\n readonly removedUserId: string;\n }\n \| { readonly kind: \"revoke\"; readonly revokedContainerId: string };\n\n/** Built-in hosts with private custody use bounded current-policy mutation work. */\ninterface CurrentPrincipalMutationInput {\n readonly runtime: InternalWorkflowRuntimeInput;\n readonly organizationId: string;\n readonly signerUserId: string;\n readonly signingFingerprint: string;\n readonly signingKeyPair: SigningKeyPair;\n readonly stillCurrent: () => boolean;\n}\n\nexport function createCurrentPrincipalMutation(\n input: CurrentPrincipalMutationInput,\n) {\n const mutate = createRuntimeCurrentGroupMutation(input.runtime);\n if (!mutate) return undefined;\n return (groupId: string, mutation: CurrentGroupMutation) =>\n mutate(\n {\n groupId,\n organizationId: input.organizationId,\n signerUserId: input.signerUserId,\n stillCurrent: input.stillCurrent,\n },\n async (context) => {\n const prepareChange = async (\n selected: RuntimeCurrentGroupMutationContext,\n change: CurrentGroupMutation,\n ) => ({\n context: selected,\n request: await buildCurrentMutationRequest(input, selected, change),\n prepareContainerMutations: (\n nextPolicy: Parameters<\n typeof preparePrincipalContainerMutations\n >[0][\"nextPolicy\"],\n preceding?: Parameters<\n typeof preparePrincipalContainerMutations\n >[0][\"preceding\"],\n ) =>\n preparePrincipalContainerMutations({\n preceding,\n currentPolicy: selected.currentPolicy,\n nextPolicy,\n groupId: selected.currentPolicy.currentState.principalId,\n organizationId: input.organizationId,\n runtime: input.runtime,\n stillCurrent: selected.stillCurrent,\n recitationStillCurrent: input.stillCurrent,\n resolveAuthoredPolicyReferences:\n selected.resolveAuthoredPolicyReferences,\n revokedContainerId:\n change.kind === \"revoke\"\n ? change.revokedContainerId\n : undefined,\n }),\n });\n const primary = await prepareChange(context, mutation);\n let member: Awaited<ReturnType<typeof prepareChange>> \| undefined;\n if (mutation.kind === \"add\" && groupId !== context.memberGroupId) {\n const members = await context.loadGroup(context.memberGroupId);\n if (\n !members.currentPolicy.currentProjection.some(\n (entry) => entry.userId === mutation.targetUserId,\n )\n ) {\n member = await prepareChange(members, {\n ...mutation,\n expectedGroupName: \"Members\",\n });\n }\n }\n assertProjectionVerificationCurrent(context.stillCurrent);\n const response = await commitCurrentGroupPolicyMutation({\n ...input,\n apiClient: input.runtime.apiClient,\n groupId,\n ...primary,\n member,\n resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n });\n return {\n response,\n memberGroupId: context.memberGroupId,\n enrolled: Boolean(member),\n };\n },\n );\n}\n\nasync function buildCurrentMutationRequest(\n input: CurrentPrincipalMutationInput,\n context: RuntimeCurrentGroupMutationContext,\n mutation: CurrentGroupMutation,\n): Promise<PutPrincipalPolicyRequest> {\n const shared = {\n ...context,\n signerUserId: input.signerUserId,\n signingFingerprint: input.signingFingerprint,\n signingKeyPair: input.signingKeyPair,\n };\n if (mutation.kind !== \"revoke\") {\n await assertGroupMembershipName(\n context.currentPolicy,\n mutation.expectedGroupName,\n createRuntimeGroupMetadataAccess(\n input.runtime,\n input.organizationId,\n context.stillCurrent,\n context.verifyMetadataContainer,\n ).readName,\n );\n }\n const resolveUsers = (userIds: readonly string[]) =>\n resolveRequiredUserIdentities({\n resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n userIds,\n });\n const projection = context.currentPolicy.currentProjection;\n let request: PutPrincipalPolicyRequest;\n if (mutation.kind === \"add\") {\n const currentUserSecretKey =\n input.runtime.crypto.encapsulationKeyPair?.secretKey;\n if (!currentUserSecretKey)\n throw new Error(\"Organization encryption context is unavailable\");\n const identities = await resolveUsers([\n ...projectionUserIds(projection),\n mutation.targetUserId,\n ]);\n const targetUser = identities.find(\n (identity) => identity.userId === mutation.targetUserId,\n );\n if (!targetUser) throw new Error(\"Group target identity is unavailable\");\n request = await buildAddGroupUserPolicyRequest({\n ...shared,\n currentUserSecretKey,\n targetUser,\n currentUsers: identities.filter(\n (identity) => identity.userId !== mutation.targetUserId,\n ),\n reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n });\n } else if (mutation.kind === \"remove\") {\n request = await buildRemoveGroupUserPolicyRequest({\n ...shared,\n removedUserId: mutation.removedUserId,\n remainingUsers: await resolveUsers(\n projectionUserIds(\n projection.filter(\n (member) => member.userId !== mutation.removedUserId,\n ),\n ),\n ),\n });\n } else {\n request = await buildGroupAccessSetShrinkPolicyRequest({\n ...shared,\n revokedContainerId: mutation.revokedContainerId,\n currentUsers: await resolveUsers(projectionUserIds(projection)),\n });\n }\n\n return request;\n}\n"]}
1	+ {"version":3,"file":"currentPrincipalMutations.js","sourceRoot":"","sources":["currentPrincipalMutations.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,gCAAgC,EAAE,MAAM,kEAAkE,CAAC;AACpH,OAAO,EAAE,yBAAyB,EAAE,MAAM,8DAA8D,CAAC;AACzG,OAAO,EAAE,gCAAgC,EAAE,MAAM,4EAA4E,CAAC;AAC9H,OAAO,EACL,8BAA8B,EAC9B,sCAAsC,EACtC,iCAAiC,GAClC,MAAM,+DAA+D,CAAC;AACvE,OAAO,EACL,iCAAiC,GAElC,MAAM,8EAA8E,CAAC;AACtF,OAAO,EACL,iBAAiB,EACjB,6BAA6B,GAC9B,MAAM,wDAAwD,CAAC;AAEhE,OAAO,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AAyBnF,MAAM,UAAU,8BAA8B,CAC5C,KAAoC;IAEpC,MAAM,MAAM,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChE,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO,CAAC,OAAe,EAAE,QAA8B,EAAE,EAAE,CACzD,MAAM,CACJ;QACE,OAAO;QACP,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,aAAa,GAAG,KAAK,EACzB,QAA4C,EAC5C,MAA4B,EAC5B,EAAE,CAAC,CAAC;YACJ,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE,MAAM,2BAA2B,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC;YACnE,yBAAyB,EAAE,CACzB,UAEkB,EAClB,SAEiB,EACjB,EAAE,CACF,kCAAkC,CAAC;gBACjC,SAAS;gBACT,aAAa,EAAE,QAAQ,CAAC,aAAa;gBACrC,UAAU;gBACV,OAAO,EAAE,QAAQ,CAAC,aAAa,CAAC,YAAY,CAAC,WAAW;gBACxD,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,YAAY,EAAE,QAAQ,CAAC,YAAY;gBACnC,sBAAsB,EAAE,KAAK,CAAC,YAAY;gBAC1C,+BAA+B,EAC7B,QAAQ,CAAC,+BAA+B;gBAC1C,kBAAkB,EAChB,MAAM,CAAC,IAAI,KAAK,QAAQ;oBACtB,CAAC,CAAC,MAAM,CAAC,kBAAkB;oBAC3B,CAAC,CAAC,SAAS;aAChB,CAAC;SACL,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACvD,IAAI,MAA6D,CAAC;QAClE,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,IAAI,OAAO,KAAK,OAAO,CAAC,aAAa,EAAE,CAAC;YACjE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YAC/D,IACE,CAAC,OAAO,CAAC,aAAa,CAAC,iBAAiB,CAAC,IAAI,CAC3C,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,YAAY,CAClD,EACD,CAAC;gBACD,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE;oBACpC,GAAG,QAAQ;oBACX,iBAAiB,EAAE,SAAS;iBAC7B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,MAAM,gCAAgC,CAAC;YACtD,GAAG,KAAK;YACR,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;YAClC,OAAO;YACP,GAAG,OAAO;YACV,MAAM;YACN,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;SACrE,CAAC,CAAC;QACH,OAAO;YACL,QAAQ;YACR,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC;SAC1B,CAAC;IACJ,CAAC,CACF,CAAC;AACN,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,KAAoC,EACpC,OAA2C,EAC3C,QAA8B;IAE9B,MAAM,MAAM,GAAG;QACb,GAAG,OAAO;QACV,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;IACF,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,yBAAyB,CAC7B,OAAO,CAAC,aAAa,EACrB,QAAQ,CAAC,iBAAiB,EAC1B,gCAAgC,CAC9B,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,OAAO,CAAC,YAAY,EACpB,OAAO,CAAC,uBAAuB,CAChC,CAAC,QAAQ,CACX,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,CAAC,OAA0B,EAAE,EAAE,CAClD,6BAA6B,CAAC;QAC5B,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;QACpE,OAAO;KACR,CAAC,CAAC;IACL,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,iBAAiB,CAAC;IAC3D,IAAI,OAAkC,CAAC;IACvC,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC5B,MAAM,oBAAoB,GACxB,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,SAAS,CAAC;QACvD,IAAI,CAAC,oBAAoB;YACvB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC;YACpC,GAAG,iBAAiB,CAAC,UAAU,CAAC;YAChC,QAAQ,CAAC,YAAY;SACtB,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAChC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,YAAY,CACxD,CAAC;QACF,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACzE,OAAO,GAAG,MAAM,8BAA8B,CAAC;YAC7C,GAAG,MAAM;YACT,oBAAoB;YACpB,UAAU;YACV,YAAY,EAAE,UAAU,CAAC,MAAM,CAC7B,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,YAAY,CACxD;YACD,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;SAClE,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,GAAG,MAAM,iCAAiC,CAAC;YAChD,GAAG,MAAM;YACT,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,cAAc,EAAE,MAAM,YAAY,CAChC,iBAAiB,CACf,UAAU,CAAC,MAAM,CACf,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,aAAa,CACrD,CACF,CACF;SACF,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,MAAM,sCAAsC,CAAC;YACrD,GAAG,MAAM;YACT,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;YAC/C,YAAY,EAAE,MAAM,YAAY,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;SAChE,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["import type { SigningKeyPair } from \"@tearleads/crypto\";\nimport type { PutPrincipalPolicyRequest } from \"@tearleads/validators/request\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { createRuntimeGroupMetadataAccess } from \"../../workflows/organizations/groupMetadata/groupMetadataRuntime\";\nimport { assertGroupMembershipName } from \"../../workflows/organizations/groupNames/groupMembershipName\";\nimport { commitCurrentGroupPolicyMutation } from \"../../workflows/organizations/groupPolicy/commitCurrentGroupPolicyMutation\";\nimport {\n buildAddGroupUserPolicyRequest,\n buildGroupAccessSetShrinkPolicyRequest,\n buildRemoveGroupUserPolicyRequest,\n} from \"../../workflows/organizations/groupPolicy/groupPolicyRequests\";\nimport {\n createRuntimeCurrentGroupMutation,\n type RuntimeCurrentGroupMutationContext,\n} from \"../../workflows/organizations/principalMutations/runtimeCurrentGroupMutation\";\nimport {\n projectionUserIds,\n resolveRequiredUserIdentities,\n} from \"../../workflows/organizations/trustedOrganizationUsers\";\nimport type { InternalWorkflowRuntimeInput } from \"../runtime/workflowRuntime\";\nimport { preparePrincipalContainerMutations } from \"./principalContainerMutations\";\n\ntype CurrentGroupMutation =\n \| {\n readonly kind: \"add\";\n readonly expectedGroupName: string;\n readonly targetUserId: string;\n }\n \| {\n readonly kind: \"remove\";\n readonly expectedGroupName: string;\n readonly removedUserId: string;\n }\n \| { readonly kind: \"revoke\"; readonly revokedContainerId: string };\n\n/** Built-in hosts with private custody use bounded current-policy mutation work. */\ninterface CurrentPrincipalMutationInput {\n readonly runtime: InternalWorkflowRuntimeInput;\n readonly organizationId: string;\n readonly signerUserId: string;\n readonly signingFingerprint: string;\n readonly signingKeyPair: SigningKeyPair;\n readonly stillCurrent: () => boolean;\n}\n\nexport function createCurrentPrincipalMutation(\n input: CurrentPrincipalMutationInput,\n) {\n const mutate = createRuntimeCurrentGroupMutation(input.runtime);\n if (!mutate) return undefined;\n return (groupId: string, mutation: CurrentGroupMutation) =>\n mutate(\n {\n groupId,\n organizationId: input.organizationId,\n signerUserId: input.signerUserId,\n stillCurrent: input.stillCurrent,\n },\n async (context) => {\n const prepareChange = async (\n selected: RuntimeCurrentGroupMutationContext,\n change: CurrentGroupMutation,\n ) => ({\n context: selected,\n request: await buildCurrentMutationRequest(input, selected, change),\n prepareContainerMutations: (\n nextPolicy: Parameters<\n typeof preparePrincipalContainerMutations\n >[0][\"nextPolicy\"],\n preceding?: Parameters<\n typeof preparePrincipalContainerMutations\n >[0][\"preceding\"],\n ) =>\n preparePrincipalContainerMutations({\n preceding,\n currentPolicy: selected.currentPolicy,\n nextPolicy,\n groupId: selected.currentPolicy.currentState.principalId,\n organizationId: input.organizationId,\n runtime: input.runtime,\n stillCurrent: selected.stillCurrent,\n recitationStillCurrent: input.stillCurrent,\n resolveAuthoredPolicyReferences:\n selected.resolveAuthoredPolicyReferences,\n revokedContainerId:\n change.kind === \"revoke\"\n ? change.revokedContainerId\n : undefined,\n }),\n });\n const primary = await prepareChange(context, mutation);\n let member: Awaited<ReturnType<typeof prepareChange>> \| undefined;\n if (mutation.kind === \"add\" && groupId !== context.memberGroupId) {\n const members = await context.loadGroup(context.memberGroupId);\n if (\n !members.currentPolicy.currentProjection.some(\n (entry) => entry.userId === mutation.targetUserId,\n )\n ) {\n member = await prepareChange(members, {\n ...mutation,\n expectedGroupName: \"Members\",\n });\n }\n }\n assertProjectionVerificationCurrent(context.stillCurrent);\n const response = await commitCurrentGroupPolicyMutation({\n ...input,\n apiClient: input.runtime.apiClient,\n groupId,\n ...primary,\n member,\n resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n });\n return {\n response,\n memberGroupId: context.memberGroupId,\n enrolled: Boolean(member),\n };\n },\n );\n}\n\nasync function buildCurrentMutationRequest(\n input: CurrentPrincipalMutationInput,\n context: RuntimeCurrentGroupMutationContext,\n mutation: CurrentGroupMutation,\n): Promise<PutPrincipalPolicyRequest> {\n const shared = {\n ...context,\n signerUserId: input.signerUserId,\n signingFingerprint: input.signingFingerprint,\n signingKeyPair: input.signingKeyPair,\n };\n if (mutation.kind !== \"revoke\") {\n await assertGroupMembershipName(\n context.currentPolicy,\n mutation.expectedGroupName,\n createRuntimeGroupMetadataAccess(\n input.runtime,\n input.organizationId,\n context.stillCurrent,\n context.verifyMetadataContainer,\n ).readName,\n );\n }\n const resolveUsers = (userIds: readonly string[]) =>\n resolveRequiredUserIdentities({\n resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n userIds,\n });\n const projection = context.currentPolicy.currentProjection;\n let request: PutPrincipalPolicyRequest;\n if (mutation.kind === \"add\") {\n const currentUserSecretKey =\n input.runtime.crypto.encapsulationKeyPair?.secretKey;\n if (!currentUserSecretKey)\n throw new Error(\"Organization encryption context is unavailable\");\n const identities = await resolveUsers([\n ...projectionUserIds(projection),\n mutation.targetUserId,\n ]);\n const targetUser = identities.find(\n (identity) => identity.userId === mutation.targetUserId,\n );\n if (!targetUser) throw new Error(\"Group target identity is unavailable\");\n request = await buildAddGroupUserPolicyRequest({\n ...shared,\n currentUserSecretKey,\n targetUser,\n currentUsers: identities.filter(\n (identity) => identity.userId !== mutation.targetUserId,\n ),\n reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n });\n } else if (mutation.kind === \"remove\") {\n request = await buildRemoveGroupUserPolicyRequest({\n ...shared,\n removedUserId: mutation.removedUserId,\n remainingUsers: await resolveUsers(\n projectionUserIds(\n projection.filter(\n (member) => member.userId !== mutation.removedUserId,\n ),\n ),\n ),\n });\n } else {\n request = await buildGroupAccessSetShrinkPolicyRequest({\n ...shared,\n revokedContainerId: mutation.revokedContainerId,\n currentUsers: await resolveUsers(projectionUserIds(projection)),\n });\n }\n\n return request;\n}\n"]}

package/client/organizations/organizationDataUsage.js CHANGED Viewed

@@ -1,5 +1,5 @@
 import { loadLocalOrganizationDataUsage, reconcileOrganizationDataUsage, } from "../../workflows/organizations/index.js";
-import { organizationAccessScopeKey } from "../../workflows/organizations/organizationPresentationAccessState.js";
+import { organizationAccessScopeKey } from "../../workflows/organizations/readModel/organizationPresentationAccessState.js";
 import { activeOrganizationDataRuntime, } from "./organizationWorkflowRuntime.js";
 const coordinatorsByRuntime = new WeakMap();
 class OrganizationDataUsageCoordinatorImpl {

package/client/organizations/organizationDataUsage.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"organizationDataUsage.js","sourceRoot":"","sources":["organizationDataUsage.ts"],"names":[],"mappings":"AACA,OAAO,EACL,8BAA8B,EAE9B,8BAA8B,GAC/B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,0BAA0B,EAAE,MAAM,~~mEAAmE~~,CAAC;~~AAE/G~~,OAAO,EAEL,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AAEvC,MAAM,qBAAqB,GAAG,IAAI,OAAO,EAGtC,CAAC;AAYJ,MAAM,oCAAoC;IAQX;IALZ,sBAAsB,GAAG,IAAI,OAAO,EAGlD,CAAC;IAEJ,YAA6B,cAA+B;QAA/B,mBAAc,GAAd,cAAc,CAAiB;IAAG,CAAC;IAExD,iBAAiB,CAAC,MAAqC;QAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QAC/C,IAAI,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,cAAuB;QACrC,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,OAAO,MAAM,8BAA8B,CAAC;gBAC1C,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBACrC,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,eAAe,EAAE,MAAM,CAAC,MAAM;aAC/B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAC1B,8CAA8C,EAC9C,KAAK,CACN,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,SAAS,CAAC,cAAuB;QAC/B,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,IAAI,CAC/C,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,SAAS,CAC9B,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,0BAA0B,CACpC,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,MAAM,CACd,CAAC;QACF,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,cAAc,GAAG,8BAA8B,CAAC;YACpD,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;YACnC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ;YACtC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,eAAe,EAAE,MAAM,CAAC,MAAM;SAC/B,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACd,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,cAAc,EAAE,CAAC;gBACtC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;QACH,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC/B,OAAO,cAAc,CAAC;IACxB,CAAC;CACF;AAED,MAAM,UAAU,sCAAsC,CACpD,cAA+B;IAE/B,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC3D,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,oCAAoC,CAAC,cAAc,CAAC,CAAC;IAC7E,qBAAqB,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IACvD,OAAO,WAAW,CAAC;AACrB,CAAC","sourcesContent":["import type { DomainScope } from \"../../data/shared/domainScope\";\nimport {\n loadLocalOrganizationDataUsage,\n type OrganizationDataUsage,\n reconcileOrganizationDataUsage,\n} from \"../../workflows/organizations\";\nimport { organizationAccessScopeKey } from \"../../workflows/organizations/organizationPresentationAccessState\";\nimport type { InternalRuntime } from \"../runtime/workflowRuntime\";\nimport {\n type ActiveOrganizationDataRuntime,\n activeOrganizationDataRuntime,\n} from \"./organizationWorkflowRuntime\";\n\nconst coordinatorsByRuntime = new WeakMap<\n InternalRuntime,\n OrganizationDataUsageCoordinator\n>();\n\nexport interface OrganizationDataUsageCoordinator {\n loadLocal(\n organizationId?: string \| undefined,\n ): Promise<OrganizationDataUsage \| null>;\n /** Undefined means no authoritative result was available for this runtime. */\n reconcile(\n organizationId?: string \| undefined,\n ): Promise<OrganizationDataUsage \| null \| undefined>;\n}\n\nclass OrganizationDataUsageCoordinatorImpl\n implements OrganizationDataUsageCoordinator\n{\n private readonly reconciliationsByScope = new WeakMap<\n DomainScope,\n Map<string, Promise<OrganizationDataUsage \| null \| undefined>>\n >();\n\n constructor(private readonly runtimeService: InternalRuntime) {}\n\n private reconciliationMap(active: ActiveOrganizationDataRuntime) {\n const scope = active.runtime.state.domainScope;\n let byKey = this.reconciliationsByScope.get(scope);\n if (!byKey) {\n byKey = new Map();\n this.reconciliationsByScope.set(scope, byKey);\n }\n return byKey;\n }\n\n async loadLocal(organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active) {\n return null;\n }\n\n try {\n return await loadLocalOrganizationDataUsage({\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n requesterUserId: active.userId,\n });\n } catch (error) {\n active.runtime.util.logError(\n \"Failed to load local organization data usage\",\n error,\n );\n return null;\n }\n }\n\n reconcile(organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active) {\n return Promise.resolve(undefined);\n }\n if (!active.runtime.state.online) {\n return this.loadLocal(active.organizationId).then(\n (local) => local ?? undefined,\n );\n }\n\n const byKey = this.reconciliationMap(active);\n const key = organizationAccessScopeKey(\n active.organizationId,\n active.userId,\n );\n const existing = byKey.get(key);\n if (existing) {\n return existing;\n }\n\n const reconciliation = reconcileOrganizationDataUsage({\n apiClient: active.runtime.apiClient,\n execSql: active.runtime.infra.execSql,\n logError: active.runtime.util.logError,\n organizationId: active.organizationId,\n requesterUserId: active.userId,\n }).finally(() => {\n if (byKey.get(key) === reconciliation) {\n byKey.delete(key);\n }\n });\n byKey.set(key, reconciliation);\n return reconciliation;\n }\n}\n\nexport function createOrganizationDataUsageCoordinator(\n runtimeService: InternalRuntime,\n): OrganizationDataUsageCoordinator {\n const existing = coordinatorsByRuntime.get(runtimeService);\n if (existing) {\n return existing;\n }\n\n const coordinator = new OrganizationDataUsageCoordinatorImpl(runtimeService);\n coordinatorsByRuntime.set(runtimeService, coordinator);\n return coordinator;\n}\n"]}
1	+ {"version":3,"file":"organizationDataUsage.js","sourceRoot":"","sources":["organizationDataUsage.ts"],"names":[],"mappings":"AACA,OAAO,EACL,8BAA8B,EAE9B,8BAA8B,GAC/B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,0BAA0B,EAAE,MAAM,6EAA6E,CAAC;AAEzH,OAAO,EAEL,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AAEvC,MAAM,qBAAqB,GAAG,IAAI,OAAO,EAGtC,CAAC;AAYJ,MAAM,oCAAoC;IAQX;IALZ,sBAAsB,GAAG,IAAI,OAAO,EAGlD,CAAC;IAEJ,YAA6B,cAA+B;QAA/B,mBAAc,GAAd,cAAc,CAAiB;IAAG,CAAC;IAExD,iBAAiB,CAAC,MAAqC;QAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QAC/C,IAAI,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,cAAuB;QACrC,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,OAAO,MAAM,8BAA8B,CAAC;gBAC1C,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBACrC,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,eAAe,EAAE,MAAM,CAAC,MAAM;aAC/B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAC1B,8CAA8C,EAC9C,KAAK,CACN,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,SAAS,CAAC,cAAuB;QAC/B,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,IAAI,CAC/C,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,SAAS,CAC9B,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,0BAA0B,CACpC,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,MAAM,CACd,CAAC;QACF,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,cAAc,GAAG,8BAA8B,CAAC;YACpD,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;YACnC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ;YACtC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,eAAe,EAAE,MAAM,CAAC,MAAM;SAC/B,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACd,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,cAAc,EAAE,CAAC;gBACtC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;QACH,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC/B,OAAO,cAAc,CAAC;IACxB,CAAC;CACF;AAED,MAAM,UAAU,sCAAsC,CACpD,cAA+B;IAE/B,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC3D,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,oCAAoC,CAAC,cAAc,CAAC,CAAC;IAC7E,qBAAqB,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IACvD,OAAO,WAAW,CAAC;AACrB,CAAC","sourcesContent":["import type { DomainScope } from \"../../data/shared/domainScope\";\nimport {\n loadLocalOrganizationDataUsage,\n type OrganizationDataUsage,\n reconcileOrganizationDataUsage,\n} from \"../../workflows/organizations\";\nimport { organizationAccessScopeKey } from \"../../workflows/organizations/readModel/organizationPresentationAccessState\";\nimport type { InternalRuntime } from \"../runtime/workflowRuntime\";\nimport {\n type ActiveOrganizationDataRuntime,\n activeOrganizationDataRuntime,\n} from \"./organizationWorkflowRuntime\";\n\nconst coordinatorsByRuntime = new WeakMap<\n InternalRuntime,\n OrganizationDataUsageCoordinator\n>();\n\nexport interface OrganizationDataUsageCoordinator {\n loadLocal(\n organizationId?: string \| undefined,\n ): Promise<OrganizationDataUsage \| null>;\n /** Undefined means no authoritative result was available for this runtime. */\n reconcile(\n organizationId?: string \| undefined,\n ): Promise<OrganizationDataUsage \| null \| undefined>;\n}\n\nclass OrganizationDataUsageCoordinatorImpl\n implements OrganizationDataUsageCoordinator\n{\n private readonly reconciliationsByScope = new WeakMap<\n DomainScope,\n Map<string, Promise<OrganizationDataUsage \| null \| undefined>>\n >();\n\n constructor(private readonly runtimeService: InternalRuntime) {}\n\n private reconciliationMap(active: ActiveOrganizationDataRuntime) {\n const scope = active.runtime.state.domainScope;\n let byKey = this.reconciliationsByScope.get(scope);\n if (!byKey) {\n byKey = new Map();\n this.reconciliationsByScope.set(scope, byKey);\n }\n return byKey;\n }\n\n async loadLocal(organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active) {\n return null;\n }\n\n try {\n return await loadLocalOrganizationDataUsage({\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n requesterUserId: active.userId,\n });\n } catch (error) {\n active.runtime.util.logError(\n \"Failed to load local organization data usage\",\n error,\n );\n return null;\n }\n }\n\n reconcile(organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active) {\n return Promise.resolve(undefined);\n }\n if (!active.runtime.state.online) {\n return this.loadLocal(active.organizationId).then(\n (local) => local ?? undefined,\n );\n }\n\n const byKey = this.reconciliationMap(active);\n const key = organizationAccessScopeKey(\n active.organizationId,\n active.userId,\n );\n const existing = byKey.get(key);\n if (existing) {\n return existing;\n }\n\n const reconciliation = reconcileOrganizationDataUsage({\n apiClient: active.runtime.apiClient,\n execSql: active.runtime.infra.execSql,\n logError: active.runtime.util.logError,\n organizationId: active.organizationId,\n requesterUserId: active.userId,\n }).finally(() => {\n if (byKey.get(key) === reconciliation) {\n byKey.delete(key);\n }\n });\n byKey.set(key, reconciliation);\n return reconciliation;\n }\n}\n\nexport function createOrganizationDataUsageCoordinator(\n runtimeService: InternalRuntime,\n): OrganizationDataUsageCoordinator {\n const existing = coordinatorsByRuntime.get(runtimeService);\n if (existing) {\n return existing;\n }\n\n const coordinator = new OrganizationDataUsageCoordinatorImpl(runtimeService);\n coordinatorsByRuntime.set(runtimeService, coordinator);\n return coordinator;\n}\n"]}

package/client/organizations/organizationGroupHistory.js CHANGED Viewed

@@ -1,7 +1,7 @@
 import { ProjectionDependencyUnavailableError } from "../../data/keyingProjectionVerification/dependencyUnavailable.js";
 import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
 import { loadLocalOrganizationPolicyReference } from "../../workflows/organizations/index.js";
-import { buildOrganizationGroupPolicyHistoryPage } from "../../workflows/organizations/groupPolicyHistoryPage.js";
+import { buildOrganizationGroupPolicyHistoryPage } from "../../workflows/organizations/policyHistory/groupPolicyHistoryPage.js";
 import { createRuntimePrincipalPolicyCurrentResolver } from "../../workflows/principals/runtimePolicyRecovery.js";
 /** All group history reads use the private paged verifier. */
 export async function loadBoundedOrganizationGroupHistory(input) {

package/client/organizations/organizationGroupHistory.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"organizationGroupHistory.js","sourceRoot":"","sources":["organizationGroupHistory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,oCAAoC,EAAE,MAAM,+BAA+B,CAAC;AACrF,OAAO,EAAE,uCAAuC,EAAE,MAAM,~~sDAAsD~~,CAAC;~~AAC/G~~,OAAO,EAAE,2CAA2C,EAAE,MAAM,kDAAkD,CAAC;AAG/G,8DAA8D;AAC9D,MAAM,CAAC,KAAK,UAAU,mCAAmC,CAAC,KAKzD;IACC,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACzB,MAAM,OAAO,GAAG,2CAA2C,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5E,IAAI,CAAC,OAAO;QACV,MAAM,IAAI,oCAAoC,CAC5C,+CAA+C,CAChD,CAAC;IACJ,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,MAAM,oCAAoC,CAAC;QAC3D,aAAa,EAAE,MAAM,CAAC,MAAM;QAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QACrC,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,WAAW,EAAE,KAAK,CAAC,OAAO;QAC1B,aAAa,EAAE,OAAO;KACvB,CAAC,CAAC;IACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC;QAC7B,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,SAAS;QACT,kBAAkB,EAAE,IAAI;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,WAAW,EACT,KAAK,CAAC,aAAa,KAAK,SAAS;YAC/B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE;KAC7C,CAAC,CAAC;IACH,mCAAmC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC3D,IAAI,CAAC,QAAQ,CAAC,WAAW;QACvB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,OAAO,uCAAuC,CAAC;QAC7C,IAAI,EAAE,QAAQ,CAAC,WAAW;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { ProjectionDependencyUnavailableError } from \"../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { loadLocalOrganizationPolicyReference } from \"../../workflows/organizations\";\nimport { buildOrganizationGroupPolicyHistoryPage } from \"../../workflows/organizations/groupPolicyHistoryPage\";\nimport { createRuntimePrincipalPolicyCurrentResolver } from \"../../workflows/principals/runtimePolicyRecovery\";\nimport type { ActiveOrganizationDataRuntime } from \"./organizationWorkflowRuntime\";\n\n/** All group history reads use the private paged verifier. */\nexport async function loadBoundedOrganizationGroupHistory(input: {\n readonly active: ActiveOrganizationDataRuntime;\n readonly groupId: string;\n readonly beforeVersion?: number \| undefined;\n readonly stillCurrent: () => boolean;\n}) {\n const { active } = input;\n const resolve = createRuntimePrincipalPolicyCurrentResolver(active.runtime);\n if (!resolve)\n throw new ProjectionDependencyUnavailableError(\n \"Group history requires private paged recovery\",\n );\n assertProjectionVerificationCurrent(input.stillCurrent);\n const reference = await loadLocalOrganizationPolicyReference({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n principalId: input.groupId,\n principalType: \"group\",\n });\n assertProjectionVerificationCurrent(input.stillCurrent);\n if (!reference) return null;\n const resolved = await resolve({\n organizationId: active.organizationId,\n reference,\n preferLocalCurrent: true,\n stillCurrent: input.stillCurrent,\n historyPage:\n input.beforeVersion === undefined\n ? {}\n : { beforeVersion: input.beforeVersion },\n });\n assertProjectionVerificationCurrent(resolved.stillCurrent);\n if (!resolved.historyPage)\n throw new Error(\"Verified history page is missing\");\n return buildOrganizationGroupPolicyHistoryPage({\n page: resolved.historyPage,\n groupId: input.groupId,\n organizationId: active.organizationId,\n });\n}\n"]}
1	+ {"version":3,"file":"organizationGroupHistory.js","sourceRoot":"","sources":["organizationGroupHistory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,oCAAoC,EAAE,MAAM,+BAA+B,CAAC;AACrF,OAAO,EAAE,uCAAuC,EAAE,MAAM,oEAAoE,CAAC;AAC7H,OAAO,EAAE,2CAA2C,EAAE,MAAM,kDAAkD,CAAC;AAG/G,8DAA8D;AAC9D,MAAM,CAAC,KAAK,UAAU,mCAAmC,CAAC,KAKzD;IACC,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACzB,MAAM,OAAO,GAAG,2CAA2C,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5E,IAAI,CAAC,OAAO;QACV,MAAM,IAAI,oCAAoC,CAC5C,+CAA+C,CAChD,CAAC;IACJ,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,MAAM,oCAAoC,CAAC;QAC3D,aAAa,EAAE,MAAM,CAAC,MAAM;QAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QACrC,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,WAAW,EAAE,KAAK,CAAC,OAAO;QAC1B,aAAa,EAAE,OAAO;KACvB,CAAC,CAAC;IACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC;QAC7B,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,SAAS;QACT,kBAAkB,EAAE,IAAI;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,WAAW,EACT,KAAK,CAAC,aAAa,KAAK,SAAS;YAC/B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE;KAC7C,CAAC,CAAC;IACH,mCAAmC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC3D,IAAI,CAAC,QAAQ,CAAC,WAAW;QACvB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,OAAO,uCAAuC,CAAC;QAC7C,IAAI,EAAE,QAAQ,CAAC,WAAW;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { ProjectionDependencyUnavailableError } from \"../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { loadLocalOrganizationPolicyReference } from \"../../workflows/organizations\";\nimport { buildOrganizationGroupPolicyHistoryPage } from \"../../workflows/organizations/policyHistory/groupPolicyHistoryPage\";\nimport { createRuntimePrincipalPolicyCurrentResolver } from \"../../workflows/principals/runtimePolicyRecovery\";\nimport type { ActiveOrganizationDataRuntime } from \"./organizationWorkflowRuntime\";\n\n/** All group history reads use the private paged verifier. */\nexport async function loadBoundedOrganizationGroupHistory(input: {\n readonly active: ActiveOrganizationDataRuntime;\n readonly groupId: string;\n readonly beforeVersion?: number \| undefined;\n readonly stillCurrent: () => boolean;\n}) {\n const { active } = input;\n const resolve = createRuntimePrincipalPolicyCurrentResolver(active.runtime);\n if (!resolve)\n throw new ProjectionDependencyUnavailableError(\n \"Group history requires private paged recovery\",\n );\n assertProjectionVerificationCurrent(input.stillCurrent);\n const reference = await loadLocalOrganizationPolicyReference({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n principalId: input.groupId,\n principalType: \"group\",\n });\n assertProjectionVerificationCurrent(input.stillCurrent);\n if (!reference) return null;\n const resolved = await resolve({\n organizationId: active.organizationId,\n reference,\n preferLocalCurrent: true,\n stillCurrent: input.stillCurrent,\n historyPage:\n input.beforeVersion === undefined\n ? {}\n : { beforeVersion: input.beforeVersion },\n });\n assertProjectionVerificationCurrent(resolved.stillCurrent);\n if (!resolved.historyPage)\n throw new Error(\"Verified history page is missing\");\n return buildOrganizationGroupPolicyHistoryPage({\n page: resolved.historyPage,\n groupId: input.groupId,\n organizationId: active.organizationId,\n });\n}\n"]}

package/client/organizations/organizationGroupNameHydration.js CHANGED Viewed

@@ -1,7 +1,7 @@
 import { loadLocalOrganizationPolicyReference } from "../../workflows/organizations/index.js";
-import { createSelectedCurrentGroupMetadataContainerVerifier } from "../../workflows/organizations/currentGroupMetadataAuthority.js";
-import { createRuntimeGroupMetadataAccess } from "../../workflows/organizations/groupMetadataRuntime.js";
-import { hydrateOrganizationGroupNames } from "../../workflows/organizations/organizationGroupNames.js";
+import { createSelectedCurrentGroupMetadataContainerVerifier } from "../../workflows/organizations/groupMetadata/currentGroupMetadataAuthority.js";
+import { createRuntimeGroupMetadataAccess } from "../../workflows/organizations/groupMetadata/groupMetadataRuntime.js";
+import { hydrateOrganizationGroupNames } from "../../workflows/organizations/groupNames/organizationGroupNames.js";
 import { createRuntimePrincipalPolicyCurrentResolver } from "../../workflows/principals/runtimePolicyRecovery.js";
 import { isOrganizationDataRuntimeCurrent, } from "./organizationWorkflowRuntime.js";
 export async function hydrateOrganizationGroupNamesForRuntime(runtimeService, active, domainScope, directoryAndGroups) {

package/client/organizations/organizationGroupNameHydration.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"organizationGroupNameHydration.js","sourceRoot":"","sources":["organizationGroupNameHydration.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oCAAoC,EAAE,MAAM,+BAA+B,CAAC;AACrF,OAAO,EAAE,mDAAmD,EAAE,MAAM,~~6DAA6D~~,CAAC;~~AAClI~~,OAAO,EAAE,gCAAgC,EAAE,MAAM,~~oDAAoD~~,CAAC;~~AACtG~~,OAAO,EAAE,6BAA6B,EAAE,MAAM,~~sDAAsD~~,CAAC;~~AAErG~~,OAAO,EAAE,2CAA2C,EAAE,MAAM,kDAAkD,CAAC;AAE/G,OAAO,EAEL,gCAAgC,GACjC,MAAM,+BAA+B,CAAC;AAEvC,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAC3D,cAA+B,EAC/B,MAAqC,EACrC,WAAwB,EACxB,kBAAqE;IAErE,IAAI,kBAAkB,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;QACrE,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,gCAAgC,CAAC,cAAc,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QACxE,yEAAyE;QACzE,MAAM,eAAe,GAAG;YACtB,oBAAoB,EAAE,2CAA2C,CAC/D,MAAM,CAAC,OAAO,CACf;YACD,aAAa,EAAE,EAAE;SAClB,CAAC;QACF,OAAO,6BAA6B,CAAC;YACnC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;YACnC,SAAS,EAAE,kBAAkB;YAC7B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;gBACtE,aAAa,EAAE,MAAM,CAAC,MAAM;gBAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBACrC,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,WAAW,EAAE,MAAM,CAAC,cAAc;gBAClC,aAAa,EAAE,cAAc;aAC9B,CAAC;YACF,sBAAsB,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;YAClE,uBAAuB,EAAE,CAAC,SAAS,EAAE,EAAE,CACrC,gCAAgC,CAC9B,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,cAAc,EACrB,YAAY,EACZ,mDAAmD,CAAC;gBAClD,SAAS;gBACT,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,YAAY;aACb,CAAC,CACH,CAAC,QAAQ;YACZ,iBAAiB,EAAE,gCAAgC,CACjD,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,cAAc,EACrB,YAAY,EACZ,SAAS,EACT,eAAe,CAChB,CAAC,QAAQ;YACV,0BAA0B,EAAE,MAAM,CAAC,OAAO,CAAC,0BAA0B;YACrE,GAAG,eAAe;YAClB,YAAY;SACb,CAAC,CAAC;IACL,CAAC;IACD,OAAO,kBAAkB,CAAC;AAC5B,CAAC","sourcesContent":["import type { DomainScope } from \"../../data/shared/domainScope\";\nimport { loadLocalOrganizationPolicyReference } from \"../../workflows/organizations\";\nimport { createSelectedCurrentGroupMetadataContainerVerifier } from \"../../workflows/organizations/currentGroupMetadataAuthority\";\nimport { createRuntimeGroupMetadataAccess } from \"../../workflows/organizations/groupMetadataRuntime\";\nimport { hydrateOrganizationGroupNames } from \"../../workflows/organizations/organizationGroupNames\";\nimport type { OrganizationDirectoryAndGroups } from \"../../workflows/organizations/readModel\";\nimport { createRuntimePrincipalPolicyCurrentResolver } from \"../../workflows/principals/runtimePolicyRecovery\";\nimport type { InternalRuntime } from \"../runtime/workflowRuntime\";\nimport {\n type ActiveOrganizationDataRuntime,\n isOrganizationDataRuntimeCurrent,\n} from \"./organizationWorkflowRuntime\";\n\nexport async function hydrateOrganizationGroupNamesForRuntime(\n runtimeService: InternalRuntime,\n active: ActiveOrganizationDataRuntime,\n domainScope: DomainScope,\n directoryAndGroups: OrganizationDirectoryAndGroups \| null \| undefined,\n) {\n if (directoryAndGroups && active.runtime.crypto.encapsulationKeyPair) {\n const stillCurrent = () =>\n isOrganizationDataRuntimeCurrent(runtimeService, active, domainScope);\n // Labels and their metadata root belong to this one reconciliation view.\n const currentRecovery = {\n resolveCurrentPolicy: createRuntimePrincipalPolicyCurrentResolver(\n active.runtime,\n ),\n recoveryBatch: {},\n };\n return hydrateOrganizationGroupNames({\n apiClient: active.runtime.apiClient,\n directory: directoryAndGroups,\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n organizationPolicyReference: await loadLocalOrganizationPolicyReference({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n principalId: active.organizationId,\n principalType: \"organization\",\n }),\n reportSecurityIncident: active.runtime.util.reportSecurityIncident,\n createCurrentNameReader: (authority) =>\n createRuntimeGroupMetadataAccess(\n active.runtime,\n active.organizationId,\n stillCurrent,\n createSelectedCurrentGroupMetadataContainerVerifier({\n authority,\n organizationId: active.organizationId,\n stillCurrent,\n }),\n ).readName,\n readEncryptedName: createRuntimeGroupMetadataAccess(\n active.runtime,\n active.organizationId,\n stillCurrent,\n undefined,\n currentRecovery,\n ).readName,\n resolveTrustedUserIdentity: active.runtime.resolveTrustedUserIdentity,\n ...currentRecovery,\n stillCurrent,\n });\n }\n return directoryAndGroups;\n}\n"]}
1	+ {"version":3,"file":"organizationGroupNameHydration.js","sourceRoot":"","sources":["organizationGroupNameHydration.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oCAAoC,EAAE,MAAM,+BAA+B,CAAC;AACrF,OAAO,EAAE,mDAAmD,EAAE,MAAM,2EAA2E,CAAC;AAChJ,OAAO,EAAE,gCAAgC,EAAE,MAAM,kEAAkE,CAAC;AACpH,OAAO,EAAE,6BAA6B,EAAE,MAAM,iEAAiE,CAAC;AAEhH,OAAO,EAAE,2CAA2C,EAAE,MAAM,kDAAkD,CAAC;AAE/G,OAAO,EAEL,gCAAgC,GACjC,MAAM,+BAA+B,CAAC;AAEvC,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAC3D,cAA+B,EAC/B,MAAqC,EACrC,WAAwB,EACxB,kBAAqE;IAErE,IAAI,kBAAkB,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;QACrE,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,gCAAgC,CAAC,cAAc,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QACxE,yEAAyE;QACzE,MAAM,eAAe,GAAG;YACtB,oBAAoB,EAAE,2CAA2C,CAC/D,MAAM,CAAC,OAAO,CACf;YACD,aAAa,EAAE,EAAE;SAClB,CAAC;QACF,OAAO,6BAA6B,CAAC;YACnC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;YACnC,SAAS,EAAE,kBAAkB;YAC7B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;gBACtE,aAAa,EAAE,MAAM,CAAC,MAAM;gBAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBACrC,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,WAAW,EAAE,MAAM,CAAC,cAAc;gBAClC,aAAa,EAAE,cAAc;aAC9B,CAAC;YACF,sBAAsB,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;YAClE,uBAAuB,EAAE,CAAC,SAAS,EAAE,EAAE,CACrC,gCAAgC,CAC9B,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,cAAc,EACrB,YAAY,EACZ,mDAAmD,CAAC;gBAClD,SAAS;gBACT,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,YAAY;aACb,CAAC,CACH,CAAC,QAAQ;YACZ,iBAAiB,EAAE,gCAAgC,CACjD,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,cAAc,EACrB,YAAY,EACZ,SAAS,EACT,eAAe,CAChB,CAAC,QAAQ;YACV,0BAA0B,EAAE,MAAM,CAAC,OAAO,CAAC,0BAA0B;YACrE,GAAG,eAAe;YAClB,YAAY;SACb,CAAC,CAAC;IACL,CAAC;IACD,OAAO,kBAAkB,CAAC;AAC5B,CAAC","sourcesContent":["import type { DomainScope } from \"../../data/shared/domainScope\";\nimport { loadLocalOrganizationPolicyReference } from \"../../workflows/organizations\";\nimport { createSelectedCurrentGroupMetadataContainerVerifier } from \"../../workflows/organizations/groupMetadata/currentGroupMetadataAuthority\";\nimport { createRuntimeGroupMetadataAccess } from \"../../workflows/organizations/groupMetadata/groupMetadataRuntime\";\nimport { hydrateOrganizationGroupNames } from \"../../workflows/organizations/groupNames/organizationGroupNames\";\nimport type { OrganizationDirectoryAndGroups } from \"../../workflows/organizations/readModel\";\nimport { createRuntimePrincipalPolicyCurrentResolver } from \"../../workflows/principals/runtimePolicyRecovery\";\nimport type { InternalRuntime } from \"../runtime/workflowRuntime\";\nimport {\n type ActiveOrganizationDataRuntime,\n isOrganizationDataRuntimeCurrent,\n} from \"./organizationWorkflowRuntime\";\n\nexport async function hydrateOrganizationGroupNamesForRuntime(\n runtimeService: InternalRuntime,\n active: ActiveOrganizationDataRuntime,\n domainScope: DomainScope,\n directoryAndGroups: OrganizationDirectoryAndGroups \| null \| undefined,\n) {\n if (directoryAndGroups && active.runtime.crypto.encapsulationKeyPair) {\n const stillCurrent = () =>\n isOrganizationDataRuntimeCurrent(runtimeService, active, domainScope);\n // Labels and their metadata root belong to this one reconciliation view.\n const currentRecovery = {\n resolveCurrentPolicy: createRuntimePrincipalPolicyCurrentResolver(\n active.runtime,\n ),\n recoveryBatch: {},\n };\n return hydrateOrganizationGroupNames({\n apiClient: active.runtime.apiClient,\n directory: directoryAndGroups,\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n organizationPolicyReference: await loadLocalOrganizationPolicyReference({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n principalId: active.organizationId,\n principalType: \"organization\",\n }),\n reportSecurityIncident: active.runtime.util.reportSecurityIncident,\n createCurrentNameReader: (authority) =>\n createRuntimeGroupMetadataAccess(\n active.runtime,\n active.organizationId,\n stillCurrent,\n createSelectedCurrentGroupMetadataContainerVerifier({\n authority,\n organizationId: active.organizationId,\n stillCurrent,\n }),\n ).readName,\n readEncryptedName: createRuntimeGroupMetadataAccess(\n active.runtime,\n active.organizationId,\n stillCurrent,\n undefined,\n currentRecovery,\n ).readName,\n resolveTrustedUserIdentity: active.runtime.resolveTrustedUserIdentity,\n ...currentRecovery,\n stillCurrent,\n });\n }\n return directoryAndGroups;\n}\n"]}

package/client/organizations/organizationHistory.js CHANGED Viewed

@@ -1,8 +1,8 @@
 import { ProjectionDependencyUnavailableError } from "../../data/keyingProjectionVerification/dependencyUnavailable.js";
 import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
 import { loadLocalOrganizationPolicyReference } from "../../workflows/organizations/index.js";
-import { buildOrganizationGroupPolicyHistoryPage } from "../../workflows/organizations/groupPolicyHistoryPage.js";
-import { loadPolicyHistoryDetails } from "../../workflows/organizations/loadPolicyHistoryDetails.js";
+import { buildOrganizationGroupPolicyHistoryPage } from "../../workflows/organizations/policyHistory/groupPolicyHistoryPage.js";
+import { loadPolicyHistoryDetails } from "../../workflows/organizations/policyHistory/loadPolicyHistoryDetails.js";
 import { createRuntimePrincipalPolicyCurrentResolver } from "../../workflows/principals/runtimePolicyRecovery.js";
 import { createRuntimeProjectionPolicyResolver } from "../../workflows/principals/runtimeProjectionPolicyRecovery.js";
 export async function loadBoundedOrganizationHistory(input) {

package/client/organizations/organizationHistory.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"organizationHistory.js","sourceRoot":"","sources":["organizationHistory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,oCAAoC,EAAE,MAAM,+BAA+B,CAAC;AACrF,OAAO,EAAE,uCAAuC,EAAE,MAAM,~~sDAAsD~~,CAAC;~~AAC/G~~,OAAO,EAAE,wBAAwB,EAAE,MAAM,~~wDAAwD~~,CAAC;~~AAClG~~,OAAO,EAAE,2CAA2C,EAAE,MAAM,kDAAkD,CAAC;AAC/G,OAAO,EAAE,qCAAqC,EAAE,MAAM,4DAA4D,CAAC;AAGnH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAIpD;IACC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IACvC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IAC3B,MAAM,OAAO,GAAG,2CAA2C,CAAC,OAAO,CAAC,CAAC;IACrE,MAAM,cAAc,GAAG,qCAAqC,CAAC,OAAO,CAAC,CAAC;IACtE,IAAI,CAAC,OAAO,IAAI,CAAC,cAAc;QAC7B,MAAM,IAAI,oCAAoC,CAC5C,sDAAsD,CACvD,CAAC;IACJ,MAAM,SAAS,GAAG,MAAM,oCAAoC,CAAC;QAC3D,aAAa,EAAE,MAAM,CAAC,MAAM;QAC5B,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9B,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,WAAW,EAAE,MAAM,CAAC,cAAc;QAClC,aAAa,EAAE,cAAc;KAC9B,CAAC,CAAC;IACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC;QAC7B,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,SAAS;QACT,kBAAkB,EAAE,IAAI;QACxB,YAAY;QACZ,WAAW,EACT,KAAK,CAAC,aAAa,KAAK,SAAS;YAC/B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE;KAC7C,CAAC,CAAC;IACH,mCAAmC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,CAAC;IAClC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAG,uCAAuC,CAAC;QACpD,IAAI;QACJ,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,OAAO,EAAE,MAAM,CAAC,cAAc;KAC/B,CAAC,CAAC;IACH,OAAO,wBAAwB,CAAC;QAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,aAAa,EAAE,MAAM,CAAC,MAAM;QAC5B,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,WAAW;QACtC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9B,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,IAAI,EAAE,SAAS;QACf,IAAI;QACJ,OAAO,EAAE;YACP,WAAW,EAAE,MAAM,CAAC,cAAc;YAClC,aAAa,EAAE,cAAc;YAC7B,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;SAC1E;QACD,cAAc;QACd,YAAY;QACZ,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM;QAC5B,SAAS,EAAE,KAAK,CAAC,aAAa,KAAK,SAAS;QAC5C,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ;QAC/B,sBAAsB,EAAE,OAAO,CAAC,IAAI,CAAC,sBAAsB;KAC5D,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { ProjectionDependencyUnavailableError } from \"../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { loadLocalOrganizationPolicyReference } from \"../../workflows/organizations\";\nimport { buildOrganizationGroupPolicyHistoryPage } from \"../../workflows/organizations/groupPolicyHistoryPage\";\nimport { loadPolicyHistoryDetails } from \"../../workflows/organizations/loadPolicyHistoryDetails\";\nimport { createRuntimePrincipalPolicyCurrentResolver } from \"../../workflows/principals/runtimePolicyRecovery\";\nimport { createRuntimeProjectionPolicyResolver } from \"../../workflows/principals/runtimeProjectionPolicyRecovery\";\nimport type { ActiveOrganizationDataRuntime } from \"./organizationWorkflowRuntime\";\n\nexport async function loadBoundedOrganizationHistory(input: {\n readonly active: ActiveOrganizationDataRuntime;\n readonly beforeVersion?: number \| undefined;\n readonly stillCurrent: () => boolean;\n}) {\n const { active, stillCurrent } = input;\n const { runtime } = active;\n const resolve = createRuntimePrincipalPolicyCurrentResolver(runtime);\n const resolveHistory = createRuntimeProjectionPolicyResolver(runtime);\n if (!resolve \|\| !resolveHistory)\n throw new ProjectionDependencyUnavailableError(\n \"Organization history requires private paged recovery\",\n );\n const reference = await loadLocalOrganizationPolicyReference({\n currentUserId: active.userId,\n execSql: runtime.infra.execSql,\n organizationId: active.organizationId,\n principalId: active.organizationId,\n principalType: \"organization\",\n });\n assertProjectionVerificationCurrent(stillCurrent);\n if (!reference) return null;\n const resolved = await resolve({\n organizationId: active.organizationId,\n reference,\n preferLocalCurrent: true,\n stillCurrent,\n historyPage:\n input.beforeVersion === undefined\n ? {}\n : { beforeVersion: input.beforeVersion },\n });\n assertProjectionVerificationCurrent(resolved.stillCurrent);\n const page = resolved.historyPage;\n if (!page) throw new Error(\"Verified organization history page is missing\");\n const basic = buildOrganizationGroupPolicyHistoryPage({\n page,\n organizationId: active.organizationId,\n groupId: active.organizationId,\n });\n return loadPolicyHistoryDetails({\n apiClient: runtime.apiClient,\n currentUserId: active.userId,\n domainScope: runtime.state.domainScope,\n execSql: runtime.infra.execSql,\n organizationId: active.organizationId,\n head: reference,\n page,\n history: {\n principalId: active.organizationId,\n principalType: \"organization\",\n organizationId: active.organizationId,\n nextBeforeVersion: page.nextBeforeVersion,\n entries: basic.entries.map((entry) => ({ ...entry, groupChanges: null })),\n },\n resolveHistory,\n stillCurrent,\n online: runtime.state.online,\n olderPage: input.beforeVersion !== undefined,\n logError: runtime.util.logError,\n reportSecurityIncident: runtime.util.reportSecurityIncident,\n });\n}\n"]}
1	+ {"version":3,"file":"organizationHistory.js","sourceRoot":"","sources":["organizationHistory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,oCAAoC,EAAE,MAAM,+BAA+B,CAAC;AACrF,OAAO,EAAE,uCAAuC,EAAE,MAAM,oEAAoE,CAAC;AAC7H,OAAO,EAAE,wBAAwB,EAAE,MAAM,sEAAsE,CAAC;AAChH,OAAO,EAAE,2CAA2C,EAAE,MAAM,kDAAkD,CAAC;AAC/G,OAAO,EAAE,qCAAqC,EAAE,MAAM,4DAA4D,CAAC;AAGnH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAIpD;IACC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IACvC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IAC3B,MAAM,OAAO,GAAG,2CAA2C,CAAC,OAAO,CAAC,CAAC;IACrE,MAAM,cAAc,GAAG,qCAAqC,CAAC,OAAO,CAAC,CAAC;IACtE,IAAI,CAAC,OAAO,IAAI,CAAC,cAAc;QAC7B,MAAM,IAAI,oCAAoC,CAC5C,sDAAsD,CACvD,CAAC;IACJ,MAAM,SAAS,GAAG,MAAM,oCAAoC,CAAC;QAC3D,aAAa,EAAE,MAAM,CAAC,MAAM;QAC5B,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9B,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,WAAW,EAAE,MAAM,CAAC,cAAc;QAClC,aAAa,EAAE,cAAc;KAC9B,CAAC,CAAC;IACH,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC;QAC7B,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,SAAS;QACT,kBAAkB,EAAE,IAAI;QACxB,YAAY;QACZ,WAAW,EACT,KAAK,CAAC,aAAa,KAAK,SAAS;YAC/B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE;KAC7C,CAAC,CAAC;IACH,mCAAmC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,CAAC;IAClC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAG,uCAAuC,CAAC;QACpD,IAAI;QACJ,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,OAAO,EAAE,MAAM,CAAC,cAAc;KAC/B,CAAC,CAAC;IACH,OAAO,wBAAwB,CAAC;QAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,aAAa,EAAE,MAAM,CAAC,MAAM;QAC5B,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,WAAW;QACtC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9B,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,IAAI,EAAE,SAAS;QACf,IAAI;QACJ,OAAO,EAAE;YACP,WAAW,EAAE,MAAM,CAAC,cAAc;YAClC,aAAa,EAAE,cAAc;YAC7B,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;SAC1E;QACD,cAAc;QACd,YAAY;QACZ,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM;QAC5B,SAAS,EAAE,KAAK,CAAC,aAAa,KAAK,SAAS;QAC5C,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ;QAC/B,sBAAsB,EAAE,OAAO,CAAC,IAAI,CAAC,sBAAsB;KAC5D,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { ProjectionDependencyUnavailableError } from \"../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { loadLocalOrganizationPolicyReference } from \"../../workflows/organizations\";\nimport { buildOrganizationGroupPolicyHistoryPage } from \"../../workflows/organizations/policyHistory/groupPolicyHistoryPage\";\nimport { loadPolicyHistoryDetails } from \"../../workflows/organizations/policyHistory/loadPolicyHistoryDetails\";\nimport { createRuntimePrincipalPolicyCurrentResolver } from \"../../workflows/principals/runtimePolicyRecovery\";\nimport { createRuntimeProjectionPolicyResolver } from \"../../workflows/principals/runtimeProjectionPolicyRecovery\";\nimport type { ActiveOrganizationDataRuntime } from \"./organizationWorkflowRuntime\";\n\nexport async function loadBoundedOrganizationHistory(input: {\n readonly active: ActiveOrganizationDataRuntime;\n readonly beforeVersion?: number \| undefined;\n readonly stillCurrent: () => boolean;\n}) {\n const { active, stillCurrent } = input;\n const { runtime } = active;\n const resolve = createRuntimePrincipalPolicyCurrentResolver(runtime);\n const resolveHistory = createRuntimeProjectionPolicyResolver(runtime);\n if (!resolve \|\| !resolveHistory)\n throw new ProjectionDependencyUnavailableError(\n \"Organization history requires private paged recovery\",\n );\n const reference = await loadLocalOrganizationPolicyReference({\n currentUserId: active.userId,\n execSql: runtime.infra.execSql,\n organizationId: active.organizationId,\n principalId: active.organizationId,\n principalType: \"organization\",\n });\n assertProjectionVerificationCurrent(stillCurrent);\n if (!reference) return null;\n const resolved = await resolve({\n organizationId: active.organizationId,\n reference,\n preferLocalCurrent: true,\n stillCurrent,\n historyPage:\n input.beforeVersion === undefined\n ? {}\n : { beforeVersion: input.beforeVersion },\n });\n assertProjectionVerificationCurrent(resolved.stillCurrent);\n const page = resolved.historyPage;\n if (!page) throw new Error(\"Verified organization history page is missing\");\n const basic = buildOrganizationGroupPolicyHistoryPage({\n page,\n organizationId: active.organizationId,\n groupId: active.organizationId,\n });\n return loadPolicyHistoryDetails({\n apiClient: runtime.apiClient,\n currentUserId: active.userId,\n domainScope: runtime.state.domainScope,\n execSql: runtime.infra.execSql,\n organizationId: active.organizationId,\n head: reference,\n page,\n history: {\n principalId: active.organizationId,\n principalType: \"organization\",\n organizationId: active.organizationId,\n nextBeforeVersion: page.nextBeforeVersion,\n entries: basic.entries.map((entry) => ({ ...entry, groupChanges: null })),\n },\n resolveHistory,\n stillCurrent,\n online: runtime.state.online,\n olderPage: input.beforeVersion !== undefined,\n logError: runtime.util.logError,\n reportSecurityIncident: runtime.util.reportSecurityIncident,\n });\n}\n"]}

package/client/organizations/organizationReadModels.js CHANGED Viewed

@@ -1,5 +1,5 @@
 import { loadLocalOrganizationContainerGrants, loadLocalOrganizationDirectoryAndGroups, loadLocalOrganizationGroupContainers, loadLocalOrganizationGroupMembers, loadLocalOrganizationUserDetail, reconcileOrganizationDirectoryAndGroups, } from "../../workflows/organizations/index.js";
-import { organizationAccessScopeKey, wasOrganizationPresentationAccessDeniedByServer, } from "../../workflows/organizations/organizationPresentationAccessState.js";
+import { organizationAccessScopeKey, wasOrganizationPresentationAccessDeniedByServer, } from "../../workflows/organizations/readModel/organizationPresentationAccessState.js";
 import { recoverOrganizationAccess } from "./organizationAccessRestoration.js";
 import { loadBoundedOrganizationGroupHistory } from "./organizationGroupHistory.js";
 import { hydrateOrganizationGroupNamesForRuntime } from "./organizationGroupNameHydration.js";

package/client/organizations/organizationReadModels.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"organizationReadModels.js","sourceRoot":"","sources":["organizationReadModels.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oCAAoC,EACpC,uCAAuC,EACvC,oCAAoC,EACpC,iCAAiC,EACjC,+BAA+B,EAQ/B,uCAAuC,GACxC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,0BAA0B,EAC1B,+CAA+C,GAChD,MAAM,mEAAmE,CAAC;AAE3E,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,mCAAmC,EAAE,MAAM,4BAA4B,CAAC;AACjF,OAAO,EAAE,uCAAuC,EAAE,MAAM,kCAAkC,CAAC;AAC3F,OAAO,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAEL,6BAA6B,EAC7B,gCAAgC,GACjC,MAAM,+BAA+B,CAAC;AAEvC,MAAM,qBAAqB,GAAG,IAAI,OAAO,EAGtC,CAAC;AA8CJ,MAAM,oCAAoC;IAOX;IAJZ,sBAAsB,GAAG,IAAI,OAAO,EAGlD,CAAC;IACJ,YAA6B,cAA+B;QAA/B,mBAAc,GAAd,cAAc,CAAiB;IAAG,CAAC;IAExD,iBAAiB,CAAC,MAAqC;QAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QAC/C,IAAI,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,cAAuB;QACrC,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,uCAAuC,CAAC;YAC7C,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,cAAuB;QAC3C,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,oCAAoC,CAAC;YAC1C,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,OAAe,EAAE,cAAuB;QACrE,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,oCAAoC,CAAC;YAC1C,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,OAAO;YACP,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,OAAe,EAAE,cAAuB;QAClE,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,iCAAiC,CAAC;YACvC,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,OAAO;YACP,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,sBAAsB,CAC1B,OAAe,EACf,cAAuB,EACvB,aAAsB;QAEtB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACrD,OAAO,mCAAmC,CAAC;YACzC,MAAM;YACN,OAAO;YACP,aAAa;YACb,YAAY,EAAE,GAAG,EAAE,CACjB,gCAAgC,CAC9B,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,CACZ;SACJ,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,6BAA6B,CACjC,cAAuB,EACvB,aAAsB;QAEtB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACrD,OAAO,8BAA8B,CAAC;YACpC,MAAM;YACN,aAAa;YACb,YAAY,EAAE,GAAG,EAAE,CACjB,gCAAgC,CAC9B,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,CACZ;SACJ,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,MAAc,EAAE,cAAuB;QAC/D,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,+BAA+B,CAAC;YACrC,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,SAAS,CACP,cAAuB;QAEvB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClC,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,0BAA0B,CACpC,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,MAAM,CACd,CAAC;QACF,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,uEAAuE;QACvE,yEAAyE;QACzE,8DAA8D;QAC9D,0EAA0E;QAC1E,qEAAqE;QACrE,yEAAyE;QACzE,2EAA2E;QAC3E,oEAAoE;QACpE,MAAM,eAAe,GAAG,+CAA+C,CACrE;YACE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,eAAe,EAAE,MAAM,CAAC,MAAM;SAC/B,EACD,WAAW,CACZ,CAAC;QACF,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACrD,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,gCAAgC,CAC9B,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,CACZ,CAAC;QAEJ,MAAM,cAAc,GAAG,uCAAuC,CAAC;YAC7D,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;YACnC,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ;YACtC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC;aACC,IAAI,CAAC,KAAK,EAAE,kBAAkB,EAAE,EAAE;YACjC,IAAI,CAAC,YAAY,EAAE;gBAAE,OAAO,IAAI,CAAC;YACjC,yEAAyE;YACzE,MAAM,iBAAiB,GACrB,eAAe;gBACf,kBAAkB,KAAK,IAAI;gBAC3B,kBAAkB,KAAK,SAAS,CAAC;YACnC,IAAI,iBAAiB;gBACnB,MAAM,yBAAyB,CAAC;oBAC9B,MAAM;oBACN,WAAW;oBACX,YAAY;iBACb,CAAC,CAAC;YACL,IAAI,CAAC,YAAY,EAAE;gBAAE,OAAO,IAAI,CAAC;YACjC,OAAO,uCAAuC,CAC5C,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,EACX,kBAAkB,CACnB,CAAC;QACJ,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,cAAc,EAAE,CAAC;gBACtC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;QACH,CAAC,CAAC,CAAC;QACL,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC/B,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,sBAAsB,CAC1B,cAAuB;QAEvB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,GAAG,CACjD,0BAA0B,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CACjE,CAAC;QACF,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC/C,CAAC;CACF;AAED,MAAM,UAAU,sCAAsC,CACpD,cAA+B;IAE/B,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC3D,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,oCAAoC,CAAC,cAAc,CAAC,CAAC;IAC7E,qBAAqB,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IACvD,OAAO,WAAW,CAAC;AACrB,CAAC","sourcesContent":["import type { DomainScope } from \"../../data/shared/domainScope\";\nimport {\n loadLocalOrganizationContainerGrants,\n loadLocalOrganizationDirectoryAndGroups,\n loadLocalOrganizationGroupContainers,\n loadLocalOrganizationGroupMembers,\n loadLocalOrganizationUserDetail,\n type OrganizationContainerGrants,\n type OrganizationDirectoryAndGroups,\n type OrganizationGroupContainers,\n type OrganizationGroupMembers,\n type OrganizationGroupPolicyHistory,\n type OrganizationPolicyHistory,\n type OrganizationUserDetail,\n reconcileOrganizationDirectoryAndGroups,\n} from \"../../workflows/organizations\";\nimport {\n organizationAccessScopeKey,\n wasOrganizationPresentationAccessDeniedByServer,\n} from \"../../workflows/organizations/organizationPresentationAccessState\";\nimport type { InternalRuntime } from \"../runtime/workflowRuntime\";\nimport { recoverOrganizationAccess } from \"./organizationAccessRestoration\";\nimport { loadBoundedOrganizationGroupHistory } from \"./organizationGroupHistory\";\nimport { hydrateOrganizationGroupNamesForRuntime } from \"./organizationGroupNameHydration\";\nimport { loadBoundedOrganizationHistory } from \"./organizationHistory\";\nimport {\n type ActiveOrganizationDataRuntime,\n activeOrganizationDataRuntime,\n isOrganizationDataRuntimeCurrent,\n} from \"./organizationWorkflowRuntime\";\n\nconst coordinatorsByRuntime = new WeakMap<\n InternalRuntime,\n OrganizationReadModelCoordinator\n>();\n\nexport interface OrganizationReadModelCoordinator {\n loadLocal(\n organizationId?: string \| undefined,\n ): Promise<OrganizationDirectoryAndGroups \| null>;\n loadLocalGroupMembers(\n groupId: string,\n organizationId?: string \| undefined,\n ): Promise<OrganizationGroupMembers \| null>;\n loadGroupPolicyHistory(\n groupId: string,\n organizationId?: string \| undefined,\n beforeVersion?: number \| undefined,\n ): Promise<OrganizationGroupPolicyHistory \| null>;\n loadOrganizationPolicyHistory(\n organizationId?: string \| undefined,\n beforeVersion?: number \| undefined,\n ): Promise<OrganizationPolicyHistory \| null>;\n loadLocalGrants(\n organizationId?: string \| undefined,\n ): Promise<OrganizationContainerGrants \| null>;\n loadLocalGroupContainers(\n groupId: string,\n organizationId?: string \| undefined,\n ): Promise<OrganizationGroupContainers \| null>;\n loadLocalUserDetail(\n userId: string,\n organizationId?: string \| undefined,\n ): Promise<OrganizationUserDetail \| null>;\n /*\n Resolves `undefined` when the runtime declines without I/O (offline,\n * database not ready, organization mismatch) or when the feed failed with\n * no locally retained projection — passes that must not count as caught\n * up; `null` when the reconcile completed but produced nothing presentable\n * — including an authoritative denial that purged the projection, which\n * consumers must repaint.\n */\n reconcile(\n organizationId?: string \| undefined,\n ): Promise<OrganizationDirectoryAndGroups \| null \| undefined>;\n reconcileAfterMutation(\n organizationId?: string \| undefined,\n ): Promise<OrganizationDirectoryAndGroups \| null \| undefined>;\n}\n\nclass OrganizationReadModelCoordinatorImpl\n implements OrganizationReadModelCoordinator\n{\n private readonly reconciliationsByScope = new WeakMap<\n DomainScope,\n Map<string, Promise<OrganizationDirectoryAndGroups \| null \| undefined>>\n >();\n constructor(private readonly runtimeService: InternalRuntime) {}\n\n private reconciliationMap(active: ActiveOrganizationDataRuntime) {\n const scope = active.runtime.state.domainScope;\n let byKey = this.reconciliationsByScope.get(scope);\n if (!byKey) {\n byKey = new Map();\n this.reconciliationsByScope.set(scope, byKey);\n }\n return byKey;\n }\n\n async loadLocal(organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active) {\n return null;\n }\n return loadLocalOrganizationDirectoryAndGroups({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n });\n }\n\n async loadLocalGrants(organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active) {\n return null;\n }\n return loadLocalOrganizationContainerGrants({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n });\n }\n\n async loadLocalGroupContainers(groupId: string, organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active \|\| groupId.length === 0) {\n return null;\n }\n return loadLocalOrganizationGroupContainers({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n groupId,\n organizationId: active.organizationId,\n });\n }\n\n async loadLocalGroupMembers(groupId: string, organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active \|\| groupId.length === 0) {\n return null;\n }\n return loadLocalOrganizationGroupMembers({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n groupId,\n organizationId: active.organizationId,\n });\n }\n\n async loadGroupPolicyHistory(\n groupId: string,\n organizationId?: string,\n beforeVersion?: number,\n ) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active \|\| groupId.length === 0) {\n return null;\n }\n const domainScope = active.runtime.state.domainScope;\n return loadBoundedOrganizationGroupHistory({\n active,\n groupId,\n beforeVersion,\n stillCurrent: () =>\n isOrganizationDataRuntimeCurrent(\n this.runtimeService,\n active,\n domainScope,\n ),\n });\n }\n\n async loadOrganizationPolicyHistory(\n organizationId?: string,\n beforeVersion?: number,\n ) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active) return null;\n const domainScope = active.runtime.state.domainScope;\n return loadBoundedOrganizationHistory({\n active,\n beforeVersion,\n stillCurrent: () =>\n isOrganizationDataRuntimeCurrent(\n this.runtimeService,\n active,\n domainScope,\n ),\n });\n }\n\n async loadLocalUserDetail(userId: string, organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active \|\| userId.length === 0) {\n return null;\n }\n return loadLocalOrganizationUserDetail({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n userId,\n });\n }\n\n reconcile(\n organizationId?: string,\n ): Promise<OrganizationDirectoryAndGroups \| null \| undefined> {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active?.runtime.state.online) {\n return Promise.resolve(undefined);\n }\n\n const byKey = this.reconciliationMap(active);\n const key = organizationAccessScopeKey(\n active.organizationId,\n active.userId,\n );\n const existing = byKey.get(key);\n if (existing) {\n return existing;\n }\n\n // Snapshot the server-denied flag before reconciling. A reconcile that\n // flips it back to readable means org access was just restored (e.g. the\n // user was re-added to a group), and any write lanes idled by\n // permission-denied submissions have no self re-arm — regaining access is\n // their retry signal, mirroring how billing recovery re-requests all\n // lanes. Only a genuine server denial counts: a local session reset also\n // marks scopes denied, and re-arming on its first reconcile would race the\n // startup sync passes (e.g. pending-create adoption between panes).\n const accessWasDenied = wasOrganizationPresentationAccessDeniedByServer(\n {\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n requesterUserId: active.userId,\n },\n \"readModel\",\n );\n const domainScope = active.runtime.state.domainScope;\n const stillCurrent = () =>\n isOrganizationDataRuntimeCurrent(\n this.runtimeService,\n active,\n domainScope,\n );\n\n const reconciliation = reconcileOrganizationDirectoryAndGroups({\n apiClient: active.runtime.apiClient,\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n logError: active.runtime.util.logError,\n organizationId: active.organizationId,\n })\n .then(async (directoryAndGroups) => {\n if (!stillCurrent()) return null;\n // Feed success restores retry eligibility even if name decryption fails.\n const accessWasRestored =\n accessWasDenied &&\n directoryAndGroups !== null &&\n directoryAndGroups !== undefined;\n if (accessWasRestored)\n await recoverOrganizationAccess({\n active,\n domainScope,\n stillCurrent,\n });\n if (!stillCurrent()) return null;\n return hydrateOrganizationGroupNamesForRuntime(\n this.runtimeService,\n active,\n domainScope,\n directoryAndGroups,\n );\n })\n .finally(() => {\n if (byKey.get(key) === reconciliation) {\n byKey.delete(key);\n }\n });\n byKey.set(key, reconciliation);\n return reconciliation;\n }\n\n async reconcileAfterMutation(\n organizationId?: string,\n ): Promise<OrganizationDirectoryAndGroups \| null \| undefined> {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active?.runtime.state.online) {\n return undefined;\n }\n const existing = this.reconciliationMap(active).get(\n organizationAccessScopeKey(active.organizationId, active.userId),\n );\n if (existing) {\n await existing.catch(() => null);\n }\n return this.reconcile(active.organizationId);\n }\n}\n\nexport function createOrganizationReadModelCoordinator(\n runtimeService: InternalRuntime,\n): OrganizationReadModelCoordinator {\n const existing = coordinatorsByRuntime.get(runtimeService);\n if (existing) {\n return existing;\n }\n\n const coordinator = new OrganizationReadModelCoordinatorImpl(runtimeService);\n coordinatorsByRuntime.set(runtimeService, coordinator);\n return coordinator;\n}\n"]}
1	+ {"version":3,"file":"organizationReadModels.js","sourceRoot":"","sources":["organizationReadModels.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oCAAoC,EACpC,uCAAuC,EACvC,oCAAoC,EACpC,iCAAiC,EACjC,+BAA+B,EAQ/B,uCAAuC,GACxC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,0BAA0B,EAC1B,+CAA+C,GAChD,MAAM,6EAA6E,CAAC;AAErF,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,mCAAmC,EAAE,MAAM,4BAA4B,CAAC;AACjF,OAAO,EAAE,uCAAuC,EAAE,MAAM,kCAAkC,CAAC;AAC3F,OAAO,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAEL,6BAA6B,EAC7B,gCAAgC,GACjC,MAAM,+BAA+B,CAAC;AAEvC,MAAM,qBAAqB,GAAG,IAAI,OAAO,EAGtC,CAAC;AA8CJ,MAAM,oCAAoC;IAOX;IAJZ,sBAAsB,GAAG,IAAI,OAAO,EAGlD,CAAC;IACJ,YAA6B,cAA+B;QAA/B,mBAAc,GAAd,cAAc,CAAiB;IAAG,CAAC;IAExD,iBAAiB,CAAC,MAAqC;QAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QAC/C,IAAI,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,cAAuB;QACrC,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,uCAAuC,CAAC;YAC7C,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,cAAuB;QAC3C,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,oCAAoC,CAAC;YAC1C,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,OAAe,EAAE,cAAuB;QACrE,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,oCAAoC,CAAC;YAC1C,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,OAAO;YACP,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,OAAe,EAAE,cAAuB;QAClE,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,iCAAiC,CAAC;YACvC,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,OAAO;YACP,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,sBAAsB,CAC1B,OAAe,EACf,cAAuB,EACvB,aAAsB;QAEtB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACrD,OAAO,mCAAmC,CAAC;YACzC,MAAM;YACN,OAAO;YACP,aAAa;YACb,YAAY,EAAE,GAAG,EAAE,CACjB,gCAAgC,CAC9B,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,CACZ;SACJ,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,6BAA6B,CACjC,cAAuB,EACvB,aAAsB;QAEtB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACrD,OAAO,8BAA8B,CAAC;YACpC,MAAM;YACN,aAAa;YACb,YAAY,EAAE,GAAG,EAAE,CACjB,gCAAgC,CAC9B,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,CACZ;SACJ,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,MAAc,EAAE,cAAuB;QAC/D,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,+BAA+B,CAAC;YACrC,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,SAAS,CACP,cAAuB;QAEvB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClC,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,0BAA0B,CACpC,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,MAAM,CACd,CAAC;QACF,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,uEAAuE;QACvE,yEAAyE;QACzE,8DAA8D;QAC9D,0EAA0E;QAC1E,qEAAqE;QACrE,yEAAyE;QACzE,2EAA2E;QAC3E,oEAAoE;QACpE,MAAM,eAAe,GAAG,+CAA+C,CACrE;YACE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,eAAe,EAAE,MAAM,CAAC,MAAM;SAC/B,EACD,WAAW,CACZ,CAAC;QACF,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACrD,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,gCAAgC,CAC9B,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,CACZ,CAAC;QAEJ,MAAM,cAAc,GAAG,uCAAuC,CAAC;YAC7D,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;YACnC,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ;YACtC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC;aACC,IAAI,CAAC,KAAK,EAAE,kBAAkB,EAAE,EAAE;YACjC,IAAI,CAAC,YAAY,EAAE;gBAAE,OAAO,IAAI,CAAC;YACjC,yEAAyE;YACzE,MAAM,iBAAiB,GACrB,eAAe;gBACf,kBAAkB,KAAK,IAAI;gBAC3B,kBAAkB,KAAK,SAAS,CAAC;YACnC,IAAI,iBAAiB;gBACnB,MAAM,yBAAyB,CAAC;oBAC9B,MAAM;oBACN,WAAW;oBACX,YAAY;iBACb,CAAC,CAAC;YACL,IAAI,CAAC,YAAY,EAAE;gBAAE,OAAO,IAAI,CAAC;YACjC,OAAO,uCAAuC,CAC5C,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,EACX,kBAAkB,CACnB,CAAC;QACJ,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,cAAc,EAAE,CAAC;gBACtC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;QACH,CAAC,CAAC,CAAC;QACL,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC/B,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,sBAAsB,CAC1B,cAAuB;QAEvB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,GAAG,CACjD,0BAA0B,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CACjE,CAAC;QACF,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC/C,CAAC;CACF;AAED,MAAM,UAAU,sCAAsC,CACpD,cAA+B;IAE/B,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC3D,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,oCAAoC,CAAC,cAAc,CAAC,CAAC;IAC7E,qBAAqB,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IACvD,OAAO,WAAW,CAAC;AACrB,CAAC","sourcesContent":["import type { DomainScope } from \"../../data/shared/domainScope\";\nimport {\n loadLocalOrganizationContainerGrants,\n loadLocalOrganizationDirectoryAndGroups,\n loadLocalOrganizationGroupContainers,\n loadLocalOrganizationGroupMembers,\n loadLocalOrganizationUserDetail,\n type OrganizationContainerGrants,\n type OrganizationDirectoryAndGroups,\n type OrganizationGroupContainers,\n type OrganizationGroupMembers,\n type OrganizationGroupPolicyHistory,\n type OrganizationPolicyHistory,\n type OrganizationUserDetail,\n reconcileOrganizationDirectoryAndGroups,\n} from \"../../workflows/organizations\";\nimport {\n organizationAccessScopeKey,\n wasOrganizationPresentationAccessDeniedByServer,\n} from \"../../workflows/organizations/readModel/organizationPresentationAccessState\";\nimport type { InternalRuntime } from \"../runtime/workflowRuntime\";\nimport { recoverOrganizationAccess } from \"./organizationAccessRestoration\";\nimport { loadBoundedOrganizationGroupHistory } from \"./organizationGroupHistory\";\nimport { hydrateOrganizationGroupNamesForRuntime } from \"./organizationGroupNameHydration\";\nimport { loadBoundedOrganizationHistory } from \"./organizationHistory\";\nimport {\n type ActiveOrganizationDataRuntime,\n activeOrganizationDataRuntime,\n isOrganizationDataRuntimeCurrent,\n} from \"./organizationWorkflowRuntime\";\n\nconst coordinatorsByRuntime = new WeakMap<\n InternalRuntime,\n OrganizationReadModelCoordinator\n>();\n\nexport interface OrganizationReadModelCoordinator {\n loadLocal(\n organizationId?: string \| undefined,\n ): Promise<OrganizationDirectoryAndGroups \| null>;\n loadLocalGroupMembers(\n groupId: string,\n organizationId?: string \| undefined,\n ): Promise<OrganizationGroupMembers \| null>;\n loadGroupPolicyHistory(\n groupId: string,\n organizationId?: string \| undefined,\n beforeVersion?: number \| undefined,\n ): Promise<OrganizationGroupPolicyHistory \| null>;\n loadOrganizationPolicyHistory(\n organizationId?: string \| undefined,\n beforeVersion?: number \| undefined,\n ): Promise<OrganizationPolicyHistory \| null>;\n loadLocalGrants(\n organizationId?: string \| undefined,\n ): Promise<OrganizationContainerGrants \| null>;\n loadLocalGroupContainers(\n groupId: string,\n organizationId?: string \| undefined,\n ): Promise<OrganizationGroupContainers \| null>;\n loadLocalUserDetail(\n userId: string,\n organizationId?: string \| undefined,\n ): Promise<OrganizationUserDetail \| null>;\n /*\n Resolves `undefined` when the runtime declines without I/O (offline,\n * database not ready, organization mismatch) or when the feed failed with\n * no locally retained projection — passes that must not count as caught\n * up; `null` when the reconcile completed but produced nothing presentable\n * — including an authoritative denial that purged the projection, which\n * consumers must repaint.\n */\n reconcile(\n organizationId?: string \| undefined,\n ): Promise<OrganizationDirectoryAndGroups \| null \| undefined>;\n reconcileAfterMutation(\n organizationId?: string \| undefined,\n ): Promise<OrganizationDirectoryAndGroups \| null \| undefined>;\n}\n\nclass OrganizationReadModelCoordinatorImpl\n implements OrganizationReadModelCoordinator\n{\n private readonly reconciliationsByScope = new WeakMap<\n DomainScope,\n Map<string, Promise<OrganizationDirectoryAndGroups \| null \| undefined>>\n >();\n constructor(private readonly runtimeService: InternalRuntime) {}\n\n private reconciliationMap(active: ActiveOrganizationDataRuntime) {\n const scope = active.runtime.state.domainScope;\n let byKey = this.reconciliationsByScope.get(scope);\n if (!byKey) {\n byKey = new Map();\n this.reconciliationsByScope.set(scope, byKey);\n }\n return byKey;\n }\n\n async loadLocal(organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active) {\n return null;\n }\n return loadLocalOrganizationDirectoryAndGroups({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n });\n }\n\n async loadLocalGrants(organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active) {\n return null;\n }\n return loadLocalOrganizationContainerGrants({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n });\n }\n\n async loadLocalGroupContainers(groupId: string, organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active \|\| groupId.length === 0) {\n return null;\n }\n return loadLocalOrganizationGroupContainers({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n groupId,\n organizationId: active.organizationId,\n });\n }\n\n async loadLocalGroupMembers(groupId: string, organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active \|\| groupId.length === 0) {\n return null;\n }\n return loadLocalOrganizationGroupMembers({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n groupId,\n organizationId: active.organizationId,\n });\n }\n\n async loadGroupPolicyHistory(\n groupId: string,\n organizationId?: string,\n beforeVersion?: number,\n ) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active \|\| groupId.length === 0) {\n return null;\n }\n const domainScope = active.runtime.state.domainScope;\n return loadBoundedOrganizationGroupHistory({\n active,\n groupId,\n beforeVersion,\n stillCurrent: () =>\n isOrganizationDataRuntimeCurrent(\n this.runtimeService,\n active,\n domainScope,\n ),\n });\n }\n\n async loadOrganizationPolicyHistory(\n organizationId?: string,\n beforeVersion?: number,\n ) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active) return null;\n const domainScope = active.runtime.state.domainScope;\n return loadBoundedOrganizationHistory({\n active,\n beforeVersion,\n stillCurrent: () =>\n isOrganizationDataRuntimeCurrent(\n this.runtimeService,\n active,\n domainScope,\n ),\n });\n }\n\n async loadLocalUserDetail(userId: string, organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active \|\| userId.length === 0) {\n return null;\n }\n return loadLocalOrganizationUserDetail({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n userId,\n });\n }\n\n reconcile(\n organizationId?: string,\n ): Promise<OrganizationDirectoryAndGroups \| null \| undefined> {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active?.runtime.state.online) {\n return Promise.resolve(undefined);\n }\n\n const byKey = this.reconciliationMap(active);\n const key = organizationAccessScopeKey(\n active.organizationId,\n active.userId,\n );\n const existing = byKey.get(key);\n if (existing) {\n return existing;\n }\n\n // Snapshot the server-denied flag before reconciling. A reconcile that\n // flips it back to readable means org access was just restored (e.g. the\n // user was re-added to a group), and any write lanes idled by\n // permission-denied submissions have no self re-arm — regaining access is\n // their retry signal, mirroring how billing recovery re-requests all\n // lanes. Only a genuine server denial counts: a local session reset also\n // marks scopes denied, and re-arming on its first reconcile would race the\n // startup sync passes (e.g. pending-create adoption between panes).\n const accessWasDenied = wasOrganizationPresentationAccessDeniedByServer(\n {\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n requesterUserId: active.userId,\n },\n \"readModel\",\n );\n const domainScope = active.runtime.state.domainScope;\n const stillCurrent = () =>\n isOrganizationDataRuntimeCurrent(\n this.runtimeService,\n active,\n domainScope,\n );\n\n const reconciliation = reconcileOrganizationDirectoryAndGroups({\n apiClient: active.runtime.apiClient,\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n logError: active.runtime.util.logError,\n organizationId: active.organizationId,\n })\n .then(async (directoryAndGroups) => {\n if (!stillCurrent()) return null;\n // Feed success restores retry eligibility even if name decryption fails.\n const accessWasRestored =\n accessWasDenied &&\n directoryAndGroups !== null &&\n directoryAndGroups !== undefined;\n if (accessWasRestored)\n await recoverOrganizationAccess({\n active,\n domainScope,\n stillCurrent,\n });\n if (!stillCurrent()) return null;\n return hydrateOrganizationGroupNamesForRuntime(\n this.runtimeService,\n active,\n domainScope,\n directoryAndGroups,\n );\n })\n .finally(() => {\n if (byKey.get(key) === reconciliation) {\n byKey.delete(key);\n }\n });\n byKey.set(key, reconciliation);\n return reconciliation;\n }\n\n async reconcileAfterMutation(\n organizationId?: string,\n ): Promise<OrganizationDirectoryAndGroups \| null \| undefined> {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active?.runtime.state.online) {\n return undefined;\n }\n const existing = this.reconciliationMap(active).get(\n organizationAccessScopeKey(active.organizationId, active.userId),\n );\n if (existing) {\n await existing.catch(() => null);\n }\n return this.reconcile(active.organizationId);\n }\n}\n\nexport function createOrganizationReadModelCoordinator(\n runtimeService: InternalRuntime,\n): OrganizationReadModelCoordinator {\n const existing = coordinatorsByRuntime.get(runtimeService);\n if (existing) {\n return existing;\n }\n\n const coordinator = new OrganizationReadModelCoordinatorImpl(runtimeService);\n coordinatorsByRuntime.set(runtimeService, coordinator);\n return coordinator;\n}\n"]}

package/client/organizations/principalContainerMutations.js CHANGED Viewed

@@ -1,5 +1,5 @@
 import { resolveDocumentCreateAuthor } from "../../workflows/documents/index.js";
-import { preparePrincipalContainerRematerializationBatch, } from "../../workflows/organizations/principalContainerRematerialization.js";
+import { preparePrincipalContainerRematerializationBatch, } from "../../workflows/organizations/rematerialization/principalContainerRematerialization.js";
 import { createRuntimePrincipalPolicyWarmer } from "../../workflows/principals/runtimePolicyWarmer.js";
 export async function preparePrincipalContainerMutations(input) {
     const author = resolveDocumentCreateAuthor(input.runtime);

package/client/organizations/principalContainerMutations.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"principalContainerMutations.js","sourceRoot":"","sources":["principalContainerMutations.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAEL,+CAA+C,GAChD,MAAM,~~mEAAmE~~,CAAC;~~AAE3E~~,OAAO,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAGpG,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAaxD;IACC,MAAM,MAAM,GAAG,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,SAAS,CAAC;IAC7E,IAAI,CAAC,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,+CAA+C,CAAC;QACrD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;QACjE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;QAClC,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QACpC,MAAM,EAAE;YACN,GAAG,IAAI,GAAG,CACR,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,aAAa,EAAE,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CACpE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAU,CAC/C,CACF,CAAC,MAAM,EAAE;SACX;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;QACtE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;QACpE,eAAe;QACf,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport type { CurrentPolicyReferenceResolver } from \"../../data/principals/currentPolicyReferenceResolver\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../data/principals/principalPolicyEvidence\";\nimport { resolveDocumentCreateAuthor } from \"../../workflows/documents\";\nimport {\n type PreparedPrincipalContainerRematerializationBatch,\n preparePrincipalContainerRematerializationBatch,\n} from \"../../workflows/organizations/principalContainerRematerialization\";\nimport type { PrincipalRematerializationPredecessor } from \"../../workflows/organizations/principalContainerRematerializationPlanning\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../workflows/principals/runtimePolicyWarmer\";\nimport type { InternalWorkflowRuntimeInput } from \"../runtime/workflowRuntime\";\n\nexport async function preparePrincipalContainerMutations(input: {\n readonly preceding?: PrincipalRematerializationPredecessor \| undefined;\n readonly currentPolicy: Pick<PrincipalPolicyBundleResponse, \"currentGrants\">;\n readonly groupId: string;\n readonly nextPolicy: PrincipalPolicyCurrentEvidence;\n readonly resolveAuthoredPolicyReferences?:\n \| CurrentPolicyReferenceResolver\n \| undefined;\n readonly organizationId: string;\n readonly revokedContainerId?: string \| undefined;\n readonly runtime: InternalWorkflowRuntimeInput;\n readonly stillCurrent: () => boolean;\n readonly recitationStillCurrent?: (() => boolean) \| undefined;\n}): Promise<PreparedPrincipalContainerRematerializationBatch> {\n const author = resolveDocumentCreateAuthor(input.runtime);\n const targetSecretKey = input.runtime.crypto.encapsulationKeyPair?.secretKey;\n if (!author \|\| !targetSecretKey) {\n throw new Error(\n \"Organization container rematerialization context is unavailable\",\n );\n }\n return preparePrincipalContainerRematerializationBatch({\n preceding: input.preceding,\n stillCurrent: input.stillCurrent,\n recitationStillCurrent: input.recitationStillCurrent,\n reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n apiClient: input.runtime.apiClient,\n author,\n execSql: input.runtime.infra.execSql,\n grants: [\n ...new Map(\n [...input.currentPolicy.currentGrants, ...input.nextPolicy.grants].map(\n (grant) => [grant.containerId, grant] as const,\n ),\n ).values(),\n ],\n groupId: input.groupId,\n nextPolicy: input.nextPolicy,\n resolveAuthoredPolicyReferences: input.resolveAuthoredPolicyReferences,\n revokedContainerId: input.revokedContainerId,\n resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n targetSecretKey,\n warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n input.runtime,\n ),\n });\n}\n"]}
1	+ {"version":3,"file":"principalContainerMutations.js","sourceRoot":"","sources":["principalContainerMutations.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAEL,+CAA+C,GAChD,MAAM,qFAAqF,CAAC;AAE7F,OAAO,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAGpG,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAaxD;IACC,MAAM,MAAM,GAAG,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,SAAS,CAAC;IAC7E,IAAI,CAAC,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,+CAA+C,CAAC;QACrD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;QACjE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;QAClC,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QACpC,MAAM,EAAE;YACN,GAAG,IAAI,GAAG,CACR,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,aAAa,EAAE,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CACpE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAU,CAC/C,CACF,CAAC,MAAM,EAAE;SACX;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;QACtE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;QACpE,eAAe;QACf,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport type { CurrentPolicyReferenceResolver } from \"../../data/principals/currentPolicyReferenceResolver\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../data/principals/principalPolicyEvidence\";\nimport { resolveDocumentCreateAuthor } from \"../../workflows/documents\";\nimport {\n type PreparedPrincipalContainerRematerializationBatch,\n preparePrincipalContainerRematerializationBatch,\n} from \"../../workflows/organizations/rematerialization/principalContainerRematerialization\";\nimport type { PrincipalRematerializationPredecessor } from \"../../workflows/organizations/rematerialization/principalContainerRematerializationPlanning\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../workflows/principals/runtimePolicyWarmer\";\nimport type { InternalWorkflowRuntimeInput } from \"../runtime/workflowRuntime\";\n\nexport async function preparePrincipalContainerMutations(input: {\n readonly preceding?: PrincipalRematerializationPredecessor \| undefined;\n readonly currentPolicy: Pick<PrincipalPolicyBundleResponse, \"currentGrants\">;\n readonly groupId: string;\n readonly nextPolicy: PrincipalPolicyCurrentEvidence;\n readonly resolveAuthoredPolicyReferences?:\n \| CurrentPolicyReferenceResolver\n \| undefined;\n readonly organizationId: string;\n readonly revokedContainerId?: string \| undefined;\n readonly runtime: InternalWorkflowRuntimeInput;\n readonly stillCurrent: () => boolean;\n readonly recitationStillCurrent?: (() => boolean) \| undefined;\n}): Promise<PreparedPrincipalContainerRematerializationBatch> {\n const author = resolveDocumentCreateAuthor(input.runtime);\n const targetSecretKey = input.runtime.crypto.encapsulationKeyPair?.secretKey;\n if (!author \|\| !targetSecretKey) {\n throw new Error(\n \"Organization container rematerialization context is unavailable\",\n );\n }\n return preparePrincipalContainerRematerializationBatch({\n preceding: input.preceding,\n stillCurrent: input.stillCurrent,\n recitationStillCurrent: input.recitationStillCurrent,\n reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n apiClient: input.runtime.apiClient,\n author,\n execSql: input.runtime.infra.execSql,\n grants: [\n ...new Map(\n [...input.currentPolicy.currentGrants, ...input.nextPolicy.grants].map(\n (grant) => [grant.containerId, grant] as const,\n ),\n ).values(),\n ],\n groupId: input.groupId,\n nextPolicy: input.nextPolicy,\n resolveAuthoredPolicyReferences: input.resolveAuthoredPolicyReferences,\n revokedContainerId: input.revokedContainerId,\n resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n targetSecretKey,\n warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n input.runtime,\n ),\n });\n}\n"]}

package/client/organizations/principalMutationRecovery.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"principalMutationRecovery.js","sourceRoot":"","sources":["principalMutationRecovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AAIpG,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AAcvE,KAAK,UAAU,WAAW,CACxB,OAAwB,EACxB,cAAsB,EACtB,GAAsD;IAEtD,MAAM,MAAM,GAAG,2BAA2B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1D,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC;IACzC,mCAAmC,CACjC,GAAG,EAAE,CAAC,YAAY,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC,cAAc,KAAK,cAAc,CACvE,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5C,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,2CAA2C,CACzD,OAAwB,EACxB,KAAuD;IAEvD,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE,CACxD,GAAG,CAAC,kCAAkC,CACpC,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,yBAAyB,CAChC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qCAAqC,CACnD,OAAwB,EACxB,cAAsB;IAEtB,OAAO,WAAW,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE,CAClD,GAAG,CAAC,4BAA4B,CAAC,cAAc,CAAC,CACjD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sCAAsC,CACpD,OAAwB,EACxB,cAAsB;IAEtB,OAAO,WAAW,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE,CAClD,GAAG,CAAC,+BAA+B,CAAC,cAAc,CAAC,CACpD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wCAAwC,CACtD,OAAwB,EACxB,KAA6C;IAE7C,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE,CACxD,GAAG,CAAC,+BAA+B,CACjC,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,yBAAyB,CAChC,CACF,CAAC;AACJ,CAAC","sourcesContent":["import { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport type { AuthoredPrincipalMutation } from \"../../data/principals/principalMutationJournal\";\nimport type { PrincipalMutationRecoveryApi } from \"../../workflows/organizations/principalMutationJournalManagement\";\nimport type { InternalRuntime } from \"../runtime/workflowRuntime\";\nimport { currentOrganizationMutation } from \"./principalMutationScope\";\n\nexport interface AbandonOrganizationPolicyMutationInput {\n readonly organizationId: string;\n readonly mutation: AuthoredPrincipalMutation;\n readonly acknowledgeUnknownOutcome: true;\n}\n\nexport interface DiscardUnreadableOrganizationPolicyMutationInput {\n readonly organizationId: string;\n readonly recordId: string;\n readonly acknowledgeUnknownOutcome: true;\n}\n\nasync function runRecovery<T>(\n service: InternalRuntime,\n organizationId: string,\n run: (api: PrincipalMutationRecoveryApi) => Promise<T>,\n): Promise<T> {\n const active = currentOrganizationMutation(service, true);\n const { runtime, stillCurrent } = active;\n assertProjectionVerificationCurrent(\n () => stillCurrent() && runtime.auth.organizationId === organizationId,\n );\n const result = await run(runtime.apiClient);\n assertProjectionVerificationCurrent(stillCurrent);\n return result;\n}\n\nexport function discardUnreadableOrganizationPolicyMutation(\n service: InternalRuntime,\n input: DiscardUnreadableOrganizationPolicyMutationInput,\n) {\n return runRecovery(service, input.organizationId, (api) =>\n api.discardUnreadablePrincipalMutation(\n input.organizationId,\n input.recordId,\n input.acknowledgeUnknownOutcome,\n ),\n );\n}\n\nexport function readPendingOrganizationPolicyMutation(\n service: InternalRuntime,\n organizationId: string,\n) {\n return runRecovery(service, organizationId, (api) =>\n api.readPendingPrincipalMutation(organizationId),\n );\n}\n\nexport function retryPendingOrganizationPolicyMutation(\n service: InternalRuntime,\n organizationId: string,\n) {\n return runRecovery(service, organizationId, (api) =>\n api.recoverPendingPrincipalMutation(organizationId),\n );\n}\n\nexport function abandonPendingOrganizationPolicyMutation(\n service: InternalRuntime,\n input: AbandonOrganizationPolicyMutationInput,\n) {\n return runRecovery(service, input.organizationId, (api) =>\n api.abandonPendingPrincipalMutation(\n input.organizationId,\n input.mutation,\n input.acknowledgeUnknownOutcome,\n ),\n );\n}\n"]}
1	+ {"version":3,"file":"principalMutationRecovery.js","sourceRoot":"","sources":["principalMutationRecovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AAIpG,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AAcvE,KAAK,UAAU,WAAW,CACxB,OAAwB,EACxB,cAAsB,EACtB,GAAsD;IAEtD,MAAM,MAAM,GAAG,2BAA2B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1D,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC;IACzC,mCAAmC,CACjC,GAAG,EAAE,CAAC,YAAY,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC,cAAc,KAAK,cAAc,CACvE,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5C,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,2CAA2C,CACzD,OAAwB,EACxB,KAAuD;IAEvD,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE,CACxD,GAAG,CAAC,kCAAkC,CACpC,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,yBAAyB,CAChC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qCAAqC,CACnD,OAAwB,EACxB,cAAsB;IAEtB,OAAO,WAAW,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE,CAClD,GAAG,CAAC,4BAA4B,CAAC,cAAc,CAAC,CACjD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sCAAsC,CACpD,OAAwB,EACxB,cAAsB;IAEtB,OAAO,WAAW,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE,CAClD,GAAG,CAAC,+BAA+B,CAAC,cAAc,CAAC,CACpD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wCAAwC,CACtD,OAAwB,EACxB,KAA6C;IAE7C,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE,CACxD,GAAG,CAAC,+BAA+B,CACjC,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,yBAAyB,CAChC,CACF,CAAC;AACJ,CAAC","sourcesContent":["import { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport type { AuthoredPrincipalMutation } from \"../../data/principals/principalMutationJournal\";\nimport type { PrincipalMutationRecoveryApi } from \"../../workflows/organizations/principalMutations/principalMutationJournalManagement\";\nimport type { InternalRuntime } from \"../runtime/workflowRuntime\";\nimport { currentOrganizationMutation } from \"./principalMutationScope\";\n\nexport interface AbandonOrganizationPolicyMutationInput {\n readonly organizationId: string;\n readonly mutation: AuthoredPrincipalMutation;\n readonly acknowledgeUnknownOutcome: true;\n}\n\nexport interface DiscardUnreadableOrganizationPolicyMutationInput {\n readonly organizationId: string;\n readonly recordId: string;\n readonly acknowledgeUnknownOutcome: true;\n}\n\nasync function runRecovery<T>(\n service: InternalRuntime,\n organizationId: string,\n run: (api: PrincipalMutationRecoveryApi) => Promise<T>,\n): Promise<T> {\n const active = currentOrganizationMutation(service, true);\n const { runtime, stillCurrent } = active;\n assertProjectionVerificationCurrent(\n () => stillCurrent() && runtime.auth.organizationId === organizationId,\n );\n const result = await run(runtime.apiClient);\n assertProjectionVerificationCurrent(stillCurrent);\n return result;\n}\n\nexport function discardUnreadableOrganizationPolicyMutation(\n service: InternalRuntime,\n input: DiscardUnreadableOrganizationPolicyMutationInput,\n) {\n return runRecovery(service, input.organizationId, (api) =>\n api.discardUnreadablePrincipalMutation(\n input.organizationId,\n input.recordId,\n input.acknowledgeUnknownOutcome,\n ),\n );\n}\n\nexport function readPendingOrganizationPolicyMutation(\n service: InternalRuntime,\n organizationId: string,\n) {\n return runRecovery(service, organizationId, (api) =>\n api.readPendingPrincipalMutation(organizationId),\n );\n}\n\nexport function retryPendingOrganizationPolicyMutation(\n service: InternalRuntime,\n organizationId: string,\n) {\n return runRecovery(service, organizationId, (api) =>\n api.recoverPendingPrincipalMutation(organizationId),\n );\n}\n\nexport function abandonPendingOrganizationPolicyMutation(\n service: InternalRuntime,\n input: AbandonOrganizationPolicyMutationInput,\n) {\n return runRecovery(service, input.organizationId, (api) =>\n api.abandonPendingPrincipalMutation(\n input.organizationId,\n input.mutation,\n input.acknowledgeUnknownOutcome,\n ),\n );\n}\n"]}

package/client/organizations/principalMutations.js CHANGED Viewed

@@ -1,11 +1,11 @@
 import { ProjectionDependencyUnavailableError } from "../../data/keyingProjectionVerification/dependencyUnavailable.js";
 import { runWithSecurityIncidentReporting } from "../../data/keyingProjectionVerification/error.js";
 import { revokeOrganizationContainerGrant } from "../../workflows/organizations/index.js";
-import { createCurrentOrganizationGroup } from "../../workflows/organizations/createCurrentOrganizationGroup.js";
-import { createSelectedCurrentGroupMetadataContainerVerifier } from "../../workflows/organizations/currentGroupMetadataAuthority.js";
-import { deleteCurrentOrganizationGroup } from "../../workflows/organizations/deleteCurrentOrganizationGroup.js";
-import { createRuntimeGroupMetadataAccess } from "../../workflows/organizations/groupMetadataRuntime.js";
-import { createRuntimeCurrentOrganizationMutation } from "../../workflows/organizations/runtimeCurrentOrganizationMutation.js";
+import { createSelectedCurrentGroupMetadataContainerVerifier } from "../../workflows/organizations/groupMetadata/currentGroupMetadataAuthority.js";
+import { createRuntimeGroupMetadataAccess } from "../../workflows/organizations/groupMetadata/groupMetadataRuntime.js";
+import { createCurrentOrganizationGroup } from "../../workflows/organizations/groups/createCurrentOrganizationGroup.js";
+import { deleteCurrentOrganizationGroup } from "../../workflows/organizations/groups/deleteCurrentOrganizationGroup.js";
+import { createRuntimeCurrentOrganizationMutation } from "../../workflows/organizations/principalMutations/runtimeCurrentOrganizationMutation.js";
 import { createRuntimePrincipalPolicyWarmer } from "../../workflows/principals/runtimePolicyWarmer.js";
 import { createCurrentPrincipalMutation } from "./currentPrincipalMutations.js";
 import { syncOrganizationMetadataProfile } from "./organizationMetadataProfileSync.js";

package/client/organizations/principalMutations.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"principalMutations.js","sourceRoot":"","sources":["principalMutations.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EAAE,gCAAgC,EAAE,MAAM,+CAA+C,CAAC;AACjG,OAAO,EAAE,gCAAgC,EAAE,MAAM,+BAA+B,CAAC;AACjF,OAAO,EAAE,8BAA8B,EAAE,MAAM,8DAA8D,CAAC;AAC9G,OAAO,EAAE,mDAAmD,EAAE,MAAM,6DAA6D,CAAC;AAClI,OAAO,EAAE,8BAA8B,EAAE,MAAM,8DAA8D,CAAC;AAC9G,OAAO,EAAE,gCAAgC,EAAE,MAAM,oDAAoD,CAAC;AACtG,OAAO,EAAE,wCAAwC,EAAE,MAAM,kEAAkE,CAAC;AAC5H,OAAO,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAGpG,OAAO,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAC7E,OAAO,EAAE,+BAA+B,EAAE,MAAM,mCAAmC,CAAC;AAiCpF,SAAS,qBAAqB,CAC5B,OAAqC;IAErC,IACE,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc;QAC5B,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM;QACpB,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB;QAClC,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,EAC9B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IAED,OAAO;QACL,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;QAC3C,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;QACjC,kBAAkB,EAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB;QACrD,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc;KAC9C,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAClC,OAAqC;IAErC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC;AAC7C,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAA+D;IAE/D,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,kBAAkB;QAC7B,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,KAAK,IAAI,EAAE;QACT,MAAM,aAAa,GAAG,8BAA8B,CAAC;YACnD,GAAG,cAAc;YACjB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;QACH,IAAI,CAAC,aAAa;YAChB,MAAM,IAAI,oCAAoC,CAC5C,2CAA2C,CAC5C,CAAC;QACJ,MAAM,EACJ,aAAa,EACb,QAAQ,EAAE,MAAM,EAChB,QAAQ,GACT,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE;YACrC,IAAI,EAAE,KAAK;YACX,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,OAAO,KAAK,aAAa,IAAI,QAAQ,EAAE,CAAC;YAChD,MAAM,+BAA+B,CAAC;gBACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG;gBAC3B,cAAc,EAAE,cAAc,CAAC,cAAc;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,CAAC,oBAAoB,CAAC,sBAAsB,CACrD,cAAc,CAAC,cAAc,CAC9B,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAI1C;IACC,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,cAAc,CAAC,cAAc;QACvC,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,cAAc;QACzB,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,GAAG,EAAE;QACH,MAAM,2BAA2B,GAAG,2BAA2B,CAC7D,KAAK,CAAC,OAAO,CACd,CAAC;QACF,MAAM,MAAM,GAAG,wCAAwC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,oCAAoC,CAC5C,2CAA2C,CAC5C,CAAC;QACJ,OAAO,MAAM,CACX,EAAE,GAAG,cAAc,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,EACvD,CAAC,OAAO,EAAE,EAAE,CACV,8BAA8B,CAAC;YAC7B,GAAG,cAAc;YACjB,OAAO;YACP,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;YAClC,2BAA2B;YAC3B,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACpC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,cAAc,EAAE,gCAAgC,CAC9C,KAAK,CAAC,OAAO,EACb,cAAc,CAAC,cAAc,EAC7B,OAAO,CAAC,YAAY,EACpB,mDAAmD,CAAC;gBAClD,SAAS,EAAE,OAAO;gBAClB,cAAc,EAAE,cAAc,CAAC,cAAc;gBAC7C,YAAY,EAAE,OAAO,CAAC,YAAY;aACnC,CAAC,CACH;YACD,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;YACjE,0BAA0B,EACxB,KAAK,CAAC,OAAO,CAAC,0BAA0B;SAC3C,CAAC,CACL,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAI1C;IACC,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,cAAc;QACzB,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,GAAG,EAAE;QACH,MAAM,MAAM,GAAG,wCAAwC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,oCAAoC,CAC5C,2CAA2C,CAC5C,CAAC;QACJ,OAAO,MAAM,CACX,EAAE,GAAG,cAAc,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,EACvD,CAAC,OAAO,EAAE,EAAE,CACV,8BAA8B,CAAC;YAC7B,GAAG,cAAc;YACjB,OAAO;YACP,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;YAClC,0BAA0B,EACxB,KAAK,CAAC,OAAO,CAAC,0BAA0B;SAC3C,CAAC,CACL,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KAAkE;IAElE,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,qBAAqB;QAChC,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,KAAK,IAAI,EAAE;QACT,MAAM,aAAa,GAAG,8BAA8B,CAAC;YACnD,GAAG,cAAc;YACjB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;QACH,IAAI,CAAC,aAAa;YAChB,MAAM,IAAI,oCAAoC,CAC5C,2CAA2C,CAC5C,CAAC;QACJ,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAC7D,KAAK,CAAC,OAAO,EACb;YACE,IAAI,EAAE,QAAQ;YACd,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,aAAa,EAAE,KAAK,CAAC,aAAa;SACnC,CACF,CAAC;QACF,IAAI,KAAK,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;YACpC,MAAM,+BAA+B,CAAC;gBACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG;gBAC3B,cAAc,EAAE,cAAc,CAAC,cAAc;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,CAAC,oBAAoB,CAAC,sBAAsB,CACrD,cAAc,CAAC,cAAc,CAC9B,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAsD;IAEtD,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,oBAAoB,GAAG,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACxE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,KAAK,CAAC,SAAS;QACzB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,wBAAwB;QACnC,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,KAAK,IAAI,EAAE;QACT,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE;YACxB,IAAI,KAAK,CAAC,WAAW,KAAK,OAAO,EAAE,CAAC;gBAClC,MAAM,aAAa,GAAG,8BAA8B,CAAC;oBACnD,GAAG,cAAc;oBACjB,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,YAAY,EAAE,KAAK,CAAC,YAAY;iBACjC,CAAC,CAAC;gBACH,IAAI,CAAC,aAAa;oBAChB,MAAM,IAAI,oCAAoC,CAC5C,2CAA2C,CAC5C,CAAC;gBACJ,OAAO,CACL,MAAM,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE;oBACnC,IAAI,EAAE,QAAQ;oBACd,kBAAkB,EAAE,KAAK,CAAC,WAAW;iBACtC,CAAC,CACH,CAAC,QAAQ,CAAC;YACb,CAAC;iBAAM,CAAC;gBACN,OAAO,gCAAgC,CAAC;oBACtC,YAAY,EAAE,KAAK,CAAC,YAAY;oBAChC,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;oBACjE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;oBAClC,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,oBAAoB;oBACpB,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;oBACpC,cAAc,EAAE;wBACd,SAAS,EAAE,KAAK,CAAC,SAAS;wBAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;qBAC/B;oBACD,0BAA0B,EACxB,KAAK,CAAC,OAAO,CAAC,0BAA0B;oBAC1C,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;oBACD,GAAG,cAAc;iBAClB,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC;QAChC,MAAM,KAAK,CAAC,oBAAoB,CAAC,sBAAsB,CACrD,cAAc,CAAC,cAAc,CAC9B,CAAC;QACF,OAAO,QAAQ,CAAC;IAClB,CAAC,CACF,CAAC;AACJ,CAAC","sourcesContent":["import type { ContainerGrantSubjectType } from \"@tearleads/crypto\";\nimport { ProjectionDependencyUnavailableError } from \"../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { runWithSecurityIncidentReporting } from \"../../data/keyingProjectionVerification/error\";\nimport { revokeOrganizationContainerGrant } from \"../../workflows/organizations\";\nimport { createCurrentOrganizationGroup } from \"../../workflows/organizations/createCurrentOrganizationGroup\";\nimport { createSelectedCurrentGroupMetadataContainerVerifier } from \"../../workflows/organizations/currentGroupMetadataAuthority\";\nimport { deleteCurrentOrganizationGroup } from \"../../workflows/organizations/deleteCurrentOrganizationGroup\";\nimport { createRuntimeGroupMetadataAccess } from \"../../workflows/organizations/groupMetadataRuntime\";\nimport { createRuntimeCurrentOrganizationMutation } from \"../../workflows/organizations/runtimeCurrentOrganizationMutation\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../workflows/principals/runtimePolicyWarmer\";\nimport type { ContainerContents } from \"../containerContents\";\nimport type { InternalWorkflowRuntimeInput } from \"../runtime/workflowRuntime\";\nimport { createCurrentPrincipalMutation } from \"./currentPrincipalMutations\";\nimport { syncOrganizationMetadataProfile } from \"./organizationMetadataProfileSync\";\nimport type { OrganizationReadModelCoordinator } from \"./organizationReadModels\";\n\nexport interface OrganizationGrantRef {\n containerId: string;\n subjectId: string;\n subjectType: ContainerGrantSubjectType;\n}\n\nexport interface OrganizationGroupUserMutationInput {\n groupId: string;\n expectedGroupName: string;\n}\n\nexport interface AddOrganizationGroupUserInput\n extends OrganizationGroupUserMutationInput {\n targetUserId: string;\n}\n\nexport interface RemoveOrganizationGroupUserInput\n extends OrganizationGroupUserMutationInput {\n removedUserId: string;\n}\n\ninterface OrganizationSigningContext {\n organizationId: string;\n signerUserId: string;\n signingFingerprint: string;\n signingKeyPair: NonNullable<\n InternalWorkflowRuntimeInput[\"crypto\"][\"signingKeyPair\"]\n >;\n}\n\nfunction requireSigningContext(\n runtime: InternalWorkflowRuntimeInput,\n): OrganizationSigningContext {\n if (\n !runtime.auth.organizationId \|\|\n !runtime.auth.userId \|\|\n !runtime.crypto.signingFingerprint \|\|\n !runtime.crypto.signingKeyPair\n ) {\n throw new Error(\"Organization signing context is unavailable\");\n }\n\n return {\n organizationId: runtime.auth.organizationId,\n signerUserId: runtime.auth.userId,\n signingFingerprint: runtime.crypto.signingFingerprint,\n signingKeyPair: runtime.crypto.signingKeyPair,\n };\n}\n\nfunction requireEncapsulationKeyPair(\n runtime: InternalWorkflowRuntimeInput,\n): NonNullable<InternalWorkflowRuntimeInput[\"crypto\"][\"encapsulationKeyPair\"]> {\n if (!runtime.crypto.encapsulationKeyPair) {\n throw new Error(\"Organization encryption context is unavailable\");\n }\n\n return runtime.crypto.encapsulationKeyPair;\n}\n\ninterface PrincipalMutationRuntime {\n readonly stillCurrent: () => boolean;\n readonly containerContents: ContainerContents;\n readonly readModelCoordinator: OrganizationReadModelCoordinator;\n readonly runtime: InternalWorkflowRuntimeInput;\n}\n\nexport async function addUserToOrganizationGroup(\n input: PrincipalMutationRuntime & AddOrganizationGroupUserInput,\n) {\n const signingContext = requireSigningContext(input.runtime);\n return runWithSecurityIncidentReporting(\n input.runtime.util.reportSecurityIncident,\n {\n objectId: input.groupId,\n objectKind: \"principal\",\n operation: \"group.member.add\",\n organizationId: signingContext.organizationId,\n },\n async () => {\n const mutateCurrent = createCurrentPrincipalMutation({\n ...signingContext,\n runtime: input.runtime,\n stillCurrent: input.stillCurrent,\n });\n if (!mutateCurrent)\n throw new ProjectionDependencyUnavailableError(\n \"Principal history recovery is unavailable\",\n );\n const {\n memberGroupId,\n response: bundle,\n enrolled,\n } = await mutateCurrent(input.groupId, {\n kind: \"add\",\n expectedGroupName: input.expectedGroupName,\n targetUserId: input.targetUserId,\n });\n if (input.groupId === memberGroupId \|\| enrolled) {\n await syncOrganizationMetadataProfile({\n containerContents: input.containerContents,\n log: input.runtime.util.log,\n organizationId: signingContext.organizationId,\n });\n }\n await input.readModelCoordinator.reconcileAfterMutation(\n signingContext.organizationId,\n );\n return bundle;\n },\n );\n}\n\nexport function createGroupForOrganization(input: {\n readonly name: string;\n readonly runtime: InternalWorkflowRuntimeInput;\n readonly stillCurrent: () => boolean;\n}) {\n const signingContext = requireSigningContext(input.runtime);\n return runWithSecurityIncidentReporting(\n input.runtime.util.reportSecurityIncident,\n {\n objectId: signingContext.organizationId,\n objectKind: \"principal\",\n operation: \"group.create\",\n organizationId: signingContext.organizationId,\n },\n () => {\n const creatorEncapsulationKeyPair = requireEncapsulationKeyPair(\n input.runtime,\n );\n const mutate = createRuntimeCurrentOrganizationMutation(input.runtime);\n if (!mutate)\n throw new ProjectionDependencyUnavailableError(\n \"Principal history recovery is unavailable\",\n );\n return mutate(\n { ...signingContext, stillCurrent: input.stillCurrent },\n (context) =>\n createCurrentOrganizationGroup({\n ...signingContext,\n context,\n apiClient: input.runtime.apiClient,\n creatorEncapsulationKeyPair,\n execSql: input.runtime.infra.execSql,\n name: input.name,\n metadataAccess: createRuntimeGroupMetadataAccess(\n input.runtime,\n signingContext.organizationId,\n context.stillCurrent,\n createSelectedCurrentGroupMetadataContainerVerifier({\n authority: context,\n organizationId: signingContext.organizationId,\n stillCurrent: context.stillCurrent,\n }),\n ),\n reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n resolveTrustedUserIdentity:\n input.runtime.resolveTrustedUserIdentity,\n }),\n );\n },\n );\n}\n\nexport function deleteGroupForOrganization(input: {\n readonly groupId: string;\n readonly runtime: InternalWorkflowRuntimeInput;\n readonly stillCurrent: () => boolean;\n}) {\n const signingContext = requireSigningContext(input.runtime);\n return runWithSecurityIncidentReporting(\n input.runtime.util.reportSecurityIncident,\n {\n objectId: input.groupId,\n objectKind: \"principal\",\n operation: \"group.delete\",\n organizationId: signingContext.organizationId,\n },\n () => {\n const mutate = createRuntimeCurrentOrganizationMutation(input.runtime);\n if (!mutate)\n throw new ProjectionDependencyUnavailableError(\n \"Principal history recovery is unavailable\",\n );\n return mutate(\n { ...signingContext, stillCurrent: input.stillCurrent },\n (context) =>\n deleteCurrentOrganizationGroup({\n ...signingContext,\n context,\n groupId: input.groupId,\n apiClient: input.runtime.apiClient,\n resolveTrustedUserIdentity:\n input.runtime.resolveTrustedUserIdentity,\n }),\n );\n },\n );\n}\n\nexport async function removeUserFromOrganizationGroup(\n input: PrincipalMutationRuntime & RemoveOrganizationGroupUserInput,\n) {\n const signingContext = requireSigningContext(input.runtime);\n return runWithSecurityIncidentReporting(\n input.runtime.util.reportSecurityIncident,\n {\n objectId: input.groupId,\n objectKind: \"principal\",\n operation: \"group.member.remove\",\n organizationId: signingContext.organizationId,\n },\n async () => {\n const mutateCurrent = createCurrentPrincipalMutation({\n ...signingContext,\n runtime: input.runtime,\n stillCurrent: input.stillCurrent,\n });\n if (!mutateCurrent)\n throw new ProjectionDependencyUnavailableError(\n \"Principal history recovery is unavailable\",\n );\n const { memberGroupId, response: bundle } = await mutateCurrent(\n input.groupId,\n {\n kind: \"remove\",\n expectedGroupName: input.expectedGroupName,\n removedUserId: input.removedUserId,\n },\n );\n if (input.groupId === memberGroupId) {\n await syncOrganizationMetadataProfile({\n containerContents: input.containerContents,\n log: input.runtime.util.log,\n organizationId: signingContext.organizationId,\n });\n }\n await input.readModelCoordinator.reconcileAfterMutation(\n signingContext.organizationId,\n );\n return bundle;\n },\n );\n}\n\nexport async function revokeOrganizationGrant(\n input: PrincipalMutationRuntime & OrganizationGrantRef,\n) {\n const signingContext = requireSigningContext(input.runtime);\n const encapsulationKeyPair = requireEncapsulationKeyPair(input.runtime);\n if (input.runtime.infra.dbStatus !== \"ready\") {\n throw new Error(\"Organization local database is unavailable\");\n }\n\n return runWithSecurityIncidentReporting(\n input.runtime.util.reportSecurityIncident,\n {\n objectId: input.subjectId,\n objectKind: \"principal\",\n operation: \"principal.grant.revoke\",\n organizationId: signingContext.organizationId,\n },\n async () => {\n const revoke = async () => {\n if (input.subjectType === \"group\") {\n const mutateCurrent = createCurrentPrincipalMutation({\n ...signingContext,\n runtime: input.runtime,\n stillCurrent: input.stillCurrent,\n });\n if (!mutateCurrent)\n throw new ProjectionDependencyUnavailableError(\n \"Principal history recovery is unavailable\",\n );\n return (\n await mutateCurrent(input.subjectId, {\n kind: \"revoke\",\n revokedContainerId: input.containerId,\n })\n ).response;\n } else {\n return revokeOrganizationContainerGrant({\n stillCurrent: input.stillCurrent,\n reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n apiClient: input.runtime.apiClient,\n containerId: input.containerId,\n encapsulationKeyPair,\n execSql: input.runtime.infra.execSql,\n revokedSubject: {\n subjectId: input.subjectId,\n subjectType: input.subjectType,\n },\n resolveTrustedUserIdentity:\n input.runtime.resolveTrustedUserIdentity,\n warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n input.runtime,\n ),\n ...signingContext,\n });\n }\n };\n const response = await revoke();\n await input.readModelCoordinator.reconcileAfterMutation(\n signingContext.organizationId,\n );\n return response;\n },\n );\n}\n"]}
1	+ {"version":3,"file":"principalMutations.js","sourceRoot":"","sources":["principalMutations.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EAAE,gCAAgC,EAAE,MAAM,+CAA+C,CAAC;AACjG,OAAO,EAAE,gCAAgC,EAAE,MAAM,+BAA+B,CAAC;AACjF,OAAO,EAAE,mDAAmD,EAAE,MAAM,2EAA2E,CAAC;AAChJ,OAAO,EAAE,gCAAgC,EAAE,MAAM,kEAAkE,CAAC;AACpH,OAAO,EAAE,8BAA8B,EAAE,MAAM,qEAAqE,CAAC;AACrH,OAAO,EAAE,8BAA8B,EAAE,MAAM,qEAAqE,CAAC;AACrH,OAAO,EAAE,wCAAwC,EAAE,MAAM,qFAAqF,CAAC;AAC/I,OAAO,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAGpG,OAAO,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAC7E,OAAO,EAAE,+BAA+B,EAAE,MAAM,mCAAmC,CAAC;AAiCpF,SAAS,qBAAqB,CAC5B,OAAqC;IAErC,IACE,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc;QAC5B,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM;QACpB,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB;QAClC,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,EAC9B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IAED,OAAO;QACL,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;QAC3C,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;QACjC,kBAAkB,EAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB;QACrD,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc;KAC9C,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAClC,OAAqC;IAErC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC;AAC7C,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAA+D;IAE/D,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,kBAAkB;QAC7B,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,KAAK,IAAI,EAAE;QACT,MAAM,aAAa,GAAG,8BAA8B,CAAC;YACnD,GAAG,cAAc;YACjB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;QACH,IAAI,CAAC,aAAa;YAChB,MAAM,IAAI,oCAAoC,CAC5C,2CAA2C,CAC5C,CAAC;QACJ,MAAM,EACJ,aAAa,EACb,QAAQ,EAAE,MAAM,EAChB,QAAQ,GACT,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE;YACrC,IAAI,EAAE,KAAK;YACX,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,OAAO,KAAK,aAAa,IAAI,QAAQ,EAAE,CAAC;YAChD,MAAM,+BAA+B,CAAC;gBACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG;gBAC3B,cAAc,EAAE,cAAc,CAAC,cAAc;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,CAAC,oBAAoB,CAAC,sBAAsB,CACrD,cAAc,CAAC,cAAc,CAC9B,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAI1C;IACC,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,cAAc,CAAC,cAAc;QACvC,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,cAAc;QACzB,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,GAAG,EAAE;QACH,MAAM,2BAA2B,GAAG,2BAA2B,CAC7D,KAAK,CAAC,OAAO,CACd,CAAC;QACF,MAAM,MAAM,GAAG,wCAAwC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,oCAAoC,CAC5C,2CAA2C,CAC5C,CAAC;QACJ,OAAO,MAAM,CACX,EAAE,GAAG,cAAc,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,EACvD,CAAC,OAAO,EAAE,EAAE,CACV,8BAA8B,CAAC;YAC7B,GAAG,cAAc;YACjB,OAAO;YACP,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;YAClC,2BAA2B;YAC3B,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACpC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,cAAc,EAAE,gCAAgC,CAC9C,KAAK,CAAC,OAAO,EACb,cAAc,CAAC,cAAc,EAC7B,OAAO,CAAC,YAAY,EACpB,mDAAmD,CAAC;gBAClD,SAAS,EAAE,OAAO;gBAClB,cAAc,EAAE,cAAc,CAAC,cAAc;gBAC7C,YAAY,EAAE,OAAO,CAAC,YAAY;aACnC,CAAC,CACH;YACD,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;YACjE,0BAA0B,EACxB,KAAK,CAAC,OAAO,CAAC,0BAA0B;SAC3C,CAAC,CACL,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAI1C;IACC,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,cAAc;QACzB,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,GAAG,EAAE;QACH,MAAM,MAAM,GAAG,wCAAwC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,oCAAoC,CAC5C,2CAA2C,CAC5C,CAAC;QACJ,OAAO,MAAM,CACX,EAAE,GAAG,cAAc,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,EACvD,CAAC,OAAO,EAAE,EAAE,CACV,8BAA8B,CAAC;YAC7B,GAAG,cAAc;YACjB,OAAO;YACP,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;YAClC,0BAA0B,EACxB,KAAK,CAAC,OAAO,CAAC,0BAA0B;SAC3C,CAAC,CACL,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KAAkE;IAElE,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,qBAAqB;QAChC,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,KAAK,IAAI,EAAE;QACT,MAAM,aAAa,GAAG,8BAA8B,CAAC;YACnD,GAAG,cAAc;YACjB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;QACH,IAAI,CAAC,aAAa;YAChB,MAAM,IAAI,oCAAoC,CAC5C,2CAA2C,CAC5C,CAAC;QACJ,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAC7D,KAAK,CAAC,OAAO,EACb;YACE,IAAI,EAAE,QAAQ;YACd,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,aAAa,EAAE,KAAK,CAAC,aAAa;SACnC,CACF,CAAC;QACF,IAAI,KAAK,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;YACpC,MAAM,+BAA+B,CAAC;gBACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG;gBAC3B,cAAc,EAAE,cAAc,CAAC,cAAc;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,CAAC,oBAAoB,CAAC,sBAAsB,CACrD,cAAc,CAAC,cAAc,CAC9B,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAsD;IAEtD,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,oBAAoB,GAAG,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACxE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,KAAK,CAAC,SAAS;QACzB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,wBAAwB;QACnC,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,KAAK,IAAI,EAAE;QACT,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE;YACxB,IAAI,KAAK,CAAC,WAAW,KAAK,OAAO,EAAE,CAAC;gBAClC,MAAM,aAAa,GAAG,8BAA8B,CAAC;oBACnD,GAAG,cAAc;oBACjB,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,YAAY,EAAE,KAAK,CAAC,YAAY;iBACjC,CAAC,CAAC;gBACH,IAAI,CAAC,aAAa;oBAChB,MAAM,IAAI,oCAAoC,CAC5C,2CAA2C,CAC5C,CAAC;gBACJ,OAAO,CACL,MAAM,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE;oBACnC,IAAI,EAAE,QAAQ;oBACd,kBAAkB,EAAE,KAAK,CAAC,WAAW;iBACtC,CAAC,CACH,CAAC,QAAQ,CAAC;YACb,CAAC;iBAAM,CAAC;gBACN,OAAO,gCAAgC,CAAC;oBACtC,YAAY,EAAE,KAAK,CAAC,YAAY;oBAChC,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;oBACjE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;oBAClC,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,oBAAoB;oBACpB,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;oBACpC,cAAc,EAAE;wBACd,SAAS,EAAE,KAAK,CAAC,SAAS;wBAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;qBAC/B;oBACD,0BAA0B,EACxB,KAAK,CAAC,OAAO,CAAC,0BAA0B;oBAC1C,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;oBACD,GAAG,cAAc;iBAClB,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC;QAChC,MAAM,KAAK,CAAC,oBAAoB,CAAC,sBAAsB,CACrD,cAAc,CAAC,cAAc,CAC9B,CAAC;QACF,OAAO,QAAQ,CAAC;IAClB,CAAC,CACF,CAAC;AACJ,CAAC","sourcesContent":["import type { ContainerGrantSubjectType } from \"@tearleads/crypto\";\nimport { ProjectionDependencyUnavailableError } from \"../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { runWithSecurityIncidentReporting } from \"../../data/keyingProjectionVerification/error\";\nimport { revokeOrganizationContainerGrant } from \"../../workflows/organizations\";\nimport { createSelectedCurrentGroupMetadataContainerVerifier } from \"../../workflows/organizations/groupMetadata/currentGroupMetadataAuthority\";\nimport { createRuntimeGroupMetadataAccess } from \"../../workflows/organizations/groupMetadata/groupMetadataRuntime\";\nimport { createCurrentOrganizationGroup } from \"../../workflows/organizations/groups/createCurrentOrganizationGroup\";\nimport { deleteCurrentOrganizationGroup } from \"../../workflows/organizations/groups/deleteCurrentOrganizationGroup\";\nimport { createRuntimeCurrentOrganizationMutation } from \"../../workflows/organizations/principalMutations/runtimeCurrentOrganizationMutation\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../workflows/principals/runtimePolicyWarmer\";\nimport type { ContainerContents } from \"../containerContents\";\nimport type { InternalWorkflowRuntimeInput } from \"../runtime/workflowRuntime\";\nimport { createCurrentPrincipalMutation } from \"./currentPrincipalMutations\";\nimport { syncOrganizationMetadataProfile } from \"./organizationMetadataProfileSync\";\nimport type { OrganizationReadModelCoordinator } from \"./organizationReadModels\";\n\nexport interface OrganizationGrantRef {\n containerId: string;\n subjectId: string;\n subjectType: ContainerGrantSubjectType;\n}\n\nexport interface OrganizationGroupUserMutationInput {\n groupId: string;\n expectedGroupName: string;\n}\n\nexport interface AddOrganizationGroupUserInput\n extends OrganizationGroupUserMutationInput {\n targetUserId: string;\n}\n\nexport interface RemoveOrganizationGroupUserInput\n extends OrganizationGroupUserMutationInput {\n removedUserId: string;\n}\n\ninterface OrganizationSigningContext {\n organizationId: string;\n signerUserId: string;\n signingFingerprint: string;\n signingKeyPair: NonNullable<\n InternalWorkflowRuntimeInput[\"crypto\"][\"signingKeyPair\"]\n >;\n}\n\nfunction requireSigningContext(\n runtime: InternalWorkflowRuntimeInput,\n): OrganizationSigningContext {\n if (\n !runtime.auth.organizationId \|\|\n !runtime.auth.userId \|\|\n !runtime.crypto.signingFingerprint \|\|\n !runtime.crypto.signingKeyPair\n ) {\n throw new Error(\"Organization signing context is unavailable\");\n }\n\n return {\n organizationId: runtime.auth.organizationId,\n signerUserId: runtime.auth.userId,\n signingFingerprint: runtime.crypto.signingFingerprint,\n signingKeyPair: runtime.crypto.signingKeyPair,\n };\n}\n\nfunction requireEncapsulationKeyPair(\n runtime: InternalWorkflowRuntimeInput,\n): NonNullable<InternalWorkflowRuntimeInput[\"crypto\"][\"encapsulationKeyPair\"]> {\n if (!runtime.crypto.encapsulationKeyPair) {\n throw new Error(\"Organization encryption context is unavailable\");\n }\n\n return runtime.crypto.encapsulationKeyPair;\n}\n\ninterface PrincipalMutationRuntime {\n readonly stillCurrent: () => boolean;\n readonly containerContents: ContainerContents;\n readonly readModelCoordinator: OrganizationReadModelCoordinator;\n readonly runtime: InternalWorkflowRuntimeInput;\n}\n\nexport async function addUserToOrganizationGroup(\n input: PrincipalMutationRuntime & AddOrganizationGroupUserInput,\n) {\n const signingContext = requireSigningContext(input.runtime);\n return runWithSecurityIncidentReporting(\n input.runtime.util.reportSecurityIncident,\n {\n objectId: input.groupId,\n objectKind: \"principal\",\n operation: \"group.member.add\",\n organizationId: signingContext.organizationId,\n },\n async () => {\n const mutateCurrent = createCurrentPrincipalMutation({\n ...signingContext,\n runtime: input.runtime,\n stillCurrent: input.stillCurrent,\n });\n if (!mutateCurrent)\n throw new ProjectionDependencyUnavailableError(\n \"Principal history recovery is unavailable\",\n );\n const {\n memberGroupId,\n response: bundle,\n enrolled,\n } = await mutateCurrent(input.groupId, {\n kind: \"add\",\n expectedGroupName: input.expectedGroupName,\n targetUserId: input.targetUserId,\n });\n if (input.groupId === memberGroupId \|\| enrolled) {\n await syncOrganizationMetadataProfile({\n containerContents: input.containerContents,\n log: input.runtime.util.log,\n organizationId: signingContext.organizationId,\n });\n }\n await input.readModelCoordinator.reconcileAfterMutation(\n signingContext.organizationId,\n );\n return bundle;\n },\n );\n}\n\nexport function createGroupForOrganization(input: {\n readonly name: string;\n readonly runtime: InternalWorkflowRuntimeInput;\n readonly stillCurrent: () => boolean;\n}) {\n const signingContext = requireSigningContext(input.runtime);\n return runWithSecurityIncidentReporting(\n input.runtime.util.reportSecurityIncident,\n {\n objectId: signingContext.organizationId,\n objectKind: \"principal\",\n operation: \"group.create\",\n organizationId: signingContext.organizationId,\n },\n () => {\n const creatorEncapsulationKeyPair = requireEncapsulationKeyPair(\n input.runtime,\n );\n const mutate = createRuntimeCurrentOrganizationMutation(input.runtime);\n if (!mutate)\n throw new ProjectionDependencyUnavailableError(\n \"Principal history recovery is unavailable\",\n );\n return mutate(\n { ...signingContext, stillCurrent: input.stillCurrent },\n (context) =>\n createCurrentOrganizationGroup({\n ...signingContext,\n context,\n apiClient: input.runtime.apiClient,\n creatorEncapsulationKeyPair,\n execSql: input.runtime.infra.execSql,\n name: input.name,\n metadataAccess: createRuntimeGroupMetadataAccess(\n input.runtime,\n signingContext.organizationId,\n context.stillCurrent,\n createSelectedCurrentGroupMetadataContainerVerifier({\n authority: context,\n organizationId: signingContext.organizationId,\n stillCurrent: context.stillCurrent,\n }),\n ),\n reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n resolveTrustedUserIdentity:\n input.runtime.resolveTrustedUserIdentity,\n }),\n );\n },\n );\n}\n\nexport function deleteGroupForOrganization(input: {\n readonly groupId: string;\n readonly runtime: InternalWorkflowRuntimeInput;\n readonly stillCurrent: () => boolean;\n}) {\n const signingContext = requireSigningContext(input.runtime);\n return runWithSecurityIncidentReporting(\n input.runtime.util.reportSecurityIncident,\n {\n objectId: input.groupId,\n objectKind: \"principal\",\n operation: \"group.delete\",\n organizationId: signingContext.organizationId,\n },\n () => {\n const mutate = createRuntimeCurrentOrganizationMutation(input.runtime);\n if (!mutate)\n throw new ProjectionDependencyUnavailableError(\n \"Principal history recovery is unavailable\",\n );\n return mutate(\n { ...signingContext, stillCurrent: input.stillCurrent },\n (context) =>\n deleteCurrentOrganizationGroup({\n ...signingContext,\n context,\n groupId: input.groupId,\n apiClient: input.runtime.apiClient,\n resolveTrustedUserIdentity:\n input.runtime.resolveTrustedUserIdentity,\n }),\n );\n },\n );\n}\n\nexport async function removeUserFromOrganizationGroup(\n input: PrincipalMutationRuntime & RemoveOrganizationGroupUserInput,\n) {\n const signingContext = requireSigningContext(input.runtime);\n return runWithSecurityIncidentReporting(\n input.runtime.util.reportSecurityIncident,\n {\n objectId: input.groupId,\n objectKind: \"principal\",\n operation: \"group.member.remove\",\n organizationId: signingContext.organizationId,\n },\n async () => {\n const mutateCurrent = createCurrentPrincipalMutation({\n ...signingContext,\n runtime: input.runtime,\n stillCurrent: input.stillCurrent,\n });\n if (!mutateCurrent)\n throw new ProjectionDependencyUnavailableError(\n \"Principal history recovery is unavailable\",\n );\n const { memberGroupId, response: bundle } = await mutateCurrent(\n input.groupId,\n {\n kind: \"remove\",\n expectedGroupName: input.expectedGroupName,\n removedUserId: input.removedUserId,\n },\n );\n if (input.groupId === memberGroupId) {\n await syncOrganizationMetadataProfile({\n containerContents: input.containerContents,\n log: input.runtime.util.log,\n organizationId: signingContext.organizationId,\n });\n }\n await input.readModelCoordinator.reconcileAfterMutation(\n signingContext.organizationId,\n );\n return bundle;\n },\n );\n}\n\nexport async function revokeOrganizationGrant(\n input: PrincipalMutationRuntime & OrganizationGrantRef,\n) {\n const signingContext = requireSigningContext(input.runtime);\n const encapsulationKeyPair = requireEncapsulationKeyPair(input.runtime);\n if (input.runtime.infra.dbStatus !== \"ready\") {\n throw new Error(\"Organization local database is unavailable\");\n }\n\n return runWithSecurityIncidentReporting(\n input.runtime.util.reportSecurityIncident,\n {\n objectId: input.subjectId,\n objectKind: \"principal\",\n operation: \"principal.grant.revoke\",\n organizationId: signingContext.organizationId,\n },\n async () => {\n const revoke = async () => {\n if (input.subjectType === \"group\") {\n const mutateCurrent = createCurrentPrincipalMutation({\n ...signingContext,\n runtime: input.runtime,\n stillCurrent: input.stillCurrent,\n });\n if (!mutateCurrent)\n throw new ProjectionDependencyUnavailableError(\n \"Principal history recovery is unavailable\",\n );\n return (\n await mutateCurrent(input.subjectId, {\n kind: \"revoke\",\n revokedContainerId: input.containerId,\n })\n ).response;\n } else {\n return revokeOrganizationContainerGrant({\n stillCurrent: input.stillCurrent,\n reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n apiClient: input.runtime.apiClient,\n containerId: input.containerId,\n encapsulationKeyPair,\n execSql: input.runtime.infra.execSql,\n revokedSubject: {\n subjectId: input.subjectId,\n subjectType: input.subjectType,\n },\n resolveTrustedUserIdentity:\n input.runtime.resolveTrustedUserIdentity,\n warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n input.runtime,\n ),\n ...signingContext,\n });\n }\n };\n const response = await revoke();\n await input.readModelCoordinator.reconcileAfterMutation(\n signingContext.organizationId,\n );\n return response;\n },\n );\n}\n"]}

package/client/runtime/principalMutationApi.d.ts CHANGED Viewed

@@ -1,7 +1,7 @@
 import type { ApiClient } from "../../internal/api-client/index.js";
 import type { SigningKeyPair } from "../../internal/crypto/index.js";
 import type { ExecSql } from "../../data/sqlite/sqlSchema.js";
-import { type PrincipalMutationRecoveryApi } from "../../workflows/organizations/principalMutationJournalManagement.js";
+import { type PrincipalMutationRecoveryApi } from "../../workflows/organizations/principalMutations/principalMutationJournalManagement.js";
 export interface PrincipalMutationRuntimeScope {
     readonly database: object;
     readonly execSql: ExecSql;

package/client/runtime/principalMutationApi.js CHANGED Viewed

@@ -1,5 +1,5 @@
-import { abandonJournaledPrincipalMutation, discardUnreadableJournaledPrincipalMutation, readJournaledPrincipalMutation, } from "../../workflows/organizations/principalMutationJournalManagement.js";
-import { recoverJournaledPrincipalMutation } from "../../workflows/organizations/principalMutationJournalSession.js";
+import { abandonJournaledPrincipalMutation, discardUnreadableJournaledPrincipalMutation, readJournaledPrincipalMutation, } from "../../workflows/organizations/principalMutations/principalMutationJournalManagement.js";
+import { recoverJournaledPrincipalMutation } from "../../workflows/organizations/principalMutations/principalMutationJournalSession.js";
 import { createPrincipalMutationDispatcher } from "./principalMutationDeadline.js";
 import { createJournaledPrincipalMutations, dispatchAuthoredPrincipalMutation, } from "./principalMutationDispatch.js";
 function sameScope(current, bound) {

package/client/runtime/principalMutationApi.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"principalMutationApi.js","sourceRoot":"","sources":["principalMutationApi.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,iCAAiC,EACjC,2CAA2C,EAE3C,8BAA8B,GAC/B,MAAM,kEAAkE,CAAC;AAC1E,OAAO,EAAE,iCAAiC,EAAE,MAAM,+DAA+D,CAAC;AAClH,OAAO,EAAE,iCAAiC,EAAE,MAAM,6BAA6B,CAAC;AAChF,OAAO,EACL,iCAAiC,EACjC,iCAAiC,GAElC,MAAM,6BAA6B,CAAC;AAYrC,SAAS,SAAS,CAChB,OAA6C,EAC7C,KAA2C;IAE3C,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK;QAAE,OAAO,OAAO,KAAK,KAAK,CAAC;IACjD,OAAO,CACL,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QACnC,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QACjC,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;QACvC,OAAO,CAAC,mBAAmB,KAAK,KAAK,CAAC,mBAAmB;QACzD,OAAO,CAAC,kBAAkB,KAAK,KAAK,CAAC,kBAAkB;QACvD,OAAO,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QAC/C,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAChC,CAAC;AACJ,CAAC;AAYD,SAAS,eAAe,CACtB,KAAuC,EACvC,KAA2C,EAC3C,cAAsB;IAEtB,IAAI,CAAC,KAAK;QACR,MAAM,IAAI,KAAK,CACb,+GAA+G,CAChH,CAAC;IACJ,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,KAAK,EAAE;YACL,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,cAAc;YACd,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB;QACD,YAAY,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,KAAK,CAAC;KACxD,CAAC;AACJ,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,iCAAiC,CAC/C,KAAuC;IAEvC,MAAM,QAAQ,GAAG,iCAAiC,CAChD,KAAK,CAAC,0BAA0B,CACjC,CAAC;IACF,IAAI,MAAM,GAGC,IAAI,CAAC;IAChB,OAAO;QACL,IAAI;YACF,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;YAChC,IAAI,MAAM,IAAI,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;gBAAE,OAAO,MAAM,CAAC,GAAG,CAAC;YAChE,MAAM,OAAO,GAAG,CAAC,cAAsB,EAAE,EAAE,CACzC,eAAe,CAAC,KAAK,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;YAChD,MAAM,IAAI,GACR,KAAK,EAAE,cAAc,EAAE,EAAE,CACvB,KAAK;gBACH,CAAC,CAAC,8BAA8B,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;gBACzD,CAAC,CAAC,IAAI,CAAC;YACb,MAAM,OAAO,GACX,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,yBAAyB,EAAE,EAAE,CAC5D,iCAAiC,CAAC;gBAChC,GAAG,OAAO,CAAC,cAAc,CAAC;gBAC1B,QAAQ;gBACR,yBAAyB;aAC1B,CAAC,CAAC;YACP,MAAM,OAAO,GAAG;gBACd,GAAG,iCAAiC,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC;gBAClE,kCAAkC,EAAE,KAAK,EACvC,cAAc,EACd,QAAQ,EACR,yBAAyB,EACzB,EAAE,CACF,2CAA2C,CAAC;oBAC1C,GAAG,OAAO,CAAC,cAAc,CAAC;oBAC1B,QAAQ;oBACR,yBAAyB;iBAC1B,CAAC;gBACJ,4BAA4B,EAAE,IAAI;gBAClC,+BAA+B,EAAE,OAAO;gBACxC,+BAA+B,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;oBACxD,MAAM,iCAAiC,CAAC;wBACtC,GAAG,OAAO,CAAC,cAAc,CAAC;wBAC1B,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CACnB,QAAQ,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,CAAC,eAAe,EAAE,EAAE,CACpD,iCAAiC,CAC/B,KAAK,CAAC,GAAG,EACT,cAAc,EACd,QAAQ,EACR,eAAe,CAChB,CACF;qBACJ,CAAC,CAAC;gBACL,CAAC;aAC0B,CAAC;YAC9B,MAAM,GAAG,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACpD,MAAM,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;YACxB,OAAO,GAAG,CAAC;QACb,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,GAAc,EACd,OAA0B;IAE1B,MAAM,YAAY,GAAG,IAAI,GAAG,EAGzB,CAAC;IACJ,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,GAAG,EAAE;QAC3B,GAAG,CAAC,MAAM,EAAE,QAAQ;YAClB,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC;gBAClC,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACxC,MAAM,KAAK,GAAY,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC7D,IAAI,OAAO,KAAK,KAAK,UAAU;gBAAE,OAAO,KAAK,CAAC;YAC9C,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC5C,IAAI,QAAQ,EAAE,MAAM,KAAK,KAAK;gBAAE,OAAO,QAAQ,CAAC,KAAK,CAAC;YACtD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACjC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YACrD,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC,CAAC;IACH,6EAA6E;IAC7E,uEAAuE;IACvE,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAc;IACxC,OAAO,CACL,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,8BAA8B,CAAC,KAAK,UAAU;QACtE,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,iCAAiC,CAAC,KAAK,UAAU;QACzE,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,iCAAiC,CAAC,KAAK,UAAU;QACzE,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,oCAAoC,CAAC,KAAK,UAAU,CAC7E,CAAC;AACJ,CAAC","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport type { SigningKeyPair } from \"@tearleads/crypto\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport {\n abandonJournaledPrincipalMutation,\n discardUnreadableJournaledPrincipalMutation,\n type PrincipalMutationRecoveryApi,\n readJournaledPrincipalMutation,\n} from \"../../workflows/organizations/principalMutationJournalManagement\";\nimport { recoverJournaledPrincipalMutation } from \"../../workflows/organizations/principalMutationJournalSession\";\nimport { createPrincipalMutationDispatcher } from \"./principalMutationDeadline\";\nimport {\n createJournaledPrincipalMutations,\n dispatchAuthoredPrincipalMutation,\n type JournaledPrincipalMutationMethods,\n} from \"./principalMutationDispatch\";\n\nexport interface PrincipalMutationRuntimeScope {\n readonly database: object;\n readonly execSql: ExecSql;\n readonly generation: number;\n readonly identityTrustDomain: string;\n readonly signingFingerprint: string;\n readonly signingKeyPair: SigningKeyPair;\n readonly userId: string;\n}\n\nfunction sameScope(\n current: PrincipalMutationRuntimeScope \| null,\n bound: PrincipalMutationRuntimeScope \| null,\n): boolean {\n if (!current \|\| !bound) return current === bound;\n return (\n current.database === bound.database &&\n current.execSql === bound.execSql &&\n current.generation === bound.generation &&\n current.identityTrustDomain === bound.identityTrustDomain &&\n current.signingFingerprint === bound.signingFingerprint &&\n current.signingKeyPair === bound.signingKeyPair &&\n current.userId === bound.userId\n );\n}\n\nexport type PrincipalMutationApi = ApiClient & PrincipalMutationRecoveryApi;\ntype MutationOverrides = JournaledPrincipalMutationMethods &\n PrincipalMutationRecoveryApi;\n\ninterface PrincipalMutationApiCustodyInput {\n readonly api: ApiClient;\n readonly readScope: () => PrincipalMutationRuntimeScope \| null;\n readonly principalMutationTimeoutMs?: number \| undefined;\n}\n\nfunction mutationContext(\n input: PrincipalMutationApiCustodyInput,\n scope: PrincipalMutationRuntimeScope \| null,\n organizationId: string,\n) {\n if (!scope)\n throw new Error(\n \"Principal mutations require an authenticated signing identity, a trusted API origin and durable local storage\",\n );\n return {\n execSql: scope.execSql,\n signingKeyPair: scope.signingKeyPair,\n scope: {\n identityTrustDomain: scope.identityTrustDomain,\n organizationId,\n signingFingerprint: scope.signingFingerprint,\n userId: scope.userId,\n },\n stillCurrent: () => sameScope(input.readScope(), scope),\n };\n}\n\n/** Keep API methods bound to their real receiver and journal principal policy and group lifecycle writes. */\nexport function createPrincipalMutationApiCustody(\n input: PrincipalMutationApiCustodyInput,\n) {\n const dispatch = createPrincipalMutationDispatcher(\n input.principalMutationTimeoutMs,\n );\n let cached: {\n scope: PrincipalMutationRuntimeScope \| null;\n api: PrincipalMutationApi;\n } \| null = null;\n return {\n bind(): PrincipalMutationApi {\n const scope = input.readScope();\n if (cached && sameScope(scope, cached.scope)) return cached.api;\n const context = (organizationId: string) =>\n mutationContext(input, scope, organizationId);\n const read: PrincipalMutationRecoveryApi[\"readPendingPrincipalMutation\"] =\n async (organizationId) =>\n scope\n ? readJournaledPrincipalMutation(context(organizationId))\n : null;\n const abandon: PrincipalMutationRecoveryApi[\"abandonPendingPrincipalMutation\"] =\n async (organizationId, mutation, acknowledgeUnknownOutcome) =>\n abandonJournaledPrincipalMutation({\n ...context(organizationId),\n mutation,\n acknowledgeUnknownOutcome,\n });\n const methods = {\n ...createJournaledPrincipalMutations(input.api, context, dispatch),\n discardUnreadablePrincipalMutation: async (\n organizationId,\n recordId,\n acknowledgeUnknownOutcome,\n ) =>\n discardUnreadableJournaledPrincipalMutation({\n ...context(organizationId),\n recordId,\n acknowledgeUnknownOutcome,\n }),\n readPendingPrincipalMutation: read,\n abandonPendingPrincipalMutation: abandon,\n recoverPendingPrincipalMutation: async (organizationId) => {\n await recoverJournaledPrincipalMutation({\n ...context(organizationId),\n submit: (mutation) =>\n dispatch({ reportErrors: false }, (dispatchOptions) =>\n dispatchAuthoredPrincipalMutation(\n input.api,\n organizationId,\n mutation,\n dispatchOptions,\n ),\n ),\n });\n },\n } satisfies MutationOverrides;\n const api = bindMutationMethods(input.api, methods);\n cached = { scope, api };\n return api;\n },\n };\n}\n\nfunction bindMutationMethods(\n api: ApiClient,\n methods: MutationOverrides,\n): PrincipalMutationApi {\n const boundMethods = new Map<\n PropertyKey,\n { source: unknown; bound: unknown }\n >();\n const bound = new Proxy(api, {\n get(target, property) {\n if (Object.hasOwn(methods, property))\n return Reflect.get(methods, property);\n const value: unknown = Reflect.get(target, property, target);\n if (typeof value !== \"function\") return value;\n const previous = boundMethods.get(property);\n if (previous?.source === value) return previous.bound;\n const bound = value.bind(target);\n boundMethods.set(property, { source: value, bound });\n return bound;\n },\n });\n // The checked overrides supply the signatures; verify their presence through\n // the reflective boundary before exposing the extended API to callers.\n if (!hasRecoveryMethods(bound))\n throw new Error(\"Principal mutation recovery methods are unavailable\");\n return bound;\n}\n\nfunction hasRecoveryMethods(api: ApiClient): api is PrincipalMutationApi {\n return (\n typeof Reflect.get(api, \"readPendingPrincipalMutation\") === \"function\" &&\n typeof Reflect.get(api, \"recoverPendingPrincipalMutation\") === \"function\" &&\n typeof Reflect.get(api, \"abandonPendingPrincipalMutation\") === \"function\" &&\n typeof Reflect.get(api, \"discardUnreadablePrincipalMutation\") === \"function\"\n );\n}\n"]}
1	+ {"version":3,"file":"principalMutationApi.js","sourceRoot":"","sources":["principalMutationApi.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,iCAAiC,EACjC,2CAA2C,EAE3C,8BAA8B,GAC/B,MAAM,qFAAqF,CAAC;AAC7F,OAAO,EAAE,iCAAiC,EAAE,MAAM,kFAAkF,CAAC;AACrI,OAAO,EAAE,iCAAiC,EAAE,MAAM,6BAA6B,CAAC;AAChF,OAAO,EACL,iCAAiC,EACjC,iCAAiC,GAElC,MAAM,6BAA6B,CAAC;AAYrC,SAAS,SAAS,CAChB,OAA6C,EAC7C,KAA2C;IAE3C,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK;QAAE,OAAO,OAAO,KAAK,KAAK,CAAC;IACjD,OAAO,CACL,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QACnC,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QACjC,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;QACvC,OAAO,CAAC,mBAAmB,KAAK,KAAK,CAAC,mBAAmB;QACzD,OAAO,CAAC,kBAAkB,KAAK,KAAK,CAAC,kBAAkB;QACvD,OAAO,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QAC/C,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAChC,CAAC;AACJ,CAAC;AAYD,SAAS,eAAe,CACtB,KAAuC,EACvC,KAA2C,EAC3C,cAAsB;IAEtB,IAAI,CAAC,KAAK;QACR,MAAM,IAAI,KAAK,CACb,+GAA+G,CAChH,CAAC;IACJ,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,KAAK,EAAE;YACL,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,cAAc;YACd,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB;QACD,YAAY,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,KAAK,CAAC;KACxD,CAAC;AACJ,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,iCAAiC,CAC/C,KAAuC;IAEvC,MAAM,QAAQ,GAAG,iCAAiC,CAChD,KAAK,CAAC,0BAA0B,CACjC,CAAC;IACF,IAAI,MAAM,GAGC,IAAI,CAAC;IAChB,OAAO;QACL,IAAI;YACF,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;YAChC,IAAI,MAAM,IAAI,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;gBAAE,OAAO,MAAM,CAAC,GAAG,CAAC;YAChE,MAAM,OAAO,GAAG,CAAC,cAAsB,EAAE,EAAE,CACzC,eAAe,CAAC,KAAK,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;YAChD,MAAM,IAAI,GACR,KAAK,EAAE,cAAc,EAAE,EAAE,CACvB,KAAK;gBACH,CAAC,CAAC,8BAA8B,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;gBACzD,CAAC,CAAC,IAAI,CAAC;YACb,MAAM,OAAO,GACX,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,yBAAyB,EAAE,EAAE,CAC5D,iCAAiC,CAAC;gBAChC,GAAG,OAAO,CAAC,cAAc,CAAC;gBAC1B,QAAQ;gBACR,yBAAyB;aAC1B,CAAC,CAAC;YACP,MAAM,OAAO,GAAG;gBACd,GAAG,iCAAiC,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC;gBAClE,kCAAkC,EAAE,KAAK,EACvC,cAAc,EACd,QAAQ,EACR,yBAAyB,EACzB,EAAE,CACF,2CAA2C,CAAC;oBAC1C,GAAG,OAAO,CAAC,cAAc,CAAC;oBAC1B,QAAQ;oBACR,yBAAyB;iBAC1B,CAAC;gBACJ,4BAA4B,EAAE,IAAI;gBAClC,+BAA+B,EAAE,OAAO;gBACxC,+BAA+B,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;oBACxD,MAAM,iCAAiC,CAAC;wBACtC,GAAG,OAAO,CAAC,cAAc,CAAC;wBAC1B,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CACnB,QAAQ,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,CAAC,eAAe,EAAE,EAAE,CACpD,iCAAiC,CAC/B,KAAK,CAAC,GAAG,EACT,cAAc,EACd,QAAQ,EACR,eAAe,CAChB,CACF;qBACJ,CAAC,CAAC;gBACL,CAAC;aAC0B,CAAC;YAC9B,MAAM,GAAG,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACpD,MAAM,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;YACxB,OAAO,GAAG,CAAC;QACb,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,GAAc,EACd,OAA0B;IAE1B,MAAM,YAAY,GAAG,IAAI,GAAG,EAGzB,CAAC;IACJ,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,GAAG,EAAE;QAC3B,GAAG,CAAC,MAAM,EAAE,QAAQ;YAClB,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC;gBAClC,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACxC,MAAM,KAAK,GAAY,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC7D,IAAI,OAAO,KAAK,KAAK,UAAU;gBAAE,OAAO,KAAK,CAAC;YAC9C,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC5C,IAAI,QAAQ,EAAE,MAAM,KAAK,KAAK;gBAAE,OAAO,QAAQ,CAAC,KAAK,CAAC;YACtD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACjC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YACrD,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC,CAAC;IACH,6EAA6E;IAC7E,uEAAuE;IACvE,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAc;IACxC,OAAO,CACL,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,8BAA8B,CAAC,KAAK,UAAU;QACtE,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,iCAAiC,CAAC,KAAK,UAAU;QACzE,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,iCAAiC,CAAC,KAAK,UAAU;QACzE,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,oCAAoC,CAAC,KAAK,UAAU,CAC7E,CAAC;AACJ,CAAC","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport type { SigningKeyPair } from \"@tearleads/crypto\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport {\n abandonJournaledPrincipalMutation,\n discardUnreadableJournaledPrincipalMutation,\n type PrincipalMutationRecoveryApi,\n readJournaledPrincipalMutation,\n} from \"../../workflows/organizations/principalMutations/principalMutationJournalManagement\";\nimport { recoverJournaledPrincipalMutation } from \"../../workflows/organizations/principalMutations/principalMutationJournalSession\";\nimport { createPrincipalMutationDispatcher } from \"./principalMutationDeadline\";\nimport {\n createJournaledPrincipalMutations,\n dispatchAuthoredPrincipalMutation,\n type JournaledPrincipalMutationMethods,\n} from \"./principalMutationDispatch\";\n\nexport interface PrincipalMutationRuntimeScope {\n readonly database: object;\n readonly execSql: ExecSql;\n readonly generation: number;\n readonly identityTrustDomain: string;\n readonly signingFingerprint: string;\n readonly signingKeyPair: SigningKeyPair;\n readonly userId: string;\n}\n\nfunction sameScope(\n current: PrincipalMutationRuntimeScope \| null,\n bound: PrincipalMutationRuntimeScope \| null,\n): boolean {\n if (!current \|\| !bound) return current === bound;\n return (\n current.database === bound.database &&\n current.execSql === bound.execSql &&\n current.generation === bound.generation &&\n current.identityTrustDomain === bound.identityTrustDomain &&\n current.signingFingerprint === bound.signingFingerprint &&\n current.signingKeyPair === bound.signingKeyPair &&\n current.userId === bound.userId\n );\n}\n\nexport type PrincipalMutationApi = ApiClient & PrincipalMutationRecoveryApi;\ntype MutationOverrides = JournaledPrincipalMutationMethods &\n PrincipalMutationRecoveryApi;\n\ninterface PrincipalMutationApiCustodyInput {\n readonly api: ApiClient;\n readonly readScope: () => PrincipalMutationRuntimeScope \| null;\n readonly principalMutationTimeoutMs?: number \| undefined;\n}\n\nfunction mutationContext(\n input: PrincipalMutationApiCustodyInput,\n scope: PrincipalMutationRuntimeScope \| null,\n organizationId: string,\n) {\n if (!scope)\n throw new Error(\n \"Principal mutations require an authenticated signing identity, a trusted API origin and durable local storage\",\n );\n return {\n execSql: scope.execSql,\n signingKeyPair: scope.signingKeyPair,\n scope: {\n identityTrustDomain: scope.identityTrustDomain,\n organizationId,\n signingFingerprint: scope.signingFingerprint,\n userId: scope.userId,\n },\n stillCurrent: () => sameScope(input.readScope(), scope),\n };\n}\n\n/** Keep API methods bound to their real receiver and journal principal policy and group lifecycle writes. */\nexport function createPrincipalMutationApiCustody(\n input: PrincipalMutationApiCustodyInput,\n) {\n const dispatch = createPrincipalMutationDispatcher(\n input.principalMutationTimeoutMs,\n );\n let cached: {\n scope: PrincipalMutationRuntimeScope \| null;\n api: PrincipalMutationApi;\n } \| null = null;\n return {\n bind(): PrincipalMutationApi {\n const scope = input.readScope();\n if (cached && sameScope(scope, cached.scope)) return cached.api;\n const context = (organizationId: string) =>\n mutationContext(input, scope, organizationId);\n const read: PrincipalMutationRecoveryApi[\"readPendingPrincipalMutation\"] =\n async (organizationId) =>\n scope\n ? readJournaledPrincipalMutation(context(organizationId))\n : null;\n const abandon: PrincipalMutationRecoveryApi[\"abandonPendingPrincipalMutation\"] =\n async (organizationId, mutation, acknowledgeUnknownOutcome) =>\n abandonJournaledPrincipalMutation({\n ...context(organizationId),\n mutation,\n acknowledgeUnknownOutcome,\n });\n const methods = {\n ...createJournaledPrincipalMutations(input.api, context, dispatch),\n discardUnreadablePrincipalMutation: async (\n organizationId,\n recordId,\n acknowledgeUnknownOutcome,\n ) =>\n discardUnreadableJournaledPrincipalMutation({\n ...context(organizationId),\n recordId,\n acknowledgeUnknownOutcome,\n }),\n readPendingPrincipalMutation: read,\n abandonPendingPrincipalMutation: abandon,\n recoverPendingPrincipalMutation: async (organizationId) => {\n await recoverJournaledPrincipalMutation({\n ...context(organizationId),\n submit: (mutation) =>\n dispatch({ reportErrors: false }, (dispatchOptions) =>\n dispatchAuthoredPrincipalMutation(\n input.api,\n organizationId,\n mutation,\n dispatchOptions,\n ),\n ),\n });\n },\n } satisfies MutationOverrides;\n const api = bindMutationMethods(input.api, methods);\n cached = { scope, api };\n return api;\n },\n };\n}\n\nfunction bindMutationMethods(\n api: ApiClient,\n methods: MutationOverrides,\n): PrincipalMutationApi {\n const boundMethods = new Map<\n PropertyKey,\n { source: unknown; bound: unknown }\n >();\n const bound = new Proxy(api, {\n get(target, property) {\n if (Object.hasOwn(methods, property))\n return Reflect.get(methods, property);\n const value: unknown = Reflect.get(target, property, target);\n if (typeof value !== \"function\") return value;\n const previous = boundMethods.get(property);\n if (previous?.source === value) return previous.bound;\n const bound = value.bind(target);\n boundMethods.set(property, { source: value, bound });\n return bound;\n },\n });\n // The checked overrides supply the signatures; verify their presence through\n // the reflective boundary before exposing the extended API to callers.\n if (!hasRecoveryMethods(bound))\n throw new Error(\"Principal mutation recovery methods are unavailable\");\n return bound;\n}\n\nfunction hasRecoveryMethods(api: ApiClient): api is PrincipalMutationApi {\n return (\n typeof Reflect.get(api, \"readPendingPrincipalMutation\") === \"function\" &&\n typeof Reflect.get(api, \"recoverPendingPrincipalMutation\") === \"function\" &&\n typeof Reflect.get(api, \"abandonPendingPrincipalMutation\") === \"function\" &&\n typeof Reflect.get(api, \"discardUnreadablePrincipalMutation\") === \"function\"\n );\n}\n"]}

package/client/runtime/principalMutationDispatch.js CHANGED Viewed

@@ -1,5 +1,5 @@
 import { isCommitOrganizationGroupPolicyResponse, isCreateOrganizationGroupResponse, isDeleteOrganizationGroupResponse, isPrincipalPolicyMutationResponse, } from "../../internal/validators/response/index.js";
-import { submitJournaledPrincipalMutation, } from "../../workflows/organizations/principalMutationJournalSession.js";
+import { submitJournaledPrincipalMutation, } from "../../workflows/organizations/principalMutations/principalMutationJournalSession.js";
 /** Dispatch the authenticated operation, with no application planning callback. */
 export function dispatchAuthoredPrincipalMutation(api, organizationId, mutation, options = {}) {
     switch (mutation.kind) {