@things-factory/auth-base 10.1.192 → 10.1.202

package/dist-server/utils/access-request-review.d.ts

@@ -36,12 +36,18 @@ export interface DecisionFacts {
     } | null;
     /** The requester holds the privilege now - through some other role, since the request was made. */
     requesterHoldsIt: boolean;
-    /** Every assignable role that grants the privilege, with how many privileges each carries. */
+    /** Every assignable role that grants the privilege, with how many privileges each carries and whether it holds the task asked. */
     candidates: {
         id: string;
         name: string;
         privilegeCount: number;
+        holdsTask?: boolean;
     }[];
+    /** The task the requester asked for, with its declared privileges - null when none was asked or it is gone (ADR-0103 decision 9). */
+    task?: {
+        id: string;
+        privileges: PrivilegeName[];
+    } | null;
     /** The decider's own privileges - to tell them when a role gives what they do not have. */
     deciderPrivileges: PrivilegeName[];
     /** Whether the decider is a domain owner - an owner may give anything. */
@@ -64,9 +70,13 @@ export interface DecisionIssue {
 export declare function effectiveState(state: AccessRequestState, expiresAt: Date | string | null | undefined, now: Date): AccessRequestState;
 export declare function expiryFrom(now: Date, days?: number): Date;
 export declare function reviewAccessDecision(facts: DecisionFacts): DecisionIssue[];
-/** The smallest candidate - what the draft card proposes by default. Ties go by name, so the answer is the same every time. */
+/**
+ * The candidate the draft card proposes by default - one holding the task asked, if any does, then the smallest. Ties go
+ * by name, so the answer is the same every time; the order is `rolesGranting`'s.
+ */
 export declare function smallestRole<T extends {
     name: string;
     privilegeCount: number;
+    holdsTask?: boolean;
 }>(candidates: T[]): T | undefined;
 export declare const isBlocked: (issues: DecisionIssue[]) => boolean;

package/dist-server/utils/access-request-review.js

@@ -95,11 +95,18 @@ function grantIssues(facts, asked) {
             params: { role: role.name, count: more.length, privileges: more.map(nameOf).join(', ') }
         });
     }
+    /* Told, not refused: the role opens the refused door, and the rest of the work asked for is the decider's call. */
+    const missingOfTask = (facts.task?.privileges || []).filter(p => !role.privileges.some(r => same(r, p)));
+    if (facts.task && missingOfTask.length > 0) {
+        issues.push({ code: 'role-lacks-task', blocking: false, field: 'role', params: { role: role.name, task: facts.task.id, privileges: missingOfTask.map(nameOf).join(', ') } });
+    }
     if (!same(asked, exports.ROLE_GRANTING_PRIVILEGE) && role.privileges.some(p => same(p, exports.ROLE_GRANTING_PRIVILEGE))) {
         issues.push({ code: 'role-grants-admin', blocking: false, field: 'role', params: { role: role.name } });
     }
+    /* A smaller role that drops the task asked for is not a better answer - only one holding it as the chosen does counts. */
+    const choiceHoldsTask = !!facts.task && missingOfTask.length === 0;
     const smaller = facts.candidates
-        .filter(c => c.id !== role.id && c.privilegeCount < role.privileges.length)
+        .filter(c => c.id !== role.id && c.privilegeCount < role.privileges.length && (!choiceHoldsTask || c.holdsTask))
         .sort((a, b) => a.privilegeCount - b.privilegeCount || a.name.localeCompare(b.name))[0];
     if (smaller) {
         issues.push({ code: 'smaller-role-exists', blocking: false, field: 'role', params: { role: smaller.name, count: smaller.privilegeCount } });
@@ -113,9 +120,12 @@ function grantIssues(facts, asked) {
     }
     return issues;
 }
-/** The smallest candidate - what the draft card proposes by default. Ties go by name, so the answer is the same every time. */
+/**
+ * The candidate the draft card proposes by default - one holding the task asked, if any does, then the smallest. Ties go
+ * by name, so the answer is the same every time; the order is `rolesGranting`'s.
+ */
 function smallestRole(candidates) {
-    return [...candidates].sort((a, b) => a.privilegeCount - b.privilegeCount || a.name.localeCompare(b.name))[0];
+    return [...candidates].sort((a, b) => Number(!!b.holdsTask) - Number(!!a.holdsTask) || a.privilegeCount - b.privilegeCount || a.name.localeCompare(b.name))[0];
 }
 const isBlocked = (issues) => issues.some(issue => issue.blocking);
 exports.isBlocked = isBlocked;

package/dist-server/utils/access-request-review.js.map

@@ -1 +1 @@
-{"version":3,"file":"access-request-review.js","sourceRoot":"","sources":["../../server/utils/access-request-review.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AAyDH,wCAIC;AAED,gCAEC;AAED,oDAuCC;AA6DD,oCAEC;AAjKD,yGAAyG;AAC5F,QAAA,uBAAuB,GAAkB,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA;AAEjG,8DAA8D;AACjD,QAAA,2BAA2B,GAAG,EAAE,CAAA;AAyC7C,MAAM,IAAI,GAAG,CAAC,CAAgB,EAAE,CAAgB,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,CAAA;AAC7G,MAAM,MAAM,GAAG,CAAC,CAAgB,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,SAAS,EAAE,CAAA;AAEnE,kFAAkF;AAClF,SAAgB,cAAc,CAAC,KAAyB,EAAE,SAA2C,EAAE,GAAS;IAC9G,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAA;IACnD,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAA;IAC9B,OAAO,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AAChF,CAAC;AAED,SAAgB,UAAU,CAAC,GAAS,EAAE,IAAI,GAAG,mCAA2B;IACtE,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;AAC7D,CAAC;AAED,SAAgB,oBAAoB,CAAC,KAAoB;IACvD,MAAM,MAAM,GAAoB,EAAE,CAAA;IAClC,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAA;IAEzB,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;IACjF,CAAC;IAED,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAA;IACzE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAA;IACnG,CAAC;IAED,IAAI,OAAO,CAAC,WAAW,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;IACxE,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QAC7E,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;IAClF,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YAC1C,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;QAC7E,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAA;IAClG,CAAC;IAED,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,eAAe;YACrB,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,SAAS;YAChB,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,YAAY,CAAC,MAAM,IAAI,EAAE,EAAE;SAClI,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,WAAW,CAAC,KAAoB,EAAE,KAAoB;IAC7D,MAAM,MAAM,GAAoB,EAAE,CAAA;IAElC,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;IAChH,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,eAAe;YAC/E,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,MAAM;SACd,CAAC,CAAA;QACF,OAAO,MAAM,CAAA;IACf,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAA;IACtB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QAC/C,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;QAClI,OAAO,MAAM,CAAA;IACf,CAAC;IAED,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,2BAA2B,EAAE,CAAC;QAC9D,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IAC7G,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAA;IACzD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,kBAAkB;YACxB,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,MAAM;YACb,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SACzF,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,+BAAuB,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,+BAAuB,CAAC,CAAC,EAAE,CAAC;QACzG,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IACzG,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU;SAC7B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;SAC1E,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,GAAG,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACzF,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAA;IAC7I,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3F,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,uHAAuH;YACvH,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;QACnI,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,+HAA+H;AAC/H,SAAgB,YAAY,CAAqD,UAAe;IAC9F,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,GAAG,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAC/G,CAAC;AAEM,MAAM,SAAS,GAAG,CAAC,MAAuB,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;AAA7E,QAAA,SAAS,aAAoE","sourcesContent":["/*\n * The checks an access decision passes - one function, read by the list screen, by the AI 입력 draft card\n * (its `check`, when the card is made and again when it is pressed) and by `decideAccessRequest` itself\n * (ADR-0103 decision 4: the card and the screen cannot say different things).\n *\n * Pure: the facts are collected by `access-request-facts.ts`; this decides what they mean. A model never\n * judges a role as risky - this does, the same way every time, and the model only words the result.\n *\n * Blocking issues keep the decision from being written. The rest are told to the person deciding.\n */\n\nexport type AccessRequestState = 'PENDING' | 'GRANTED' | 'DENIED' | 'WITHDRAWN' | 'EXPIRED'\n\nexport type AccessDecisionKind = 'GRANT' | 'DENY'\n\nexport type PrivilegeName = { category: string; privilege: string }\n\n/** The privilege that lets its holder put people into roles - a role carrying it hands that power on. */\nexport const ROLE_GRANTING_PRIVILEGE: PrivilegeName = { category: 'user', privilege: 'mutation' }\n\n/** How long a request waits for a decision (questions Q7). */\nexport const ACCESS_REQUEST_PENDING_DAYS = 14\n\nexport interface DecisionFacts {\n  request: {\n    state: AccessRequestState\n    requesterId: string\n    category: string\n    privilege: string\n    expiresAt?: Date | string | null\n  } | null\n  deciderId: string\n  decision: AccessDecisionKind\n  reason?: string | null\n  /** The role chosen to grant - absent when it is not this domain's to assign. */\n  role?: { id: string; name: string; privileges: PrivilegeName[] } | null\n  /** A role id was named but not found in the domain's scope. */\n  roleNamedButNotAssignable?: boolean\n  /** The chosen role is the parent domain's - and whether the decider may give it (ADR-0103 decision 8). */\n  roleIsParents?: boolean\n  deciderMayChangeParentRoles?: boolean\n  requester: { active: boolean; inDomain: boolean } | null\n  /** The requester holds the privilege now - through some other role, since the request was made. */\n  requesterHoldsIt: boolean\n  /** Every assignable role that grants the privilege, with how many privileges each carries. */\n  candidates: { id: string; name: string; privilegeCount: number }[]\n  /** The decider's own privileges - to tell them when a role gives what they do not have. */\n  deciderPrivileges: PrivilegeName[]\n  /** Whether the decider is a domain owner - an owner may give anything. */\n  deciderIsOwner: boolean\n  /** The latest earlier denial of the same requester and privilege. */\n  deniedBefore?: { by: string; at: Date | string; reason?: string | null } | null\n  now: Date\n}\n\nexport interface DecisionIssue {\n  code: string\n  blocking: boolean\n  field?: 'request' | 'decision' | 'role' | 'reason'\n  params?: Record<string, string | number | boolean | null>\n}\n\nconst same = (a: PrivilegeName, b: PrivilegeName) => a.category === b.category && a.privilege === b.privilege\nconst nameOf = (p: PrivilegeName) => `${p.category}:${p.privilege}`\n\n/** A pending request past its time is expired, whatever the column still says. */\nexport function effectiveState(state: AccessRequestState, expiresAt: Date | string | null | undefined, now: Date): AccessRequestState {\n  if (state !== 'PENDING' || !expiresAt) return state\n  const at = new Date(expiresAt)\n  return isNaN(at.getTime()) || at.getTime() > now.getTime() ? state : 'EXPIRED'\n}\n\nexport function expiryFrom(now: Date, days = ACCESS_REQUEST_PENDING_DAYS): Date {\n  return new Date(now.getTime() + days * 24 * 60 * 60 * 1000)\n}\n\nexport function reviewAccessDecision(facts: DecisionFacts): DecisionIssue[] {\n  const issues: DecisionIssue[] = []\n  const { request } = facts\n\n  if (!request) {\n    return [{ code: 'access-request-not-found', blocking: true, field: 'request' }]\n  }\n\n  const state = effectiveState(request.state, request.expiresAt, facts.now)\n  if (state !== 'PENDING') {\n    issues.push({ code: 'request-not-pending', blocking: true, field: 'request', params: { state } })\n  }\n\n  if (request.requesterId === facts.deciderId) {\n    issues.push({ code: 'own-request', blocking: true, field: 'request' })\n  }\n\n  if (!facts.requester || !facts.requester.inDomain || !facts.requester.active) {\n    issues.push({ code: 'requester-unavailable', blocking: true, field: 'request' })\n  }\n\n  if (facts.decision === 'DENY') {\n    if (!facts.reason || !facts.reason.trim()) {\n      issues.push({ code: 'deny-needs-reason', blocking: true, field: 'reason' })\n    }\n  } else {\n    issues.push(...grantIssues(facts, { category: request.category, privilege: request.privilege }))\n  }\n\n  if (facts.deniedBefore) {\n    issues.push({\n      code: 'denied-before',\n      blocking: false,\n      field: 'request',\n      params: { by: facts.deniedBefore.by, at: new Date(facts.deniedBefore.at).toISOString(), reason: facts.deniedBefore.reason ?? '' }\n    })\n  }\n\n  return issues\n}\n\nfunction grantIssues(facts: DecisionFacts, asked: PrivilegeName): DecisionIssue[] {\n  const issues: DecisionIssue[] = []\n\n  if (facts.requesterHoldsIt) {\n    issues.push({ code: 'already-holds', blocking: true, field: 'request', params: { privilege: nameOf(asked) } })\n  }\n\n  if (!facts.role) {\n    issues.push({\n      code: facts.roleNamedButNotAssignable ? 'role-not-assignable' : 'role-required',\n      blocking: true,\n      field: 'role'\n    })\n    return issues\n  }\n\n  const { role } = facts\n  if (!role.privileges.some(p => same(p, asked))) {\n    issues.push({ code: 'role-does-not-grant', blocking: true, field: 'role', params: { role: role.name, privilege: nameOf(asked) } })\n    return issues\n  }\n\n  if (facts.roleIsParents && !facts.deciderMayChangeParentRoles) {\n    issues.push({ code: 'role-belongs-to-parent', blocking: true, field: 'role', params: { role: role.name } })\n  }\n\n  const more = role.privileges.filter(p => !same(p, asked))\n  if (more.length > 0) {\n    issues.push({\n      code: 'role-grants-more',\n      blocking: false,\n      field: 'role',\n      params: { role: role.name, count: more.length, privileges: more.map(nameOf).join(', ') }\n    })\n  }\n\n  if (!same(asked, ROLE_GRANTING_PRIVILEGE) && role.privileges.some(p => same(p, ROLE_GRANTING_PRIVILEGE))) {\n    issues.push({ code: 'role-grants-admin', blocking: false, field: 'role', params: { role: role.name } })\n  }\n\n  const smaller = facts.candidates\n    .filter(c => c.id !== role.id && c.privilegeCount < role.privileges.length)\n    .sort((a, b) => a.privilegeCount - b.privilegeCount || a.name.localeCompare(b.name))[0]\n  if (smaller) {\n    issues.push({ code: 'smaller-role-exists', blocking: false, field: 'role', params: { role: smaller.name, count: smaller.privilegeCount } })\n  }\n\n  if (!facts.deciderIsOwner) {\n    const lacking = role.privileges.filter(p => !facts.deciderPrivileges.some(d => same(d, p)))\n    if (lacking.length > 0) {\n      /* Told, not refused (questions Q6) - the role screen gives the same role today; ruling both is a separate decision. */\n      issues.push({ code: 'decider-lacks-it', blocking: false, field: 'role', params: { privileges: lacking.map(nameOf).join(', ') } })\n    }\n  }\n\n  return issues\n}\n\n/** The smallest candidate - what the draft card proposes by default. Ties go by name, so the answer is the same every time. */\nexport function smallestRole<T extends { name: string; privilegeCount: number }>(candidates: T[]): T | undefined {\n  return [...candidates].sort((a, b) => a.privilegeCount - b.privilegeCount || a.name.localeCompare(b.name))[0]\n}\n\nexport const isBlocked = (issues: DecisionIssue[]) => issues.some(issue => issue.blocking)\n"]}
+{"version":3,"file":"access-request-review.js","sourceRoot":"","sources":["../../server/utils/access-request-review.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AA2DH,wCAIC;AAED,gCAEC;AAED,oDAuCC;AAuED,oCAEC;AA7KD,yGAAyG;AAC5F,QAAA,uBAAuB,GAAkB,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA;AAEjG,8DAA8D;AACjD,QAAA,2BAA2B,GAAG,EAAE,CAAA;AA2C7C,MAAM,IAAI,GAAG,CAAC,CAAgB,EAAE,CAAgB,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,CAAA;AAC7G,MAAM,MAAM,GAAG,CAAC,CAAgB,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,SAAS,EAAE,CAAA;AAEnE,kFAAkF;AAClF,SAAgB,cAAc,CAAC,KAAyB,EAAE,SAA2C,EAAE,GAAS;IAC9G,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAA;IACnD,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAA;IAC9B,OAAO,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AAChF,CAAC;AAED,SAAgB,UAAU,CAAC,GAAS,EAAE,IAAI,GAAG,mCAA2B;IACtE,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;AAC7D,CAAC;AAED,SAAgB,oBAAoB,CAAC,KAAoB;IACvD,MAAM,MAAM,GAAoB,EAAE,CAAA;IAClC,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAA;IAEzB,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;IACjF,CAAC;IAED,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAA;IACzE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAA;IACnG,CAAC;IAED,IAAI,OAAO,CAAC,WAAW,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;IACxE,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QAC7E,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;IAClF,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YAC1C,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;QAC7E,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAA;IAClG,CAAC;IAED,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,eAAe;YACrB,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,SAAS;YAChB,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,YAAY,CAAC,MAAM,IAAI,EAAE,EAAE;SAClI,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,WAAW,CAAC,KAAoB,EAAE,KAAoB;IAC7D,MAAM,MAAM,GAAoB,EAAE,CAAA;IAElC,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;IAChH,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,eAAe;YAC/E,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,MAAM;SACd,CAAC,CAAA;QACF,OAAO,MAAM,CAAA;IACf,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAA;IACtB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QAC/C,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;QAClI,OAAO,MAAM,CAAA;IACf,CAAC;IAED,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,2BAA2B,EAAE,CAAC;QAC9D,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IAC7G,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAA;IACzD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,kBAAkB;YACxB,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,MAAM;YACb,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SACzF,CAAC,CAAA;IACJ,CAAC;IAED,mHAAmH;IACnH,MAAM,aAAa,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IACxG,IAAI,KAAK,CAAC,IAAI,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;IAC9K,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,+BAAuB,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,+BAAuB,CAAC,CAAC,EAAE,CAAC;QACzG,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IACzG,CAAC;IAED,0HAA0H;IAC1H,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,CAAA;IAClE,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU;SAC7B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC;SAC/G,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,GAAG,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACzF,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAA;IAC7I,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3F,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,uHAAuH;YACvH,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;QACnI,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;GAGG;AACH,SAAgB,YAAY,CAA0E,UAAe;IACnH,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,cAAc,GAAG,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAChK,CAAC;AAEM,MAAM,SAAS,GAAG,CAAC,MAAuB,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;AAA7E,QAAA,SAAS,aAAoE","sourcesContent":["/*\n * The checks an access decision passes - one function, read by the list screen, by the AI 입력 draft card\n * (its `check`, when the card is made and again when it is pressed) and by `decideAccessRequest` itself\n * (ADR-0103 decision 4: the card and the screen cannot say different things).\n *\n * Pure: the facts are collected by `access-request-facts.ts`; this decides what they mean. A model never\n * judges a role as risky - this does, the same way every time, and the model only words the result.\n *\n * Blocking issues keep the decision from being written. The rest are told to the person deciding.\n */\n\nexport type AccessRequestState = 'PENDING' | 'GRANTED' | 'DENIED' | 'WITHDRAWN' | 'EXPIRED'\n\nexport type AccessDecisionKind = 'GRANT' | 'DENY'\n\nexport type PrivilegeName = { category: string; privilege: string }\n\n/** The privilege that lets its holder put people into roles - a role carrying it hands that power on. */\nexport const ROLE_GRANTING_PRIVILEGE: PrivilegeName = { category: 'user', privilege: 'mutation' }\n\n/** How long a request waits for a decision (questions Q7). */\nexport const ACCESS_REQUEST_PENDING_DAYS = 14\n\nexport interface DecisionFacts {\n  request: {\n    state: AccessRequestState\n    requesterId: string\n    category: string\n    privilege: string\n    expiresAt?: Date | string | null\n  } | null\n  deciderId: string\n  decision: AccessDecisionKind\n  reason?: string | null\n  /** The role chosen to grant - absent when it is not this domain's to assign. */\n  role?: { id: string; name: string; privileges: PrivilegeName[] } | null\n  /** A role id was named but not found in the domain's scope. */\n  roleNamedButNotAssignable?: boolean\n  /** The chosen role is the parent domain's - and whether the decider may give it (ADR-0103 decision 8). */\n  roleIsParents?: boolean\n  deciderMayChangeParentRoles?: boolean\n  requester: { active: boolean; inDomain: boolean } | null\n  /** The requester holds the privilege now - through some other role, since the request was made. */\n  requesterHoldsIt: boolean\n  /** Every assignable role that grants the privilege, with how many privileges each carries and whether it holds the task asked. */\n  candidates: { id: string; name: string; privilegeCount: number; holdsTask?: boolean }[]\n  /** The task the requester asked for, with its declared privileges - null when none was asked or it is gone (ADR-0103 decision 9). */\n  task?: { id: string; privileges: PrivilegeName[] } | null\n  /** The decider's own privileges - to tell them when a role gives what they do not have. */\n  deciderPrivileges: PrivilegeName[]\n  /** Whether the decider is a domain owner - an owner may give anything. */\n  deciderIsOwner: boolean\n  /** The latest earlier denial of the same requester and privilege. */\n  deniedBefore?: { by: string; at: Date | string; reason?: string | null } | null\n  now: Date\n}\n\nexport interface DecisionIssue {\n  code: string\n  blocking: boolean\n  field?: 'request' | 'decision' | 'role' | 'reason'\n  params?: Record<string, string | number | boolean | null>\n}\n\nconst same = (a: PrivilegeName, b: PrivilegeName) => a.category === b.category && a.privilege === b.privilege\nconst nameOf = (p: PrivilegeName) => `${p.category}:${p.privilege}`\n\n/** A pending request past its time is expired, whatever the column still says. */\nexport function effectiveState(state: AccessRequestState, expiresAt: Date | string | null | undefined, now: Date): AccessRequestState {\n  if (state !== 'PENDING' || !expiresAt) return state\n  const at = new Date(expiresAt)\n  return isNaN(at.getTime()) || at.getTime() > now.getTime() ? state : 'EXPIRED'\n}\n\nexport function expiryFrom(now: Date, days = ACCESS_REQUEST_PENDING_DAYS): Date {\n  return new Date(now.getTime() + days * 24 * 60 * 60 * 1000)\n}\n\nexport function reviewAccessDecision(facts: DecisionFacts): DecisionIssue[] {\n  const issues: DecisionIssue[] = []\n  const { request } = facts\n\n  if (!request) {\n    return [{ code: 'access-request-not-found', blocking: true, field: 'request' }]\n  }\n\n  const state = effectiveState(request.state, request.expiresAt, facts.now)\n  if (state !== 'PENDING') {\n    issues.push({ code: 'request-not-pending', blocking: true, field: 'request', params: { state } })\n  }\n\n  if (request.requesterId === facts.deciderId) {\n    issues.push({ code: 'own-request', blocking: true, field: 'request' })\n  }\n\n  if (!facts.requester || !facts.requester.inDomain || !facts.requester.active) {\n    issues.push({ code: 'requester-unavailable', blocking: true, field: 'request' })\n  }\n\n  if (facts.decision === 'DENY') {\n    if (!facts.reason || !facts.reason.trim()) {\n      issues.push({ code: 'deny-needs-reason', blocking: true, field: 'reason' })\n    }\n  } else {\n    issues.push(...grantIssues(facts, { category: request.category, privilege: request.privilege }))\n  }\n\n  if (facts.deniedBefore) {\n    issues.push({\n      code: 'denied-before',\n      blocking: false,\n      field: 'request',\n      params: { by: facts.deniedBefore.by, at: new Date(facts.deniedBefore.at).toISOString(), reason: facts.deniedBefore.reason ?? '' }\n    })\n  }\n\n  return issues\n}\n\nfunction grantIssues(facts: DecisionFacts, asked: PrivilegeName): DecisionIssue[] {\n  const issues: DecisionIssue[] = []\n\n  if (facts.requesterHoldsIt) {\n    issues.push({ code: 'already-holds', blocking: true, field: 'request', params: { privilege: nameOf(asked) } })\n  }\n\n  if (!facts.role) {\n    issues.push({\n      code: facts.roleNamedButNotAssignable ? 'role-not-assignable' : 'role-required',\n      blocking: true,\n      field: 'role'\n    })\n    return issues\n  }\n\n  const { role } = facts\n  if (!role.privileges.some(p => same(p, asked))) {\n    issues.push({ code: 'role-does-not-grant', blocking: true, field: 'role', params: { role: role.name, privilege: nameOf(asked) } })\n    return issues\n  }\n\n  if (facts.roleIsParents && !facts.deciderMayChangeParentRoles) {\n    issues.push({ code: 'role-belongs-to-parent', blocking: true, field: 'role', params: { role: role.name } })\n  }\n\n  const more = role.privileges.filter(p => !same(p, asked))\n  if (more.length > 0) {\n    issues.push({\n      code: 'role-grants-more',\n      blocking: false,\n      field: 'role',\n      params: { role: role.name, count: more.length, privileges: more.map(nameOf).join(', ') }\n    })\n  }\n\n  /* Told, not refused: the role opens the refused door, and the rest of the work asked for is the decider's call. */\n  const missingOfTask = (facts.task?.privileges || []).filter(p => !role.privileges.some(r => same(r, p)))\n  if (facts.task && missingOfTask.length > 0) {\n    issues.push({ code: 'role-lacks-task', blocking: false, field: 'role', params: { role: role.name, task: facts.task.id, privileges: missingOfTask.map(nameOf).join(', ') } })\n  }\n  if (!same(asked, ROLE_GRANTING_PRIVILEGE) && role.privileges.some(p => same(p, ROLE_GRANTING_PRIVILEGE))) {\n    issues.push({ code: 'role-grants-admin', blocking: false, field: 'role', params: { role: role.name } })\n  }\n\n  /* A smaller role that drops the task asked for is not a better answer - only one holding it as the chosen does counts. */\n  const choiceHoldsTask = !!facts.task && missingOfTask.length === 0\n  const smaller = facts.candidates\n    .filter(c => c.id !== role.id && c.privilegeCount < role.privileges.length && (!choiceHoldsTask || c.holdsTask))\n    .sort((a, b) => a.privilegeCount - b.privilegeCount || a.name.localeCompare(b.name))[0]\n  if (smaller) {\n    issues.push({ code: 'smaller-role-exists', blocking: false, field: 'role', params: { role: smaller.name, count: smaller.privilegeCount } })\n  }\n\n  if (!facts.deciderIsOwner) {\n    const lacking = role.privileges.filter(p => !facts.deciderPrivileges.some(d => same(d, p)))\n    if (lacking.length > 0) {\n      /* Told, not refused (questions Q6) - the role screen gives the same role today; ruling both is a separate decision. */\n      issues.push({ code: 'decider-lacks-it', blocking: false, field: 'role', params: { privileges: lacking.map(nameOf).join(', ') } })\n    }\n  }\n\n  return issues\n}\n\n/**\n * The candidate the draft card proposes by default - one holding the task asked, if any does, then the smallest. Ties go\n * by name, so the answer is the same every time; the order is `rolesGranting`'s.\n */\nexport function smallestRole<T extends { name: string; privilegeCount: number; holdsTask?: boolean }>(candidates: T[]): T | undefined {\n  return [...candidates].sort((a, b) => Number(!!b.holdsTask) - Number(!!a.holdsTask) || a.privilegeCount - b.privilegeCount || a.name.localeCompare(b.name))[0]\n}\n\nexport const isBlocked = (issues: DecisionIssue[]) => issues.some(issue => issue.blocking)\n"]}

package/dist-server/utils/check-permission.d.ts

@@ -20,8 +20,14 @@ export type ProhibitedPrivilege = {
     privilege: string;
     by?: 'address' | 'license';
 };
+/**
+ * What opened a gate - the audit keeps it with every check (ADR-0141 §3.2), so a pass that rested on
+ * superuser is told from one a role gave.
+ */
+export type GrantBasis = 'role' | 'domain-owner' | 'superuser';
 export type PermissionJudgement = {
     permitted: true;
+    by?: GrantBasis;
 } | {
     permitted: false;
     because: RefusalCause;

package/dist-server/utils/check-permission.js

@@ -3,7 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.judgePermission = judgePermission;
 exports.checkPermission = checkPermission;
 const user_js_1 = require("../service/user/user.js");
+/* A gate that declares nothing - nothing opened it. */
 const PERMITTED = { permitted: true };
+function granted(by) {
+    return { permitted: true, by };
+}
 function refused(because) {
     return { permitted: false, because };
 }
@@ -19,9 +23,18 @@ async function judgePermission(privilegeObject, user, domain, unsafeIP, prohibit
         return PERMITTED;
     }
     const { owner: domainOwnerGranted, super: superUserGranted, category, privilege } = privilegeObject;
-    /* Ownership as the gate has always asked it - `process` carries the answer (domain-authenticate-middleware installs it). */
-    const ownershipOpens = async () => !!((domainOwnerGranted && (await process.domainOwnerGranted(domain, user))) ||
-        (superUserGranted && (await process.superUserGranted(domain, user))));
+    /*
+     * Ownership as the gate has always asked it - `process` carries the answer (domain-authenticate-middleware
+     * installs it). Domain owner first, then superuser, as the `||` it replaces; it now says which one opened.
+     */
+    const ownershipBasis = async () => {
+        if (domainOwnerGranted && (await process.domainOwnerGranted(domain, user)))
+            return 'domain-owner';
+        if (superUserGranted && (await process.superUserGranted(domain, user)))
+            return 'superuser';
+        return null;
+    };
+    const ownershipOpens = async () => !!(await ownershipBasis());
     /*
      * From an unsafe address ownership never opened anything and was never asked. It is asked now only on the
      * way to a refusal, to tell "address" from "role" - and a missing answer is "no", so the gate refuses as it did.
@@ -42,7 +55,7 @@ async function judgePermission(privilegeObject, user, domain, unsafeIP, prohibit
                 return refused(prohibition.by ?? 'unknown');
             }
             if (await user_js_1.User.hasPrivilege(privilege, category, domain, user)) {
-                return PERMITTED;
+                return granted('role');
             }
             /* An owner without the role would pass from a safe address - what stopped them is where they are. */
             return refused((await ownershipWouldHaveOpened()) ? 'address' : 'role');
@@ -62,16 +75,18 @@ async function judgePermission(privilegeObject, user, domain, unsafeIP, prohibit
     else {
         if (!privilege || !category) {
             // privilege, category가 설정되지 않은 경우에는 ownership granted만을 적용한다.
-            return (await ownershipOpens()) ? PERMITTED : refused('ownership');
+            const basis = await ownershipBasis();
+            return basis ? granted(basis) : refused('ownership');
         }
-        if (await ownershipOpens()) {
-            return PERMITTED;
+        const basis = await ownershipBasis();
+        if (basis) {
+            return granted(basis);
         }
         const prohibition = prohibitionOf(prohibitedPrivileges, category, privilege);
         if (prohibition) {
             return refused(prohibition.by ?? 'unknown');
         }
-        return (await user_js_1.User.hasPrivilege(privilege, category, domain, user)) ? PERMITTED : refused('role');
+        return (await user_js_1.User.hasPrivilege(privilege, category, domain, user)) ? granted('role') : refused('role');
     }
 }
 async function checkPermission(privilegeObject, user, domain, unsafeIP, prohibitedPrivileges) {

package/dist-server/utils/check-permission.js.map

@@ -1 +1 @@
-{"version":3,"file":"check-permission.js","sourceRoot":"","sources":["../../server/utils/check-permission.ts"],"names":[],"mappings":";;AAqCA,0CA4EC;AAED,0CAQC;AAzHD,qDAA8C;AAqB9C,MAAM,SAAS,GAAwB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;AAE1D,SAAS,OAAO,CAAC,OAAqB;IACpC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;AACtC,CAAC;AAED,SAAS,aAAa,CAAC,oBAAuD,EAAE,QAAgB,EAAE,SAAiB;IACjH,OAAO,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,QAAQ,IAAI,QAAQ,IAAI,EAAE,CAAC,SAAS,IAAI,SAAS,CAAC,CAAA;AACtG,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,eAAe,CACnC,eAAgC,EAChC,IAAU,EACV,MAAc,EACd,QAAkB,EAClB,oBAA4C;IAE5C,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,eAAe,CAAA;IAEnG,4HAA4H;IAC5H,MAAM,cAAc,GAAG,KAAK,IAAI,EAAE,CAChC,CAAC,CAAC,CACA,CAAC,kBAAkB,IAAI,CAAC,MAAO,OAAe,CAAC,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;QACjF,CAAC,gBAAgB,IAAI,CAAC,MAAO,OAAe,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAC9E,CAAA;IAEH;;;OAGG;IACH,MAAM,wBAAwB,GAAG,KAAK,IAAI,EAAE;QAC1C,IAAI,CAAC;YACH,OAAO,MAAM,cAAc,EAAE,CAAA;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC,CAAA;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;YAC1B,8CAA8C;YAC9C,MAAM,WAAW,GAAG,aAAa,CAAC,oBAAoB,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;YAC5E,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,SAAS,CAAC,CAAA;YAC7C,CAAC;YAED,IAAI,MAAM,cAAI,CAAC,YAAY,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;gBAC/D,OAAO,SAAS,CAAA;YAClB,CAAC;YAED,qGAAqG;YACrG,OAAO,OAAO,CAAC,CAAC,MAAM,wBAAwB,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;QACzE,CAAC;QAED;;;;;;;;;WASG;QACH,OAAO,OAAO,CAAC,SAAS,CAAC,CAAA;IAC3B,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,8DAA8D;YAC9D,OAAO,CAAC,MAAM,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QACpE,CAAC;QAED,IAAI,MAAM,cAAc,EAAE,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,MAAM,WAAW,GAAG,aAAa,CAAC,oBAAoB,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;QAC5E,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,SAAS,CAAC,CAAA;QAC7C,CAAC;QAED,OAAO,CAAC,MAAM,cAAI,CAAC,YAAY,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IACnG,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,eAAe,CACnC,eAAgC,EAChC,IAAU,EACV,MAAc,EACd,QAAkB,EAClB,oBAA4C;IAE5C,OAAO,CAAC,MAAM,eAAe,CAAC,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAA;AACzG,CAAC","sourcesContent":["import { Domain } from '@things-factory/shell'\nimport { PrivilegeObject } from '../service/privilege/privilege.js'\nimport { User } from '../service/user/user.js'\n\n/**\n * Why a gate said no - what the person can do about it differs (ADR-0103 decision 1).\n *\n *  role       none of their roles holds category:privilege - a role can be given (an access request)\n *  address    refused from where they are: the domain's protected address list\n *  license    refused by what this installation is licensed for\n *  ownership  the declaration opens only to domain or system owners - no role gives it\n *  unknown    a prohibition that does not say where it came from - the reason is not made up\n */\nexport type RefusalCause = 'role' | 'address' | 'license' | 'ownership' | 'unknown'\n\n/**\n * A privilege refused by the request, whatever the person's roles. `by` says who refused it:\n * the domain's address list (shell domain-middleware) or the installation's license (board-service).\n */\nexport type ProhibitedPrivilege = { category: string; privilege: string; by?: 'address' | 'license' }\n\nexport type PermissionJudgement = { permitted: true } | { permitted: false; because: RefusalCause }\n\nconst PERMITTED: PermissionJudgement = { permitted: true }\n\nfunction refused(because: RefusalCause): PermissionJudgement {\n  return { permitted: false, because }\n}\n\nfunction prohibitionOf(prohibitedPrivileges: ProhibitedPrivilege[] | undefined, category: string, privilege: string) {\n  return (prohibitedPrivileges || []).find(pp => pp.category == category && pp.privilege == privilege)\n}\n\n/**\n * The gate, with its reason. `checkPermission` answers only the boolean and is what most callers\n * want; the privilege directive reads this so a refusal can say which of the four it was.\n */\nexport async function judgePermission(\n  privilegeObject: PrivilegeObject,\n  user: User,\n  domain: Domain,\n  unsafeIP?: boolean,\n  prohibitedPrivileges?: ProhibitedPrivilege[]\n): Promise<PermissionJudgement> {\n  if (!privilegeObject) {\n    return PERMITTED\n  }\n\n  const { owner: domainOwnerGranted, super: superUserGranted, category, privilege } = privilegeObject\n\n  /* Ownership as the gate has always asked it - `process` carries the answer (domain-authenticate-middleware installs it). */\n  const ownershipOpens = async () =>\n    !!(\n      (domainOwnerGranted && (await (process as any).domainOwnerGranted(domain, user))) ||\n      (superUserGranted && (await (process as any).superUserGranted(domain, user)))\n    )\n\n  /*\n   * From an unsafe address ownership never opened anything and was never asked. It is asked now only on the\n   * way to a refusal, to tell \"address\" from \"role\" - and a missing answer is \"no\", so the gate refuses as it did.\n   */\n  const ownershipWouldHaveOpened = async () => {\n    try {\n      return await ownershipOpens()\n    } catch {\n      return false\n    }\n  }\n\n  if (unsafeIP) {\n    if (privilege && category) {\n      // unsafeIP 상황에서는 ownership granted는 적용되지 않는다.\n      const prohibition = prohibitionOf(prohibitedPrivileges, category, privilege)\n      if (prohibition) {\n        return refused(prohibition.by ?? 'unknown')\n      }\n\n      if (await User.hasPrivilege(privilege, category, domain, user)) {\n        return PERMITTED\n      }\n\n      /* An owner without the role would pass from a safe address - what stopped them is where they are. */\n      return refused((await ownershipWouldHaveOpened()) ? 'address' : 'role')\n    }\n\n    /*\n     * Ownership does not count from an unsafe address, so a declaration that rests on\n     * ownership alone has nothing left to stand on here and the answer is no.\n     *\n     * This read `!domainOwnerGranted && !superUserGranted` until 2026-09-15, which answered\n     * **yes** for an object that named nothing at all — the same `{}` a safe address\n     * refused. An unsafe address was the more permissive of the two, which is backwards.\n     * `privilege-directive.ts` now refuses to build a declaration that names nothing, but\n     * this function is exported and called directly, so the rule is fixed here too.\n     */\n    return refused('address')\n  } else {\n    if (!privilege || !category) {\n      // privilege, category가 설정되지 않은 경우에는 ownership granted만을 적용한다.\n      return (await ownershipOpens()) ? PERMITTED : refused('ownership')\n    }\n\n    if (await ownershipOpens()) {\n      return PERMITTED\n    }\n\n    const prohibition = prohibitionOf(prohibitedPrivileges, category, privilege)\n    if (prohibition) {\n      return refused(prohibition.by ?? 'unknown')\n    }\n\n    return (await User.hasPrivilege(privilege, category, domain, user)) ? PERMITTED : refused('role')\n  }\n}\n\nexport async function checkPermission(\n  privilegeObject: PrivilegeObject,\n  user: User,\n  domain: Domain,\n  unsafeIP?: boolean,\n  prohibitedPrivileges?: ProhibitedPrivilege[]\n): Promise<boolean> {\n  return (await judgePermission(privilegeObject, user, domain, unsafeIP, prohibitedPrivileges)).permitted\n}\n"]}
+{"version":3,"file":"check-permission.js","sourceRoot":"","sources":["../../server/utils/check-permission.ts"],"names":[],"mappings":";;AAgDA,0CAkFC;AAED,0CAQC;AA1ID,qDAA8C;AA2B9C,uDAAuD;AACvD,MAAM,SAAS,GAAwB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;AAE1D,SAAS,OAAO,CAAC,EAAc;IAC7B,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,CAAA;AAChC,CAAC;AAED,SAAS,OAAO,CAAC,OAAqB;IACpC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;AACtC,CAAC;AAED,SAAS,aAAa,CAAC,oBAAuD,EAAE,QAAgB,EAAE,SAAiB;IACjH,OAAO,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,QAAQ,IAAI,QAAQ,IAAI,EAAE,CAAC,SAAS,IAAI,SAAS,CAAC,CAAA;AACtG,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,eAAe,CACnC,eAAgC,EAChC,IAAU,EACV,MAAc,EACd,QAAkB,EAClB,oBAA4C;IAE5C,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,eAAe,CAAA;IAEnG;;;OAGG;IACH,MAAM,cAAc,GAAG,KAAK,IAAgC,EAAE;QAC5D,IAAI,kBAAkB,IAAI,CAAC,MAAO,OAAe,CAAC,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAAE,OAAO,cAAc,CAAA;QAC1G,IAAI,gBAAgB,IAAI,CAAC,MAAO,OAAe,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAAE,OAAO,WAAW,CAAA;QACnG,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IACD,MAAM,cAAc,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,cAAc,EAAE,CAAC,CAAA;IAE7D;;;OAGG;IACH,MAAM,wBAAwB,GAAG,KAAK,IAAI,EAAE;QAC1C,IAAI,CAAC;YACH,OAAO,MAAM,cAAc,EAAE,CAAA;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC,CAAA;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;YAC1B,8CAA8C;YAC9C,MAAM,WAAW,GAAG,aAAa,CAAC,oBAAoB,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;YAC5E,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,SAAS,CAAC,CAAA;YAC7C,CAAC;YAED,IAAI,MAAM,cAAI,CAAC,YAAY,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;gBAC/D,OAAO,OAAO,CAAC,MAAM,CAAC,CAAA;YACxB,CAAC;YAED,qGAAqG;YACrG,OAAO,OAAO,CAAC,CAAC,MAAM,wBAAwB,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;QACzE,CAAC;QAED;;;;;;;;;WASG;QACH,OAAO,OAAO,CAAC,SAAS,CAAC,CAAA;IAC3B,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,8DAA8D;YAC9D,MAAM,KAAK,GAAG,MAAM,cAAc,EAAE,CAAA;YACpC,OAAO,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QACtD,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,cAAc,EAAE,CAAA;QACpC,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,OAAO,CAAC,KAAK,CAAC,CAAA;QACvB,CAAC;QAED,MAAM,WAAW,GAAG,aAAa,CAAC,oBAAoB,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;QAC5E,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,SAAS,CAAC,CAAA;QAC7C,CAAC;QAED,OAAO,CAAC,MAAM,cAAI,CAAC,YAAY,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IACzG,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,eAAe,CACnC,eAAgC,EAChC,IAAU,EACV,MAAc,EACd,QAAkB,EAClB,oBAA4C;IAE5C,OAAO,CAAC,MAAM,eAAe,CAAC,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAA;AACzG,CAAC","sourcesContent":["import { Domain } from '@things-factory/shell'\nimport { PrivilegeObject } from '../service/privilege/privilege.js'\nimport { User } from '../service/user/user.js'\n\n/**\n * Why a gate said no - what the person can do about it differs (ADR-0103 decision 1).\n *\n *  role       none of their roles holds category:privilege - a role can be given (an access request)\n *  address    refused from where they are: the domain's protected address list\n *  license    refused by what this installation is licensed for\n *  ownership  the declaration opens only to domain or system owners - no role gives it\n *  unknown    a prohibition that does not say where it came from - the reason is not made up\n */\nexport type RefusalCause = 'role' | 'address' | 'license' | 'ownership' | 'unknown'\n\n/**\n * A privilege refused by the request, whatever the person's roles. `by` says who refused it:\n * the domain's address list (shell domain-middleware) or the installation's license (board-service).\n */\nexport type ProhibitedPrivilege = { category: string; privilege: string; by?: 'address' | 'license' }\n\n/**\n * What opened a gate - the audit keeps it with every check (ADR-0141 §3.2), so a pass that rested on\n * superuser is told from one a role gave.\n */\nexport type GrantBasis = 'role' | 'domain-owner' | 'superuser'\n\nexport type PermissionJudgement = { permitted: true; by?: GrantBasis } | { permitted: false; because: RefusalCause }\n\n/* A gate that declares nothing - nothing opened it. */\nconst PERMITTED: PermissionJudgement = { permitted: true }\n\nfunction granted(by: GrantBasis): PermissionJudgement {\n  return { permitted: true, by }\n}\n\nfunction refused(because: RefusalCause): PermissionJudgement {\n  return { permitted: false, because }\n}\n\nfunction prohibitionOf(prohibitedPrivileges: ProhibitedPrivilege[] | undefined, category: string, privilege: string) {\n  return (prohibitedPrivileges || []).find(pp => pp.category == category && pp.privilege == privilege)\n}\n\n/**\n * The gate, with its reason. `checkPermission` answers only the boolean and is what most callers\n * want; the privilege directive reads this so a refusal can say which of the four it was.\n */\nexport async function judgePermission(\n  privilegeObject: PrivilegeObject,\n  user: User,\n  domain: Domain,\n  unsafeIP?: boolean,\n  prohibitedPrivileges?: ProhibitedPrivilege[]\n): Promise<PermissionJudgement> {\n  if (!privilegeObject) {\n    return PERMITTED\n  }\n\n  const { owner: domainOwnerGranted, super: superUserGranted, category, privilege } = privilegeObject\n\n  /*\n   * Ownership as the gate has always asked it - `process` carries the answer (domain-authenticate-middleware\n   * installs it). Domain owner first, then superuser, as the `||` it replaces; it now says which one opened.\n   */\n  const ownershipBasis = async (): Promise<GrantBasis | null> => {\n    if (domainOwnerGranted && (await (process as any).domainOwnerGranted(domain, user))) return 'domain-owner'\n    if (superUserGranted && (await (process as any).superUserGranted(domain, user))) return 'superuser'\n    return null\n  }\n  const ownershipOpens = async () => !!(await ownershipBasis())\n\n  /*\n   * From an unsafe address ownership never opened anything and was never asked. It is asked now only on the\n   * way to a refusal, to tell \"address\" from \"role\" - and a missing answer is \"no\", so the gate refuses as it did.\n   */\n  const ownershipWouldHaveOpened = async () => {\n    try {\n      return await ownershipOpens()\n    } catch {\n      return false\n    }\n  }\n\n  if (unsafeIP) {\n    if (privilege && category) {\n      // unsafeIP 상황에서는 ownership granted는 적용되지 않는다.\n      const prohibition = prohibitionOf(prohibitedPrivileges, category, privilege)\n      if (prohibition) {\n        return refused(prohibition.by ?? 'unknown')\n      }\n\n      if (await User.hasPrivilege(privilege, category, domain, user)) {\n        return granted('role')\n      }\n\n      /* An owner without the role would pass from a safe address - what stopped them is where they are. */\n      return refused((await ownershipWouldHaveOpened()) ? 'address' : 'role')\n    }\n\n    /*\n     * Ownership does not count from an unsafe address, so a declaration that rests on\n     * ownership alone has nothing left to stand on here and the answer is no.\n     *\n     * This read `!domainOwnerGranted && !superUserGranted` until 2026-09-15, which answered\n     * **yes** for an object that named nothing at all — the same `{}` a safe address\n     * refused. An unsafe address was the more permissive of the two, which is backwards.\n     * `privilege-directive.ts` now refuses to build a declaration that names nothing, but\n     * this function is exported and called directly, so the rule is fixed here too.\n     */\n    return refused('address')\n  } else {\n    if (!privilege || !category) {\n      // privilege, category가 설정되지 않은 경우에는 ownership granted만을 적용한다.\n      const basis = await ownershipBasis()\n      return basis ? granted(basis) : refused('ownership')\n    }\n\n    const basis = await ownershipBasis()\n    if (basis) {\n      return granted(basis)\n    }\n\n    const prohibition = prohibitionOf(prohibitedPrivileges, category, privilege)\n    if (prohibition) {\n      return refused(prohibition.by ?? 'unknown')\n    }\n\n    return (await User.hasPrivilege(privilege, category, domain, user)) ? granted('role') : refused('role')\n  }\n}\n\nexport async function checkPermission(\n  privilegeObject: PrivilegeObject,\n  user: User,\n  domain: Domain,\n  unsafeIP?: boolean,\n  prohibitedPrivileges?: ProhibitedPrivilege[]\n): Promise<boolean> {\n  return (await judgePermission(privilegeObject, user, domain, unsafeIP, prohibitedPrivileges)).permitted\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/auth-base",
-  "version": "10.1.192",
+  "version": "10.1.202",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -38,6 +38,7 @@
     "@things-factory/email-base": "^10.1.188",
     "@things-factory/env": "^10.1.149",
     "@things-factory/shell": "^10.1.188",
+    "@things-factory/task-lease": "^10.1.188",
     "@things-factory/utils": "^10.1.179",
     "@types/webappsec-credential-management": "^0.6.9",
     "jsonwebtoken": "^9.0.0",
@@ -49,5 +50,5 @@
     "passport-jwt": "^4.0.0",
     "passport-local": "^1.0.0"
   },
-  "gitHead": "c44fe3ae4646dc4ffad7947785322acdb84c7374"
+  "gitHead": "3243b81eb1a4d3d903a01929f3a85d5b8df438dd"
 }

package/tests/access-assistant-db.test.ts

@@ -84,7 +84,7 @@ describe('listPendingAccessRequests', () => {
     await ask(kim)
     const answer = await assistant.pendingRequestsToDecide({ domain, user: park })
     expect(answer.requests).toEqual([
-      expect.objectContaining({ requester: 'kim', privilege: 'warehouse:mutation', roles: [{ name: 'inbound', privilegeCount: 1 }] })
+      expect.objectContaining({ requester: 'kim', privilege: 'warehouse:mutation', task: null, roles: [{ name: 'inbound', privilegeCount: 1, holdsTask: false }] })
     ])
   })
 

package/tests/access-request-db.test.ts

@@ -315,3 +315,74 @@ describe('found in review (2026-10-02)', () => {
     expect(mine.requester?.id).toBe(kim.id)
   })
 })
+
+describe('asking for a task (ADR-0103 decision 9)', () => {
+  const { registerRoleTask } = loadCompiled('service/role-template/role-task')
+  const { AccessRequestQuery } = loadCompiled('service/access-request/access-request-query')
+
+  beforeEach(() => {
+    ;(process as any)['ROLE_TASKS'] = {}
+    ;(process as any).PRIVILEGES = {
+      'warehouse query': ['warehouse', 'query'],
+      'warehouse mutation': ['warehouse', 'mutation'],
+      'user mutation': ['user', 'mutation']
+    }
+    registerRoleTask({ id: 'warehouse.keeping', grants: [{ category: 'warehouse', axes: ['query', 'mutation'] }] })
+    registerRoleTask({ id: 'warehouse.reading', grants: [{ category: 'warehouse', axes: ['query'] }] })
+  })
+
+  it('★ the tasks holding a refused privilege are listed fewest privileges first', async () => {
+    const query = new AccessRequestQuery()
+    expect((await query.tasksGranting('warehouse', 'query')).map((one: any) => [one.taskId, one.privilegeCount])).toEqual([
+      ['warehouse.reading', 1],
+      ['warehouse.keeping', 2]
+    ])
+    expect((await query.tasksGranting('warehouse', 'mutation')).map((one: any) => one.taskId)).toEqual(['warehouse.keeping'])
+  })
+
+  it('★ the request keeps the task asked for, and refuses one that does not hold the refused privilege', async () => {
+    const request = await access.requestAccess({ ...ASK, taskId: 'warehouse.keeping' }, contextOf(kim))
+    expect(request.taskId).toBe('warehouse.keeping')
+
+    await expect(access.requestAccess({ ...ASK, taskId: 'warehouse.reading' }, contextOf(park))).rejects.toMatchObject({ code: 'access-request-task-mismatch' })
+  })
+
+  it('★ asking again with other work adds to the pending one and does not change the work it named', async () => {
+    await access.requestAccess({ ...ASK, taskId: 'warehouse.keeping' }, contextOf(kim))
+    registerRoleTask({ id: 'warehouse.receiving', grants: [{ category: 'warehouse', axes: ['mutation'] }] })
+    const merged = await access.requestAccess({ ...ASK, taskId: 'warehouse.receiving', reason: 'still needed' }, contextOf(kim))
+
+    expect(merged.count).toBe(2)
+    expect(merged.taskId).toBe('warehouse.keeping')
+    expect(await getRepository(AccessRequest).count()).toBe(1)
+  })
+
+  it('★ roles holding the whole task come first, then fewest privileges', async () => {
+    expect((await access.rolesGranting('warehouse', 'mutation', domain)).map((c: any) => c.name)).toEqual(['inbound', 'manager'])
+    const ordered = await access.rolesGranting('warehouse', 'mutation', domain, undefined, 'warehouse.keeping')
+    expect(ordered.map((c: any) => [c.name, c.holdsTask])).toEqual([
+      ['manager', true],
+      ['inbound', false]
+    ])
+  })
+
+  it('★ a role short of the task is told, not refused - and a smaller role short of it is not proposed', async () => {
+    const request = await access.requestAccess({ ...ASK, taskId: 'warehouse.keeping' }, contextOf(kim))
+
+    const short = await access.reviewDecision({ requestId: request.id, decision: 'GRANT', roleId: inbound.id }, contextOf(park))
+    expect(short.find((i: any) => i.code === 'role-lacks-task')).toMatchObject({ blocking: false, params: { task: 'warehouse.keeping', privileges: 'warehouse:query' } })
+
+    const whole = await access.reviewDecision({ requestId: request.id, decision: 'GRANT', roleId: manager.id }, contextOf(park))
+    expect(whole.map((i: any) => i.code)).not.toContain('role-lacks-task')
+    expect(whole.map((i: any) => i.code)).not.toContain('smaller-role-exists')
+  })
+
+  it('a task gone from the catalog is no error - the review says nothing of it and no role is put first', async () => {
+    const request = await access.requestAccess({ ...ASK, taskId: 'warehouse.keeping' }, contextOf(kim))
+    ;(process as any)['ROLE_TASKS'] = {}
+
+    const issues = await access.reviewDecision({ requestId: request.id, decision: 'GRANT', roleId: inbound.id }, contextOf(park))
+    expect(issues.map((i: any) => i.code)).not.toContain('role-lacks-task')
+    expect((await access.rolesGranting('warehouse', 'mutation', domain, undefined, 'warehouse.keeping')).map((c: any) => c.name)).toEqual(['inbound', 'manager'])
+  })
+})

package/tests/access-request-review.test.ts

@@ -161,3 +161,33 @@ describe('the parent domain\'s role (ADR-0103 decision 8)', () => {
     expect(codes(facts({ roleIsParents: false }))).not.toContain('⛔role-belongs-to-parent')
   })
 })
+
+describe('the task asked for (ADR-0103 decision 9)', () => {
+  const task = { id: 'warehouse.keeping', privileges: [ASKED, SEE] }
+
+  it('★ a role short of the task asked is told which privileges it lacks - not refused', () => {
+    const issues = reviewAccessDecision(facts({ task }))
+    expect(issues.find(issue => issue.code === 'role-lacks-task')).toEqual({
+      code: 'role-lacks-task',
+      blocking: false,
+      field: 'role',
+      params: { role: 'inbound', task: 'warehouse.keeping', privileges: 'warehouse:query' }
+    })
+    expect(isBlocked(issues)).toBe(false)
+  })
+
+  it('★ says nothing when no task was asked or the task is gone', () => {
+    expect(codes(facts({ task: null }))).not.toContain('⚠role-lacks-task')
+    expect(codes(facts())).not.toContain('⚠role-lacks-task')
+  })
+
+  it('★ a smaller role that drops the task is not proposed over a role holding it', () => {
+    const keeper = { id: 'r-keeper', name: 'keeper', privileges: [ASKED, SEE, GRANT_ROLES] }
+    const candidates = [
+      { id: 'r-keeper', name: 'keeper', privilegeCount: 3, holdsTask: true },
+      { id: 'r-inbound', name: 'inbound', privilegeCount: 1, holdsTask: false }
+    ]
+    expect(codes(facts({ task, role: keeper, candidates }))).not.toContain('⚠smaller-role-exists')
+    expect(smallestRole(candidates)?.name).toBe('keeper')
+  })
+})