npm - @tearleads/client-sdk - Versions diffs - 0.1.62 → 0.1.64 - Mend

@tearleads/client-sdk 0.1.62 → 0.1.64

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1588) hide show

package/workflows/organizations/groups/organizationGroupDirectory.js ADDED Viewed

@@ -0,0 +1,153 @@
+import { buildPrincipalStateSigningInput, generateKemSeedAndKeyPair, normalizePrincipalProjectionMembers, signPrincipalState, toFingerprint, } from "../../../internal/crypto/index.js";
+import { bytesToBase64 } from "../../../internal/encoding/index.js";
+import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
+import { persistLocallyAcknowledgedPrincipalPolicyBundles } from "../../../data/persistence/locallyAcknowledgedCheckpointPersistence.js";
+import { encodeOrganizationAuthorityDescriptor, normalizeOrganizationGroupHeads, } from "../../../data/principals/organizationAuthorityDescriptor.js";
+import { assertGroupNameUniqueInDirectory } from "../groupNames/groupNameUniqueness.js";
+import { acknowledgeGroupPolicyState, acknowledgeInitialGroupPolicy, buildAcknowledgedGroupPolicyBundle, } from "../groupPolicy/groupPolicyMutationAcknowledgement.js";
+import { groupPolicyMutationHead } from "../groupPolicy/groupPolicyMutationHead.js";
+import { rewrapProjectionMemberEnvelopes } from "../principalPolicy/principalPolicyRecipients.js";
+import { projectionUserIds, resolveRequiredUserIdentities, } from "../trustedOrganizationUsers.js";
+function organizationGroupHead(head) {
+    if (head.principalType !== "group") {
+        throw new Error("Organization directory can contain only group heads");
+    }
+    return { ...head, principalType: "group" };
+}
+export function replaceOrganizationGroupHead(input) {
+    const nextHead = organizationGroupHead(input.nextHead);
+    return normalizeOrganizationGroupHeads([
+        ...input.descriptor.groupHeads.filter((head) => head.principalId !== nextHead.principalId),
+        nextHead,
+    ]);
+}
+export function removeOrganizationGroupHead(input) {
+    if (input.groupId === input.descriptor.adminGroupId ||
+        input.groupId === input.descriptor.memberGroupId) {
+        throw new Error("Built-in groups cannot be removed from the directory");
+    }
+    const groupHeads = input.descriptor.groupHeads.filter((head) => head.principalId !== input.groupId);
+    if (groupHeads.length === input.descriptor.groupHeads.length) {
+        throw new Error("Organization directory does not commit the deleted group");
+    }
+    return normalizeOrganizationGroupHeads(groupHeads);
+}
+export async function buildOrganizationGroupDirectoryPolicyRequest(input) {
+    const projection = normalizePrincipalProjectionMembers(input.adminProjection);
+    if (projection.length === 0 ||
+        projection.some((member) => member.role !== "admin")) {
+        throw new Error("Organization policy must mirror the Admins projection");
+    }
+    const organizationKem = generateKemSeedAndKeyPair();
+    const memberEnvelopes = await rewrapProjectionMemberEnvelopes({
+        projection,
+        secretKey: organizationKem.secretKey,
+        users: input.adminUsers,
+    });
+    const payloadCiphertext = encodeOrganizationAuthorityDescriptor({
+        ...input.descriptor,
+        groupHeads: input.groupHeads,
+    });
+    const state = await signPrincipalState(await buildPrincipalStateSigningInput({
+        principalType: "organization",
+        principalId: input.descriptor.organizationId,
+        version: input.currentPolicy.currentState.version + 1,
+        prevStateHash: input.currentPolicy.currentState.stateHash,
+        keyEpoch: input.currentPolicy.currentState.keyEpoch + 1,
+        encapsulationPublicKey: bytesToBase64(organizationKem.publicKey),
+        keyFingerprint: await toFingerprint(organizationKem.publicKey),
+        members: projection.map((member) => ({ userId: member.userId })),
+        memberEnvelopes,
+        projection,
+        grants: [],
+        payloadCiphertext,
+        externalAuthority: null,
+        signedAt: new Date().toISOString(),
+        signerUserId: input.signerUserId,
+        signerUserKeyFingerprint: input.signingFingerprint,
+    }), input.signingKeyPair.signingPrivateKey);
+    return {
+        encryptedPayload: {
+            cipherSuite: "aes-256-gcm",
+            ciphertext: payloadCiphertext,
+            ciphertextHash: state.payloadCiphertextHash,
+        },
+        grants: [],
+        memberEnvelopes,
+        projection,
+        state,
+    };
+}
+export async function commitCreatedGroupToDirectory(input) {
+    assertProjectionVerificationCurrent(input.stillCurrent);
+    // Signed group names are unique per organization; refuse a collision before
+    // anything reaches the server.
+    await assertGroupNameUniqueInDirectory({
+        apiClient: input.apiClient,
+        descriptor: input.externalAdminPolicy.descriptor,
+        execSql: input.execSql,
+        externalAuthority: input.externalAdminPolicy.externalAuthority,
+        name: input.name,
+        readEncryptedName: input.readEncryptedName,
+        organizationId: input.organizationId,
+        reportSecurityIncident: input.reportSecurityIncident,
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+    });
+    const expectedHead = await groupPolicyMutationHead(input.request.initialGroupPolicy);
+    const adminProjection = input.externalAdminPolicy.adminBundle.currentProjection;
+    const adminUsers = await resolveRequiredUserIdentities({
+        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
+        userIds: projectionUserIds(adminProjection),
+    });
+    const organizationRequest = await buildOrganizationGroupDirectoryPolicyRequest({
+        adminProjection,
+        adminUsers,
+        currentPolicy: input.externalAdminPolicy.bundle,
+        descriptor: input.externalAdminPolicy.descriptor,
+        groupHeads: [
+            ...input.externalAdminPolicy.descriptor.groupHeads,
+            organizationGroupHead(expectedHead),
+        ],
+        signerUserId: input.signerUserId,
+        signingFingerprint: input.signingFingerprint,
+        signingKeyPair: input.signingKeyPair,
+    });
+    assertProjectionVerificationCurrent(input.stillCurrent);
+    const stored = await input.apiClient.createOrganizationGroup(input.organizationId, { ...input.request, organizationPolicy: organizationRequest });
+    assertProjectionVerificationCurrent(input.stillCurrent);
+    if (!stored) {
+        throw new Error("Group could not be created");
+    }
+    const acknowledged = await acknowledgeInitialGroupPolicy({
+        organizationId: input.organizationId,
+        request: input.request,
+        response: stored.group,
+        stateHash: expectedHead.stateHash,
+    });
+    const organizationHead = await groupPolicyMutationHead(organizationRequest);
+    const organizationPolicy = await acknowledgeGroupPolicyState({
+        currentPolicy: input.externalAdminPolicy.bundle,
+        expectedHead: organizationHead,
+        request: organizationRequest,
+        response: stored.organizationPolicy.currentState,
+    });
+    const organizationBundle = buildAcknowledgedGroupPolicyBundle({
+        currentPolicy: input.externalAdminPolicy.bundle,
+        expectedHead: organizationHead,
+        request: organizationRequest,
+        response: stored.organizationPolicy,
+    });
+    await persistLocallyAcknowledgedPrincipalPolicyBundles({
+        entries: [
+            { bundle: acknowledged.bundle, policy: acknowledged.policy },
+            { bundle: organizationBundle, policy: organizationPolicy },
+        ],
+        execSql: input.execSql,
+        organizationId: input.organizationId,
+        updatedAt: new Date().toISOString(),
+        stillCurrent: input.stillCurrent,
+    });
+    assertProjectionVerificationCurrent(input.stillCurrent);
+    return { group: stored.group, head: expectedHead };
+}
+//# sourceMappingURL=organizationGroupDirectory.js.map

package/workflows/organizations/groups/organizationGroupDirectory.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"organizationGroupDirectory.js","sourceRoot":"","sources":["organizationGroupDirectory.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,EAC/B,yBAAyB,EACzB,mCAAmC,EAGnC,kBAAkB,EAClB,aAAa,GACd,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AASpD,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AACvG,OAAO,EAAE,gDAAgD,EAAE,MAAM,oEAAoE,CAAC;AACtI,OAAO,EACL,qCAAqC,EACrC,+BAA+B,GAGhC,MAAM,0DAA0D,CAAC;AAQlE,OAAO,EAAE,gCAAgC,EAAE,MAAM,mCAAmC,CAAC;AACrF,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAC7B,kCAAkC,GACnC,MAAM,mDAAmD,CAAC;AAE3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,+BAA+B,EAAE,MAAM,8CAA8C,CAAC;AAK/F,OAAO,EACL,iBAAiB,EACjB,6BAA6B,GAC9B,MAAM,6BAA6B,CAAC;AAErC,SAAS,qBAAqB,CAC5B,IAA6B;IAE7B,IAAI,IAAI,CAAC,aAAa,KAAK,OAAO,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,KAG5C;IACC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvD,OAAO,+BAA+B,CAAC;QACrC,GAAG,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,CACnC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,CACpD;QACD,QAAQ;KACT,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAG3C;IACC,IACE,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,UAAU,CAAC,YAAY;QAC/C,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,UAAU,CAAC,aAAa,EAChD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,CACnD,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,OAAO,CAC7C,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,KAAK,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,+BAA+B,CAAC,UAAU,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4CAA4C,CAAC,KASlE;IACC,MAAM,UAAU,GAAG,mCAAmC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAC9E,IACE,UAAU,CAAC,MAAM,KAAK,CAAC;QACvB,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,EACpD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,eAAe,GAAG,yBAAyB,EAAE,CAAC;IACpD,MAAM,eAAe,GAAG,MAAM,+BAA+B,CAAC;QAC5D,UAAU;QACV,SAAS,EAAE,eAAe,CAAC,SAAS;QACpC,KAAK,EAAE,KAAK,CAAC,UAAU;KACxB,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,qCAAqC,CAAC;QAC9D,GAAG,KAAK,CAAC,UAAU;QACnB,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,kBAAkB,CACpC,MAAM,+BAA+B,CAAC;QACpC,aAAa,EAAE,cAAc;QAC7B,WAAW,EAAE,KAAK,CAAC,UAAU,CAAC,cAAc;QAC5C,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,OAAO,GAAG,CAAC;QACrD,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,SAAS;QACzD,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,QAAQ,GAAG,CAAC;QACvD,sBAAsB,EAAE,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC;QAChE,cAAc,EAAE,MAAM,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC;QAC9D,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAChE,eAAe;QACf,UAAU;QACV,MAAM,EAAE,EAAE;QACV,iBAAiB;QACjB,iBAAiB,EAAE,IAAI;QACvB,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,wBAAwB,EAAE,KAAK,CAAC,kBAAkB;KACnD,CAAC,EACF,KAAK,CAAC,cAAc,CAAC,iBAAiB,CACvC,CAAC;IAEF,OAAO;QACL,gBAAgB,EAAE;YAChB,WAAW,EAAE,aAAa;YAC1B,UAAU,EAAE,iBAAiB;YAC7B,cAAc,EAAE,KAAK,CAAC,qBAAqB;SAC5C;QACD,MAAM,EAAE,EAAE;QACV,eAAe;QACf,UAAU;QACV,KAAK;KACN,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAgBnD;IAIC,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,4EAA4E;IAC5E,+BAA+B;IAC/B,MAAM,gCAAgC,CAAC;QACrC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,mBAAmB,CAAC,UAAU;QAChD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,iBAAiB,EAAE,KAAK,CAAC,mBAAmB,CAAC,iBAAiB;QAC9D,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,MAAM,uBAAuB,CAChD,KAAK,CAAC,OAAO,CAAC,kBAAkB,CACjC,CAAC;IACF,MAAM,eAAe,GACnB,KAAK,CAAC,mBAAmB,CAAC,WAAW,CAAC,iBAAiB,CAAC;IAC1D,MAAM,UAAU,GAAG,MAAM,6BAA6B,CAAC;QACrD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,OAAO,EAAE,iBAAiB,CAAC,eAAe,CAAC;KAC5C,CAAC,CAAC;IACH,MAAM,mBAAmB,GACvB,MAAM,4CAA4C,CAAC;QACjD,eAAe;QACf,UAAU;QACV,aAAa,EAAE,KAAK,CAAC,mBAAmB,CAAC,MAAM;QAC/C,UAAU,EAAE,KAAK,CAAC,mBAAmB,CAAC,UAAU;QAChD,UAAU,EAAE;YACV,GAAG,KAAK,CAAC,mBAAmB,CAAC,UAAU,CAAC,UAAU;YAClD,qBAAqB,CAAC,YAAY,CAAC;SACpC;QACD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACL,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,uBAAuB,CAC1D,KAAK,CAAC,cAAc,EACpB,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,CAC9D,CAAC;IACF,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,6BAA6B,CAAC;QACvD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,MAAM,CAAC,KAAK;QACtB,SAAS,EAAE,YAAY,CAAC,SAAS;KAClC,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,MAAM,uBAAuB,CAAC,mBAAmB,CAAC,CAAC;IAC5E,MAAM,kBAAkB,GAAG,MAAM,2BAA2B,CAAC;QAC3D,aAAa,EAAE,KAAK,CAAC,mBAAmB,CAAC,MAAM;QAC/C,YAAY,EAAE,gBAAgB;QAC9B,OAAO,EAAE,mBAAmB;QAC5B,QAAQ,EAAE,MAAM,CAAC,kBAAkB,CAAC,YAAY;KACjD,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,kCAAkC,CAAC;QAC5D,aAAa,EAAE,KAAK,CAAC,mBAAmB,CAAC,MAAM;QAC/C,YAAY,EAAE,gBAAgB;QAC9B,OAAO,EAAE,mBAAmB;QAC5B,QAAQ,EAAE,MAAM,CAAC,kBAAkB;KACpC,CAAC,CAAC;IACH,MAAM,gDAAgD,CAAC;QACrD,OAAO,EAAE;YACP,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE;YAC5D,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;SAC3D;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AACrD,CAAC","sourcesContent":["import {\n buildPrincipalStateSigningInput,\n generateKemSeedAndKeyPair,\n normalizePrincipalProjectionMembers,\n type ReferencedPrincipalHead,\n type SigningKeyPair,\n signPrincipalState,\n toFingerprint,\n} from \"@tearleads/crypto\";\nimport { bytesToBase64 } from \"@tearleads/encoding\";\nimport type {\n PrincipalProjectionMemberRequest,\n PutPrincipalPolicyRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n OrganizationGroupSummaryResponse,\n PrincipalPolicyBundleResponse,\n} from \"@tearleads/validators/response\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport { persistLocallyAcknowledgedPrincipalPolicyBundles } from \"../../../data/persistence/locallyAcknowledgedCheckpointPersistence\";\nimport {\n encodeOrganizationAuthorityDescriptor,\n normalizeOrganizationGroupHeads,\n type OrganizationAuthorityDescriptor,\n type OrganizationGroupHead,\n} from \"../../../data/principals/organizationAuthorityDescriptor\";\nimport type { SecurityIncidentReporter } from \"../../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport type {\n TrustedUserIdentity,\n TrustedUserIdentityResolver,\n} from \"../../../data/trustedUserIdentity\";\nimport type { loadOrganizationExternalAdminPolicy } from \"../../principals/externalAdminPolicy\";\nimport { assertGroupNameUniqueInDirectory } from \"../groupNames/groupNameUniqueness\";\nimport {\n acknowledgeGroupPolicyState,\n acknowledgeInitialGroupPolicy,\n buildAcknowledgedGroupPolicyBundle,\n} from \"../groupPolicy/groupPolicyMutationAcknowledgement\";\nimport type { OrganizationPrincipalPolicyApi } from \"../groupPolicy/groupPolicyMutationContext\";\nimport { groupPolicyMutationHead } from \"../groupPolicy/groupPolicyMutationHead\";\nimport { rewrapProjectionMemberEnvelopes } from \"../principalPolicy/principalPolicyRecipients\";\nimport type {\n buildInitialGroupPolicyRequest,\n GroupPolicyNameReader,\n} from \"../principalPolicy/principalPolicyRequest\";\nimport {\n projectionUserIds,\n resolveRequiredUserIdentities,\n} from \"../trustedOrganizationUsers\";\n\nfunction organizationGroupHead(\n head: ReferencedPrincipalHead,\n): OrganizationGroupHead {\n if (head.principalType !== \"group\") {\n throw new Error(\"Organization directory can contain only group heads\");\n }\n return { ...head, principalType: \"group\" };\n}\n\nexport function replaceOrganizationGroupHead(input: {\n readonly descriptor: OrganizationAuthorityDescriptor;\n readonly nextHead: ReferencedPrincipalHead;\n}): OrganizationGroupHead[] {\n const nextHead = organizationGroupHead(input.nextHead);\n return normalizeOrganizationGroupHeads([\n ...input.descriptor.groupHeads.filter(\n (head) => head.principalId !== nextHead.principalId,\n ),\n nextHead,\n ]);\n}\n\nexport function removeOrganizationGroupHead(input: {\n readonly descriptor: OrganizationAuthorityDescriptor;\n readonly groupId: string;\n}): OrganizationGroupHead[] {\n if (\n input.groupId === input.descriptor.adminGroupId ||\n input.groupId === input.descriptor.memberGroupId\n ) {\n throw new Error(\"Built-in groups cannot be removed from the directory\");\n }\n const groupHeads = input.descriptor.groupHeads.filter(\n (head) => head.principalId !== input.groupId,\n );\n if (groupHeads.length === input.descriptor.groupHeads.length) {\n throw new Error(\"Organization directory does not commit the deleted group\");\n }\n return normalizeOrganizationGroupHeads(groupHeads);\n}\n\nexport async function buildOrganizationGroupDirectoryPolicyRequest(input: {\n readonly adminProjection: readonly PrincipalProjectionMemberRequest[];\n readonly adminUsers: readonly TrustedUserIdentity[];\n readonly currentPolicy: Pick<PrincipalPolicyBundleResponse, \"currentState\">;\n readonly descriptor: OrganizationAuthorityDescriptor;\n readonly groupHeads: readonly OrganizationGroupHead[];\n readonly signerUserId: string;\n readonly signingFingerprint: string;\n readonly signingKeyPair: SigningKeyPair;\n}): Promise<PutPrincipalPolicyRequest> {\n const projection = normalizePrincipalProjectionMembers(input.adminProjection);\n if (\n projection.length === 0 ||\n projection.some((member) => member.role !== \"admin\")\n ) {\n throw new Error(\"Organization policy must mirror the Admins projection\");\n }\n const organizationKem = generateKemSeedAndKeyPair();\n const memberEnvelopes = await rewrapProjectionMemberEnvelopes({\n projection,\n secretKey: organizationKem.secretKey,\n users: input.adminUsers,\n });\n const payloadCiphertext = encodeOrganizationAuthorityDescriptor({\n ...input.descriptor,\n groupHeads: input.groupHeads,\n });\n const state = await signPrincipalState(\n await buildPrincipalStateSigningInput({\n principalType: \"organization\",\n principalId: input.descriptor.organizationId,\n version: input.currentPolicy.currentState.version + 1,\n prevStateHash: input.currentPolicy.currentState.stateHash,\n keyEpoch: input.currentPolicy.currentState.keyEpoch + 1,\n encapsulationPublicKey: bytesToBase64(organizationKem.publicKey),\n keyFingerprint: await toFingerprint(organizationKem.publicKey),\n members: projection.map((member) => ({ userId: member.userId })),\n memberEnvelopes,\n projection,\n grants: [],\n payloadCiphertext,\n externalAuthority: null,\n signedAt: new Date().toISOString(),\n signerUserId: input.signerUserId,\n signerUserKeyFingerprint: input.signingFingerprint,\n }),\n input.signingKeyPair.signingPrivateKey,\n );\n\n return {\n encryptedPayload: {\n cipherSuite: \"aes-256-gcm\",\n ciphertext: payloadCiphertext,\n ciphertextHash: state.payloadCiphertextHash,\n },\n grants: [],\n memberEnvelopes,\n projection,\n state,\n };\n}\n\nexport async function commitCreatedGroupToDirectory(input: {\n readonly stillCurrent?: (() => boolean) | undefined;\n readonly name: string;\n readonly readEncryptedName?: GroupPolicyNameReader;\n readonly apiClient: OrganizationPrincipalPolicyApi;\n readonly execSql: ExecSql;\n readonly externalAdminPolicy: NonNullable<\n Awaited<ReturnType<typeof loadOrganizationExternalAdminPolicy>>\n >;\n readonly organizationId: string;\n readonly reportSecurityIncident: SecurityIncidentReporter;\n readonly request: Awaited<ReturnType<typeof buildInitialGroupPolicyRequest>>;\n readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n readonly signerUserId: string;\n readonly signingFingerprint: string;\n readonly signingKeyPair: SigningKeyPair;\n}): Promise<{\n readonly group: OrganizationGroupSummaryResponse;\n readonly head: ReferencedPrincipalHead;\n}> {\n assertProjectionVerificationCurrent(input.stillCurrent);\n // Signed group names are unique per organization; refuse a collision before\n // anything reaches the server.\n await assertGroupNameUniqueInDirectory({\n apiClient: input.apiClient,\n descriptor: input.externalAdminPolicy.descriptor,\n execSql: input.execSql,\n externalAuthority: input.externalAdminPolicy.externalAuthority,\n name: input.name,\n readEncryptedName: input.readEncryptedName,\n organizationId: input.organizationId,\n reportSecurityIncident: input.reportSecurityIncident,\n resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n });\n const expectedHead = await groupPolicyMutationHead(\n input.request.initialGroupPolicy,\n );\n const adminProjection =\n input.externalAdminPolicy.adminBundle.currentProjection;\n const adminUsers = await resolveRequiredUserIdentities({\n resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n userIds: projectionUserIds(adminProjection),\n });\n const organizationRequest =\n await buildOrganizationGroupDirectoryPolicyRequest({\n adminProjection,\n adminUsers,\n currentPolicy: input.externalAdminPolicy.bundle,\n descriptor: input.externalAdminPolicy.descriptor,\n groupHeads: [\n ...input.externalAdminPolicy.descriptor.groupHeads,\n organizationGroupHead(expectedHead),\n ],\n signerUserId: input.signerUserId,\n signingFingerprint: input.signingFingerprint,\n signingKeyPair: input.signingKeyPair,\n });\n assertProjectionVerificationCurrent(input.stillCurrent);\n const stored = await input.apiClient.createOrganizationGroup(\n input.organizationId,\n { ...input.request, organizationPolicy: organizationRequest },\n );\n assertProjectionVerificationCurrent(input.stillCurrent);\n if (!stored) {\n throw new Error(\"Group could not be created\");\n }\n const acknowledged = await acknowledgeInitialGroupPolicy({\n organizationId: input.organizationId,\n request: input.request,\n response: stored.group,\n stateHash: expectedHead.stateHash,\n });\n const organizationHead = await groupPolicyMutationHead(organizationRequest);\n const organizationPolicy = await acknowledgeGroupPolicyState({\n currentPolicy: input.externalAdminPolicy.bundle,\n expectedHead: organizationHead,\n request: organizationRequest,\n response: stored.organizationPolicy.currentState,\n });\n const organizationBundle = buildAcknowledgedGroupPolicyBundle({\n currentPolicy: input.externalAdminPolicy.bundle,\n expectedHead: organizationHead,\n request: organizationRequest,\n response: stored.organizationPolicy,\n });\n await persistLocallyAcknowledgedPrincipalPolicyBundles({\n entries: [\n { bundle: acknowledged.bundle, policy: acknowledged.policy },\n { bundle: organizationBundle, policy: organizationPolicy },\n ],\n execSql: input.execSql,\n organizationId: input.organizationId,\n updatedAt: new Date().toISOString(),\n stillCurrent: input.stillCurrent,\n });\n assertProjectionVerificationCurrent(input.stillCurrent);\n return { group: stored.group, head: expectedHead };\n}\n"]}

package/workflows/organizations/index.d.ts CHANGED Viewed

@@ -4,19 +4,19 @@ export type { AuthoredPrincipalMutation, PrincipalMutationJournalScope, } from "
 export { UnreadablePrincipalMutationError } from "../../data/principals/principalMutationJournalRecord.js";
 export { cancelStripeSubscription, checkNativePurchaseEligibility, claimNativeOrganizationSubscription, createStripeCheckout, createStripeCheckoutSession, loadOrganizationBilling, loadOrganizationBillingHistory, loadOrganizationBillingManagementUrl, loadStripeCheckoutOptions, type OrganizationBilling, type OrganizationBillingHistory, type OrganizationBillingHistoryEntry, type OrganizationBillingManagementUrl, type OrganizationBillingView, type OrganizationNativePurchaseEligibility, resolveOrganizationBillingView, type StripeCheckoutIntent, type StripeCheckoutOptions, startOrganizationTrial, } from "./billing.js";
 export { revokeOrganizationContainerGrant } from "./containerGrantRevocation.js";
-export { type CreateOrganizationApi, type CreateOrganizationInput, createOrganization, } from "./createOrganization.js";
-export { loadLocalOrganizationDataUsage, type OrganizationDataUsage, type ReconcileOrganizationDataUsageInput, reconcileOrganizationDataUsage, } from "./dataUsageReadModel.js";
-export { deleteOrganizationGroup } from "./deleteOrganizationGroup.js";
-export { GroupMembershipNameMismatchError } from "./groupMembershipName.js";
-export { type LocalOrganizationSummary, listLocalOrganizations, } from "./listLocalOrganizations.js";
-export { loadLocalOrganizationContainerGrants, loadLocalOrganizationGroupContainers, loadLocalOrganizationGroupPolicyHistory, loadLocalOrganizationPolicyHistory, loadLocalOrganizationPolicyReference, loadLocalOrganizationUserDetail, } from "./localReadModelDetails.js";
+export { GroupMembershipNameMismatchError } from "./groupNames/groupMembershipName.js";
+export { deleteOrganizationGroup } from "./groups/deleteOrganizationGroup.js";
 export { buildOrganizationProfileDocumentPatch, createInitializedOrganizationProfileDocument, DEFAULT_PERSONAL_ORGANIZATION_PROFILE_NAME, getOrganizationProfileDocumentLocalId, ORGANIZATION_PROFILE_DOCUMENT_KIND, readOrganizationProfileName, } from "./organizationProfile.js";
 export { type ImportedOrganizationUser, importOrganizationUser, } from "./organizationUserImport.js";
-export { abandonJournaledPrincipalMutation, discardUnreadableJournaledPrincipalMutation, readJournaledPrincipalMutation, } from "./principalMutationJournalManagement.js";
-export { type PrincipalMutationJournalContext, PrincipalMutationOutcomeUnknownError, recoverJournaledPrincipalMutation, submitJournaledPrincipalMutation, } from "./principalMutationJournalSession.js";
-export type { PrincipalMutationResponse } from "./principalOperationReceipt.js";
-export { addOrganizationGroupUser, buildInitialGroupPolicyRequest, buildInitialMemberGroupPolicyRequest, createOrganizationGroup, removeOrganizationGroupUser, rotateOrganizationGroupForAccessSetShrink, } from "./principalPolicy.js";
-export { buildOrganizationGroupPolicyHistory, type OrganizationContainerGrant, type OrganizationContainerGrants, type OrganizationDirectory, type OrganizationDirectoryAndGroups, type OrganizationDirectoryUser, type OrganizationGroupContainer, type OrganizationGroupContainers, type OrganizationGroupDetails, type OrganizationGroupMember, type OrganizationGroupMembers, type OrganizationGroupPolicyHistory, type OrganizationGroupPolicyHistoryEntry, type OrganizationGroupSummary, type OrganizationPolicyGrantChange, type OrganizationPolicyGroupChange, type OrganizationPolicyHistory, type OrganizationPolicyHistoryEntry, type OrganizationPrincipalMemberChange, type OrganizationPrincipalMemberChangeType, type OrganizationPrincipalPolicyHistory, type OrganizationPrincipalPolicyHistoryEntry, type OrganizationProfile, type OrganizationUserDetail, updateOrganizationProfile, updateOrganizationRosterEntry, } from "./readModel.js";
-export { loadLocalOrganizationDirectoryAndGroups, loadLocalOrganizationGroupMembers, type ReconcileOrganizationDirectoryAndGroupsInput, reconcileOrganizationDirectoryAndGroups, } from "./readModelProjection.js";
-export { type AcknowledgedPrincipalCurrentInput, type AcknowledgedPrincipalCurrentRetirement, retainAcknowledgedPrincipalCurrents, } from "./retainAcknowledgedPrincipalCurrents.js";
+export { abandonJournaledPrincipalMutation, discardUnreadableJournaledPrincipalMutation, readJournaledPrincipalMutation, } from "./principalMutations/principalMutationJournalManagement.js";
+export { type PrincipalMutationJournalContext, PrincipalMutationOutcomeUnknownError, recoverJournaledPrincipalMutation, submitJournaledPrincipalMutation, } from "./principalMutations/principalMutationJournalSession.js";
+export type { PrincipalMutationResponse } from "./principalMutations/principalOperationReceipt.js";
+export { type AcknowledgedPrincipalCurrentInput, type AcknowledgedPrincipalCurrentRetirement, retainAcknowledgedPrincipalCurrents, } from "./principalMutations/retainAcknowledgedPrincipalCurrents.js";
+export { addOrganizationGroupUser, buildInitialGroupPolicyRequest, buildInitialMemberGroupPolicyRequest, createOrganizationGroup, removeOrganizationGroupUser, rotateOrganizationGroupForAccessSetShrink, } from "./principalPolicy/index.js";
+export { type CreateOrganizationApi, type CreateOrganizationInput, createOrganization, } from "./provisioning/createOrganization.js";
+export { buildOrganizationGroupPolicyHistory, type OrganizationContainerGrant, type OrganizationContainerGrants, type OrganizationDirectory, type OrganizationDirectoryAndGroups, type OrganizationDirectoryUser, type OrganizationGroupContainer, type OrganizationGroupContainers, type OrganizationGroupDetails, type OrganizationGroupMember, type OrganizationGroupMembers, type OrganizationGroupPolicyHistory, type OrganizationGroupPolicyHistoryEntry, type OrganizationGroupSummary, type OrganizationPolicyGrantChange, type OrganizationPolicyGroupChange, type OrganizationPolicyHistory, type OrganizationPolicyHistoryEntry, type OrganizationPrincipalMemberChange, type OrganizationPrincipalMemberChangeType, type OrganizationPrincipalPolicyHistory, type OrganizationPrincipalPolicyHistoryEntry, type OrganizationProfile, type OrganizationUserDetail, updateOrganizationProfile, updateOrganizationRosterEntry, } from "./readModel/index.js";
+export { loadLocalOrganizationDataUsage, type OrganizationDataUsage, type ReconcileOrganizationDataUsageInput, reconcileOrganizationDataUsage, } from "./readModel/dataUsageReadModel.js";
+export { type LocalOrganizationSummary, listLocalOrganizations, } from "./readModel/listLocalOrganizations.js";
+export { loadLocalOrganizationContainerGrants, loadLocalOrganizationGroupContainers, loadLocalOrganizationGroupPolicyHistory, loadLocalOrganizationPolicyHistory, loadLocalOrganizationPolicyReference, loadLocalOrganizationUserDetail, } from "./readModel/localReadModelDetails.js";
+export { loadLocalOrganizationDirectoryAndGroups, loadLocalOrganizationGroupMembers, type ReconcileOrganizationDirectoryAndGroupsInput, reconcileOrganizationDirectoryAndGroups, } from "./readModel/readModelProjection.js";
 export { buildRosterProfileDocumentPatch, createInitializedRosterProfileDocument, deriveOrganizationMetadataContainerSystemSlot, deriveOrganizationRosterProfileContainerSystemSlot, getRosterProfileDocumentLocalId, ORGANIZATION_METADATA_CONTAINER_NAME, ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME, ROSTER_PROFILE_DOCUMENT_KIND, } from "./rosterProfileContainer.js";

package/workflows/organizations/index.js CHANGED Viewed

@@ -3,19 +3,19 @@ export { PendingPrincipalMutationError } from "../../data/persistence/principalM
 export { UnreadablePrincipalMutationError } from "../../data/principals/principalMutationJournalRecord.js";
 export { cancelStripeSubscription, checkNativePurchaseEligibility, claimNativeOrganizationSubscription, createStripeCheckout, createStripeCheckoutSession, loadOrganizationBilling, loadOrganizationBillingHistory, loadOrganizationBillingManagementUrl, loadStripeCheckoutOptions, resolveOrganizationBillingView, startOrganizationTrial, } from "./billing.js";
 export { revokeOrganizationContainerGrant } from "./containerGrantRevocation.js";
-export { createOrganization, } from "./createOrganization.js";
-export { loadLocalOrganizationDataUsage, reconcileOrganizationDataUsage, } from "./dataUsageReadModel.js";
-export { deleteOrganizationGroup } from "./deleteOrganizationGroup.js";
-export { GroupMembershipNameMismatchError } from "./groupMembershipName.js";
-export { listLocalOrganizations, } from "./listLocalOrganizations.js";
-export { loadLocalOrganizationContainerGrants, loadLocalOrganizationGroupContainers, loadLocalOrganizationGroupPolicyHistory, loadLocalOrganizationPolicyHistory, loadLocalOrganizationPolicyReference, loadLocalOrganizationUserDetail, } from "./localReadModelDetails.js";
+export { GroupMembershipNameMismatchError } from "./groupNames/groupMembershipName.js";
+export { deleteOrganizationGroup } from "./groups/deleteOrganizationGroup.js";
 export { buildOrganizationProfileDocumentPatch, createInitializedOrganizationProfileDocument, DEFAULT_PERSONAL_ORGANIZATION_PROFILE_NAME, getOrganizationProfileDocumentLocalId, ORGANIZATION_PROFILE_DOCUMENT_KIND, readOrganizationProfileName, } from "./organizationProfile.js";
 export { importOrganizationUser, } from "./organizationUserImport.js";
-export { abandonJournaledPrincipalMutation, discardUnreadableJournaledPrincipalMutation, readJournaledPrincipalMutation, } from "./principalMutationJournalManagement.js";
-export { PrincipalMutationOutcomeUnknownError, recoverJournaledPrincipalMutation, submitJournaledPrincipalMutation, } from "./principalMutationJournalSession.js";
-export { addOrganizationGroupUser, buildInitialGroupPolicyRequest, buildInitialMemberGroupPolicyRequest, createOrganizationGroup, removeOrganizationGroupUser, rotateOrganizationGroupForAccessSetShrink, } from "./principalPolicy.js";
-export { buildOrganizationGroupPolicyHistory, updateOrganizationProfile, updateOrganizationRosterEntry, } from "./readModel.js";
-export { loadLocalOrganizationDirectoryAndGroups, loadLocalOrganizationGroupMembers, reconcileOrganizationDirectoryAndGroups, } from "./readModelProjection.js";
-export { retainAcknowledgedPrincipalCurrents, } from "./retainAcknowledgedPrincipalCurrents.js";
+export { abandonJournaledPrincipalMutation, discardUnreadableJournaledPrincipalMutation, readJournaledPrincipalMutation, } from "./principalMutations/principalMutationJournalManagement.js";
+export { PrincipalMutationOutcomeUnknownError, recoverJournaledPrincipalMutation, submitJournaledPrincipalMutation, } from "./principalMutations/principalMutationJournalSession.js";
+export { retainAcknowledgedPrincipalCurrents, } from "./principalMutations/retainAcknowledgedPrincipalCurrents.js";
+export { addOrganizationGroupUser, buildInitialGroupPolicyRequest, buildInitialMemberGroupPolicyRequest, createOrganizationGroup, removeOrganizationGroupUser, rotateOrganizationGroupForAccessSetShrink, } from "./principalPolicy/index.js";
+export { createOrganization, } from "./provisioning/createOrganization.js";
+export { buildOrganizationGroupPolicyHistory, updateOrganizationProfile, updateOrganizationRosterEntry, } from "./readModel/index.js";
+export { loadLocalOrganizationDataUsage, reconcileOrganizationDataUsage, } from "./readModel/dataUsageReadModel.js";
+export { listLocalOrganizations, } from "./readModel/listLocalOrganizations.js";
+export { loadLocalOrganizationContainerGrants, loadLocalOrganizationGroupContainers, loadLocalOrganizationGroupPolicyHistory, loadLocalOrganizationPolicyHistory, loadLocalOrganizationPolicyReference, loadLocalOrganizationUserDetail, } from "./readModel/localReadModelDetails.js";
+export { loadLocalOrganizationDirectoryAndGroups, loadLocalOrganizationGroupMembers, reconcileOrganizationDirectoryAndGroups, } from "./readModel/readModelProjection.js";
 export { buildRosterProfileDocumentPatch, createInitializedRosterProfileDocument, deriveOrganizationMetadataContainerSystemSlot, deriveOrganizationRosterProfileContainerSystemSlot, getRosterProfileDocumentLocalId, ORGANIZATION_METADATA_CONTAINER_NAME, ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME, ROSTER_PROFILE_DOCUMENT_KIND, } from "./rosterProfileContainer.js";
 //# sourceMappingURL=index.js.map

package/workflows/organizations/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,0CAA0C,GAC3C,MAAM,wEAAwE,CAAC;AAChF,OAAO,EAAE,6BAA6B,EAAE,MAAM,4DAA4D,CAAC;AAK3G,OAAO,EAAE,gCAAgC,EAAE,MAAM,sDAAsD,CAAC;AACxG,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,mCAAmC,EACnC,oBAAoB,EACpB,2BAA2B,EAC3B,uBAAuB,EACvB,8BAA8B,EAC9B,oCAAoC,EACpC,yBAAyB,EAOzB,8BAA8B,EAG9B,sBAAsB,GACvB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,gCAAgC,EAAE,MAAM,4BAA4B,CAAC;AAC9E,OAAO,~~EAGL,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,8BAA8B,EAG9B,8BAA8B,GAC/B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,~~EAAE,~~uBAAuB~~,EAAE,MAAM,~~2BAA2B~~,CAAC;~~AACpE~~,OAAO,EAAE,~~gCAAgC~~,EAAE,MAAM,~~uBAAuB,CAAC;AACzE,OAAO,EAEL,sBAAsB,GACvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,oCAAoC,EACpC,oCAAoC,EACpC,uCAAuC,EACvC,~~kCAAkC,~~EAClC,oCAAoC,EACpC,+BAA+B,GAChC,MAAM,yBAAyB,~~CAAC;~~AACjC~~,OAAO,EACL,qCAAqC,EACrC,4CAA4C,EAC5C,0CAA0C,EAC1C,qCAAqC,EACrC,kCAAkC,EAClC,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,sBAAsB,GACvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,iCAAiC,EACjC,2CAA2C,EAC3C,8BAA8B,GAC/B,MAAM,~~sCAAsC~~,CAAC;~~AAC9C~~,OAAO,EAEL,oCAAoC,EACpC,iCAAiC,EACjC,gCAAgC,GACjC,MAAM,mCAAmC,CAAC;~~AAE3C~~,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,oCAAoC,EACpC,uBAAuB,EACvB,2BAA2B,EAC3B,yCAAyC,GAC1C,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,mCAAmC,EAwBnC,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,uCAAuC,EACvC,~~iCAAiC~~,~~EAEjC~~,~~uCAAuC~~,~~GACxC~~,MAAM,~~uBAAuB~~,CAAC;~~AAC/B~~,OAAO,~~EAGL~~,~~mCAAmC~~,~~GACpC~~,~~MAAM~~,uCAAuC,CAAC;~~AAC/C~~,OAAO,EACL,+BAA+B,EAC/B,sCAAsC,EACtC,6CAA6C,EAC7C,kDAAkD,EAClD,+BAA+B,EAC/B,oCAAoC,EACpC,0CAA0C,EAC1C,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC","sourcesContent":["export {\n type OrganizationReadModelInvalidationListener,\n subscribeOrganizationReadModelInvalidation,\n} from \"../../data/persistence/organizations/organizationReadModelInvalidation\";\nexport { PendingPrincipalMutationError } from \"../../data/persistence/principalMutationJournalPersistence\";\nexport type {\n AuthoredPrincipalMutation,\n PrincipalMutationJournalScope,\n} from \"../../data/principals/principalMutationJournal\";\nexport { UnreadablePrincipalMutationError } from \"../../data/principals/principalMutationJournalRecord\";\nexport {\n cancelStripeSubscription,\n checkNativePurchaseEligibility,\n claimNativeOrganizationSubscription,\n createStripeCheckout,\n createStripeCheckoutSession,\n loadOrganizationBilling,\n loadOrganizationBillingHistory,\n loadOrganizationBillingManagementUrl,\n loadStripeCheckoutOptions,\n type OrganizationBilling,\n type OrganizationBillingHistory,\n type OrganizationBillingHistoryEntry,\n type OrganizationBillingManagementUrl,\n type OrganizationBillingView,\n type OrganizationNativePurchaseEligibility,\n resolveOrganizationBillingView,\n type StripeCheckoutIntent,\n type StripeCheckoutOptions,\n startOrganizationTrial,\n} from \"./billing\";\nexport { revokeOrganizationContainerGrant } from \"./containerGrantRevocation\";\nexport {~~\n type~~ ~~CreateOrganizationApi,\n type~~ ~~CreateOrganizationInput,\n createOrganization,\n~~} from \"./~~createOrganization~~\";\nexport {~~\n loadLocalOrganizationDataUsage,\n type~~ ~~OrganizationDataUsage,\n type ReconcileOrganizationDataUsageInput,\n reconcileOrganizationDataUsage,\n} from \"./dataUsageReadModel\";\nexport {~~ deleteOrganizationGroup } from \"./deleteOrganizationGroup\";\nexport { ~~GroupMembershipNameMismatchError } from~~ \~~"./groupMembershipName\";\nexport {\~~n type LocalOrganizationSummary,\n listLocalOrganizations,\n} from \"./listLocalOrganizations\";\nexport {\n loadLocalOrganizationContainerGrants,\n loadLocalOrganizationGroupContainers,\n loadLocalOrganizationGroupPolicyHistory,\n loadLocalOrganizationPolicyHistory,\n loadLocalOrganizationPolicyReference,\n loadLocalOrganizationUserDetail,\n} from \"./localReadModelDetails\";\nexport {\n buildOrganizationProfileDocumentPatch,\n createInitializedOrganizationProfileDocument,\n DEFAULT_PERSONAL_ORGANIZATION_PROFILE_NAME,\n getOrganizationProfileDocumentLocalId,\n ORGANIZATION_PROFILE_DOCUMENT_KIND,\n readOrganizationProfileName,\n} from \"./organizationProfile\";\nexport {\n type ImportedOrganizationUser,\n importOrganizationUser,\n} from \"./organizationUserImport\";\nexport {\n abandonJournaledPrincipalMutation,\n discardUnreadableJournaledPrincipalMutation,\n readJournaledPrincipalMutation,\n} from \"./principalMutationJournalManagement\";\nexport {\n type PrincipalMutationJournalContext,\n PrincipalMutationOutcomeUnknownError,\n recoverJournaledPrincipalMutation,\n submitJournaledPrincipalMutation,\n} from \"./principalMutationJournalSession\";\nexport type { PrincipalMutationResponse } from \"./principalOperationReceipt\";\nexport {\n addOrganizationGroupUser,\n buildInitialGroupPolicyRequest,\n buildInitialMemberGroupPolicyRequest,\n createOrganizationGroup,\n removeOrganizationGroupUser,\n rotateOrganizationGroupForAccessSetShrink,\n} from \"./principalPolicy\";\nexport {\n buildOrganizationGroupPolicyHistory,\n type OrganizationContainerGrant,\n type OrganizationContainerGrants,\n type OrganizationDirectory,\n type OrganizationDirectoryAndGroups,\n type OrganizationDirectoryUser,\n type OrganizationGroupContainer,\n type OrganizationGroupContainers,\n type OrganizationGroupDetails,\n type OrganizationGroupMember,\n type OrganizationGroupMembers,\n type OrganizationGroupPolicyHistory,\n type OrganizationGroupPolicyHistoryEntry,\n type OrganizationGroupSummary,\n type OrganizationPolicyGrantChange,\n type OrganizationPolicyGroupChange,\n type OrganizationPolicyHistory,\n type OrganizationPolicyHistoryEntry,\n type OrganizationPrincipalMemberChange,\n type OrganizationPrincipalMemberChangeType,\n type OrganizationPrincipalPolicyHistory,\n type OrganizationPrincipalPolicyHistoryEntry,\n type OrganizationProfile,\n type OrganizationUserDetail,\n updateOrganizationProfile,\n updateOrganizationRosterEntry,\n} from \"./readModel\";\nexport {\n ~~loadLocalOrganizationDirectoryAndGroups~~,\n ~~loadLocalOrganizationGroupMembers~~,\n type ~~ReconcileOrganizationDirectoryAndGroupsInput~~,\n ~~reconcileOrganizationDirectoryAndGroups~~,\n} from \"./~~readModelProjection~~\";\nexport {\n type ~~AcknowledgedPrincipalCurrentInput~~,\n type ~~AcknowledgedPrincipalCurrentRetirement~~,\n ~~retainAcknowledgedPrincipalCurrents~~,\n} from \"./~~retainAcknowledgedPrincipalCurrents~~\";\nexport {\n buildRosterProfileDocumentPatch,\n createInitializedRosterProfileDocument,\n deriveOrganizationMetadataContainerSystemSlot,\n deriveOrganizationRosterProfileContainerSystemSlot,\n getRosterProfileDocumentLocalId,\n ORGANIZATION_METADATA_CONTAINER_NAME,\n ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME,\n ROSTER_PROFILE_DOCUMENT_KIND,\n} from \"./rosterProfileContainer\";\n"]}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,0CAA0C,GAC3C,MAAM,wEAAwE,CAAC;AAChF,OAAO,EAAE,6BAA6B,EAAE,MAAM,4DAA4D,CAAC;AAK3G,OAAO,EAAE,gCAAgC,EAAE,MAAM,sDAAsD,CAAC;AACxG,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,mCAAmC,EACnC,oBAAoB,EACpB,2BAA2B,EAC3B,uBAAuB,EACvB,8BAA8B,EAC9B,oCAAoC,EACpC,yBAAyB,EAOzB,8BAA8B,EAG9B,sBAAsB,GACvB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,gCAAgC,EAAE,MAAM,4BAA4B,CAAC;AAC9E,OAAO,EAAE,gCAAgC,EAAE,MAAM,kCAAkC,CAAC;AACpF,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EACL,qCAAqC,EACrC,4CAA4C,EAC5C,0CAA0C,EAC1C,qCAAqC,EACrC,kCAAkC,EAClC,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,sBAAsB,GACvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,iCAAiC,EACjC,2CAA2C,EAC3C,8BAA8B,GAC/B,MAAM,yDAAyD,CAAC;AACjE,OAAO,EAEL,oCAAoC,EACpC,iCAAiC,EACjC,gCAAgC,GACjC,MAAM,sDAAsD,CAAC;AAE9D,OAAO,EAGL,mCAAmC,GACpC,MAAM,0DAA0D,CAAC;AAClE,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,oCAAoC,EACpC,uBAAuB,EACvB,2BAA2B,EAC3B,yCAAyC,GAC1C,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAGL,kBAAkB,GACnB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,mCAAmC,EAwBnC,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,8BAA8B,EAG9B,8BAA8B,GAC/B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAEL,sBAAsB,GACvB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,oCAAoC,EACpC,oCAAoC,EACpC,uCAAuC,EACvC,kCAAkC,EAClC,oCAAoC,EACpC,+BAA+B,GAChC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,uCAAuC,EACvC,iCAAiC,EAEjC,uCAAuC,GACxC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,+BAA+B,EAC/B,sCAAsC,EACtC,6CAA6C,EAC7C,kDAAkD,EAClD,+BAA+B,EAC/B,oCAAoC,EACpC,0CAA0C,EAC1C,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC","sourcesContent":["export {\n type OrganizationReadModelInvalidationListener,\n subscribeOrganizationReadModelInvalidation,\n} from \"../../data/persistence/organizations/organizationReadModelInvalidation\";\nexport { PendingPrincipalMutationError } from \"../../data/persistence/principalMutationJournalPersistence\";\nexport type {\n AuthoredPrincipalMutation,\n PrincipalMutationJournalScope,\n} from \"../../data/principals/principalMutationJournal\";\nexport { UnreadablePrincipalMutationError } from \"../../data/principals/principalMutationJournalRecord\";\nexport {\n cancelStripeSubscription,\n checkNativePurchaseEligibility,\n claimNativeOrganizationSubscription,\n createStripeCheckout,\n createStripeCheckoutSession,\n loadOrganizationBilling,\n loadOrganizationBillingHistory,\n loadOrganizationBillingManagementUrl,\n loadStripeCheckoutOptions,\n type OrganizationBilling,\n type OrganizationBillingHistory,\n type OrganizationBillingHistoryEntry,\n type OrganizationBillingManagementUrl,\n type OrganizationBillingView,\n type OrganizationNativePurchaseEligibility,\n resolveOrganizationBillingView,\n type StripeCheckoutIntent,\n type StripeCheckoutOptions,\n startOrganizationTrial,\n} from \"./billing\";\nexport { revokeOrganizationContainerGrant } from \"./containerGrantRevocation\";\nexport { GroupMembershipNameMismatchError } from \"./groupNames/groupMembershipName\";\nexport { deleteOrganizationGroup } from \"./groups/deleteOrganizationGroup\";\nexport {\n buildOrganizationProfileDocumentPatch,\n createInitializedOrganizationProfileDocument,\n DEFAULT_PERSONAL_ORGANIZATION_PROFILE_NAME,\n getOrganizationProfileDocumentLocalId,\n ORGANIZATION_PROFILE_DOCUMENT_KIND,\n readOrganizationProfileName,\n} from \"./organizationProfile\";\nexport {\n type ImportedOrganizationUser,\n importOrganizationUser,\n} from \"./organizationUserImport\";\nexport {\n abandonJournaledPrincipalMutation,\n discardUnreadableJournaledPrincipalMutation,\n readJournaledPrincipalMutation,\n} from \"./principalMutations/principalMutationJournalManagement\";\nexport {\n type PrincipalMutationJournalContext,\n PrincipalMutationOutcomeUnknownError,\n recoverJournaledPrincipalMutation,\n submitJournaledPrincipalMutation,\n} from \"./principalMutations/principalMutationJournalSession\";\nexport type { PrincipalMutationResponse } from \"./principalMutations/principalOperationReceipt\";\nexport {\n type AcknowledgedPrincipalCurrentInput,\n type AcknowledgedPrincipalCurrentRetirement,\n retainAcknowledgedPrincipalCurrents,\n} from \"./principalMutations/retainAcknowledgedPrincipalCurrents\";\nexport {\n addOrganizationGroupUser,\n buildInitialGroupPolicyRequest,\n buildInitialMemberGroupPolicyRequest,\n createOrganizationGroup,\n removeOrganizationGroupUser,\n rotateOrganizationGroupForAccessSetShrink,\n} from \"./principalPolicy\";\nexport {\n type CreateOrganizationApi,\n type CreateOrganizationInput,\n createOrganization,\n} from \"./provisioning/createOrganization\";\nexport {\n buildOrganizationGroupPolicyHistory,\n type OrganizationContainerGrant,\n type OrganizationContainerGrants,\n type OrganizationDirectory,\n type OrganizationDirectoryAndGroups,\n type OrganizationDirectoryUser,\n type OrganizationGroupContainer,\n type OrganizationGroupContainers,\n type OrganizationGroupDetails,\n type OrganizationGroupMember,\n type OrganizationGroupMembers,\n type OrganizationGroupPolicyHistory,\n type OrganizationGroupPolicyHistoryEntry,\n type OrganizationGroupSummary,\n type OrganizationPolicyGrantChange,\n type OrganizationPolicyGroupChange,\n type OrganizationPolicyHistory,\n type OrganizationPolicyHistoryEntry,\n type OrganizationPrincipalMemberChange,\n type OrganizationPrincipalMemberChangeType,\n type OrganizationPrincipalPolicyHistory,\n type OrganizationPrincipalPolicyHistoryEntry,\n type OrganizationProfile,\n type OrganizationUserDetail,\n updateOrganizationProfile,\n updateOrganizationRosterEntry,\n} from \"./readModel\";\nexport {\n loadLocalOrganizationDataUsage,\n type OrganizationDataUsage,\n type ReconcileOrganizationDataUsageInput,\n reconcileOrganizationDataUsage,\n} from \"./readModel/dataUsageReadModel\";\nexport {\n type LocalOrganizationSummary,\n listLocalOrganizations,\n} from \"./readModel/listLocalOrganizations\";\nexport {\n loadLocalOrganizationContainerGrants,\n loadLocalOrganizationGroupContainers,\n loadLocalOrganizationGroupPolicyHistory,\n loadLocalOrganizationPolicyHistory,\n loadLocalOrganizationPolicyReference,\n loadLocalOrganizationUserDetail,\n} from \"./readModel/localReadModelDetails\";\nexport {\n loadLocalOrganizationDirectoryAndGroups,\n loadLocalOrganizationGroupMembers,\n type ReconcileOrganizationDirectoryAndGroupsInput,\n reconcileOrganizationDirectoryAndGroups,\n} from \"./readModel/readModelProjection\";\nexport {\n buildRosterProfileDocumentPatch,\n createInitializedRosterProfileDocument,\n deriveOrganizationMetadataContainerSystemSlot,\n deriveOrganizationRosterProfileContainerSystemSlot,\n getRosterProfileDocumentLocalId,\n ORGANIZATION_METADATA_CONTAINER_NAME,\n ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME,\n ROSTER_PROFILE_DOCUMENT_KIND,\n} from \"./rosterProfileContainer\";\n"]}

package/workflows/organizations/policyHistory/groupPolicyHistoryPage.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"groupPolicyHistoryPage.js","sourceRoot":"","sources":["groupPolicyHistoryPage.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAG1E,oFAAoF;AACpF,MAAM,UAAU,uCAAuC,CAAC,KAIvD;IACC,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IACvB,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,WAAW,EAAE,KAAK,CAAC,OAAO;QAC1B,aAAa,EAAE,OAAO;QACtB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,OAAO,EAAE,IAAI,CAAC,OAAO;aAClB,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YACtB,OAAO,EAAE,8BAA8B,CAAC;gBACtC,OAAO,EAAE,KAAK,CAAC,UAAU;gBACzB,QAAQ,EACN,CAAC,KAAK,KAAK,CAAC;oBACV,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU;oBAC9B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,IAAI,EAAE;aACjD,CAAC;YACF,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;YAChC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;YAC9B,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;YACpC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;YAC9B,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY;YACtC,wBAAwB,EAAE,KAAK,CAAC,KAAK,CAAC,wBAAwB;YAC9D,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;YAChC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO;SAC7B,CAAC,CAAC;aACF,OAAO,EAAE;KACb,CAAC;AACJ,CAAC","sourcesContent":["import type { RecoveredPrincipalHistoryPage } from \"../../principals/historyRecovery/loadRecoveredPrincipalHistoryPage\";\nimport { diffPrincipalProjectionMembers } from \"./policyHistoryReadModel\";\nimport type { OrganizationGroupPolicyHistory } from \"./policyHistoryTypes\";\n\n/** Keep a page boundary's actual predecessor when describing membership changes. */\nexport function buildOrganizationGroupPolicyHistoryPage(input: {\n readonly groupId: string;\n readonly organizationId: string;\n readonly page: RecoveredPrincipalHistoryPage;\n}): OrganizationGroupPolicyHistory {\n const { page } = input;\n return {\n groupId: input.groupId,\n organizationId: input.organizationId,\n principalId: input.groupId,\n principalType: \"group\",\n nextBeforeVersion: page.nextBeforeVersion,\n entries: page.entries\n .map((entry, index) => ({\n changes: diffPrincipalProjectionMembers({\n current: entry.projection,\n previous:\n (index === 0\n ? page.predecessor?.projection\n : page.entries[index - 1]?.projection) ?? [],\n }),\n createdAt: entry.state.createdAt,\n keyEpoch: entry.state.keyEpoch,\n memberCount: entry.state.memberCount,\n signedAt: entry.state.signedAt,\n signerUserId: entry.state.signerUserId,\n signerUserKeyFingerprint: entry.state.signerUserKeyFingerprint,\n stateHash: entry.state.stateHash,\n version: entry.state.version,\n }))\n .reverse(),\n };\n}\n"]}

package/workflows/organizations/policyHistory/loadPolicyHistoryDetails.js ADDED Viewed

@@ -0,0 +1,78 @@
+import { ProjectionDependencyUnavailableError } from "../../../data/keyingProjectionVerification/dependencyUnavailable.js";
+import { reportKeyingVerificationErrorInCauseChain } from "../../../data/keyingProjectionVerification/error.js";
+import { loadLocalOrganizationPolicyReference } from "../readModel/localReadModelDetails.js";
+import { captureOrganizationPresentationAccessAttempt, isOrganizationPresentationAccessAttemptCurrent, isOrganizationPresentationAccessReadable, } from "../readModel/organizationPresentationAccessState.js";
+import { isOrganizationPresentationAccessDeniedFailure } from "../readModel/organizationPresentationFailures.js";
+import { buildDetailedOrganizationPolicyHistory } from "./organizationPolicyHistoryDetails.js";
+import { denyPolicyHistoryAccess } from "./policyHistoryAccessDenial.js";
+import { cachePolicyHistory, loadCachedPolicyHistory, } from "./policyHistoryCache.js";
+export async function loadPolicyHistoryDetails(input) {
+    const access = { ...input, requesterUserId: input.currentUserId };
+    const attempt = captureOrganizationPresentationAccessAttempt(access, "readModel");
+    const current = () => input.stillCurrent() &&
+        isOrganizationPresentationAccessAttemptCurrent(access, attempt) &&
+        isOrganizationPresentationAccessReadable(access, "readModel");
+    if (!current())
+        return null;
+    const beforeVersion = (input.page.entries.at(-1)?.state.version ?? 0) + 1;
+    const cache = {
+        domainScope: input.domainScope,
+        access,
+        stateHash: input.head.stateHash,
+        beforeVersion,
+    };
+    const retain = async (history) => {
+        const latest = await loadLocalOrganizationPolicyReference({
+            ...input,
+            principalType: "organization",
+            principalId: input.organizationId,
+        });
+        return current() && latest?.stateHash === input.head.stateHash
+            ? history
+            : null;
+    };
+    const cached = loadCachedPolicyHistory(cache);
+    if (cached)
+        return retain(cached);
+    if (!input.online)
+        return retain(input.history);
+    try {
+        const response = await input.apiClient.getOrganizationPolicyHistoryResult(input.organizationId, input.head.stateHash, { beforeVersion, reportErrors: false });
+        if (!input.stillCurrent())
+            return null;
+        if (!response.ok) {
+            if (isOrganizationPresentationAccessDeniedFailure(response)) {
+                await denyPolicyHistoryAccess(access);
+                return null;
+            }
+            response.report();
+            if (input.olderPage)
+                throw new Error(response.message);
+            return retain(input.history);
+        }
+        const history = await buildDetailedOrganizationPolicyHistory({
+            head: input.head,
+            page: input.page,
+            evidence: response.data,
+            resolveHistory: input.resolveHistory,
+            stillCurrent: current,
+        });
+        const retained = await retain(history);
+        if (retained === history)
+            cachePolicyHistory({ ...cache, attempt, history });
+        return retained;
+    }
+    catch (error) {
+        if (!input.olderPage &&
+            error instanceof ProjectionDependencyUnavailableError)
+            return retain(input.history);
+        await reportKeyingVerificationErrorInCauseChain(error, input.reportSecurityIncident, {
+            objectId: input.organizationId,
+            objectKind: "principal",
+            operation: "organization.policy_history.load",
+            organizationId: input.organizationId,
+        });
+        throw error;
+    }
+}
+//# sourceMappingURL=loadPolicyHistoryDetails.js.map

package/workflows/organizations/policyHistory/loadPolicyHistoryDetails.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"loadPolicyHistoryDetails.js","sourceRoot":"","sources":["loadPolicyHistoryDetails.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oCAAoC,EAAE,MAAM,kEAAkE,CAAC;AACxH,OAAO,EAAE,yCAAyC,EAAE,MAAM,kDAAkD,CAAC;AAM7G,OAAO,EAAE,oCAAoC,EAAE,MAAM,oCAAoC,CAAC;AAC1F,OAAO,EACL,4CAA4C,EAC5C,8CAA8C,EAC9C,wCAAwC,GACzC,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,6CAA6C,EAAE,MAAM,+CAA+C,CAAC;AAC9G,OAAO,EAAE,sCAAsC,EAAE,MAAM,oCAAoC,CAAC;AAC5F,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EACL,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAG9B,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAkB9C;IACC,MAAM,MAAM,GAAG,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;IAClE,MAAM,OAAO,GAAG,4CAA4C,CAC1D,MAAM,EACN,WAAW,CACZ,CAAC;IACF,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,KAAK,CAAC,YAAY,EAAE;QACpB,8CAA8C,CAAC,MAAM,EAAE,OAAO,CAAC;QAC/D,wCAAwC,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAChE,IAAI,CAAC,OAAO,EAAE;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,aAAa,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG;QACZ,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM;QACN,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS;QAC/B,aAAa;KACd,CAAC;IACF,MAAM,MAAM,GAAG,KAAK,EAAE,OAAkC,EAAE,EAAE;QAC1D,MAAM,MAAM,GAAG,MAAM,oCAAoC,CAAC;YACxD,GAAG,KAAK;YACR,aAAa,EAAE,cAAc;YAC7B,WAAW,EAAE,KAAK,CAAC,cAAc;SAClC,CAAC,CAAC;QACH,OAAO,OAAO,EAAE,IAAI,MAAM,EAAE,SAAS,KAAK,KAAK,CAAC,IAAI,CAAC,SAAS;YAC5D,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,IAAI,CAAC;IACX,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,kCAAkC,CACvE,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,IAAI,CAAC,SAAS,EACpB,EAAE,aAAa,EAAE,YAAY,EAAE,KAAK,EAAE,CACvC,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE;YAAE,OAAO,IAAI,CAAC;QACvC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,6CAA6C,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5D,MAAM,uBAAuB,CAAC,MAAM,CAAC,CAAC;gBACtC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,QAAQ,CAAC,MAAM,EAAE,CAAC;YAClB,IAAI,KAAK,CAAC,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACvD,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,sCAAsC,CAAC;YAC3D,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,QAAQ,CAAC,IAAI;YACvB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,YAAY,EAAE,OAAO;SACtB,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,QAAQ,KAAK,OAAO;YACtB,kBAAkB,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACrD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,CAAC,KAAK,CAAC,SAAS;YAChB,KAAK,YAAY,oCAAoC;YAErD,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/B,MAAM,yCAAyC,CAC7C,KAAK,EACL,KAAK,CAAC,sBAAsB,EAC5B;YACE,QAAQ,EAAE,KAAK,CAAC,cAAc;YAC9B,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,kCAAkC;YAC7C,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CACF,CAAC;QACF,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport type { ReferencedPrincipalHead } from \"@tearleads/crypto\";\nimport { ProjectionDependencyUnavailableError } from \"../../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { reportKeyingVerificationErrorInCauseChain } from \"../../../data/keyingProjectionVerification/error\";\nimport type { ReferencedPrincipalPolicyWarmer } from \"../../../data/keyingProjectionVerification/types\";\nimport type { DomainScope } from \"../../../data/shared/domainScope\";\nimport type { SecurityIncidentReporter } from \"../../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport type { RecoveredPrincipalHistoryPage } from \"../../principals/historyRecovery/loadRecoveredPrincipalHistoryPage\";\nimport { loadLocalOrganizationPolicyReference } from \"../readModel/localReadModelDetails\";\nimport {\n captureOrganizationPresentationAccessAttempt,\n isOrganizationPresentationAccessAttemptCurrent,\n isOrganizationPresentationAccessReadable,\n} from \"../readModel/organizationPresentationAccessState\";\nimport { isOrganizationPresentationAccessDeniedFailure } from \"../readModel/organizationPresentationFailures\";\nimport { buildDetailedOrganizationPolicyHistory } from \"./organizationPolicyHistoryDetails\";\nimport { denyPolicyHistoryAccess } from \"./policyHistoryAccessDenial\";\nimport {\n cachePolicyHistory,\n loadCachedPolicyHistory,\n} from \"./policyHistoryCache\";\nimport type { OrganizationPolicyHistory } from \"./policyHistoryTypes\";\n\nexport async function loadPolicyHistoryDetails(input: {\n apiClient: Pick<ApiClient, \"getOrganizationPolicyHistoryResult\">;\n currentUserId: string;\n domainScope: DomainScope;\n execSql: ExecSql;\n organizationId: string;\n head: ReferencedPrincipalHead;\n page: RecoveredPrincipalHistoryPage;\n history: OrganizationPolicyHistory;\n resolveHistory: NonNullable<\n ReferencedPrincipalPolicyWarmer[\"resolveProjectionHistory\"]\n >;\n stillCurrent: () => boolean;\n online: boolean;\n olderPage: boolean;\n reportSecurityIncident?: SecurityIncidentReporter | undefined;\n // Forwarded to denyPolicyHistoryAccess to report failed durable cleanup.\n logError: (message: string | Error, cause?: unknown) => void;\n}): Promise<OrganizationPolicyHistory | null> {\n const access = { ...input, requesterUserId: input.currentUserId };\n const attempt = captureOrganizationPresentationAccessAttempt(\n access,\n \"readModel\",\n );\n const current = () =>\n input.stillCurrent() &&\n isOrganizationPresentationAccessAttemptCurrent(access, attempt) &&\n isOrganizationPresentationAccessReadable(access, \"readModel\");\n if (!current()) return null;\n const beforeVersion = (input.page.entries.at(-1)?.state.version ?? 0) + 1;\n const cache = {\n domainScope: input.domainScope,\n access,\n stateHash: input.head.stateHash,\n beforeVersion,\n };\n const retain = async (history: OrganizationPolicyHistory) => {\n const latest = await loadLocalOrganizationPolicyReference({\n ...input,\n principalType: \"organization\",\n principalId: input.organizationId,\n });\n return current() && latest?.stateHash === input.head.stateHash\n ? history\n : null;\n };\n const cached = loadCachedPolicyHistory(cache);\n if (cached) return retain(cached);\n if (!input.online) return retain(input.history);\n try {\n const response = await input.apiClient.getOrganizationPolicyHistoryResult(\n input.organizationId,\n input.head.stateHash,\n { beforeVersion, reportErrors: false },\n );\n if (!input.stillCurrent()) return null;\n if (!response.ok) {\n if (isOrganizationPresentationAccessDeniedFailure(response)) {\n await denyPolicyHistoryAccess(access);\n return null;\n }\n response.report();\n if (input.olderPage) throw new Error(response.message);\n return retain(input.history);\n }\n const history = await buildDetailedOrganizationPolicyHistory({\n head: input.head,\n page: input.page,\n evidence: response.data,\n resolveHistory: input.resolveHistory,\n stillCurrent: current,\n });\n const retained = await retain(history);\n if (retained === history)\n cachePolicyHistory({ ...cache, attempt, history });\n return retained;\n } catch (error) {\n if (\n !input.olderPage &&\n error instanceof ProjectionDependencyUnavailableError\n )\n return retain(input.history);\n await reportKeyingVerificationErrorInCauseChain(\n error,\n input.reportSecurityIncident,\n {\n objectId: input.organizationId,\n objectKind: \"principal\",\n operation: \"organization.policy_history.load\",\n organizationId: input.organizationId,\n },\n );\n throw error;\n }\n}\n"]}

package/workflows/organizations/policyHistory/organizationPolicyHistoryDetails.js ADDED Viewed

@@ -0,0 +1,110 @@
+import { principalPolicyMatchesReference, } from "../../../internal/crypto/index.js";
+import { assertProjectionVerificationCurrent, } from "../../../data/keyingProjectionVerification/types.js";
+import { buildOrganizationGroupPolicyHistoryPage } from "./groupPolicyHistoryPage.js";
+import { verifyOrganizationPolicyHistory } from "./organizationPolicyHistoryVerification.js";
+import { diffPrincipalProjectionMembers, } from "./policyHistoryReadModel.js";
+function diffGrants(previous, current) {
+    const before = new Map(previous.map((grant) => [grant.containerId, grant.accessLevel]));
+    const after = new Map(current.map((grant) => [grant.containerId, grant.accessLevel]));
+    return [...new Set([...before.keys(), ...after.keys()])]
+        .sort()
+        .flatMap((containerId) => {
+        const previousAccess = before.get(containerId) ?? null;
+        const nextAccess = after.get(containerId) ?? null;
+        return previousAccess === nextAccess
+            ? []
+            : [{ containerId, previousAccess, nextAccess }];
+    });
+}
+function describeGroupChange(previous, current, groupState) {
+    const head = current ?? previous;
+    if (!head)
+        throw new Error("Group change has no state");
+    const oldEntry = previous ? groupState(previous) : null;
+    const newEntry = current ? groupState(current) : null;
+    return {
+        groupId: head.principalId,
+        changeType: !previous ? "created" : !current ? "deleted" : "updated",
+        previousVersion: previous?.version ?? null,
+        version: head.version,
+        previousKeyEpoch: previous?.keyEpoch ?? null,
+        keyEpoch: head.keyEpoch,
+        changes: newEntry
+            ? diffPrincipalProjectionMembers({
+                previous: oldEntry?.projection ?? [],
+                current: newEntry.projection,
+            })
+            : [],
+        grantChanges: newEntry
+            ? diffGrants(oldEntry?.grants ?? [], newEntry.grants)
+            : [],
+    };
+}
+function diffGroups(previousHeads, heads, groupState) {
+    const before = new Map(previousHeads.map((head) => [head.principalId, head]));
+    const after = new Map(heads.map((head) => [head.principalId, head]));
+    const changes = [];
+    for (const groupId of [
+        ...new Set([...before.keys(), ...after.keys()]),
+    ].sort()) {
+        const previous = before.get(groupId);
+        const current = after.get(groupId);
+        if (previous?.stateHash === current?.stateHash)
+            continue;
+        changes.push(describeGroupChange(previous, current, groupState));
+    }
+    return changes;
+}
+/** Display only: historical group selections never advance current checkpoints. */
+export async function buildDetailedOrganizationPolicyHistory(input) {
+    input = {
+        ...input,
+        head: structuredClone(input.head),
+        page: structuredClone(input.page),
+        evidence: structuredClone(input.evidence),
+    };
+    const { descriptors, references } = await verifyOrganizationPolicyHistory(input);
+    assertProjectionVerificationCurrent(input.stillCurrent);
+    const resolved = await input.resolveHistory({
+        organizationId: input.head.principalId,
+        evidence: input.evidence.evidence,
+        references,
+        stillCurrent: input.stillCurrent,
+    });
+    assertProjectionVerificationCurrent(() => input.stillCurrent() && resolved.stillCurrent());
+    const groupState = (head) => {
+        const policy = resolved.policies.find((policy) => principalPolicyMatchesReference({ policy, reference: head }));
+        const entry = policy?.retainedHistory.find((entry) => entry.state.stateHash === head.stateHash);
+        if (!entry)
+            throw new Error("Verified group history state is missing");
+        return entry;
+    };
+    const basic = buildOrganizationGroupPolicyHistoryPage({
+        page: input.page,
+        groupId: input.head.principalId,
+        organizationId: input.head.principalId,
+    });
+    const byState = new Map();
+    let previousHeads = input.page.predecessor
+        ? (descriptors.get(input.page.predecessor.state.stateHash)?.groupHeads ??
+            [])
+        : [];
+    for (const { state } of input.page.entries) {
+        const heads = descriptors.get(state.stateHash)?.groupHeads;
+        if (!heads)
+            throw new Error("Verified organization directory is missing");
+        byState.set(state.stateHash, diffGroups(previousHeads, heads, groupState));
+        previousHeads = heads;
+    }
+    return {
+        principalId: input.head.principalId,
+        principalType: "organization",
+        organizationId: input.head.principalId,
+        nextBeforeVersion: input.page.nextBeforeVersion,
+        entries: basic.entries.map((entry) => ({
+            ...entry,
+            groupChanges: byState.get(entry.stateHash) ?? [],
+        })),
+    };
+}
+//# sourceMappingURL=organizationPolicyHistoryDetails.js.map

package/workflows/organizations/policyHistory/organizationPolicyHistoryDetails.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"organizationPolicyHistoryDetails.js","sourceRoot":"","sources":["organizationPolicyHistoryDetails.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,+BAA+B,GAChC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,mCAAmC,GAEpC,MAAM,kDAAkD,CAAC;AAE1D,OAAO,EAAE,uCAAuC,EAAE,MAAM,0BAA0B,CAAC;AACnF,OAAO,EAAE,+BAA+B,EAAE,MAAM,yCAAyC,CAAC;AAC1F,OAAO,EACL,8BAA8B,GAE/B,MAAM,0BAA0B,CAAC;AAMlC,SAAS,UAAU,CACjB,QAA4C,EAC5C,OAA2C;IAE3C,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAChE,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,GAAG,CACnB,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAC/D,CAAC;IACF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;SACrD,IAAI,EAAE;SACN,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE;QACvB,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC;QACvD,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC;QAClD,OAAO,cAAc,KAAK,UAAU;YAClC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,mBAAmB,CAC1B,QAA2C,EAC3C,OAA0C,EAC1C,UAA2E;IAE3E,MAAM,IAAI,GAAG,OAAO,IAAI,QAAQ,CAAC;IACjC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxD,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtD,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,WAAW;QACzB,UAAU,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QACpE,eAAe,EAAE,QAAQ,EAAE,OAAO,IAAI,IAAI;QAC1C,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,IAAI,IAAI;QAC5C,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,OAAO,EAAE,QAAQ;YACf,CAAC,CAAC,8BAA8B,CAAC;gBAC7B,QAAQ,EAAE,QAAQ,EAAE,UAAU,IAAI,EAAE;gBACpC,OAAO,EAAE,QAAQ,CAAC,UAAU;aAC7B,CAAC;YACJ,CAAC,CAAC,EAAE;QACN,YAAY,EAAE,QAAQ;YACpB,CAAC,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC;YACrD,CAAC,CAAC,EAAE;KACP,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CACjB,aAA+C,EAC/C,KAAuC,EACvC,UAA2E;IAE3E,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACrE,MAAM,OAAO,GAAoC,EAAE,CAAC;IACpD,KAAK,MAAM,OAAO,IAAI;QACpB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;KAChD,CAAC,IAAI,EAAE,EAAE,CAAC;QACT,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,QAAQ,EAAE,SAAS,KAAK,OAAO,EAAE,SAAS;YAAE,SAAS;QACzD,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,KAKC;IAED,KAAK,GAAG;QACN,GAAG,KAAK;QACR,IAAI,EAAE,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC;QACjC,IAAI,EAAE,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC;QACjC,QAAQ,EAAE,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC;KAC1C,CAAC;IACF,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,GAC/B,MAAM,+BAA+B,CAAC,KAAK,CAAC,CAAC;IAC/C,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC;QAC1C,cAAc,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW;QACtC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ;QACjC,UAAU;QACV,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,mCAAmC,CACjC,GAAG,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,QAAQ,CAAC,YAAY,EAAE,CACtD,CAAC;IACF,MAAM,UAAU,GAAG,CACjB,IAA2B,EACK,EAAE;QAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAC/C,+BAA+B,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAC7D,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,EAAE,eAAe,CAAC,IAAI,CACxC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,CACpD,CAAC;QACF,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QACvE,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,uCAAuC,CAAC;QACpD,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW;QAC/B,cAAc,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW;KACvC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2C,CAAC;IACnE,IAAI,aAAa,GAAqC,KAAK,CAAC,IAAI,CAAC,WAAW;QAC1E,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,UAAU;YACpE,EAAE,CAAC;QACL,CAAC,CAAC,EAAE,CAAC;IACP,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;QAC3D,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAC1E,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,UAAU,CAAC,aAAa,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;QAC3E,aAAa,GAAG,KAAK,CAAC;IACxB,CAAC;IACD,OAAO;QACL,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW;QACnC,aAAa,EAAE,cAAc;QAC7B,cAAc,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW;QACtC,iBAAiB,EAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB;QAC/C,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACrC,GAAG,KAAK;YACR,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE;SACjD,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC","sourcesContent":["import {\n type PrincipalContainerGrant,\n type PrincipalPolicyStateChainEntry,\n principalPolicyMatchesReference,\n} from \"@tearleads/crypto\";\nimport {\n assertProjectionVerificationCurrent,\n type ReferencedPrincipalPolicyWarmer,\n} from \"../../../data/keyingProjectionVerification/types\";\nimport type { OrganizationGroupHead } from \"../../../data/principals/organizationAuthorityDescriptor\";\nimport { buildOrganizationGroupPolicyHistoryPage } from \"./groupPolicyHistoryPage\";\nimport { verifyOrganizationPolicyHistory } from \"./organizationPolicyHistoryVerification\";\nimport {\n diffPrincipalProjectionMembers,\n type OrganizationPolicyHistory,\n} from \"./policyHistoryReadModel\";\nimport type {\n OrganizationPolicyGrantChange,\n OrganizationPolicyGroupChange,\n} from \"./policyHistoryTypes\";\n\nfunction diffGrants(\n previous: readonly PrincipalContainerGrant[],\n current: readonly PrincipalContainerGrant[],\n): OrganizationPolicyGrantChange[] {\n const before = new Map(\n previous.map((grant) => [grant.containerId, grant.accessLevel]),\n );\n const after = new Map(\n current.map((grant) => [grant.containerId, grant.accessLevel]),\n );\n return [...new Set([...before.keys(), ...after.keys()])]\n .sort()\n .flatMap((containerId) => {\n const previousAccess = before.get(containerId) ?? null;\n const nextAccess = after.get(containerId) ?? null;\n return previousAccess === nextAccess\n ? []\n : [{ containerId, previousAccess, nextAccess }];\n });\n}\n\nfunction describeGroupChange(\n previous: OrganizationGroupHead | undefined,\n current: OrganizationGroupHead | undefined,\n groupState: (head: OrganizationGroupHead) => PrincipalPolicyStateChainEntry,\n): OrganizationPolicyGroupChange {\n const head = current ?? previous;\n if (!head) throw new Error(\"Group change has no state\");\n const oldEntry = previous ? groupState(previous) : null;\n const newEntry = current ? groupState(current) : null;\n return {\n groupId: head.principalId,\n changeType: !previous ? \"created\" : !current ? \"deleted\" : \"updated\",\n previousVersion: previous?.version ?? null,\n version: head.version,\n previousKeyEpoch: previous?.keyEpoch ?? null,\n keyEpoch: head.keyEpoch,\n changes: newEntry\n ? diffPrincipalProjectionMembers({\n previous: oldEntry?.projection ?? [],\n current: newEntry.projection,\n })\n : [],\n grantChanges: newEntry\n ? diffGrants(oldEntry?.grants ?? [], newEntry.grants)\n : [],\n };\n}\n\nfunction diffGroups(\n previousHeads: readonly OrganizationGroupHead[],\n heads: readonly OrganizationGroupHead[],\n groupState: (head: OrganizationGroupHead) => PrincipalPolicyStateChainEntry,\n): OrganizationPolicyGroupChange[] {\n const before = new Map(previousHeads.map((head) => [head.principalId, head]));\n const after = new Map(heads.map((head) => [head.principalId, head]));\n const changes: OrganizationPolicyGroupChange[] = [];\n for (const groupId of [\n ...new Set([...before.keys(), ...after.keys()]),\n ].sort()) {\n const previous = before.get(groupId);\n const current = after.get(groupId);\n if (previous?.stateHash === current?.stateHash) continue;\n changes.push(describeGroupChange(previous, current, groupState));\n }\n return changes;\n}\n\n/** Display only: historical group selections never advance current checkpoints. */\nexport async function buildDetailedOrganizationPolicyHistory(\n input: Parameters<typeof verifyOrganizationPolicyHistory>[0] & {\n readonly resolveHistory: NonNullable<\n ReferencedPrincipalPolicyWarmer[\"resolveProjectionHistory\"]\n >;\n readonly stillCurrent: () => boolean;\n },\n): Promise<OrganizationPolicyHistory> {\n input = {\n ...input,\n head: structuredClone(input.head),\n page: structuredClone(input.page),\n evidence: structuredClone(input.evidence),\n };\n const { descriptors, references } =\n await verifyOrganizationPolicyHistory(input);\n assertProjectionVerificationCurrent(input.stillCurrent);\n const resolved = await input.resolveHistory({\n organizationId: input.head.principalId,\n evidence: input.evidence.evidence,\n references,\n stillCurrent: input.stillCurrent,\n });\n assertProjectionVerificationCurrent(\n () => input.stillCurrent() && resolved.stillCurrent(),\n );\n const groupState = (\n head: OrganizationGroupHead,\n ): PrincipalPolicyStateChainEntry => {\n const policy = resolved.policies.find((policy) =>\n principalPolicyMatchesReference({ policy, reference: head }),\n );\n const entry = policy?.retainedHistory.find(\n (entry) => entry.state.stateHash === head.stateHash,\n );\n if (!entry) throw new Error(\"Verified group history state is missing\");\n return entry;\n };\n const basic = buildOrganizationGroupPolicyHistoryPage({\n page: input.page,\n groupId: input.head.principalId,\n organizationId: input.head.principalId,\n });\n const byState = new Map<string, OrganizationPolicyGroupChange[]>();\n let previousHeads: readonly OrganizationGroupHead[] = input.page.predecessor\n ? (descriptors.get(input.page.predecessor.state.stateHash)?.groupHeads ??\n [])\n : [];\n for (const { state } of input.page.entries) {\n const heads = descriptors.get(state.stateHash)?.groupHeads;\n if (!heads) throw new Error(\"Verified organization directory is missing\");\n byState.set(state.stateHash, diffGroups(previousHeads, heads, groupState));\n previousHeads = heads;\n }\n return {\n principalId: input.head.principalId,\n principalType: \"organization\",\n organizationId: input.head.principalId,\n nextBeforeVersion: input.page.nextBeforeVersion,\n entries: basic.entries.map((entry) => ({\n ...entry,\n groupChanges: byState.get(entry.stateHash) ?? [],\n })),\n };\n}\n"]}

package/workflows/organizations/policyHistory/organizationPolicyHistoryVerification.js ADDED Viewed

@@ -0,0 +1,67 @@
+import { computePrincipalStatePayloadCiphertextHash, KeyingVerificationError, } from "../../../internal/crypto/index.js";
+import { parseOrganizationAuthorityDescriptor, principalHeadMatchesReference, } from "../../../data/principals/organizationAuthorityDescriptor.js";
+function reject(message) {
+    throw new KeyingVerificationError("hash_mismatch", `Organization policy history: ${message}`);
+}
+/** Bind every display payload and public source to the privately verified page. */
+export async function verifyOrganizationPolicyHistory(input) {
+    const { head, page, evidence } = input;
+    const beforeVersion = (page.entries.at(-1)?.state.version ?? 0) + 1;
+    if (head.principalType !== "organization" ||
+        evidence.organizationId !== head.principalId ||
+        evidence.stateHash !== head.stateHash ||
+        evidence.beforeVersion !== beforeVersion ||
+        evidence.nextBeforeVersion !== page.nextBeforeVersion ||
+        !evidence.evidence.organization ||
+        !principalHeadMatchesReference(evidence.evidence.organization.head, head))
+        reject("response does not match the requested organization page");
+    const entries = page.predecessor
+        ? [page.predecessor, ...page.entries]
+        : page.entries;
+    if (evidence.evidence.organizationPayloads.length !== entries.length)
+        reject("directory page is incomplete");
+    const descriptors = new Map();
+    const references = [head];
+    const groups = new Map();
+    for (const [index, item,] of evidence.evidence.organizationPayloads.entries()) {
+        const { reference, payload } = item;
+        const entry = entries[index];
+        if (!entry ||
+            !principalHeadMatchesReference(entry.state, reference) ||
+            payload.principalType !== "organization" ||
+            payload.principalId !== head.principalId ||
+            payload.stateHash !== reference.stateHash ||
+            descriptors.has(reference.stateHash))
+            reject("directory payload scope or order is invalid");
+        const hash = await computePrincipalStatePayloadCiphertextHash(payload.ciphertext);
+        if (hash !== entry.state.payloadCiphertextHash ||
+            hash !== payload.ciphertextHash)
+            reject("directory payload does not match its signed hash");
+        const descriptor = parseOrganizationAuthorityDescriptor(payload.ciphertext);
+        if (descriptor.organizationId !== head.principalId)
+            reject("directory belongs to another organization");
+        descriptors.set(reference.stateHash, descriptor);
+        references.push(reference, ...descriptor.groupHeads);
+        for (const group of descriptor.groupHeads) {
+            const previous = groups.get(group.principalId);
+            if (!previous || group.version > previous.version)
+                groups.set(group.principalId, group);
+        }
+    }
+    verifyGroupSources(evidence, groups);
+    return { descriptors, references };
+}
+function verifyGroupSources(evidence, groups) {
+    if (evidence.evidence.groups.length !== groups.size)
+        reject("unexpected group source");
+    const seen = new Set();
+    for (const source of evidence.evidence.groups) {
+        const expected = groups.get(source.head.principalId);
+        if (!expected ||
+            seen.has(source.head.principalId) ||
+            !principalHeadMatchesReference(source.head, expected))
+            reject("group source extends beyond the page's signed directory");
+        seen.add(source.head.principalId);
+    }
+}
+//# sourceMappingURL=organizationPolicyHistoryVerification.js.map