@tearleads/client-sdk 0.1.62 → 0.1.64

package/workflows/organizations/localReadModelDetails.js

@@ -1,182 +0,0 @@
-import { loadContainerDisplayNamesByIds } from "../../data/persistence/containers/containerPersistence.js";
-import { loadOrganizationGroupDisplayNames } from "../../data/persistence/organizations/organizationGroupNamePersistence.js";
-import { loadOrganizationReadModelProjection } from "../../data/persistence/organizations/organizationReadModelPersistence.js";
-import { loadPrincipalPolicyBundle } from "../../data/persistence/principalPolicyPersistence.js";
-import { loadVerifiedOrganizationGroupRoles } from "../../data/principals/organizationGroupRoles.js";
-import { runOrganizationPresentationRead } from "./organizationPresentationAccessState.js";
-import { buildOrganizationGroupPolicyHistory, buildOrganizationPolicyHistory, } from "./policyHistoryReadModel.js";
-const DISPLAY_NAME_BATCH_SIZE = 400;
-function uniqueContainerIds(grants) {
-    return [...new Set(grants.map((grant) => grant.containerId))];
-}
-async function enrichGrants(execSql, grants, organizationId) {
-    const containerIds = uniqueContainerIds(grants);
-    const groupNames = await loadOrganizationGroupDisplayNames(execSql, organizationId);
-    const groupRoles = await loadVerifiedOrganizationGroupRoles(execSql, organizationId);
-    const displayNames = new Map();
-    for (let index = 0; index < containerIds.length; index += DISPLAY_NAME_BATCH_SIZE) {
-        const batch = await loadContainerDisplayNamesByIds(execSql, containerIds.slice(index, index + DISPLAY_NAME_BATCH_SIZE));
-        for (const [containerId, displayName] of batch) {
-            displayNames.set(containerId, displayName);
-        }
-    }
-    return grants.map((grant) => ({
-        ...grant,
-        containerDisplayName: displayNames.get(grant.containerId) ?? null,
-        groupName: grant.subjectType === "group"
-            ? (groupRoles.get(grant.subjectId) ??
-                groupNames.get(grant.subjectId) ??
-                null)
-            : null,
-    }));
-}
-function toGroupContainer(grant) {
-    return {
-        accessLevel: grant.accessLevel,
-        containerId: grant.containerId,
-        containerDisplayName: grant.containerDisplayName,
-        createdAt: grant.createdAt,
-        depth: grant.depth,
-        isBuiltin: grant.isBuiltin,
-        metadataAccessEpoch: grant.metadataAccessEpoch,
-        metadataAccessStateHash: grant.metadataAccessStateHash,
-        metadataDocumentId: grant.metadataDocumentId,
-        parentId: grant.parentId,
-        updatedAt: grant.updatedAt,
-    };
-}
-/**
- * The groups a user belongs to is exactly the set naming them as a member.
- *
- * This used to be a breadth-first walk over group-in-group edges. Groups
- * contain only users now, so the walk had no second level to visit.
- */
-function reachableGroupIds(input) {
-    return new Set(input.edges
-        .filter((edge) => edge.userId === input.userId)
-        .map((edge) => edge.groupId));
-}
-export async function loadLocalOrganizationContainerGrants(input) {
-    return runOrganizationPresentationRead({ ...input, requesterUserId: input.currentUserId }, "readModel", async () => {
-        const projection = await loadOrganizationReadModelProjection(input.execSql, input.organizationId, input.currentUserId);
-        if (!projection?.requester) {
-            return null;
-        }
-        return {
-            organizationId: input.organizationId,
-            grants: await enrichGrants(input.execSql, projection.grants.grants, input.organizationId),
-        };
-    });
-}
-export async function loadLocalOrganizationGroupContainers(input) {
-    return runOrganizationPresentationRead({ ...input, requesterUserId: input.currentUserId }, "readModel", async () => {
-        const projection = await loadOrganizationReadModelProjection(input.execSql, input.organizationId, input.currentUserId);
-        if (!projection?.requester) {
-            return null;
-        }
-        const groupIsInOrganization = input.groupId === projection.groups.memberGroupId ||
-            projection.groups.groups.some((group) => group.groupId === input.groupId);
-        if (!groupIsInOrganization) {
-            return null;
-        }
-        const grants = projection.grants.grants.filter((grant) => grant.subjectType === "group" && grant.subjectId === input.groupId);
-        return {
-            organizationId: input.organizationId,
-            groupId: input.groupId,
-            containers: (await enrichGrants(input.execSql, grants, input.organizationId)).map(toGroupContainer),
-        };
-    });
-}
-export async function loadLocalOrganizationGroupPolicyHistory(input) {
-    return runOrganizationPresentationRead({ ...input, requesterUserId: input.currentUserId }, "readModel", async () => {
-        const projection = await loadOrganizationReadModelProjection(input.execSql, input.organizationId, input.currentUserId);
-        if (!projection?.requester) {
-            return null;
-        }
-        const projectedHead = projection.policyHeads.find((head) => head.principalType === "group" && head.principalId === input.groupId);
-        if (!projectedHead) {
-            return null;
-        }
-        const bundle = await loadPrincipalPolicyBundle(input.execSql, "group", input.groupId);
-        return policyBundleMatchesProjectedHead(bundle, projectedHead)
-            ? buildOrganizationGroupPolicyHistory(bundle, input.organizationId)
-            : null;
-    });
-}
-function policyBundleMatchesProjectedHead(bundle, projectedHead) {
-    const storedHead = bundle?.currentState;
-    return Boolean(storedHead &&
-        storedHead.principalType === projectedHead.principalType &&
-        storedHead.principalId === projectedHead.principalId &&
-        storedHead.stateHash === projectedHead.stateHash &&
-        storedHead.version === projectedHead.version &&
-        storedHead.keyEpoch === projectedHead.keyEpoch &&
-        storedHead.keyFingerprint === projectedHead.keyFingerprint &&
-        storedHead.memberCount === projectedHead.memberCount);
-}
-export async function loadLocalOrganizationPolicyHistory(input) {
-    return runOrganizationPresentationRead({ ...input, requesterUserId: input.currentUserId }, "readModel", async () => {
-        const projection = await loadOrganizationReadModelProjection(input.execSql, input.organizationId, input.currentUserId);
-        if (!projection?.requester) {
-            return null;
-        }
-        const projectedHead = projection.policyHeads.find((head) => head.principalType === "organization" &&
-            head.principalId === input.organizationId);
-        if (!projectedHead) {
-            return null;
-        }
-        const bundle = await loadPrincipalPolicyBundle(input.execSql, "organization", input.organizationId);
-        return policyBundleMatchesProjectedHead(bundle, projectedHead)
-            ? buildOrganizationPolicyHistory(bundle)
-            : null;
-    });
-}
-export async function loadLocalOrganizationPolicyReference(input) {
-    return runOrganizationPresentationRead({ ...input, requesterUserId: input.currentUserId }, "readModel", async () => {
-        const projection = await loadOrganizationReadModelProjection(input.execSql, input.organizationId, input.currentUserId);
-        if (!projection?.requester) {
-            return null;
-        }
-        const head = projection.policyHeads.find((candidate) => candidate.principalType === input.principalType &&
-            candidate.principalId === input.principalId);
-        return head
-            ? {
-                principalType: head.principalType,
-                principalId: head.principalId,
-                stateHash: head.stateHash,
-                version: head.version,
-                keyEpoch: head.keyEpoch,
-                keyFingerprint: head.keyFingerprint,
-            }
-            : null;
-    });
-}
-export async function loadLocalOrganizationUserDetail(input) {
-    return runOrganizationPresentationRead({ ...input, requesterUserId: input.currentUserId }, "readModel", async () => {
-        const projection = await loadOrganizationReadModelProjection(input.execSql, input.organizationId, input.currentUserId);
-        const user = projection?.directory.users.find((candidate) => candidate.userId === input.userId);
-        if (!projection?.requester || !user) {
-            return null;
-        }
-        const reachable = reachableGroupIds({
-            edges: projection.membershipEdges,
-            userId: input.userId,
-        });
-        const groups = projection.groups.groups
-            .filter((group) => reachable.has(group.groupId))
-            .map((group) => ({ ...group, nameUnreadable: false }));
-        const relevantGrants = projection.grants.grants.filter((grant) => (grant.subjectType === "user" && grant.subjectId === input.userId) ||
-            (grant.subjectType === "group" && reachable.has(grant.subjectId)));
-        const grants = await enrichGrants(input.execSql, relevantGrants, input.organizationId);
-        return {
-            organizationId: input.organizationId,
-            user,
-            groups,
-            grants: {
-                directGrants: grants.filter((grant) => grant.subjectType === "user" && grant.subjectId === input.userId),
-                groupGrants: grants.filter((grant) => grant.subjectType === "group" && reachable.has(grant.subjectId)),
-            },
-        };
-    });
-}
-//# sourceMappingURL=localReadModelDetails.js.map

package/workflows/organizations/localReadModelDetails.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"localReadModelDetails.js","sourceRoot":"","sources":["localReadModelDetails.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,8BAA8B,EAAE,MAAM,wDAAwD,CAAC;AACxG,OAAO,EAAE,iCAAiC,EAAE,MAAM,uEAAuE,CAAC;AAC1H,OAAO,EAAE,mCAAmC,EAAE,MAAM,uEAAuE,CAAC;AAC5H,OAAO,EAAE,yBAAyB,EAAE,MAAM,mDAAmD,CAAC;AAC9F,OAAO,EAAE,kCAAkC,EAAE,MAAM,8CAA8C,CAAC;AAElG,OAAO,EAAE,+BAA+B,EAAE,MAAM,uCAAuC,CAAC;AACxF,OAAO,EACL,mCAAmC,EACnC,8BAA8B,GAC/B,MAAM,0BAA0B,CAAC;AAmBlC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAEpC,SAAS,kBAAkB,CACzB,MAAqD;IAErD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,OAAgB,EAChB,MAAqD,EACrD,cAAsB;IAEtB,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,MAAM,iCAAiC,CACxD,OAAO,EACP,cAAc,CACf,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,kCAAkC,CACzD,OAAO,EACP,cAAc,CACf,CAAC;IACF,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC/C,KACE,IAAI,KAAK,GAAG,CAAC,EACb,KAAK,GAAG,YAAY,CAAC,MAAM,EAC3B,KAAK,IAAI,uBAAuB,EAChC,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,8BAA8B,CAChD,OAAO,EACP,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,uBAAuB,CAAC,CAC3D,CAAC;QACF,KAAK,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,IAAI,KAAK,EAAE,CAAC;YAC/C,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5B,GAAG,KAAK;QACR,oBAAoB,EAAE,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,IAAI;QACjE,SAAS,EACP,KAAK,CAAC,WAAW,KAAK,OAAO;YAC3B,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;gBAChC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;gBAC/B,IAAI,CAAC;YACP,CAAC,CAAC,IAAI;KACX,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAiC;IAEjC,OAAO;QACL,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,KAM1B;IACC,OAAO,IAAI,GAAG,CACZ,KAAK,CAAC,KAAK;SACR,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC;SAC9C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAC/B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAA0B;IAE1B,OAAO,+BAA+B,CACpC,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,EAClD,WAAW,EACX,KAAK,IAAI,EAAE;QACT,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAC1D,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,aAAa,CACpB,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,MAAM,EAAE,MAAM,YAAY,CACxB,KAAK,CAAC,OAAO,EACb,UAAU,CAAC,MAAM,CAAC,MAAM,EACxB,KAAK,CAAC,cAAc,CACrB;SACF,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAAyD;IAEzD,OAAO,+BAA+B,CACpC,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,EAClD,WAAW,EACX,KAAK,IAAI,EAAE;QACT,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAC1D,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,aAAa,CACpB,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,qBAAqB,GACzB,KAAK,CAAC,OAAO,KAAK,UAAU,CAAC,MAAM,CAAC,aAAa;YACjD,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAC3B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAC3C,CAAC;QACJ,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAC5C,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,OAAO,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,OAAO,CACrE,CAAC;QACF,OAAO;YACL,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU,EAAE,CACV,MAAM,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC,CAChE,CAAC,GAAG,CAAC,gBAAgB,CAAC;SACxB,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAC3D,KAAyD;IAEzD,OAAO,+BAA+B,CACpC,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,EAClD,WAAW,EACX,KAAK,IAAI,EAAE;QACT,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAC1D,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,aAAa,CACpB,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,aAAa,GAAG,UAAU,CAAC,WAAW,CAAC,IAAI,CAC/C,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,aAAa,KAAK,OAAO,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,OAAO,CACvE,CAAC;QACF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAC5C,KAAK,CAAC,OAAO,EACb,OAAO,EACP,KAAK,CAAC,OAAO,CACd,CAAC;QACF,OAAO,gCAAgC,CAAC,MAAM,EAAE,aAAa,CAAC;YAC5D,CAAC,CAAC,mCAAmC,CAAC,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC;YACnE,CAAC,CAAC,IAAI,CAAC;IACX,CAAC,CACF,CAAC;AACJ,CAAC;AAED,SAAS,gCAAgC,CACvC,MAA4C,EAC5C,aAQC;IAED,MAAM,UAAU,GAAG,MAAM,EAAE,YAAY,CAAC;IACxC,OAAO,OAAO,CACZ,UAAU;QACR,UAAU,CAAC,aAAa,KAAK,aAAa,CAAC,aAAa;QACxD,UAAU,CAAC,WAAW,KAAK,aAAa,CAAC,WAAW;QACpD,UAAU,CAAC,SAAS,KAAK,aAAa,CAAC,SAAS;QAChD,UAAU,CAAC,OAAO,KAAK,aAAa,CAAC,OAAO;QAC5C,UAAU,CAAC,QAAQ,KAAK,aAAa,CAAC,QAAQ;QAC9C,UAAU,CAAC,cAAc,KAAK,aAAa,CAAC,cAAc;QAC1D,UAAU,CAAC,WAAW,KAAK,aAAa,CAAC,WAAW,CACvD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,KAA0B;IAE1B,OAAO,+BAA+B,CACpC,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,EAClD,WAAW,EACX,KAAK,IAAI,EAAE;QACT,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAC1D,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,aAAa,CACpB,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,aAAa,GAAG,UAAU,CAAC,WAAW,CAAC,IAAI,CAC/C,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,aAAa,KAAK,cAAc;YACrC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc,CAC5C,CAAC;QACF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAC5C,KAAK,CAAC,OAAO,EACb,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,OAAO,gCAAgC,CAAC,MAAM,EAAE,aAAa,CAAC;YAC5D,CAAC,CAAC,8BAA8B,CAAC,MAAM,CAAC;YACxC,CAAC,CAAC,IAAI,CAAC;IACX,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAGC;IAED,OAAO,+BAA+B,CACpC,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,EAClD,WAAW,EACX,KAAK,IAAI,EAAE;QACT,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAC1D,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,aAAa,CACpB,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,UAAU,CAAC,WAAW,CAAC,IAAI,CACtC,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa;YAC/C,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAC9C,CAAC;QACF,OAAO,IAAI;YACT,CAAC,CAAC;gBACE,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,cAAc,EAAE,IAAI,CAAC,cAAc;aACpC;YACH,CAAC,CAAC,IAAI,CAAC;IACX,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KAAwD;IAExD,OAAO,+BAA+B,CACpC,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,EAClD,WAAW,EACX,KAAK,IAAI,EAAE;QACT,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAC1D,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,aAAa,CACpB,CAAC;QACF,MAAM,IAAI,GAAG,UAAU,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,CAC3C,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CACjD,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,SAAS,IAAI,CAAC,IAAI,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,SAAS,GAAG,iBAAiB,CAAC;YAClC,KAAK,EAAE,UAAU,CAAC,eAAe;YACjC,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM;aACpC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;aAC/C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACzD,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CACpD,CAAC,KAAK,EAAE,EAAE,CACR,CAAC,KAAK,CAAC,WAAW,KAAK,MAAM,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,MAAM,CAAC;YAClE,CAAC,KAAK,CAAC,WAAW,KAAK,OAAO,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CACpE,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,KAAK,CAAC,OAAO,EACb,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,OAAO;YACL,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,IAAI;YACJ,MAAM;YACN,MAAM,EAAE;gBACN,YAAY,EAAE,MAAM,CAAC,MAAM,CACzB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,MAAM,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,MAAM,CACnE;gBACD,WAAW,EAAE,MAAM,CAAC,MAAM,CACxB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,OAAO,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAClE;aACF;SACF,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  OrganizationContainerGrantResponse,\n  PrincipalPolicyBundleResponse,\n  ReferencedPrincipalStateResponse,\n} from \"@tearleads/validators/response\";\nimport { loadContainerDisplayNamesByIds } from \"../../data/persistence/containers/containerPersistence\";\nimport { loadOrganizationGroupDisplayNames } from \"../../data/persistence/organizations/organizationGroupNamePersistence\";\nimport { loadOrganizationReadModelProjection } from \"../../data/persistence/organizations/organizationReadModelPersistence\";\nimport { loadPrincipalPolicyBundle } from \"../../data/persistence/principalPolicyPersistence\";\nimport { loadVerifiedOrganizationGroupRoles } from \"../../data/principals/organizationGroupRoles\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport { runOrganizationPresentationRead } from \"./organizationPresentationAccessState\";\nimport {\n  buildOrganizationGroupPolicyHistory,\n  buildOrganizationPolicyHistory,\n} from \"./policyHistoryReadModel\";\nimport type {\n  OrganizationContainerGrant,\n  OrganizationContainerGrants,\n  OrganizationGroupContainer,\n  OrganizationGroupContainers,\n  OrganizationGroupPolicyHistory,\n  OrganizationPolicyHistory,\n  OrganizationUserDetail,\n} from \"./readModel\";\n\ninterface LocalReadModelInput {\n  readonly currentUserId: string;\n  readonly execSql: ExecSql;\n  readonly organizationId: string;\n}\n\ntype PolicyPrincipalType = ReferencedPrincipalStateResponse[\"principalType\"];\n\nconst DISPLAY_NAME_BATCH_SIZE = 400;\n\nfunction uniqueContainerIds(\n  grants: readonly OrganizationContainerGrantResponse[],\n): string[] {\n  return [...new Set(grants.map((grant) => grant.containerId))];\n}\n\nasync function enrichGrants(\n  execSql: ExecSql,\n  grants: readonly OrganizationContainerGrantResponse[],\n  organizationId: string,\n): Promise<OrganizationContainerGrant[]> {\n  const containerIds = uniqueContainerIds(grants);\n  const groupNames = await loadOrganizationGroupDisplayNames(\n    execSql,\n    organizationId,\n  );\n  const groupRoles = await loadVerifiedOrganizationGroupRoles(\n    execSql,\n    organizationId,\n  );\n  const displayNames = new Map<string, string>();\n  for (\n    let index = 0;\n    index < containerIds.length;\n    index += DISPLAY_NAME_BATCH_SIZE\n  ) {\n    const batch = await loadContainerDisplayNamesByIds(\n      execSql,\n      containerIds.slice(index, index + DISPLAY_NAME_BATCH_SIZE),\n    );\n    for (const [containerId, displayName] of batch) {\n      displayNames.set(containerId, displayName);\n    }\n  }\n  return grants.map((grant) => ({\n    ...grant,\n    containerDisplayName: displayNames.get(grant.containerId) ?? null,\n    groupName:\n      grant.subjectType === \"group\"\n        ? (groupRoles.get(grant.subjectId) ??\n          groupNames.get(grant.subjectId) ??\n          null)\n        : null,\n  }));\n}\n\nfunction toGroupContainer(\n  grant: OrganizationContainerGrant,\n): OrganizationGroupContainer {\n  return {\n    accessLevel: grant.accessLevel,\n    containerId: grant.containerId,\n    containerDisplayName: grant.containerDisplayName,\n    createdAt: grant.createdAt,\n    depth: grant.depth,\n    isBuiltin: grant.isBuiltin,\n    metadataAccessEpoch: grant.metadataAccessEpoch,\n    metadataAccessStateHash: grant.metadataAccessStateHash,\n    metadataDocumentId: grant.metadataDocumentId,\n    parentId: grant.parentId,\n    updatedAt: grant.updatedAt,\n  };\n}\n\n/**\n * The groups a user belongs to is exactly the set naming them as a member.\n *\n * This used to be a breadth-first walk over group-in-group edges. Groups\n * contain only users now, so the walk had no second level to visit.\n */\nfunction reachableGroupIds(input: {\n  readonly edges: ReadonlyArray<{\n    readonly groupId: string;\n    readonly userId: string;\n  }>;\n  readonly userId: string;\n}): Set<string> {\n  return new Set(\n    input.edges\n      .filter((edge) => edge.userId === input.userId)\n      .map((edge) => edge.groupId),\n  );\n}\n\nexport async function loadLocalOrganizationContainerGrants(\n  input: LocalReadModelInput,\n): Promise<OrganizationContainerGrants | null> {\n  return runOrganizationPresentationRead(\n    { ...input, requesterUserId: input.currentUserId },\n    \"readModel\",\n    async () => {\n      const projection = await loadOrganizationReadModelProjection(\n        input.execSql,\n        input.organizationId,\n        input.currentUserId,\n      );\n      if (!projection?.requester) {\n        return null;\n      }\n      return {\n        organizationId: input.organizationId,\n        grants: await enrichGrants(\n          input.execSql,\n          projection.grants.grants,\n          input.organizationId,\n        ),\n      };\n    },\n  );\n}\n\nexport async function loadLocalOrganizationGroupContainers(\n  input: LocalReadModelInput & { readonly groupId: string },\n): Promise<OrganizationGroupContainers | null> {\n  return runOrganizationPresentationRead(\n    { ...input, requesterUserId: input.currentUserId },\n    \"readModel\",\n    async () => {\n      const projection = await loadOrganizationReadModelProjection(\n        input.execSql,\n        input.organizationId,\n        input.currentUserId,\n      );\n      if (!projection?.requester) {\n        return null;\n      }\n      const groupIsInOrganization =\n        input.groupId === projection.groups.memberGroupId ||\n        projection.groups.groups.some(\n          (group) => group.groupId === input.groupId,\n        );\n      if (!groupIsInOrganization) {\n        return null;\n      }\n      const grants = projection.grants.grants.filter(\n        (grant) =>\n          grant.subjectType === \"group\" && grant.subjectId === input.groupId,\n      );\n      return {\n        organizationId: input.organizationId,\n        groupId: input.groupId,\n        containers: (\n          await enrichGrants(input.execSql, grants, input.organizationId)\n        ).map(toGroupContainer),\n      };\n    },\n  );\n}\n\nexport async function loadLocalOrganizationGroupPolicyHistory(\n  input: LocalReadModelInput & { readonly groupId: string },\n): Promise<OrganizationGroupPolicyHistory | null> {\n  return runOrganizationPresentationRead(\n    { ...input, requesterUserId: input.currentUserId },\n    \"readModel\",\n    async () => {\n      const projection = await loadOrganizationReadModelProjection(\n        input.execSql,\n        input.organizationId,\n        input.currentUserId,\n      );\n      if (!projection?.requester) {\n        return null;\n      }\n\n      const projectedHead = projection.policyHeads.find(\n        (head) =>\n          head.principalType === \"group\" && head.principalId === input.groupId,\n      );\n      if (!projectedHead) {\n        return null;\n      }\n\n      const bundle = await loadPrincipalPolicyBundle(\n        input.execSql,\n        \"group\",\n        input.groupId,\n      );\n      return policyBundleMatchesProjectedHead(bundle, projectedHead)\n        ? buildOrganizationGroupPolicyHistory(bundle, input.organizationId)\n        : null;\n    },\n  );\n}\n\nfunction policyBundleMatchesProjectedHead(\n  bundle: PrincipalPolicyBundleResponse | null,\n  projectedHead: {\n    readonly keyEpoch: number;\n    readonly keyFingerprint: string;\n    readonly memberCount: number;\n    readonly principalId: string;\n    readonly principalType: PolicyPrincipalType;\n    readonly stateHash: string;\n    readonly version: number;\n  },\n): bundle is PrincipalPolicyBundleResponse {\n  const storedHead = bundle?.currentState;\n  return Boolean(\n    storedHead &&\n      storedHead.principalType === projectedHead.principalType &&\n      storedHead.principalId === projectedHead.principalId &&\n      storedHead.stateHash === projectedHead.stateHash &&\n      storedHead.version === projectedHead.version &&\n      storedHead.keyEpoch === projectedHead.keyEpoch &&\n      storedHead.keyFingerprint === projectedHead.keyFingerprint &&\n      storedHead.memberCount === projectedHead.memberCount,\n  );\n}\n\nexport async function loadLocalOrganizationPolicyHistory(\n  input: LocalReadModelInput,\n): Promise<OrganizationPolicyHistory | null> {\n  return runOrganizationPresentationRead(\n    { ...input, requesterUserId: input.currentUserId },\n    \"readModel\",\n    async () => {\n      const projection = await loadOrganizationReadModelProjection(\n        input.execSql,\n        input.organizationId,\n        input.currentUserId,\n      );\n      if (!projection?.requester) {\n        return null;\n      }\n      const projectedHead = projection.policyHeads.find(\n        (head) =>\n          head.principalType === \"organization\" &&\n          head.principalId === input.organizationId,\n      );\n      if (!projectedHead) {\n        return null;\n      }\n      const bundle = await loadPrincipalPolicyBundle(\n        input.execSql,\n        \"organization\",\n        input.organizationId,\n      );\n      return policyBundleMatchesProjectedHead(bundle, projectedHead)\n        ? buildOrganizationPolicyHistory(bundle)\n        : null;\n    },\n  );\n}\n\nexport async function loadLocalOrganizationPolicyReference(\n  input: LocalReadModelInput & {\n    readonly principalId: string;\n    readonly principalType: PolicyPrincipalType;\n  },\n): Promise<ReferencedPrincipalStateResponse | null> {\n  return runOrganizationPresentationRead(\n    { ...input, requesterUserId: input.currentUserId },\n    \"readModel\",\n    async () => {\n      const projection = await loadOrganizationReadModelProjection(\n        input.execSql,\n        input.organizationId,\n        input.currentUserId,\n      );\n      if (!projection?.requester) {\n        return null;\n      }\n      const head = projection.policyHeads.find(\n        (candidate) =>\n          candidate.principalType === input.principalType &&\n          candidate.principalId === input.principalId,\n      );\n      return head\n        ? {\n            principalType: head.principalType,\n            principalId: head.principalId,\n            stateHash: head.stateHash,\n            version: head.version,\n            keyEpoch: head.keyEpoch,\n            keyFingerprint: head.keyFingerprint,\n          }\n        : null;\n    },\n  );\n}\n\nexport async function loadLocalOrganizationUserDetail(\n  input: LocalReadModelInput & { readonly userId: string },\n): Promise<OrganizationUserDetail | null> {\n  return runOrganizationPresentationRead(\n    { ...input, requesterUserId: input.currentUserId },\n    \"readModel\",\n    async () => {\n      const projection = await loadOrganizationReadModelProjection(\n        input.execSql,\n        input.organizationId,\n        input.currentUserId,\n      );\n      const user = projection?.directory.users.find(\n        (candidate) => candidate.userId === input.userId,\n      );\n      if (!projection?.requester || !user) {\n        return null;\n      }\n\n      const reachable = reachableGroupIds({\n        edges: projection.membershipEdges,\n        userId: input.userId,\n      });\n      const groups = projection.groups.groups\n        .filter((group) => reachable.has(group.groupId))\n        .map((group) => ({ ...group, nameUnreadable: false }));\n      const relevantGrants = projection.grants.grants.filter(\n        (grant) =>\n          (grant.subjectType === \"user\" && grant.subjectId === input.userId) ||\n          (grant.subjectType === \"group\" && reachable.has(grant.subjectId)),\n      );\n      const grants = await enrichGrants(\n        input.execSql,\n        relevantGrants,\n        input.organizationId,\n      );\n      return {\n        organizationId: input.organizationId,\n        user,\n        groups,\n        grants: {\n          directGrants: grants.filter(\n            (grant) =>\n              grant.subjectType === \"user\" && grant.subjectId === input.userId,\n          ),\n          groupGrants: grants.filter(\n            (grant) =>\n              grant.subjectType === \"group\" && reachable.has(grant.subjectId),\n          ),\n        },\n      };\n    },\n  );\n}\n"]}

package/workflows/organizations/organizationGroupDirectory.js

@@ -1,153 +0,0 @@
-import { buildPrincipalStateSigningInput, generateKemSeedAndKeyPair, normalizePrincipalProjectionMembers, signPrincipalState, toFingerprint, } from "../../internal/crypto/index.js";
-import { bytesToBase64 } from "../../internal/encoding/index.js";
-import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
-import { persistLocallyAcknowledgedPrincipalPolicyBundles } from "../../data/persistence/locallyAcknowledgedCheckpointPersistence.js";
-import { encodeOrganizationAuthorityDescriptor, normalizeOrganizationGroupHeads, } from "../../data/principals/organizationAuthorityDescriptor.js";
-import { assertGroupNameUniqueInDirectory } from "./groupNameUniqueness.js";
-import { acknowledgeGroupPolicyState, acknowledgeInitialGroupPolicy, buildAcknowledgedGroupPolicyBundle, } from "./groupPolicyMutationAcknowledgement.js";
-import { groupPolicyMutationHead } from "./groupPolicyMutationHead.js";
-import { rewrapProjectionMemberEnvelopes } from "./principalPolicyRecipients.js";
-import { projectionUserIds, resolveRequiredUserIdentities, } from "./trustedOrganizationUsers.js";
-function organizationGroupHead(head) {
-    if (head.principalType !== "group") {
-        throw new Error("Organization directory can contain only group heads");
-    }
-    return { ...head, principalType: "group" };
-}
-export function replaceOrganizationGroupHead(input) {
-    const nextHead = organizationGroupHead(input.nextHead);
-    return normalizeOrganizationGroupHeads([
-        ...input.descriptor.groupHeads.filter((head) => head.principalId !== nextHead.principalId),
-        nextHead,
-    ]);
-}
-export function removeOrganizationGroupHead(input) {
-    if (input.groupId === input.descriptor.adminGroupId ||
-        input.groupId === input.descriptor.memberGroupId) {
-        throw new Error("Built-in groups cannot be removed from the directory");
-    }
-    const groupHeads = input.descriptor.groupHeads.filter((head) => head.principalId !== input.groupId);
-    if (groupHeads.length === input.descriptor.groupHeads.length) {
-        throw new Error("Organization directory does not commit the deleted group");
-    }
-    return normalizeOrganizationGroupHeads(groupHeads);
-}
-export async function buildOrganizationGroupDirectoryPolicyRequest(input) {
-    const projection = normalizePrincipalProjectionMembers(input.adminProjection);
-    if (projection.length === 0 ||
-        projection.some((member) => member.role !== "admin")) {
-        throw new Error("Organization policy must mirror the Admins projection");
-    }
-    const organizationKem = generateKemSeedAndKeyPair();
-    const memberEnvelopes = await rewrapProjectionMemberEnvelopes({
-        projection,
-        secretKey: organizationKem.secretKey,
-        users: input.adminUsers,
-    });
-    const payloadCiphertext = encodeOrganizationAuthorityDescriptor({
-        ...input.descriptor,
-        groupHeads: input.groupHeads,
-    });
-    const state = await signPrincipalState(await buildPrincipalStateSigningInput({
-        principalType: "organization",
-        principalId: input.descriptor.organizationId,
-        version: input.currentPolicy.currentState.version + 1,
-        prevStateHash: input.currentPolicy.currentState.stateHash,
-        keyEpoch: input.currentPolicy.currentState.keyEpoch + 1,
-        encapsulationPublicKey: bytesToBase64(organizationKem.publicKey),
-        keyFingerprint: await toFingerprint(organizationKem.publicKey),
-        members: projection.map((member) => ({ userId: member.userId })),
-        memberEnvelopes,
-        projection,
-        grants: [],
-        payloadCiphertext,
-        externalAuthority: null,
-        signedAt: new Date().toISOString(),
-        signerUserId: input.signerUserId,
-        signerUserKeyFingerprint: input.signingFingerprint,
-    }), input.signingKeyPair.signingPrivateKey);
-    return {
-        encryptedPayload: {
-            cipherSuite: "aes-256-gcm",
-            ciphertext: payloadCiphertext,
-            ciphertextHash: state.payloadCiphertextHash,
-        },
-        grants: [],
-        memberEnvelopes,
-        projection,
-        state,
-    };
-}
-export async function commitCreatedGroupToDirectory(input) {
-    assertProjectionVerificationCurrent(input.stillCurrent);
-    // Signed group names are unique per organization; refuse a collision before
-    // anything reaches the server.
-    await assertGroupNameUniqueInDirectory({
-        apiClient: input.apiClient,
-        descriptor: input.externalAdminPolicy.descriptor,
-        execSql: input.execSql,
-        externalAuthority: input.externalAdminPolicy.externalAuthority,
-        name: input.name,
-        readEncryptedName: input.readEncryptedName,
-        organizationId: input.organizationId,
-        reportSecurityIncident: input.reportSecurityIncident,
-        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
-    });
-    const expectedHead = await groupPolicyMutationHead(input.request.initialGroupPolicy);
-    const adminProjection = input.externalAdminPolicy.adminBundle.currentProjection;
-    const adminUsers = await resolveRequiredUserIdentities({
-        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
-        userIds: projectionUserIds(adminProjection),
-    });
-    const organizationRequest = await buildOrganizationGroupDirectoryPolicyRequest({
-        adminProjection,
-        adminUsers,
-        currentPolicy: input.externalAdminPolicy.bundle,
-        descriptor: input.externalAdminPolicy.descriptor,
-        groupHeads: [
-            ...input.externalAdminPolicy.descriptor.groupHeads,
-            organizationGroupHead(expectedHead),
-        ],
-        signerUserId: input.signerUserId,
-        signingFingerprint: input.signingFingerprint,
-        signingKeyPair: input.signingKeyPair,
-    });
-    assertProjectionVerificationCurrent(input.stillCurrent);
-    const stored = await input.apiClient.createOrganizationGroup(input.organizationId, { ...input.request, organizationPolicy: organizationRequest });
-    assertProjectionVerificationCurrent(input.stillCurrent);
-    if (!stored) {
-        throw new Error("Group could not be created");
-    }
-    const acknowledged = await acknowledgeInitialGroupPolicy({
-        organizationId: input.organizationId,
-        request: input.request,
-        response: stored.group,
-        stateHash: expectedHead.stateHash,
-    });
-    const organizationHead = await groupPolicyMutationHead(organizationRequest);
-    const organizationPolicy = await acknowledgeGroupPolicyState({
-        currentPolicy: input.externalAdminPolicy.bundle,
-        expectedHead: organizationHead,
-        request: organizationRequest,
-        response: stored.organizationPolicy.currentState,
-    });
-    const organizationBundle = buildAcknowledgedGroupPolicyBundle({
-        currentPolicy: input.externalAdminPolicy.bundle,
-        expectedHead: organizationHead,
-        request: organizationRequest,
-        response: stored.organizationPolicy,
-    });
-    await persistLocallyAcknowledgedPrincipalPolicyBundles({
-        entries: [
-            { bundle: acknowledged.bundle, policy: acknowledged.policy },
-            { bundle: organizationBundle, policy: organizationPolicy },
-        ],
-        execSql: input.execSql,
-        organizationId: input.organizationId,
-        updatedAt: new Date().toISOString(),
-        stillCurrent: input.stillCurrent,
-    });
-    assertProjectionVerificationCurrent(input.stillCurrent);
-    return { group: stored.group, head: expectedHead };
-}
-//# sourceMappingURL=organizationGroupDirectory.js.map

package/workflows/organizations/organizationGroupDirectory.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"organizationGroupDirectory.js","sourceRoot":"","sources":["organizationGroupDirectory.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,EAC/B,yBAAyB,EACzB,mCAAmC,EAGnC,kBAAkB,EAClB,aAAa,GACd,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AASpD,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,gDAAgD,EAAE,MAAM,iEAAiE,CAAC;AACnI,OAAO,EACL,qCAAqC,EACrC,+BAA+B,GAGhC,MAAM,uDAAuD,CAAC;AAQ/D,OAAO,EAAE,gCAAgC,EAAE,MAAM,uBAAuB,CAAC;AACzE,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAC7B,kCAAkC,GACnC,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AAK9E,OAAO,EACL,iBAAiB,EACjB,6BAA6B,GAC9B,MAAM,4BAA4B,CAAC;AAEpC,SAAS,qBAAqB,CAC5B,IAA6B;IAE7B,IAAI,IAAI,CAAC,aAAa,KAAK,OAAO,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,KAG5C;IACC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvD,OAAO,+BAA+B,CAAC;QACrC,GAAG,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,CACnC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,CACpD;QACD,QAAQ;KACT,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAG3C;IACC,IACE,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,UAAU,CAAC,YAAY;QAC/C,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,UAAU,CAAC,aAAa,EAChD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,CACnD,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,OAAO,CAC7C,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,KAAK,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,+BAA+B,CAAC,UAAU,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4CAA4C,CAAC,KASlE;IACC,MAAM,UAAU,GAAG,mCAAmC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAC9E,IACE,UAAU,CAAC,MAAM,KAAK,CAAC;QACvB,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,EACpD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,eAAe,GAAG,yBAAyB,EAAE,CAAC;IACpD,MAAM,eAAe,GAAG,MAAM,+BAA+B,CAAC;QAC5D,UAAU;QACV,SAAS,EAAE,eAAe,CAAC,SAAS;QACpC,KAAK,EAAE,KAAK,CAAC,UAAU;KACxB,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,qCAAqC,CAAC;QAC9D,GAAG,KAAK,CAAC,UAAU;QACnB,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,kBAAkB,CACpC,MAAM,+BAA+B,CAAC;QACpC,aAAa,EAAE,cAAc;QAC7B,WAAW,EAAE,KAAK,CAAC,UAAU,CAAC,cAAc;QAC5C,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,OAAO,GAAG,CAAC;QACrD,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,SAAS;QACzD,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,QAAQ,GAAG,CAAC;QACvD,sBAAsB,EAAE,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC;QAChE,cAAc,EAAE,MAAM,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC;QAC9D,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAChE,eAAe;QACf,UAAU;QACV,MAAM,EAAE,EAAE;QACV,iBAAiB;QACjB,iBAAiB,EAAE,IAAI;QACvB,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,wBAAwB,EAAE,KAAK,CAAC,kBAAkB;KACnD,CAAC,EACF,KAAK,CAAC,cAAc,CAAC,iBAAiB,CACvC,CAAC;IAEF,OAAO;QACL,gBAAgB,EAAE;YAChB,WAAW,EAAE,aAAa;YAC1B,UAAU,EAAE,iBAAiB;YAC7B,cAAc,EAAE,KAAK,CAAC,qBAAqB;SAC5C;QACD,MAAM,EAAE,EAAE;QACV,eAAe;QACf,UAAU;QACV,KAAK;KACN,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAgBnD;IAIC,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,4EAA4E;IAC5E,+BAA+B;IAC/B,MAAM,gCAAgC,CAAC;QACrC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,mBAAmB,CAAC,UAAU;QAChD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,iBAAiB,EAAE,KAAK,CAAC,mBAAmB,CAAC,iBAAiB;QAC9D,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,MAAM,uBAAuB,CAChD,KAAK,CAAC,OAAO,CAAC,kBAAkB,CACjC,CAAC;IACF,MAAM,eAAe,GACnB,KAAK,CAAC,mBAAmB,CAAC,WAAW,CAAC,iBAAiB,CAAC;IAC1D,MAAM,UAAU,GAAG,MAAM,6BAA6B,CAAC;QACrD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,OAAO,EAAE,iBAAiB,CAAC,eAAe,CAAC;KAC5C,CAAC,CAAC;IACH,MAAM,mBAAmB,GACvB,MAAM,4CAA4C,CAAC;QACjD,eAAe;QACf,UAAU;QACV,aAAa,EAAE,KAAK,CAAC,mBAAmB,CAAC,MAAM;QAC/C,UAAU,EAAE,KAAK,CAAC,mBAAmB,CAAC,UAAU;QAChD,UAAU,EAAE;YACV,GAAG,KAAK,CAAC,mBAAmB,CAAC,UAAU,CAAC,UAAU;YAClD,qBAAqB,CAAC,YAAY,CAAC;SACpC;QACD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACL,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,uBAAuB,CAC1D,KAAK,CAAC,cAAc,EACpB,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,CAC9D,CAAC;IACF,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,6BAA6B,CAAC;QACvD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,MAAM,CAAC,KAAK;QACtB,SAAS,EAAE,YAAY,CAAC,SAAS;KAClC,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,MAAM,uBAAuB,CAAC,mBAAmB,CAAC,CAAC;IAC5E,MAAM,kBAAkB,GAAG,MAAM,2BAA2B,CAAC;QAC3D,aAAa,EAAE,KAAK,CAAC,mBAAmB,CAAC,MAAM;QAC/C,YAAY,EAAE,gBAAgB;QAC9B,OAAO,EAAE,mBAAmB;QAC5B,QAAQ,EAAE,MAAM,CAAC,kBAAkB,CAAC,YAAY;KACjD,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,kCAAkC,CAAC;QAC5D,aAAa,EAAE,KAAK,CAAC,mBAAmB,CAAC,MAAM;QAC/C,YAAY,EAAE,gBAAgB;QAC9B,OAAO,EAAE,mBAAmB;QAC5B,QAAQ,EAAE,MAAM,CAAC,kBAAkB;KACpC,CAAC,CAAC;IACH,MAAM,gDAAgD,CAAC;QACrD,OAAO,EAAE;YACP,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE;YAC5D,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;SAC3D;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AACrD,CAAC","sourcesContent":["import {\n  buildPrincipalStateSigningInput,\n  generateKemSeedAndKeyPair,\n  normalizePrincipalProjectionMembers,\n  type ReferencedPrincipalHead,\n  type SigningKeyPair,\n  signPrincipalState,\n  toFingerprint,\n} from \"@tearleads/crypto\";\nimport { bytesToBase64 } from \"@tearleads/encoding\";\nimport type {\n  PrincipalProjectionMemberRequest,\n  PutPrincipalPolicyRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n  OrganizationGroupSummaryResponse,\n  PrincipalPolicyBundleResponse,\n} from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { persistLocallyAcknowledgedPrincipalPolicyBundles } from \"../../data/persistence/locallyAcknowledgedCheckpointPersistence\";\nimport {\n  encodeOrganizationAuthorityDescriptor,\n  normalizeOrganizationGroupHeads,\n  type OrganizationAuthorityDescriptor,\n  type OrganizationGroupHead,\n} from \"../../data/principals/organizationAuthorityDescriptor\";\nimport type { SecurityIncidentReporter } from \"../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type {\n  TrustedUserIdentity,\n  TrustedUserIdentityResolver,\n} from \"../../data/trustedUserIdentity\";\nimport type { loadOrganizationExternalAdminPolicy } from \"../principals/externalAdminPolicy\";\nimport { assertGroupNameUniqueInDirectory } from \"./groupNameUniqueness\";\nimport {\n  acknowledgeGroupPolicyState,\n  acknowledgeInitialGroupPolicy,\n  buildAcknowledgedGroupPolicyBundle,\n} from \"./groupPolicyMutationAcknowledgement\";\nimport type { OrganizationPrincipalPolicyApi } from \"./groupPolicyMutationContext\";\nimport { groupPolicyMutationHead } from \"./groupPolicyMutationHead\";\nimport { rewrapProjectionMemberEnvelopes } from \"./principalPolicyRecipients\";\nimport type {\n  buildInitialGroupPolicyRequest,\n  GroupPolicyNameReader,\n} from \"./principalPolicyRequest\";\nimport {\n  projectionUserIds,\n  resolveRequiredUserIdentities,\n} from \"./trustedOrganizationUsers\";\n\nfunction organizationGroupHead(\n  head: ReferencedPrincipalHead,\n): OrganizationGroupHead {\n  if (head.principalType !== \"group\") {\n    throw new Error(\"Organization directory can contain only group heads\");\n  }\n  return { ...head, principalType: \"group\" };\n}\n\nexport function replaceOrganizationGroupHead(input: {\n  readonly descriptor: OrganizationAuthorityDescriptor;\n  readonly nextHead: ReferencedPrincipalHead;\n}): OrganizationGroupHead[] {\n  const nextHead = organizationGroupHead(input.nextHead);\n  return normalizeOrganizationGroupHeads([\n    ...input.descriptor.groupHeads.filter(\n      (head) => head.principalId !== nextHead.principalId,\n    ),\n    nextHead,\n  ]);\n}\n\nexport function removeOrganizationGroupHead(input: {\n  readonly descriptor: OrganizationAuthorityDescriptor;\n  readonly groupId: string;\n}): OrganizationGroupHead[] {\n  if (\n    input.groupId === input.descriptor.adminGroupId ||\n    input.groupId === input.descriptor.memberGroupId\n  ) {\n    throw new Error(\"Built-in groups cannot be removed from the directory\");\n  }\n  const groupHeads = input.descriptor.groupHeads.filter(\n    (head) => head.principalId !== input.groupId,\n  );\n  if (groupHeads.length === input.descriptor.groupHeads.length) {\n    throw new Error(\"Organization directory does not commit the deleted group\");\n  }\n  return normalizeOrganizationGroupHeads(groupHeads);\n}\n\nexport async function buildOrganizationGroupDirectoryPolicyRequest(input: {\n  readonly adminProjection: readonly PrincipalProjectionMemberRequest[];\n  readonly adminUsers: readonly TrustedUserIdentity[];\n  readonly currentPolicy: Pick<PrincipalPolicyBundleResponse, \"currentState\">;\n  readonly descriptor: OrganizationAuthorityDescriptor;\n  readonly groupHeads: readonly OrganizationGroupHead[];\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n}): Promise<PutPrincipalPolicyRequest> {\n  const projection = normalizePrincipalProjectionMembers(input.adminProjection);\n  if (\n    projection.length === 0 ||\n    projection.some((member) => member.role !== \"admin\")\n  ) {\n    throw new Error(\"Organization policy must mirror the Admins projection\");\n  }\n  const organizationKem = generateKemSeedAndKeyPair();\n  const memberEnvelopes = await rewrapProjectionMemberEnvelopes({\n    projection,\n    secretKey: organizationKem.secretKey,\n    users: input.adminUsers,\n  });\n  const payloadCiphertext = encodeOrganizationAuthorityDescriptor({\n    ...input.descriptor,\n    groupHeads: input.groupHeads,\n  });\n  const state = await signPrincipalState(\n    await buildPrincipalStateSigningInput({\n      principalType: \"organization\",\n      principalId: input.descriptor.organizationId,\n      version: input.currentPolicy.currentState.version + 1,\n      prevStateHash: input.currentPolicy.currentState.stateHash,\n      keyEpoch: input.currentPolicy.currentState.keyEpoch + 1,\n      encapsulationPublicKey: bytesToBase64(organizationKem.publicKey),\n      keyFingerprint: await toFingerprint(organizationKem.publicKey),\n      members: projection.map((member) => ({ userId: member.userId })),\n      memberEnvelopes,\n      projection,\n      grants: [],\n      payloadCiphertext,\n      externalAuthority: null,\n      signedAt: new Date().toISOString(),\n      signerUserId: input.signerUserId,\n      signerUserKeyFingerprint: input.signingFingerprint,\n    }),\n    input.signingKeyPair.signingPrivateKey,\n  );\n\n  return {\n    encryptedPayload: {\n      cipherSuite: \"aes-256-gcm\",\n      ciphertext: payloadCiphertext,\n      ciphertextHash: state.payloadCiphertextHash,\n    },\n    grants: [],\n    memberEnvelopes,\n    projection,\n    state,\n  };\n}\n\nexport async function commitCreatedGroupToDirectory(input: {\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly name: string;\n  readonly readEncryptedName?: GroupPolicyNameReader;\n  readonly apiClient: OrganizationPrincipalPolicyApi;\n  readonly execSql: ExecSql;\n  readonly externalAdminPolicy: NonNullable<\n    Awaited<ReturnType<typeof loadOrganizationExternalAdminPolicy>>\n  >;\n  readonly organizationId: string;\n  readonly reportSecurityIncident: SecurityIncidentReporter;\n  readonly request: Awaited<ReturnType<typeof buildInitialGroupPolicyRequest>>;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n}): Promise<{\n  readonly group: OrganizationGroupSummaryResponse;\n  readonly head: ReferencedPrincipalHead;\n}> {\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  // Signed group names are unique per organization; refuse a collision before\n  // anything reaches the server.\n  await assertGroupNameUniqueInDirectory({\n    apiClient: input.apiClient,\n    descriptor: input.externalAdminPolicy.descriptor,\n    execSql: input.execSql,\n    externalAuthority: input.externalAdminPolicy.externalAuthority,\n    name: input.name,\n    readEncryptedName: input.readEncryptedName,\n    organizationId: input.organizationId,\n    reportSecurityIncident: input.reportSecurityIncident,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n  });\n  const expectedHead = await groupPolicyMutationHead(\n    input.request.initialGroupPolicy,\n  );\n  const adminProjection =\n    input.externalAdminPolicy.adminBundle.currentProjection;\n  const adminUsers = await resolveRequiredUserIdentities({\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    userIds: projectionUserIds(adminProjection),\n  });\n  const organizationRequest =\n    await buildOrganizationGroupDirectoryPolicyRequest({\n      adminProjection,\n      adminUsers,\n      currentPolicy: input.externalAdminPolicy.bundle,\n      descriptor: input.externalAdminPolicy.descriptor,\n      groupHeads: [\n        ...input.externalAdminPolicy.descriptor.groupHeads,\n        organizationGroupHead(expectedHead),\n      ],\n      signerUserId: input.signerUserId,\n      signingFingerprint: input.signingFingerprint,\n      signingKeyPair: input.signingKeyPair,\n    });\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  const stored = await input.apiClient.createOrganizationGroup(\n    input.organizationId,\n    { ...input.request, organizationPolicy: organizationRequest },\n  );\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  if (!stored) {\n    throw new Error(\"Group could not be created\");\n  }\n  const acknowledged = await acknowledgeInitialGroupPolicy({\n    organizationId: input.organizationId,\n    request: input.request,\n    response: stored.group,\n    stateHash: expectedHead.stateHash,\n  });\n  const organizationHead = await groupPolicyMutationHead(organizationRequest);\n  const organizationPolicy = await acknowledgeGroupPolicyState({\n    currentPolicy: input.externalAdminPolicy.bundle,\n    expectedHead: organizationHead,\n    request: organizationRequest,\n    response: stored.organizationPolicy.currentState,\n  });\n  const organizationBundle = buildAcknowledgedGroupPolicyBundle({\n    currentPolicy: input.externalAdminPolicy.bundle,\n    expectedHead: organizationHead,\n    request: organizationRequest,\n    response: stored.organizationPolicy,\n  });\n  await persistLocallyAcknowledgedPrincipalPolicyBundles({\n    entries: [\n      { bundle: acknowledged.bundle, policy: acknowledged.policy },\n      { bundle: organizationBundle, policy: organizationPolicy },\n    ],\n    execSql: input.execSql,\n    organizationId: input.organizationId,\n    updatedAt: new Date().toISOString(),\n    stillCurrent: input.stillCurrent,\n  });\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  return { group: stored.group, head: expectedHead };\n}\n"]}

package/workflows/organizations/organizationGroupNamePolicies.js

@@ -1,48 +0,0 @@
-import { loadPrincipalPolicyCheckpoint } from "../../data/persistence/keyingCheckpointPersistence.js";
-import { loadPrincipalPolicyBundleForReference } from "../../data/persistence/principalPolicyReferencePersistence.js";
-import { parseOrganizationAuthorityDescriptor, principalHeadMatchesReference, } from "../../data/principals/organizationAuthorityDescriptor.js";
-import { principalPolicyReferenceFromBundle } from "../../data/principals/principalPolicyAdminSigners.js";
-import { loadOrganizationExternalAdminPolicy } from "../principals/externalAdminPolicy.js";
-/** Cached directory policies are reusable only at the exact projected head. */
-export async function loadGroupNameDirectoryAuthority(input) {
-    const load = async (reference) => {
-        const checkpoint = await loadPrincipalPolicyCheckpoint(input.execSql, reference.principalType, reference.principalId);
-        const bundle = (await loadPrincipalPolicyBundleForReference(input.execSql, reference, checkpoint)) ??
-            (await input.apiClient.getCurrentPrincipalPolicy(reference.principalType, reference.principalId));
-        if (bundle &&
-            !principalHeadMatchesReference(principalPolicyReferenceFromBundle(bundle), reference))
-            throw new Error("Group name authority does not match the projected directory head");
-        return bundle;
-    };
-    const organization = input.organizationPolicyReference
-        ? await load(input.organizationPolicyReference)
-        : await input.apiClient.getCurrentPrincipalPolicy("organization", input.organizationId);
-    if (!organization)
-        return null;
-    return loadOrganizationExternalAdminPolicy({
-        ...input,
-        currentPolicyReader: directoryPinnedPolicyReader({
-            load,
-            organization,
-            organizationId: input.organizationId,
-        }),
-    });
-}
-/**
- * Serves the organization bundle already read and each directory group at the
- * head that organization's directory pins, so the authority check reads the
- * heads the projection cited rather than whatever the server holds now.
- */
-function directoryPinnedPolicyReader(input) {
-    return {
-        getCurrentPrincipalPolicy: async (type, id) => {
-            if (type === "organization")
-                return id === input.organizationId ? input.organization : null;
-            // Reached only after the organization signature and scope checks.
-            const descriptor = parseOrganizationAuthorityDescriptor(input.organization.currentPayload.ciphertext);
-            const head = descriptor.groupHeads.find((head) => head.principalId === id);
-            return head ? input.load(head) : null;
-        },
-    };
-}
-//# sourceMappingURL=organizationGroupNamePolicies.js.map

package/workflows/organizations/organizationGroupNamePolicies.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"organizationGroupNamePolicies.js","sourceRoot":"","sources":["organizationGroupNamePolicies.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,qCAAqC,EAAE,MAAM,4DAA4D,CAAC;AACnH,OAAO,EACL,oCAAoC,EACpC,6BAA6B,GAC9B,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAEvG,OAAO,EAAE,mCAAmC,EAAE,MAAM,mCAAmC,CAAC;AAWxF,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAAY;IAChE,MAAM,IAAI,GAAG,KAAK,EAAE,SAAkC,EAAE,EAAE;QACxD,MAAM,UAAU,GAAG,MAAM,6BAA6B,CACpD,KAAK,CAAC,OAAO,EACb,SAAS,CAAC,aAAa,EACvB,SAAS,CAAC,WAAW,CACtB,CAAC;QACF,MAAM,MAAM,GACV,CAAC,MAAM,qCAAqC,CAC1C,KAAK,CAAC,OAAO,EACb,SAAS,EACT,UAAU,CACX,CAAC;YACF,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,yBAAyB,CAC9C,SAAS,CAAC,aAAa,EACvB,SAAS,CAAC,WAAW,CACtB,CAAC,CAAC;QACL,IACE,MAAM;YACN,CAAC,6BAA6B,CAC5B,kCAAkC,CAAC,MAAM,CAAC,EAC1C,SAAS,CACV;YAED,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;QACJ,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IACF,MAAM,YAAY,GAAG,KAAK,CAAC,2BAA2B;QACpD,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,2BAA2B,CAAC;QAC/C,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,yBAAyB,CAC7C,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;IACN,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAC/B,OAAO,mCAAmC,CAAC;QACzC,GAAG,KAAK;QACR,mBAAmB,EAAE,2BAA2B,CAAC;YAC/C,IAAI;YACJ,YAAY;YACZ,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC;KACH,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,2BAA2B,CAAC,KAMpC;IACC,OAAO;QACL,yBAAyB,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE;YAC5C,IAAI,IAAI,KAAK,cAAc;gBACzB,OAAO,EAAE,KAAK,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;YACjE,kEAAkE;YAClE,MAAM,UAAU,GAAG,oCAAoC,CACrD,KAAK,CAAC,YAAY,CAAC,cAAc,CAAC,UAAU,CAC7C,CAAC;YACF,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,CAAC,IAAI,CACrC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,EAAE,CAClC,CAAC;YACF,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACxC,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { ReferencedPrincipalHead } from \"@tearleads/crypto\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport { loadPrincipalPolicyCheckpoint } from \"../../data/persistence/keyingCheckpointPersistence\";\nimport { loadPrincipalPolicyBundleForReference } from \"../../data/persistence/principalPolicyReferencePersistence\";\nimport {\n  parseOrganizationAuthorityDescriptor,\n  principalHeadMatchesReference,\n} from \"../../data/principals/organizationAuthorityDescriptor\";\nimport { principalPolicyReferenceFromBundle } from \"../../data/principals/principalPolicyAdminSigners\";\nimport type { CurrentPrincipalPolicyReader } from \"../principals/currentPrincipalPolicyReader\";\nimport { loadOrganizationExternalAdminPolicy } from \"../principals/externalAdminPolicy\";\nimport type { DirectoryGroupWalkInput } from \"./groupNameUniqueness\";\n\ntype Input = Pick<\n  DirectoryGroupWalkInput,\n  \"apiClient\" | \"execSql\" | \"organizationId\" | \"resolveTrustedUserIdentity\"\n> & {\n  readonly organizationPolicyReference?: ReferencedPrincipalHead | null;\n  readonly stillCurrent: () => boolean;\n};\n\n/** Cached directory policies are reusable only at the exact projected head. */\nexport async function loadGroupNameDirectoryAuthority(input: Input) {\n  const load = async (reference: ReferencedPrincipalHead) => {\n    const checkpoint = await loadPrincipalPolicyCheckpoint(\n      input.execSql,\n      reference.principalType,\n      reference.principalId,\n    );\n    const bundle =\n      (await loadPrincipalPolicyBundleForReference(\n        input.execSql,\n        reference,\n        checkpoint,\n      )) ??\n      (await input.apiClient.getCurrentPrincipalPolicy(\n        reference.principalType,\n        reference.principalId,\n      ));\n    if (\n      bundle &&\n      !principalHeadMatchesReference(\n        principalPolicyReferenceFromBundle(bundle),\n        reference,\n      )\n    )\n      throw new Error(\n        \"Group name authority does not match the projected directory head\",\n      );\n    return bundle;\n  };\n  const organization = input.organizationPolicyReference\n    ? await load(input.organizationPolicyReference)\n    : await input.apiClient.getCurrentPrincipalPolicy(\n        \"organization\",\n        input.organizationId,\n      );\n  if (!organization) return null;\n  return loadOrganizationExternalAdminPolicy({\n    ...input,\n    currentPolicyReader: directoryPinnedPolicyReader({\n      load,\n      organization,\n      organizationId: input.organizationId,\n    }),\n  });\n}\n\n/**\n * Serves the organization bundle already read and each directory group at the\n * head that organization's directory pins, so the authority check reads the\n * heads the projection cited rather than whatever the server holds now.\n */\nfunction directoryPinnedPolicyReader(input: {\n  readonly load: (\n    reference: ReferencedPrincipalHead,\n  ) => Promise<PrincipalPolicyBundleResponse | null>;\n  readonly organization: PrincipalPolicyBundleResponse;\n  readonly organizationId: string;\n}): CurrentPrincipalPolicyReader {\n  return {\n    getCurrentPrincipalPolicy: async (type, id) => {\n      if (type === \"organization\")\n        return id === input.organizationId ? input.organization : null;\n      // Reached only after the organization signature and scope checks.\n      const descriptor = parseOrganizationAuthorityDescriptor(\n        input.organization.currentPayload.ciphertext,\n      );\n      const head = descriptor.groupHeads.find(\n        (head) => head.principalId === id,\n      );\n      return head ? input.load(head) : null;\n    },\n  };\n}\n"]}

package/workflows/organizations/organizationGroupNames.js

@@ -1,13 +0,0 @@
-import { ProjectionDependencyUnavailableError } from "../../data/keyingProjectionVerification/dependencyUnavailable.js";
-import { hydrateCurrentOrganizationGroupNames } from "./currentOrganizationGroupNames.js";
-/** Verify names against the signed directory before projecting decrypted labels. */
-export async function hydrateOrganizationGroupNames(input) {
-    if (!input.resolveCurrentPolicy)
-        throw new ProjectionDependencyUnavailableError("Group names require private paged recovery");
-    return hydrateCurrentOrganizationGroupNames({
-        ...input,
-        organizationReference: input.organizationPolicyReference,
-        resolveCurrentPolicy: input.resolveCurrentPolicy,
-    });
-}
-//# sourceMappingURL=organizationGroupNames.js.map

package/workflows/organizations/organizationGroupNames.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"organizationGroupNames.js","sourceRoot":"","sources":["organizationGroupNames.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EAAE,oCAAoC,EAAE,MAAM,iCAAiC,CAAC;AAIvF,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,KAaC;IAED,IAAI,CAAC,KAAK,CAAC,oBAAoB;QAC7B,MAAM,IAAI,oCAAoC,CAC5C,4CAA4C,CAC7C,CAAC;IACJ,OAAO,oCAAoC,CAAC;QAC1C,GAAG,KAAK;QACR,qBAAqB,EAAE,KAAK,CAAC,2BAA2B;QACxD,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;KACjD,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { ReferencedPrincipalHead } from \"@tearleads/crypto\";\nimport { ProjectionDependencyUnavailableError } from \"../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { hydrateCurrentOrganizationGroupNames } from \"./currentOrganizationGroupNames\";\nimport type { DirectoryGroupWalkInput } from \"./groupNameUniqueness\";\nimport type { OrganizationDirectoryAndGroups } from \"./readModel\";\n\n/** Verify names against the signed directory before projecting decrypted labels. */\nexport async function hydrateOrganizationGroupNames(\n  input: Omit<DirectoryGroupWalkInput, \"descriptor\" | \"externalAuthority\"> & {\n    readonly directory: OrganizationDirectoryAndGroups;\n    readonly organizationPolicyReference?: ReferencedPrincipalHead | null;\n    readonly recoveryBatch?: object | undefined;\n    readonly stillCurrent: () => boolean;\n    readonly createCurrentNameReader?: Parameters<\n      typeof hydrateCurrentOrganizationGroupNames\n    >[0][\"createCurrentNameReader\"];\n    readonly resolveCurrentPolicy?:\n      | Parameters<\n          typeof hydrateCurrentOrganizationGroupNames\n        >[0][\"resolveCurrentPolicy\"]\n      | undefined;\n  },\n): Promise<OrganizationDirectoryAndGroups> {\n  if (!input.resolveCurrentPolicy)\n    throw new ProjectionDependencyUnavailableError(\n      \"Group names require private paged recovery\",\n    );\n  return hydrateCurrentOrganizationGroupNames({\n    ...input,\n    organizationReference: input.organizationPolicyReference,\n    resolveCurrentPolicy: input.resolveCurrentPolicy,\n  });\n}\n"]}

package/workflows/organizations/organizationPolicyHistoryDetails.js

@@ -1,110 +0,0 @@
-import { principalPolicyMatchesReference, } from "../../internal/crypto/index.js";
-import { assertProjectionVerificationCurrent, } from "../../data/keyingProjectionVerification/types.js";
-import { buildOrganizationGroupPolicyHistoryPage } from "./groupPolicyHistoryPage.js";
-import { verifyOrganizationPolicyHistory } from "./organizationPolicyHistoryVerification.js";
-import { diffPrincipalProjectionMembers, } from "./policyHistoryReadModel.js";
-function diffGrants(previous, current) {
-    const before = new Map(previous.map((grant) => [grant.containerId, grant.accessLevel]));
-    const after = new Map(current.map((grant) => [grant.containerId, grant.accessLevel]));
-    return [...new Set([...before.keys(), ...after.keys()])]
-        .sort()
-        .flatMap((containerId) => {
-        const previousAccess = before.get(containerId) ?? null;
-        const nextAccess = after.get(containerId) ?? null;
-        return previousAccess === nextAccess
-            ? []
-            : [{ containerId, previousAccess, nextAccess }];
-    });
-}
-function describeGroupChange(previous, current, groupState) {
-    const head = current ?? previous;
-    if (!head)
-        throw new Error("Group change has no state");
-    const oldEntry = previous ? groupState(previous) : null;
-    const newEntry = current ? groupState(current) : null;
-    return {
-        groupId: head.principalId,
-        changeType: !previous ? "created" : !current ? "deleted" : "updated",
-        previousVersion: previous?.version ?? null,
-        version: head.version,
-        previousKeyEpoch: previous?.keyEpoch ?? null,
-        keyEpoch: head.keyEpoch,
-        changes: newEntry
-            ? diffPrincipalProjectionMembers({
-                previous: oldEntry?.projection ?? [],
-                current: newEntry.projection,
-            })
-            : [],
-        grantChanges: newEntry
-            ? diffGrants(oldEntry?.grants ?? [], newEntry.grants)
-            : [],
-    };
-}
-function diffGroups(previousHeads, heads, groupState) {
-    const before = new Map(previousHeads.map((head) => [head.principalId, head]));
-    const after = new Map(heads.map((head) => [head.principalId, head]));
-    const changes = [];
-    for (const groupId of [
-        ...new Set([...before.keys(), ...after.keys()]),
-    ].sort()) {
-        const previous = before.get(groupId);
-        const current = after.get(groupId);
-        if (previous?.stateHash === current?.stateHash)
-            continue;
-        changes.push(describeGroupChange(previous, current, groupState));
-    }
-    return changes;
-}
-/** Display only: historical group selections never advance current checkpoints. */
-export async function buildDetailedOrganizationPolicyHistory(input) {
-    input = {
-        ...input,
-        head: structuredClone(input.head),
-        page: structuredClone(input.page),
-        evidence: structuredClone(input.evidence),
-    };
-    const { descriptors, references } = await verifyOrganizationPolicyHistory(input);
-    assertProjectionVerificationCurrent(input.stillCurrent);
-    const resolved = await input.resolveHistory({
-        organizationId: input.head.principalId,
-        evidence: input.evidence.evidence,
-        references,
-        stillCurrent: input.stillCurrent,
-    });
-    assertProjectionVerificationCurrent(() => input.stillCurrent() && resolved.stillCurrent());
-    const groupState = (head) => {
-        const policy = resolved.policies.find((policy) => principalPolicyMatchesReference({ policy, reference: head }));
-        const entry = policy?.retainedHistory.find((entry) => entry.state.stateHash === head.stateHash);
-        if (!entry)
-            throw new Error("Verified group history state is missing");
-        return entry;
-    };
-    const basic = buildOrganizationGroupPolicyHistoryPage({
-        page: input.page,
-        groupId: input.head.principalId,
-        organizationId: input.head.principalId,
-    });
-    const byState = new Map();
-    let previousHeads = input.page.predecessor
-        ? (descriptors.get(input.page.predecessor.state.stateHash)?.groupHeads ??
-            [])
-        : [];
-    for (const { state } of input.page.entries) {
-        const heads = descriptors.get(state.stateHash)?.groupHeads;
-        if (!heads)
-            throw new Error("Verified organization directory is missing");
-        byState.set(state.stateHash, diffGroups(previousHeads, heads, groupState));
-        previousHeads = heads;
-    }
-    return {
-        principalId: input.head.principalId,
-        principalType: "organization",
-        organizationId: input.head.principalId,
-        nextBeforeVersion: input.page.nextBeforeVersion,
-        entries: basic.entries.map((entry) => ({
-            ...entry,
-            groupChanges: byState.get(entry.stateHash) ?? [],
-        })),
-    };
-}
-//# sourceMappingURL=organizationPolicyHistoryDetails.js.map