@tearleads/client-sdk 0.1.82 → 0.1.85

package/workflows/sync/remoteResetPrincipalScope.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"remoteResetPrincipalScope.js","sourceRoot":"","sources":["remoteResetPrincipalScope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,iBAAiB,EACjB,4BAA4B,EAC5B,+BAA+B,EAC/B,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,yDAAyD,CAAC;AACjE,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,GAC3B,MAAM,8DAA8D,CAAC;AACtE,OAAO,EAAE,2BAA2B,EAAE,MAAM,0DAA0D,CAAC;AACvG,OAAO,EAAE,sBAAsB,EAAE,MAAM,sDAAsD,CAAC;AAE9F,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAY1D,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,EAAgC,EAChC,cAAsB;IAKtB,MAAM,CAAC,UAAU,EAAE,YAAY,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAClE,EAAE;aACC,MAAM,CAAC;YACN,EAAE,EAAE,iBAAiB,CAAC,WAAW;YACjC,IAAI,EAAE,iBAAiB,CAAC,aAAa;SACtC,CAAC;aACD,IAAI,CAAC,iBAAiB,CAAC;QAC1B,OAAO,CAAC,GAAG,CACT;YACE,4BAA4B;YAC5B,+BAA+B;YAC/B,0BAA0B;SAC3B,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACd,EAAE;aACC,cAAc,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;aACpE,IAAI,CAAC,KAAK,CAAC,CACf,CACF;QACD,EAAE;aACC,MAAM,CAAC;YACN,cAAc,EAAE,4BAA4B,CAAC,cAAc;YAC3D,WAAW,EAAE,4BAA4B,CAAC,WAAW;YACrD,aAAa,EAAE,4BAA4B,CAAC,aAAa;SAC1D,CAAC;aACD,IAAI,CAAC,4BAA4B,CAAC;KACtC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,aAAa,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;QACzB,GAAG,GAAG,CAAC,aAAa,KAAK,GAAG,CAAC,WAAW,EAAE;QAC1C,GAAG,CAAC,cAAc;KACnB,CAAC,CACH,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,UAAU,EAAE,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QACnD,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CACb,sFAAsF,CACvF,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,IACE,GAAG,CAAC,IAAI,KAAK,cAAc;YAC3B,KAAK,KAAK,SAAS;YACnB,KAAK,KAAK,GAAG,CAAC,EAAE,EAChB,CAAC;YACD,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAmC,CAAC;IACxD,IAAI,CAAC,GAAG,CAAC,iBAAiB,cAAc,EAAE,EAAE;QAC1C,WAAW,EAAE,cAAc;QAC3B,aAAa,EAAE,cAAc;KAC9B,CAAC,CAAC;IACH,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,IAAI,GAAG,CAAC,aAAa,KAAK,OAAO,IAAI,GAAG,CAAC,aAAa,KAAK,cAAc,EAAE,CAAC;YAC1E,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,cAAc,KAAK,cAAc;YAAE,SAAS;QACpD,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,aAAa,KAAK,GAAG,CAAC,WAAW,EAAE,EAAE;YACnD,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,aAAa,EAAE,GAAG,CAAC,aAAa;SACjC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED,+EAA+E;AAC/E,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAInD;IACC,KAAK,MAAM,KAAK,IAAI;QAClB,8BAA8B;QAC9B,0BAA0B;QAC1B,uBAAuB;QACvB,qBAAqB;QACrB,wBAAwB;QACxB,2BAA2B;KAC5B;QACC,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,KAAK,CAAC;aACb,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;aACrD,GAAG,EAAE,CAAC;IACX,MAAM,KAAK,CAAC,EAAE;SACX,MAAM,CAAC,sBAAsB,CAAC;SAC9B,KAAK,CAAC,EAAE,CAAC,sBAAsB,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;SACtE,GAAG,EAAE,CAAC;IACT,KAAK,MAAM,cAAc,IAAI,kBAAkB,CAC7C,KAAK,CAAC,QAAQ,CAAC,aAAa,CAC7B,EAAE,CAAC;QACF,KAAK,MAAM,KAAK,IAAI;YAClB,iBAAiB;YACjB,4BAA4B;YAC5B,+BAA+B;SACvB,EAAE,CAAC;YACX,MAAM,KAAK,CAAC,EAAE;iBACX,MAAM,CAAC,KAAK,CAAC;iBACb,KAAK,CACJ,EAAE,CACA,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAClC,GAAG,CACD,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,SAAS,CAAC,aAAa,CAAC,EAChD,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,CAC7C,CACF,CACF,CACF;iBACA,GAAG,EAAE,CAAC;QACX,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import { and, eq, or } from \"drizzle-orm\";\nimport {\n  principalPolicies,\n  principalPolicyBundleHistory,\n  principalPolicyBundleReferences,\n  principalPolicyCheckpoints,\n  principalPolicyOrganizations,\n} from \"../../data/sqlite/schema\";\nimport {\n  principalHistoryEntries,\n  principalHistoryNodes,\n  principalHistoryPrefixes,\n} from \"../../data/sqlite/schema/principalHistoryEvidenceSchema\";\nimport {\n  principalHistoryNodeReferences,\n  principalHistoryRootOwners,\n} from \"../../data/sqlite/schema/principalHistoryNodeRetentionSchema\";\nimport { principalKeyEnvelopeArchive } from \"../../data/sqlite/schema/principalHistoryRetentionSchema\";\nimport { principalHistoryStages } from \"../../data/sqlite/schema/principalHistoryStageSchema\";\nimport type { ClientSQLiteTransactionScope } from \"../../data/sqlite/sqlitePersistenceRuntime\";\nimport { remoteResetBatches } from \"./remoteResetBatches\";\n\nexport interface RemoteResetPrincipalKey {\n  readonly principalId: string;\n  readonly principalType: \"group\" | \"organization\";\n}\n\ninterface PrincipalRow {\n  readonly id: string;\n  readonly type: string;\n}\n\n/** Current cache writes atomically pin ownership; reset never backfills it. */\nexport async function loadRemoteResetPrincipalScope(\n  tx: ClientSQLiteTransactionScope,\n  organizationId: string,\n): Promise<{\n  readonly policyRows: readonly PrincipalRow[];\n  readonly principalKeys: readonly RemoteResetPrincipalKey[];\n}> {\n  const [policyRows, retainedRows, ownershipRows] = await Promise.all([\n    tx\n      .select({\n        id: principalPolicies.principalId,\n        type: principalPolicies.principalType,\n      })\n      .from(principalPolicies),\n    Promise.all(\n      [\n        principalPolicyBundleHistory,\n        principalPolicyBundleReferences,\n        principalPolicyCheckpoints,\n      ].map((table) =>\n        tx\n          .selectDistinct({ id: table.principalId, type: table.principalType })\n          .from(table),\n      ),\n    ),\n    tx\n      .select({\n        organizationId: principalPolicyOrganizations.organizationId,\n        principalId: principalPolicyOrganizations.principalId,\n        principalType: principalPolicyOrganizations.principalType,\n      })\n      .from(principalPolicyOrganizations),\n  ]);\n  const owners = new Map(\n    ownershipRows.map((row) => [\n      `${row.principalType}\\0${row.principalId}`,\n      row.organizationId,\n    ]),\n  );\n  for (const row of [...policyRows, ...retainedRows.flat()]) {\n    const owner = owners.get(`${row.type}\\0${row.id}`);\n    if (row.type === \"group\" && !owner) {\n      throw new Error(\n        \"Unowned group policy cache requires a local database reset before organization purge\",\n      );\n    }\n    if (row.type !== \"group\" && row.type !== \"organization\") {\n      throw new Error(\"Principal policy cache has an invalid principal type\");\n    }\n    if (\n      row.type === \"organization\" &&\n      owner !== undefined &&\n      owner !== row.id\n    ) {\n      throw new Error(\n        \"Organization policy cache ownership does not match its identity\",\n      );\n    }\n  }\n  const keys = new Map<string, RemoteResetPrincipalKey>();\n  keys.set(`organization\\0${organizationId}`, {\n    principalId: organizationId,\n    principalType: \"organization\",\n  });\n  for (const row of ownershipRows) {\n    if (row.principalType !== \"group\" && row.principalType !== \"organization\") {\n      throw new Error(\n        \"Principal policy cache ownership has an invalid principal type\",\n      );\n    }\n    if (!row.organizationId) {\n      throw new Error(\n        \"Principal policy cache ownership requires a local database reset\",\n      );\n    }\n    if (row.organizationId !== organizationId) continue;\n    keys.set(`${row.principalType}\\0${row.principalId}`, {\n      principalId: row.principalId,\n      principalType: row.principalType,\n    });\n  }\n  return { policyRows, principalKeys: [...keys.values()] };\n}\n\n// Trust checkpoints and their ownership survive reset. Clearing cached bundles\n// must not turn a previously observed principal or object into first sight.\nexport async function clearRemoteResetPrincipalRows(input: {\n  organizationId: string;\n  snapshot: { principalKeys: readonly RemoteResetPrincipalKey[] };\n  tx: ClientSQLiteTransactionScope;\n}): Promise<void> {\n  for (const table of [\n    principalHistoryNodeReferences,\n    principalHistoryRootOwners,\n    principalHistoryEntries,\n    principalHistoryNodes,\n    principalHistoryPrefixes,\n    principalKeyEnvelopeArchive,\n  ])\n    await input.tx\n      .delete(table)\n      .where(eq(table.organizationId, input.organizationId))\n      .run();\n  await input.tx\n    .delete(principalHistoryStages)\n    .where(eq(principalHistoryStages.organizationId, input.organizationId))\n    .run();\n  for (const principalBatch of remoteResetBatches(\n    input.snapshot.principalKeys,\n  )) {\n    for (const table of [\n      principalPolicies,\n      principalPolicyBundleHistory,\n      principalPolicyBundleReferences,\n    ] as const) {\n      await input.tx\n        .delete(table)\n        .where(\n          or(\n            ...principalBatch.map((principal) =>\n              and(\n                eq(table.principalType, principal.principalType),\n                eq(table.principalId, principal.principalId),\n              ),\n            ),\n          ),\n        )\n        .run();\n    }\n  }\n}\n"]}