@tumbaland/backend-core 1.42.0 → 1.44.0

package/dist/apiKeys/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/apiKeys/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyB,cAAc,EAAY,MAAM,SAAS,CAAC;AAS1E,OAAO,EAKL,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,MAAM,EACZ,MAAM,SAAS,CAAC;AAGjB;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,iFAAiF;IACjF,OAAO,EAAE,YAAY,CAAC;IACtB,qDAAqD;IACrD,QAAQ,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC;IAC1B,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,MAAM,CAAC,EAAE,aAAa,CAAC;SACxB;KACF;CACF;AAgJD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,GAAI,GAAG,gBAAgB,WAAW,EAAE,KAAG,cAwElE,CAAC;AAEJ;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,YAAY,GAAI,GAAG,gBAAgB,WAAW,EAAE,KAAG,cAiB7D,CAAC;AAEJ;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,EAAE,cASzB,CAAC"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/apiKeys/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyB,cAAc,EAAY,MAAM,SAAS,CAAC;AAS1E,OAAO,EAKL,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,MAAM,EACZ,MAAM,SAAS,CAAC;AAIjB;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,iFAAiF;IACjF,OAAO,EAAE,YAAY,CAAC;IACtB,qDAAqD;IACrD,QAAQ,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC;IAC1B,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,MAAM,CAAC,EAAE,aAAa,CAAC;SACxB;KACF;CACF;AAyJD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,GAAI,GAAG,gBAAgB,WAAW,EAAE,KAAG,cAwElE,CAAC;AAEJ;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,YAAY,GAAI,GAAG,gBAAgB,WAAW,EAAE,KAAG,cAiB7D,CAAC;AAEJ;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,EAAE,cASzB,CAAC"}

package/dist/apiKeys/middleware.js

@@ -13,6 +13,7 @@ const crypto_1 = require("./crypto");
 const service_1 = require("./service");
 const types_1 = require("./types");
 const session_1 = require("../auth/session");
+const membership_1 = require("../groups/membership");
 /** Both auth paths read the token from the same two places. */
 const extractToken = (req) => req.cookies?.access_token || req.headers.authorization?.replace('Bearer ', '');
 const unauthorized = (res) => {
@@ -90,7 +91,7 @@ const applyTenantGrant = (req, tenants) => {
  * Settling that in one place is what keeps the two from drifting into subtly
  * different amounts of access.
  */
-function admitAgent(req, res, next, requiredScopes, credential) {
+async function admitAgent(req, res, next, requiredScopes, credential) {
     const missing = requiredScopes.filter((scope) => !credential.scopes.includes(scope));
     if (missing.length > 0) {
         res.status(403).json({
@@ -99,7 +100,15 @@ function admitAgent(req, res, next, requiredScopes, credential) {
         });
         return;
     }
-    const actingAs = applyTenantGrant(req, credential.tenants);
+    // A grant names the groups the owner belonged to when they made it. Only the
+    // ones they still belong to count, so leaving a group also takes it from
+    // every key and connection they gave it to.
+    const stillMemberOf = new Set(await (0, membership_1.currentGroupsOf)({ email: credential.email }));
+    const tenants = {
+        ...credential.tenants,
+        allowed: credential.tenants.allowed.filter((tenant) => tenant === types_1.PERSONAL_TENANT || stillMemberOf.has(tenant))
+    };
+    const actingAs = applyTenantGrant(req, tenants);
     if (actingAs === null) {
         res.status(403).json({
             success: false,
@@ -111,11 +120,11 @@ function admitAgent(req, res, next, requiredScopes, credential) {
     // Only the granted groups, never the owner's full membership: this is what
     // stops a credential reaching a group it was not issued for through any
     // handler that consults `userGroups` instead of the `groupId` parameter.
-    req.userGroups = (0, types_1.groupIdsOf)(credential.tenants.allowed);
+    req.userGroups = (0, types_1.groupIdsOf)(tenants.allowed);
     req.apiKey = {
         keyId: credential.credentialId,
         scopes: credential.scopes,
-        tenants: credential.tenants,
+        tenants,
         actingAs,
         kind: credential.kind,
         label: credential.label,
@@ -158,9 +167,9 @@ const authenticateAgent = (...requiredScopes) => async function authenticateAgen
                 unauthorized(res);
                 return;
             }
-            const user = claims;
-            req.user = user;
-            req.userGroups = user.groups ?? [];
+            const groups = await (0, membership_1.currentGroupsOf)(claims);
+            req.user = { ...claims, groups };
+            req.userGroups = groups;
             (0, context_1.beginAudit)(req, res, next);
             return;
         }
@@ -174,7 +183,7 @@ const authenticateAgent = (...requiredScopes) => async function authenticateAgen
         // `undefined`, scoped writes were refused as inaccessible, and a read
         // whose scope collapsed to nothing fell through to "no user context" and
         // answered from the whole collection.
-        admitAgent(req, res, next, requiredScopes, {
+        await admitAgent(req, res, next, requiredScopes, {
             // The client, not the token: `jti` is a new value every hour.
             credentialId: claims.clientId ?? 'unknown-client',
             kind: 'oauth',
@@ -195,7 +204,7 @@ const authenticateAgent = (...requiredScopes) => async function authenticateAgen
         unauthorized(res);
         return;
     }
-    admitAgent(req, res, next, requiredScopes, {
+    await admitAgent(req, res, next, requiredScopes, {
         credentialId: result.keyId,
         kind: 'api_key',
         label: result.label || 'An API key',

package/dist/apiKeys/middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/apiKeys/middleware.ts"],"names":[],"mappings":";;;;;;AACA,gEAA+B;AAC/B,uCAA2C;AAC3C,+DAAuC;AACvC,8CAA8C;AAC9C,4CAA8E;AAE9E,qCAA2C;AAC3C,uCAAyC;AACzC,mCAQiB;AACjB,6CAAmD;AAoCnD,+DAA+D;AAC/D,MAAM,YAAY,GAAG,CAAC,GAAY,EAAsB,EAAE,CACxD,GAAG,CAAC,OAAO,EAAE,YAAY,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AAEjF,MAAM,YAAY,GAAG,CAAC,GAAa,EAAQ,EAAE;IAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC,CAAC;AACtF,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,eAAe,GAAG,CAAC,GAAY,EAAsB,EAAE;IAC3D,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC;IACrC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAE5E,MAAM,QAAQ,GAAI,GAAG,CAAC,IAA4C,EAAE,OAAO,CAAC;IAC5E,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAEzE,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,qFAAqF;AACrF,MAAM,eAAe,GAAG,CAAC,GAAY,EAAE,OAA2B,EAAQ,EAAE;IAC1E,MAAM,KAAK,GAAG,EAAE,GAAG,GAAG,CAAC,KAAK,EAA6B,CAAC;IAC1D,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC;;QAC3C,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;IAE7B,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE;QAClC,KAAK,EAAE,KAAK;QACZ,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,IAAI;QAClB,UAAU,EAAE,IAAI;KACjB,CAAC,CAAC;AACL,CAAC,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,gBAAgB,GAAG,CAAC,GAAY,EAAE,OAAqB,EAAiB,EAAE;IAC9E,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC;IAE1D,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtD,4EAA4E;IAC5E,sEAAsE;IACtE,wEAAwE;IACxE,MAAM,OAAO,GAAG,SAAS,KAAK,uBAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACtE,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7C,IAAI,OAAO,KAAK,SAAS;YAAE,OAAQ,GAAG,CAAC,IAAgC,CAAC,OAAO,CAAC;;YAC1E,GAAG,CAAC,IAAgC,CAAC,OAAO,GAAG,OAAO,CAAC;IAC/D,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAgBF;;;;;;;;GAQG;AACH,SAAS,UAAU,CACjB,GAAY,EACZ,GAAa,EACb,IAAkB,EAClB,cAA6B,EAC7B,UAA2B;IAE3B,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACrF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,yCAAyC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SACvE,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,2DAA2D;SACrE,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,GAAG,CAAC,IAAI,GAAG,EAAE,EAAE,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC;IACrF,2EAA2E;IAC3E,wEAAwE;IACxE,yEAAyE;IACzE,GAAG,CAAC,UAAU,GAAG,IAAA,kBAAU,EAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,GAAG,CAAC,MAAM,GAAG;QACX,KAAK,EAAE,UAAU,CAAC,YAAY;QAC9B,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,QAAQ;QACR,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,KAAK,EAAE,UAAU,CAAC,KAAK;QACvB,YAAY,EAAE,UAAU,CAAC,YAAY;KACtC,CAAC;IAEF,0EAA0E;IAC1E,wEAAwE;IACxE,uEAAuE;IACvE,IAAA,oBAAU,EAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;;;;;;GAWG;AACI,MAAM,iBAAiB,GAAG,CAAC,GAAG,cAA6B,EAAkB,EAAE,CACpF,KAAK,UAAU,wBAAwB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IACrF,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC3E,OAAO;IACT,CAAC;IAED,IAAI,CAAC,IAAA,wBAAe,EAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,IAAI,MAAuC,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAA,gBAAU,EAAC,YAAY,CAAC,CAAoC,CAAC;QAC1F,CAAC;QAAC,MAAM,CAAC;YACP,YAAY,CAAC,GAAG,CAAC,CAAC;YAClB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,IAAA,4BAAmB,EAAC,MAAM,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC,CAAC,MAAM,IAAA,0BAAgB,EAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACtC,YAAY,CAAC,GAAG,CAAC,CAAC;gBAClB,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,MAAqB,CAAC;YACnC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;YAChB,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;YACnC,IAAA,oBAAU,EAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,sEAAsE;QACtE,0EAA0E;QAC1E,uEAAuE;QACvE,6CAA6C;QAC7C,EAAE;QACF,0EAA0E;QAC1E,mEAAmE;QACnE,sEAAsE;QACtE,yEAAyE;QACzE,sCAAsC;QACtC,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,cAAc,EAAE;YACzC,8DAA8D;YAC9D,YAAY,EAAE,MAAM,CAAC,QAAQ,IAAI,gBAAgB;YACjD,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,MAAM,CAAC,UAAU,IAAI,iBAAiB;YAC7C,MAAM,EAAE,MAAM,CAAC,GAAG;YAClB,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE;YACzB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE;YACvB,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,qBAAa,CAAC;YAC7D,OAAO,EAAE,IAAA,mBAAW,EAAC,MAAM,CAAC;SAC7B,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAA,sBAAY,EAAC,KAAK,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,yEAAyE;QACzE,+DAA+D;QAC/D,gBAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACjF,YAAY,CAAC,GAAG,CAAC,CAAC;QAClB,OAAO;IACT,CAAC;IAED,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,cAAc,EAAE;QACzC,YAAY,EAAE,MAAM,CAAC,KAAM;QAC3B,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,YAAY;QACnC,MAAM,EAAE,MAAM,CAAC,MAAO;QACtB,KAAK,EAAE,MAAM,CAAC,SAAS,IAAI,EAAE;QAC7B,IAAI,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;QAC3B,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAA,mBAAW,EAAC,EAAE,CAAC;KAC3C,CAAC,CAAC;AACL,CAAC,CAAC;AAxES,QAAA,iBAAiB,qBAwE1B;AAEJ;;;;;;;;;;;;GAYG;AACI,MAAM,YAAY,GAAG,CAAC,GAAG,cAA6B,EAAkB,EAAE,CAC/E,SAAS,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI;IACzC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QAChB,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,MAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACtF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,yCAAyC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SACvE,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,EAAE,CAAC;AACT,CAAC,CAAC;AAjBS,QAAA,YAAY,gBAiBrB;AAEJ;;;;;;GAMG;AACI,MAAM,WAAW,GAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IAC5D,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,gEAAgE;SAC1E,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC,CAAC;AATW,QAAA,WAAW,eAStB"}
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/apiKeys/middleware.ts"],"names":[],"mappings":";;;;;;AACA,gEAA+B;AAC/B,uCAA2C;AAC3C,+DAAuC;AACvC,8CAA8C;AAC9C,4CAA8E;AAE9E,qCAA2C;AAC3C,uCAAyC;AACzC,mCAQiB;AACjB,6CAAmD;AACnD,qDAAuD;AAoCvD,+DAA+D;AAC/D,MAAM,YAAY,GAAG,CAAC,GAAY,EAAsB,EAAE,CACxD,GAAG,CAAC,OAAO,EAAE,YAAY,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AAEjF,MAAM,YAAY,GAAG,CAAC,GAAa,EAAQ,EAAE;IAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC,CAAC;AACtF,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,eAAe,GAAG,CAAC,GAAY,EAAsB,EAAE;IAC3D,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC;IACrC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAE5E,MAAM,QAAQ,GAAI,GAAG,CAAC,IAA4C,EAAE,OAAO,CAAC;IAC5E,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAEzE,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,qFAAqF;AACrF,MAAM,eAAe,GAAG,CAAC,GAAY,EAAE,OAA2B,EAAQ,EAAE;IAC1E,MAAM,KAAK,GAAG,EAAE,GAAG,GAAG,CAAC,KAAK,EAA6B,CAAC;IAC1D,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC;;QAC3C,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;IAE7B,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE;QAClC,KAAK,EAAE,KAAK;QACZ,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,IAAI;QAClB,UAAU,EAAE,IAAI;KACjB,CAAC,CAAC;AACL,CAAC,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,gBAAgB,GAAG,CAAC,GAAY,EAAE,OAAqB,EAAiB,EAAE;IAC9E,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC;IAE1D,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtD,4EAA4E;IAC5E,sEAAsE;IACtE,wEAAwE;IACxE,MAAM,OAAO,GAAG,SAAS,KAAK,uBAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACtE,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7C,IAAI,OAAO,KAAK,SAAS;YAAE,OAAQ,GAAG,CAAC,IAAgC,CAAC,OAAO,CAAC;;YAC1E,GAAG,CAAC,IAAgC,CAAC,OAAO,GAAG,OAAO,CAAC;IAC/D,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAgBF;;;;;;;;GAQG;AACH,KAAK,UAAU,UAAU,CACvB,GAAY,EACZ,GAAa,EACb,IAAkB,EAClB,cAA6B,EAC7B,UAA2B;IAE3B,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACrF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,yCAAyC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SACvE,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,6EAA6E;IAC7E,yEAAyE;IACzE,4CAA4C;IAC5C,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,MAAM,IAAA,4BAAe,EAAC,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAClF,MAAM,OAAO,GAAiB;QAC5B,GAAG,UAAU,CAAC,OAAO;QACrB,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,uBAAe,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;KAChH,CAAC;IAEF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAChD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,2DAA2D;SACrE,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,GAAG,CAAC,IAAI,GAAG,EAAE,EAAE,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC;IACrF,2EAA2E;IAC3E,wEAAwE;IACxE,yEAAyE;IACzE,GAAG,CAAC,UAAU,GAAG,IAAA,kBAAU,EAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,GAAG,CAAC,MAAM,GAAG;QACX,KAAK,EAAE,UAAU,CAAC,YAAY;QAC9B,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,OAAO;QACP,QAAQ;QACR,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,KAAK,EAAE,UAAU,CAAC,KAAK;QACvB,YAAY,EAAE,UAAU,CAAC,YAAY;KACtC,CAAC;IAEF,0EAA0E;IAC1E,wEAAwE;IACxE,uEAAuE;IACvE,IAAA,oBAAU,EAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;;;;;;GAWG;AACI,MAAM,iBAAiB,GAAG,CAAC,GAAG,cAA6B,EAAkB,EAAE,CACpF,KAAK,UAAU,wBAAwB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IACrF,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC3E,OAAO;IACT,CAAC;IAED,IAAI,CAAC,IAAA,wBAAe,EAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,IAAI,MAAuC,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAA,gBAAU,EAAC,YAAY,CAAC,CAAoC,CAAC;QAC1F,CAAC;QAAC,MAAM,CAAC;YACP,YAAY,CAAC,GAAG,CAAC,CAAC;YAClB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,IAAA,4BAAmB,EAAC,MAAM,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC,CAAC,MAAM,IAAA,0BAAgB,EAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACtC,YAAY,CAAC,GAAG,CAAC,CAAC;gBAClB,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAA,4BAAe,EAAC,MAAqB,CAAC,CAAC;YAC5D,GAAG,CAAC,IAAI,GAAG,EAAE,GAAI,MAAsB,EAAE,MAAM,EAAE,CAAC;YAClD,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC;YACxB,IAAA,oBAAU,EAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,sEAAsE;QACtE,0EAA0E;QAC1E,uEAAuE;QACvE,6CAA6C;QAC7C,EAAE;QACF,0EAA0E;QAC1E,mEAAmE;QACnE,sEAAsE;QACtE,yEAAyE;QACzE,sCAAsC;QACtC,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,cAAc,EAAE;YAC/C,8DAA8D;YAC9D,YAAY,EAAE,MAAM,CAAC,QAAQ,IAAI,gBAAgB;YACjD,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,MAAM,CAAC,UAAU,IAAI,iBAAiB;YAC7C,MAAM,EAAE,MAAM,CAAC,GAAG;YAClB,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE;YACzB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE;YACvB,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,qBAAa,CAAC;YAC7D,OAAO,EAAE,IAAA,mBAAW,EAAC,MAAM,CAAC;SAC7B,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAA,sBAAY,EAAC,KAAK,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,yEAAyE;QACzE,+DAA+D;QAC/D,gBAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACjF,YAAY,CAAC,GAAG,CAAC,CAAC;QAClB,OAAO;IACT,CAAC;IAED,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,cAAc,EAAE;QAC/C,YAAY,EAAE,MAAM,CAAC,KAAM;QAC3B,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,YAAY;QACnC,MAAM,EAAE,MAAM,CAAC,MAAO;QACtB,KAAK,EAAE,MAAM,CAAC,SAAS,IAAI,EAAE;QAC7B,IAAI,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;QAC3B,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAA,mBAAW,EAAC,EAAE,CAAC;KAC3C,CAAC,CAAC;AACL,CAAC,CAAC;AAxES,QAAA,iBAAiB,qBAwE1B;AAEJ;;;;;;;;;;;;GAYG;AACI,MAAM,YAAY,GAAG,CAAC,GAAG,cAA6B,EAAkB,EAAE,CAC/E,SAAS,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI;IACzC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QAChB,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,MAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACtF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,yCAAyC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SACvE,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,EAAE,CAAC;AACT,CAAC,CAAC;AAjBS,QAAA,YAAY,gBAiBrB;AAEJ;;;;;;GAMG;AACI,MAAM,WAAW,GAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IAC5D,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,gEAAgE;SAC1E,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC,CAAC;AATW,QAAA,WAAW,eAStB"}

package/dist/groups/client.d.ts

@@ -7,6 +7,21 @@ export interface GroupOwner {
     /** True when group-service could not be reached and nothing was resolved. */
     stale?: boolean;
 }
+/**
+ * Prefers the container-network address over the public hostname.
+ *
+ * `GROUP_API_URL` cannot simply be pointed inward: the frontend containers
+ * template that same variable into the `config.json` the *browser* downloads,
+ * so a Docker-internal value there breaks every group call in the UI. One
+ * variable genuinely has two consumers with incompatible needs, so this is the
+ * server-side half of it.
+ *
+ * Falling back to the public URL keeps local dev (where only `GROUP_API_URL` is
+ * set) and any un-migrated deployment working — it just takes the long way
+ * round, out through the proxy and back, carrying the internal token across the
+ * public edge.
+ */
+export declare function internalGroupUrl(): string | undefined;
 /**
  * The group's owner, cached for {@link CACHE_TTL_MS}, or `null` when the group
  * does not exist or group-service could not answer.

package/dist/groups/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/groups/client.ts"],"names":[],"mappings":"AAwBA,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,4EAA4E;IAC5E,OAAO,EAAE,OAAO,CAAC;IACjB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAyGD;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAqB/E;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE1D;AAED,mFAAmF;AACnF,wBAAgB,oBAAoB,IAAI,IAAI,CAG3C"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/groups/client.ts"],"names":[],"mappings":"AAwBA,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,4EAA4E;IAC5E,OAAO,EAAE,OAAO,CAAC;IACjB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAgCD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,SAAS,CAErD;AAyDD;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAqB/E;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE1D;AAED,mFAAmF;AACnF,wBAAgB,oBAAoB,IAAI,IAAI,CAG3C"}

package/dist/groups/client.js

@@ -3,6 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.internalGroupUrl = internalGroupUrl;
 exports.getGroupOwner = getGroupOwner;
 exports.invalidateGroupOwner = invalidateGroupOwner;
 exports.clearGroupOwnerCache = clearGroupOwnerCache;

package/dist/groups/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/groups/client.ts"],"names":[],"mappings":";;;;;AAkJA,sCAqBC;AAMD,oDAEC;AAGD,oDAGC;AArLD,+DAAuC;AAEvC;;;;;;;;;;;;;;GAcG;AACH,MAAM,YAAY,GAAG,MAAM,CAAC;AAE5B,iFAAiF;AACjF,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAEhC,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAiBjC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;AAE5C;;;GAGG;AACH,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAsC,CAAC;AAE/D,SAAS,UAAU,CAAC,OAAe,EAAE,KAAiB;IACpD,IAAI,KAAK,CAAC,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACpC,yEAAyE;QACzE,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,IAAI;YAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,EAAE,CAAC,CAAC;AACtE,CAAC;AAUD;;;;;;;;;;;;;GAaG;AACH,SAAS,gBAAgB;IACvB,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,OAAe;IAC5C,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACjD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,iBAAiB,CAAC;IAEhE,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;QACvB,gBAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE;YAChD,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC;YAChC,gBAAgB,EAAE,OAAO,CAAC,KAAK,CAAC;SACjC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,oBAAoB,kBAAkB,CAAC,OAAO,CAAC,QAAQ,EAAE;YAC9F,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,kBAAkB,EAAE,KAAK;gBACzB,cAAc,EAAE,SAAS;aAC1B;YACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;SAChD,CAAC,CAAC;QAEH,2EAA2E;QAC3E,yEAAyE;QACzE,0EAA0E;QAC1E,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,gBAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACnE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,gBAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAChF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAuB,CAAC;QAC3D,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,gBAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YAClE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,OAAO;YAChC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;YAChD,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,CAAC;YAClC,OAAO,EAAE,IAAI,CAAC,OAAO,KAAK,IAAI;SAC/B,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,gBAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE,EAAE,OAAO,EAAE,KAAK,EAAG,GAAa,EAAE,OAAO,EAAE,CAAC,CAAC;QACxF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACI,KAAK,UAAU,aAAa,CAAC,OAAe;IACjD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC;IAEjE,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAE5B,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC;SACjC,IAAI,CAAC,KAAK,CAAC,EAAE;QACZ,IAAI,KAAK;YAAE,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAClC,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;SACD,OAAO,CAAC,GAAG,EAAE;QACZ,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IAEL,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,SAAgB,oBAAoB,CAAC,OAAe;IAClD,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,mFAAmF;AACnF,SAAgB,oBAAoB;IAClC,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,QAAQ,CAAC,KAAK,EAAE,CAAC;AACnB,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/groups/client.ts"],"names":[],"mappings":";;;;;AA8EA,4CAEC;AAkED,sCAqBC;AAMD,oDAEC;AAGD,oDAGC;AArLD,+DAAuC;AAEvC;;;;;;;;;;;;;;GAcG;AACH,MAAM,YAAY,GAAG,MAAM,CAAC;AAE5B,iFAAiF;AACjF,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAEhC,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAiBjC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;AAE5C;;;GAGG;AACH,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAsC,CAAC;AAE/D,SAAS,UAAU,CAAC,OAAe,EAAE,KAAiB;IACpD,IAAI,KAAK,CAAC,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACpC,yEAAyE;QACzE,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,IAAI;YAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,EAAE,CAAC,CAAC;AACtE,CAAC;AAUD;;;;;;;;;;;;;GAaG;AACH,SAAgB,gBAAgB;IAC9B,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,OAAe;IAC5C,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACjD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,iBAAiB,CAAC;IAEhE,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;QACvB,gBAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE;YAChD,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC;YAChC,gBAAgB,EAAE,OAAO,CAAC,KAAK,CAAC;SACjC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,oBAAoB,kBAAkB,CAAC,OAAO,CAAC,QAAQ,EAAE;YAC9F,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,kBAAkB,EAAE,KAAK;gBACzB,cAAc,EAAE,SAAS;aAC1B;YACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;SAChD,CAAC,CAAC;QAEH,2EAA2E;QAC3E,yEAAyE;QACzE,0EAA0E;QAC1E,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,gBAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACnE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,gBAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAChF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAuB,CAAC;QAC3D,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,gBAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YAClE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,OAAO;YAChC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;YAChD,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,CAAC;YAClC,OAAO,EAAE,IAAI,CAAC,OAAO,KAAK,IAAI;SAC/B,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,gBAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE,EAAE,OAAO,EAAE,KAAK,EAAG,GAAa,EAAE,OAAO,EAAE,CAAC,CAAC;QACxF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACI,KAAK,UAAU,aAAa,CAAC,OAAe;IACjD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC;IAEjE,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAE5B,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC;SACjC,IAAI,CAAC,KAAK,CAAC,EAAE;QACZ,IAAI,KAAK;YAAE,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAClC,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;SACD,OAAO,CAAC,GAAG,EAAE;QACZ,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IAEL,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,SAAgB,oBAAoB,CAAC,OAAe;IAClD,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,mFAAmF;AACnF,SAAgB,oBAAoB;IAClC,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,QAAQ,CAAC,KAAK,EAAE,CAAC;AACnB,CAAC"}

package/dist/groups/index.d.ts

@@ -2,4 +2,5 @@ export { getGroupOwner, invalidateGroupOwner, clearGroupOwnerCache } from './cli
 export type { GroupOwner } from './client';
 export { groupOwnerSubject } from './subject';
 export type { GroupIdResolver } from './subject';
+export { getUserGroupIds, currentGroupsOf, clearMembershipCache } from './membership';
 //# sourceMappingURL=index.d.ts.map

package/dist/groups/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/groups/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AACrF,YAAY,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAE3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,YAAY,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/groups/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AACrF,YAAY,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAE3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,YAAY,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEjD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC"}

package/dist/groups/index.js

@@ -1,10 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.groupOwnerSubject = exports.clearGroupOwnerCache = exports.invalidateGroupOwner = exports.getGroupOwner = void 0;
+exports.clearMembershipCache = exports.currentGroupsOf = exports.getUserGroupIds = exports.groupOwnerSubject = exports.clearGroupOwnerCache = exports.invalidateGroupOwner = exports.getGroupOwner = void 0;
 var client_1 = require("./client");
 Object.defineProperty(exports, "getGroupOwner", { enumerable: true, get: function () { return client_1.getGroupOwner; } });
 Object.defineProperty(exports, "invalidateGroupOwner", { enumerable: true, get: function () { return client_1.invalidateGroupOwner; } });
 Object.defineProperty(exports, "clearGroupOwnerCache", { enumerable: true, get: function () { return client_1.clearGroupOwnerCache; } });
 var subject_1 = require("./subject");
 Object.defineProperty(exports, "groupOwnerSubject", { enumerable: true, get: function () { return subject_1.groupOwnerSubject; } });
+var membership_1 = require("./membership");
+Object.defineProperty(exports, "getUserGroupIds", { enumerable: true, get: function () { return membership_1.getUserGroupIds; } });
+Object.defineProperty(exports, "currentGroupsOf", { enumerable: true, get: function () { return membership_1.currentGroupsOf; } });
+Object.defineProperty(exports, "clearMembershipCache", { enumerable: true, get: function () { return membership_1.clearMembershipCache; } });
 //# sourceMappingURL=index.js.map

package/dist/groups/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/groups/index.ts"],"names":[],"mappings":";;;AAAA,mCAAqF;AAA5E,uGAAA,aAAa,OAAA;AAAE,8GAAA,oBAAoB,OAAA;AAAE,8GAAA,oBAAoB,OAAA;AAGlE,qCAA8C;AAArC,4GAAA,iBAAiB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/groups/index.ts"],"names":[],"mappings":";;;AAAA,mCAAqF;AAA5E,uGAAA,aAAa,OAAA;AAAE,8GAAA,oBAAoB,OAAA;AAAE,8GAAA,oBAAoB,OAAA;AAGlE,qCAA8C;AAArC,4GAAA,iBAAiB,OAAA;AAG1B,2CAAsF;AAA7E,6GAAA,eAAe,OAAA;AAAE,6GAAA,eAAe,OAAA;AAAE,kHAAA,oBAAoB,OAAA"}

package/dist/groups/membership.d.ts

@@ -0,0 +1,28 @@
+/**
+ * The ids of the groups `email` belongs to right now.
+ *
+ * When group-service cannot be asked, the last answer is used even if it has
+ * expired, and failing that no groups at all: a person keeps their own data
+ * through an outage and loses group data until it ends, rather than being
+ * granted a group on a guess.
+ */
+export declare function getUserGroupIds(email: string): Promise<string[]>;
+/** For tests. */
+export declare function clearMembershipCache(): void;
+type MembershipLookup = (user: {
+    email: string;
+    groups?: string[];
+}) => Promise<string[]>;
+/** The groups the auth middlewares put on `req.userGroups`. */
+export declare const currentGroupsOf: (user: {
+    email: string;
+    groups?: string[];
+}) => Promise<string[]>;
+/**
+ * Replaces the lookup, for tests only; pass nothing to restore the real one.
+ * Service suites reach it through `@tumbaland/backend-core/testing`, which makes
+ * a test token's own `groups` claim the membership, so they need no group-service.
+ */
+export declare function overrideMembershipLookupForTests(lookup?: MembershipLookup): void;
+export {};
+//# sourceMappingURL=membership.d.ts.map

package/dist/groups/membership.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"membership.d.ts","sourceRoot":"","sources":["../../src/groups/membership.ts"],"names":[],"mappings":"AA+EA;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAqBtE;AAED,iBAAiB;AACjB,wBAAgB,oBAAoB,IAAI,IAAI,CAG3C;AAED,KAAK,gBAAgB,GAAG,CAAC,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AAK1F,+DAA+D;AAC/D,eAAO,MAAM,eAAe,GAAI,MAAM;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,KAAG,OAAO,CAAC,MAAM,EAAE,CACrE,CAAC;AAEzB;;;;GAIG;AACH,wBAAgB,gCAAgC,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAEhF"}

package/dist/groups/membership.js

@@ -0,0 +1,122 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.currentGroupsOf = void 0;
+exports.getUserGroupIds = getUserGroupIds;
+exports.clearMembershipCache = clearMembershipCache;
+exports.overrideMembershipLookupForTests = overrideMembershipLookupForTests;
+const logger_1 = __importDefault(require("../logging/logger"));
+const client_1 = require("./client");
+/**
+ * Which groups a person belongs to, asked of group-service.
+ *
+ * This used to travel in the session token's `groups` claim, which made it only
+ * as fresh as the token: a new member could not see the group until their next
+ * renewal, and a removed one kept access until theirs, which is why membership
+ * changes used to sign people out. Asked here instead, with a short cache, a
+ * change reaches every service within CACHE_TTL_MS.
+ *
+ * Every request pays for this only once per person per service per cache
+ * window; concurrent callers share one request.
+ */
+const CACHE_TTL_MS = 30_000;
+/** Bounded so a service under enumeration can't grow the cache without limit. */
+const MAX_CACHE_ENTRIES = 5_000;
+const REQUEST_TIMEOUT_MS = 3_000;
+const cache = new Map();
+const inFlight = new Map();
+function putInCache(email, groups) {
+    if (!cache.has(email) && cache.size >= MAX_CACHE_ENTRIES) {
+        // Map iterates in insertion order, so the first key is the oldest write.
+        const oldest = cache.keys().next();
+        if (!oldest.done)
+            cache.delete(oldest.value);
+    }
+    cache.set(email, { groups, expiresAt: Date.now() + CACHE_TTL_MS });
+}
+async function fetchUserGroupIds(email) {
+    const baseUrl = (0, client_1.internalGroupUrl)();
+    const token = process.env.INTERNAL_SERVICE_TOKEN;
+    if (!baseUrl || !token) {
+        logger_1.default.error('Group membership lookup not configured', {
+            hasGroupApiUrl: Boolean(baseUrl),
+            hasInternalToken: Boolean(token)
+        });
+        return null;
+    }
+    try {
+        const response = await fetch(`${baseUrl}/api/groups/mine/ids?userEmail=${encodeURIComponent(email)}`, {
+            method: 'GET',
+            headers: {
+                'Content-Type': 'application/json',
+                'x-internal-token': token,
+                'x-service-id': process.env.SERVICE_NAME || 'unknown-service'
+            },
+            signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+        });
+        if (!response.ok) {
+            logger_1.default.error('Group membership lookup failed', { email, status: response.status });
+            return null;
+        }
+        const body = (await response.json());
+        if (!body.success || !Array.isArray(body.data)) {
+            logger_1.default.error('Group membership lookup returned no list', { email });
+            return null;
+        }
+        return body.data.filter((id) => typeof id === 'string');
+    }
+    catch (error) {
+        logger_1.default.error('Group membership lookup unreachable', { email, error: error?.message });
+        return null;
+    }
+}
+/**
+ * The ids of the groups `email` belongs to right now.
+ *
+ * When group-service cannot be asked, the last answer is used even if it has
+ * expired, and failing that no groups at all: a person keeps their own data
+ * through an outage and loses group data until it ends, rather than being
+ * granted a group on a guess.
+ */
+async function getUserGroupIds(email) {
+    const key = email.toLowerCase();
+    const entry = cache.get(key);
+    if (entry && entry.expiresAt > Date.now())
+        return entry.groups;
+    let pending = inFlight.get(key);
+    if (!pending) {
+        pending = fetchUserGroupIds(key).finally(() => inFlight.delete(key));
+        inFlight.set(key, pending);
+    }
+    const groups = await pending;
+    if (groups) {
+        putInCache(key, groups);
+        return groups;
+    }
+    if (entry) {
+        logger_1.default.warn('Using the last known group membership while group-service is unreachable', { email: key });
+        return entry.groups;
+    }
+    return [];
+}
+/** For tests. */
+function clearMembershipCache() {
+    cache.clear();
+    inFlight.clear();
+}
+const lookUpMembership = (user) => getUserGroupIds(user.email);
+let membershipLookup = lookUpMembership;
+/** The groups the auth middlewares put on `req.userGroups`. */
+const currentGroupsOf = (user) => membershipLookup(user);
+exports.currentGroupsOf = currentGroupsOf;
+/**
+ * Replaces the lookup, for tests only; pass nothing to restore the real one.
+ * Service suites reach it through `@tumbaland/backend-core/testing`, which makes
+ * a test token's own `groups` claim the membership, so they need no group-service.
+ */
+function overrideMembershipLookupForTests(lookup) {
+    membershipLookup = lookup ?? lookUpMembership;
+}
+//# sourceMappingURL=membership.js.map

package/dist/groups/membership.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"membership.js","sourceRoot":"","sources":["../../src/groups/membership.ts"],"names":[],"mappings":";;;;;;AAuFA,0CAqBC;AAGD,oDAGC;AAgBD,4EAEC;AApID,+DAAuC;AACvC,qCAA4C;AAE5C;;;;;;;;;;;GAWG;AACH,MAAM,YAAY,GAAG,MAAM,CAAC;AAE5B,iFAAiF;AACjF,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAEhC,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAOjC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;AAC5C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAoC,CAAC;AAE7D,SAAS,UAAU,CAAC,KAAa,EAAE,MAAgB;IACjD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACzD,yEAAyE;QACzE,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,IAAI;YAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,KAAa;IAC5C,MAAM,OAAO,GAAG,IAAA,yBAAgB,GAAE,CAAC;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IAEjD,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;QACvB,gBAAM,CAAC,KAAK,CAAC,wCAAwC,EAAE;YACrD,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC;YAChC,gBAAgB,EAAE,OAAO,CAAC,KAAK,CAAC;SACjC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,kCAAkC,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE;YACpG,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,kBAAkB,EAAE,KAAK;gBACzB,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,iBAAiB;aAC9D;YACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;SAChD,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,gBAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACnF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA0C,CAAC;QAC9E,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/C,gBAAM,CAAC,KAAK,CAAC,0CAA0C,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACpE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,gBAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAG,KAAe,EAAE,OAAO,EAAE,CAAC,CAAC;QACjG,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,eAAe,CAAC,KAAa;IACjD,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC;IAE/D,IAAI,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACrE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC7B,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC;IAC7B,IAAI,MAAM,EAAE,CAAC;QACX,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACxB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,KAAK,EAAE,CAAC;QACV,gBAAM,CAAC,IAAI,CAAC,0EAA0E,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACxG,OAAO,KAAK,CAAC,MAAM,CAAC;IACtB,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,iBAAiB;AACjB,SAAgB,oBAAoB;IAClC,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,QAAQ,CAAC,KAAK,EAAE,CAAC;AACnB,CAAC;AAID,MAAM,gBAAgB,GAAqB,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACjF,IAAI,gBAAgB,GAAqB,gBAAgB,CAAC;AAE1D,+DAA+D;AACxD,MAAM,eAAe,GAAG,CAAC,IAA0C,EAAqB,EAAE,CAC/F,gBAAgB,CAAC,IAAI,CAAC,CAAC;AADZ,QAAA,eAAe,mBACH;AAEzB;;;;GAIG;AACH,SAAgB,gCAAgC,CAAC,MAAyB;IACxE,gBAAgB,GAAG,MAAM,IAAI,gBAAgB,CAAC;AAChD,CAAC"}

package/dist/middleware/authMiddleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authMiddleware.d.ts","sourceRoot":"","sources":["../../src/middleware/authMiddleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAO1D;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAiCtG;AACD;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBlG"}
+{"version":3,"file":"authMiddleware.d.ts","sourceRoot":"","sources":["../../src/middleware/authMiddleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAQ1D;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAmCtG;AACD;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBlG"}

package/dist/middleware/authMiddleware.js

@@ -9,6 +9,7 @@ const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
 const env_1 = require("../config/env");
 const tokens_1 = require("../oauth/tokens");
 const session_1 = require("../auth/session");
+const membership_1 = require("../groups/membership");
 /**
  * JWT authentication middleware
  * Verifies JWT token and attaches user info (and its embedded groups) to
@@ -44,9 +45,11 @@ async function authenticateToken(req, res, next) {
             res.status(401).json({ success: false, message: 'Session has ended' });
             return;
         }
-        const user = claims;
-        req.user = user;
-        req.userGroups = user.groups ?? [];
+        // Membership is asked of group-service, not read from the token, so a
+        // change applies within seconds rather than at the next renewal.
+        const groups = await (0, membership_1.currentGroupsOf)(claims);
+        req.user = { ...claims, groups };
+        req.userGroups = groups;
     }
     catch (error) {
         res.status(401).json({ success: false, message: 'Invalid or expired token' });
@@ -77,9 +80,9 @@ async function optionalAuth(req, _res, next) {
             // expired cookie, so the route still answers with its public form.
             // An ended session is treated as none, like an expired cookie.
             if (!(0, tokens_1.isAccessTokenClaims)(claims) && (await (0, session_1.isCurrentSession)(claims))) {
-                const user = claims;
-                req.user = user;
-                req.userGroups = user.groups ?? [];
+                const groups = await (0, membership_1.currentGroupsOf)(claims);
+                req.user = { ...claims, groups };
+                req.userGroups = groups;
             }
         }
     }

package/dist/middleware/authMiddleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"authMiddleware.js","sourceRoot":"","sources":["../../src/middleware/authMiddleware.ts"],"names":[],"mappings":";;;;;AAoBA,8CAiCC;AAcD,oCAoBC;AAtFD,gEAA+B;AAC/B,uCAA2C;AAC3C,4CAAsD;AAEtD,6CAAmD;AAEnD;;;;;;;;;;;;GAYG;AACI,KAAK,UAAU,iBAAiB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IACrF,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAA,gBAAU,EAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,YAAY,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAE7F,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC7C,IAAI,IAAA,4BAAmB,EAAC,MAAM,CAAC,EAAE,CAAC;YAChC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,2EAA2E;aACrF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,wEAAwE;QACxE,oCAAoC;QACpC,IAAI,CAAC,CAAC,MAAM,IAAA,0BAAgB,EAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YACtC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACvE,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAqB,CAAC;QACnC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAChB,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAC9E,OAAO;IACT,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC;AACD;;;;;;;;;;;;GAYG;AACI,KAAK,UAAU,YAAY,CAAC,GAAY,EAAE,IAAc,EAAE,IAAkB;IACjF,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAA,gBAAU,EAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,YAAY,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAE7F,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,MAAM,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;YAC7C,qEAAqE;YACrE,mEAAmE;YACnE,+DAA+D;YAC/D,IAAI,CAAC,IAAA,4BAAmB,EAAC,MAAM,CAAC,IAAI,CAAC,MAAM,IAAA,0BAAgB,EAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACrE,MAAM,IAAI,GAAG,MAAqB,CAAC;gBACnC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;gBAChB,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;YACrC,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,oCAAoC;IACtC,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC"}
+{"version":3,"file":"authMiddleware.js","sourceRoot":"","sources":["../../src/middleware/authMiddleware.ts"],"names":[],"mappings":";;;;;AAqBA,8CAmCC;AAcD,oCAoBC;AAzFD,gEAA+B;AAC/B,uCAA2C;AAC3C,4CAAsD;AAEtD,6CAAmD;AACnD,qDAAuD;AAEvD;;;;;;;;;;;;GAYG;AACI,KAAK,UAAU,iBAAiB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IACrF,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAA,gBAAU,EAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,YAAY,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAE7F,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC7C,IAAI,IAAA,4BAAmB,EAAC,MAAM,CAAC,EAAE,CAAC;YAChC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,2EAA2E;aACrF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,wEAAwE;QACxE,oCAAoC;QACpC,IAAI,CAAC,CAAC,MAAM,IAAA,0BAAgB,EAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YACtC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACvE,OAAO;QACT,CAAC;QACD,sEAAsE;QACtE,iEAAiE;QACjE,MAAM,MAAM,GAAG,MAAM,IAAA,4BAAe,EAAC,MAAqB,CAAC,CAAC;QAC5D,GAAG,CAAC,IAAI,GAAG,EAAE,GAAI,MAAsB,EAAE,MAAM,EAAE,CAAC;QAClD,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAC9E,OAAO;IACT,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC;AACD;;;;;;;;;;;;GAYG;AACI,KAAK,UAAU,YAAY,CAAC,GAAY,EAAE,IAAc,EAAE,IAAkB;IACjF,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAA,gBAAU,EAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,YAAY,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAE7F,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,MAAM,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;YAC7C,qEAAqE;YACrE,mEAAmE;YACnE,+DAA+D;YAC/D,IAAI,CAAC,IAAA,4BAAmB,EAAC,MAAM,CAAC,IAAI,CAAC,MAAM,IAAA,0BAAgB,EAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACrE,MAAM,MAAM,GAAG,MAAM,IAAA,4BAAe,EAAC,MAAqB,CAAC,CAAC;gBAC5D,GAAG,CAAC,IAAI,GAAG,EAAE,GAAI,MAAsB,EAAE,MAAM,EAAE,CAAC;gBAClD,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,oCAAoC;IACtC,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC"}

package/dist/testing/serviceTestSetup.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=serviceTestSetup.d.ts.map

package/dist/testing/serviceTestSetup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serviceTestSetup.d.ts","sourceRoot":"","sources":["../../src/testing/serviceTestSetup.ts"],"names":[],"mappings":""}

package/dist/testing/serviceTestSetup.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const session_1 = require("../auth/session");
+const membership_1 = require("../groups/membership");
+/**
+ * Jest setup for service test suites: they sign session tokens without a
+ * session and run with no database or group-service, so every token's session
+ * counts as live and its `groups` claim stands in for group membership.
+ * The session check itself is tested in backend-core (auth/session.test.ts).
+ *
+ * Loaded through the package's test-only entry point:
+ *   setupFiles: ['@tumbaland/backend-core/testing']
+ */
+(0, session_1.overrideSessionCheckForTests)(async () => true);
+// No group-service either: a test token's own `groups` claim is taken as the
+// person's membership. The live lookup is tested in groups/membership.test.ts.
+(0, membership_1.overrideMembershipLookupForTests)(async (user) => user.groups ?? []);
+//# sourceMappingURL=serviceTestSetup.js.map

package/dist/testing/serviceTestSetup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serviceTestSetup.js","sourceRoot":"","sources":["../../src/testing/serviceTestSetup.ts"],"names":[],"mappings":";;AAAA,6CAA+D;AAC/D,qDAAwE;AAExE;;;;;;;;GAQG;AACH,IAAA,sCAA4B,EAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;AAE/C,6EAA6E;AAC7E,+EAA+E;AAC/E,IAAA,6CAAgC,EAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tumbaland/backend-core",
-  "version": "1.42.0",
+  "version": "1.44.0",
   "description": "Core shared functionality for Tumbaland backend services",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/apiKeys/middleware.test.ts

@@ -12,6 +12,7 @@ import { mintAccessToken, type MintAccessTokenInput } from '../oauth/tokens';
 import { PERSONAL_TENANT } from './types';
 import { authenticateAgent, requireScope, denyApiKeys } from './middleware';
 import { overrideSessionCheckForTests } from '../auth/session';
+import { overrideMembershipLookupForTests } from '../groups/membership';
 
 const mockedVerify = verifyApiKey as jest.Mock;
 const ORIGINAL_ENV = process.env;
@@ -44,11 +45,18 @@ const okVerification = (over: Record<string, unknown> = {}) => ({
   ...over
 });
 
+// Unless a test says otherwise, the owner still belongs to every group used here.
+let memberOf: string[];
+
 beforeEach(() => {
   jest.clearAllMocks();
   process.env = { ...ORIGINAL_ENV, JWT_SECRET: 'test-jwt-secret' };
+  memberOf = ['g1', 'g2'];
+  overrideMembershipLookupForTests(async () => memberOf);
 });
 
+afterAll(() => overrideMembershipLookupForTests());
+
 afterEach(() => {
   process.env = ORIGINAL_ENV;
 });
@@ -81,6 +89,17 @@ describe('authenticateAgent — session tokens', () => {
     expect(next).not.toHaveBeenCalled();
   });
 
+  it("takes the person's groups from group-service, not from the token", async () => {
+    memberOf = ['g2'];
+    const token = jwt.sign({ id: 'u1', email: 'a@b.c', name: 'A', groups: ['g1'] }, 'test-jwt-secret');
+    const request = req({ headers: { authorization: `Bearer ${token}` } });
+
+    await authenticateAgent()(request, mockRes(), jest.fn());
+
+    expect(request.userGroups).toEqual(['g2']);
+    expect(request.user?.groups).toEqual(['g2']);
+  });
+
   it('accepts a valid JWT and grants the full session, with no apiKey context', async () => {
     const token = jwt.sign({ id: 'u1', email: 'a@b.c', name: 'A', groups: ['g1', 'g2'] }, 'test-jwt-secret');
     const request = req({ headers: { authorization: `Bearer ${token}` } });
@@ -359,6 +378,55 @@ describe('authenticateAgent — a multi-tenant grant', () => {
   });
 });
 
+describe('authenticateAgent — groups the owner has since left', () => {
+  it('drops a granted group the owner no longer belongs to', async () => {
+    memberOf = ['g2'];
+    mockedVerify.mockResolvedValue(
+      okVerification({ tenants: { allowed: [PERSONAL_TENANT, 'g1', 'g2'], default: PERSONAL_TENANT } })
+    );
+    const request = withKey();
+
+    await authenticateAgent()(request, mockRes(), jest.fn());
+
+    expect(request.userGroups).toEqual(['g2']);
+    expect(request.apiKey?.tenants.allowed).toEqual([PERSONAL_TENANT, 'g2']);
+  });
+
+  it('refuses a request for a group the owner has left, although the key was granted it', async () => {
+    memberOf = [];
+    mockedVerify.mockResolvedValue(okVerification({ tenants: grant(PERSONAL_TENANT, 'g1') }));
+    const res = mockRes();
+    const next = jest.fn();
+
+    await authenticateAgent()(withKey(undefined, { query: { groupId: 'g1' } } as Partial<Request>), res, next);
+
+    expect(res.status).toHaveBeenCalledWith(403);
+    expect(next).not.toHaveBeenCalled();
+  });
+
+  it('refuses a key whose only group the owner has left, rather than acting somewhere else', async () => {
+    memberOf = [];
+    mockedVerify.mockResolvedValue(okVerification({ tenants: grant('g1') }));
+    const res = mockRes();
+    const next = jest.fn();
+
+    await authenticateAgent()(withKey(), res, next);
+
+    expect(res.status).toHaveBeenCalledWith(403);
+    expect(next).not.toHaveBeenCalled();
+  });
+
+  it('asks about the key owner, by email', async () => {
+    const lookup = jest.fn(async () => ['g1']);
+    overrideMembershipLookupForTests(lookup);
+    mockedVerify.mockResolvedValue(okVerification({ tenants: grant('g1') }));
+
+    await authenticateAgent()(withKey(), mockRes(), jest.fn());
+
+    expect(lookup).toHaveBeenCalledWith({ email: 'u1@example.com' });
+  });
+});
+
 describe('requireScope', () => {
   const keyReq = (scopes: string[]) =>
     req({

package/src/apiKeys/middleware.ts

@@ -17,6 +17,7 @@ import {
   type Tenant
 } from './types';
 import { isCurrentSession } from '../auth/session';
+import { currentGroupsOf } from '../groups/membership';
 
 /**
  * Request-scoped facts about the key a request arrived on. Absent on ordinary
@@ -148,13 +149,13 @@ interface AgentCredential {
  * Settling that in one place is what keeps the two from drifting into subtly
  * different amounts of access.
  */
-function admitAgent(
+async function admitAgent(
   req: Request,
   res: Response,
   next: NextFunction,
   requiredScopes: ApiKeyScope[],
   credential: AgentCredential
-): void {
+): Promise<void> {
   const missing = requiredScopes.filter((scope) => !credential.scopes.includes(scope));
   if (missing.length > 0) {
     res.status(403).json({
@@ -164,7 +165,16 @@ function admitAgent(
     return;
   }
 
-  const actingAs = applyTenantGrant(req, credential.tenants);
+  // A grant names the groups the owner belonged to when they made it. Only the
+  // ones they still belong to count, so leaving a group also takes it from
+  // every key and connection they gave it to.
+  const stillMemberOf = new Set(await currentGroupsOf({ email: credential.email }));
+  const tenants: ApiKeyTenant = {
+    ...credential.tenants,
+    allowed: credential.tenants.allowed.filter((tenant) => tenant === PERSONAL_TENANT || stillMemberOf.has(tenant))
+  };
+
+  const actingAs = applyTenantGrant(req, tenants);
   if (actingAs === null) {
     res.status(403).json({
       success: false,
@@ -177,11 +187,11 @@ function admitAgent(
   // Only the granted groups, never the owner's full membership: this is what
   // stops a credential reaching a group it was not issued for through any
   // handler that consults `userGroups` instead of the `groupId` parameter.
-  req.userGroups = groupIdsOf(credential.tenants.allowed);
+  req.userGroups = groupIdsOf(tenants.allowed);
   req.apiKey = {
     keyId: credential.credentialId,
     scopes: credential.scopes,
-    tenants: credential.tenants,
+    tenants,
     actingAs,
     kind: credential.kind,
     label: credential.label,
@@ -228,9 +238,9 @@ export const authenticateAgent = (...requiredScopes: ApiKeyScope[]): RequestHand
           unauthorized(res);
           return;
         }
-        const user = claims as UserPayload;
-        req.user = user;
-        req.userGroups = user.groups ?? [];
+        const groups = await currentGroupsOf(claims as UserPayload);
+        req.user = { ...(claims as UserPayload), groups };
+        req.userGroups = groups;
         beginAudit(req, res, next);
         return;
       }
@@ -245,7 +255,7 @@ export const authenticateAgent = (...requiredScopes: ApiKeyScope[]): RequestHand
       // `undefined`, scoped writes were refused as inaccessible, and a read
       // whose scope collapsed to nothing fell through to "no user context" and
       // answered from the whole collection.
-      admitAgent(req, res, next, requiredScopes, {
+      await admitAgent(req, res, next, requiredScopes, {
         // The client, not the token: `jti` is a new value every hour.
         credentialId: claims.clientId ?? 'unknown-client',
         kind: 'oauth',
@@ -268,7 +278,7 @@ export const authenticateAgent = (...requiredScopes: ApiKeyScope[]): RequestHand
       return;
     }
 
-    admitAgent(req, res, next, requiredScopes, {
+    await admitAgent(req, res, next, requiredScopes, {
       credentialId: result.keyId!,
       kind: 'api_key',
       label: result.label || 'An API key',

package/src/groups/client.ts

@@ -76,7 +76,7 @@ interface GroupOwnerResponse {
  * round, out through the proxy and back, carrying the internal token across the
  * public edge.
  */
-function internalGroupUrl(): string | undefined {
+export function internalGroupUrl(): string | undefined {
   return process.env.GROUP_INTERNAL_URL || process.env.GROUP_API_URL;
 }
 

package/src/groups/index.ts

@@ -3,3 +3,5 @@ export type { GroupOwner } from './client';
 
 export { groupOwnerSubject } from './subject';
 export type { GroupIdResolver } from './subject';
+
+export { getUserGroupIds, currentGroupsOf, clearMembershipCache } from './membership';

package/src/groups/membership.test.ts

@@ -0,0 +1,84 @@
+import { clearMembershipCache, currentGroupsOf, getUserGroupIds } from './membership';
+import logger from '../logging/logger';
+
+jest.mock('../logging/logger', () => ({ __esModule: true, default: { error: jest.fn(), warn: jest.fn() } }));
+
+const ORIGINAL_ENV = process.env;
+const answer = (data: unknown, ok = true, status = 200) =>
+  ({ ok, status, json: async () => ({ success: ok, data }) }) as unknown as Response;
+
+beforeEach(() => {
+  clearMembershipCache();
+  jest.useRealTimers();
+  process.env = {
+    ...ORIGINAL_ENV,
+    GROUP_INTERNAL_URL: 'http://group-service:5006',
+    INTERNAL_SERVICE_TOKEN: 'internal-token',
+    SERVICE_NAME: 'album-service'
+  };
+  global.fetch = jest.fn().mockResolvedValue(answer(['g1', 'g2']));
+});
+
+afterAll(() => {
+  process.env = ORIGINAL_ENV;
+});
+
+it('asks group-service over the internal channel', async () => {
+  await expect(getUserGroupIds('Ada@Example.com')).resolves.toEqual(['g1', 'g2']);
+
+  expect(global.fetch).toHaveBeenCalledWith(
+    'http://group-service:5006/api/groups/mine/ids?userEmail=ada%40example.com',
+    expect.objectContaining({
+      headers: expect.objectContaining({ 'x-internal-token': 'internal-token', 'x-service-id': 'album-service' })
+    })
+  );
+});
+
+it('answers from the cache for 30 seconds, then asks again', async () => {
+  jest.useFakeTimers();
+
+  await getUserGroupIds('ada@example.com');
+  await getUserGroupIds('ADA@example.com');
+  expect(global.fetch).toHaveBeenCalledTimes(1);
+
+  jest.advanceTimersByTime(30_001);
+  await getUserGroupIds('ada@example.com');
+  expect(global.fetch).toHaveBeenCalledTimes(2);
+});
+
+it('shares one request between callers asking at the same time', async () => {
+  await Promise.all([getUserGroupIds('ada@example.com'), getUserGroupIds('ada@example.com')]);
+
+  expect(global.fetch).toHaveBeenCalledTimes(1);
+});
+
+it('keeps the last known membership while group-service is unreachable', async () => {
+  jest.useFakeTimers();
+  await getUserGroupIds('ada@example.com');
+  jest.advanceTimersByTime(30_001);
+  (global.fetch as jest.Mock).mockRejectedValue(new Error('connect ECONNREFUSED'));
+
+  await expect(getUserGroupIds('ada@example.com')).resolves.toEqual(['g1', 'g2']);
+  expect(logger.warn).toHaveBeenCalled();
+});
+
+it('grants no groups when it has never been able to ask', async () => {
+  (global.fetch as jest.Mock).mockResolvedValue(answer(null, false, 503));
+
+  await expect(getUserGroupIds('ada@example.com')).resolves.toEqual([]);
+  expect(logger.error).toHaveBeenCalled();
+});
+
+it('grants no groups when not configured, without calling anything', async () => {
+  delete process.env.GROUP_INTERNAL_URL;
+  delete process.env.GROUP_API_URL;
+
+  await expect(getUserGroupIds('ada@example.com')).resolves.toEqual([]);
+  expect(global.fetch).not.toHaveBeenCalled();
+});
+
+it('never takes the groups from the token', async () => {
+  (global.fetch as jest.Mock).mockResolvedValue(answer(['g2']));
+
+  await expect(currentGroupsOf({ email: 'ada@example.com', groups: ['g1', 'g9'] })).resolves.toEqual(['g2']);
+});

package/src/groups/membership.ts

@@ -0,0 +1,133 @@
+import logger from '../logging/logger';
+import { internalGroupUrl } from './client';
+
+/**
+ * Which groups a person belongs to, asked of group-service.
+ *
+ * This used to travel in the session token's `groups` claim, which made it only
+ * as fresh as the token: a new member could not see the group until their next
+ * renewal, and a removed one kept access until theirs, which is why membership
+ * changes used to sign people out. Asked here instead, with a short cache, a
+ * change reaches every service within CACHE_TTL_MS.
+ *
+ * Every request pays for this only once per person per service per cache
+ * window; concurrent callers share one request.
+ */
+const CACHE_TTL_MS = 30_000;
+
+/** Bounded so a service under enumeration can't grow the cache without limit. */
+const MAX_CACHE_ENTRIES = 5_000;
+
+const REQUEST_TIMEOUT_MS = 3_000;
+
+interface CacheEntry {
+  groups: string[];
+  expiresAt: number;
+}
+
+const cache = new Map<string, CacheEntry>();
+const inFlight = new Map<string, Promise<string[] | null>>();
+
+function putInCache(email: string, groups: string[]): void {
+  if (!cache.has(email) && cache.size >= MAX_CACHE_ENTRIES) {
+    // Map iterates in insertion order, so the first key is the oldest write.
+    const oldest = cache.keys().next();
+    if (!oldest.done) cache.delete(oldest.value);
+  }
+  cache.set(email, { groups, expiresAt: Date.now() + CACHE_TTL_MS });
+}
+
+async function fetchUserGroupIds(email: string): Promise<string[] | null> {
+  const baseUrl = internalGroupUrl();
+  const token = process.env.INTERNAL_SERVICE_TOKEN;
+
+  if (!baseUrl || !token) {
+    logger.error('Group membership lookup not configured', {
+      hasGroupApiUrl: Boolean(baseUrl),
+      hasInternalToken: Boolean(token)
+    });
+    return null;
+  }
+
+  try {
+    const response = await fetch(`${baseUrl}/api/groups/mine/ids?userEmail=${encodeURIComponent(email)}`, {
+      method: 'GET',
+      headers: {
+        'Content-Type': 'application/json',
+        'x-internal-token': token,
+        'x-service-id': process.env.SERVICE_NAME || 'unknown-service'
+      },
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+    });
+
+    if (!response.ok) {
+      logger.error('Group membership lookup failed', { email, status: response.status });
+      return null;
+    }
+
+    const body = (await response.json()) as { success?: boolean; data?: unknown };
+    if (!body.success || !Array.isArray(body.data)) {
+      logger.error('Group membership lookup returned no list', { email });
+      return null;
+    }
+    return body.data.filter((id): id is string => typeof id === 'string');
+  } catch (error) {
+    logger.error('Group membership lookup unreachable', { email, error: (error as Error)?.message });
+    return null;
+  }
+}
+
+/**
+ * The ids of the groups `email` belongs to right now.
+ *
+ * When group-service cannot be asked, the last answer is used even if it has
+ * expired, and failing that no groups at all: a person keeps their own data
+ * through an outage and loses group data until it ends, rather than being
+ * granted a group on a guess.
+ */
+export async function getUserGroupIds(email: string): Promise<string[]> {
+  const key = email.toLowerCase();
+  const entry = cache.get(key);
+  if (entry && entry.expiresAt > Date.now()) return entry.groups;
+
+  let pending = inFlight.get(key);
+  if (!pending) {
+    pending = fetchUserGroupIds(key).finally(() => inFlight.delete(key));
+    inFlight.set(key, pending);
+  }
+
+  const groups = await pending;
+  if (groups) {
+    putInCache(key, groups);
+    return groups;
+  }
+  if (entry) {
+    logger.warn('Using the last known group membership while group-service is unreachable', { email: key });
+    return entry.groups;
+  }
+  return [];
+}
+
+/** For tests. */
+export function clearMembershipCache(): void {
+  cache.clear();
+  inFlight.clear();
+}
+
+type MembershipLookup = (user: { email: string; groups?: string[] }) => Promise<string[]>;
+
+const lookUpMembership: MembershipLookup = (user) => getUserGroupIds(user.email);
+let membershipLookup: MembershipLookup = lookUpMembership;
+
+/** The groups the auth middlewares put on `req.userGroups`. */
+export const currentGroupsOf = (user: { email: string; groups?: string[] }): Promise<string[]> =>
+  membershipLookup(user);
+
+/**
+ * Replaces the lookup, for tests only; pass nothing to restore the real one.
+ * Service suites reach it through `@tumbaland/backend-core/testing`, which makes
+ * a test token's own `groups` claim the membership, so they need no group-service.
+ */
+export function overrideMembershipLookupForTests(lookup?: MembershipLookup): void {
+  membershipLookup = lookup ?? lookUpMembership;
+}

package/src/middleware/authMiddleware.test.ts

@@ -5,6 +5,7 @@ import { PERSONAL_TENANT } from '../apiKeys/types';
 import { mintAccessToken } from '../oauth/tokens';
 import { UserPayload } from '../types/auth';
 import { overrideSessionCheckForTests } from '../auth/session';
+import { overrideMembershipLookupForTests } from '../groups/membership';
 
 // These tokens carry no session; the session check has its own tests below and in session.test.ts.
 beforeEach(() => overrideSessionCheckForTests(async () => true));
@@ -57,14 +58,19 @@ describe('authenticateToken', () => {
     expect(req.userGroups).toEqual([]);
   });
 
-  it('attaches userGroups from the token when present', async () => {
-    const token = jwt.sign({ ...payload, groups: ['group-1', 'group-2'] }, 'test-secret');
+  it("takes the person's groups from group-service, not from the token", async () => {
+    const lookup = jest.fn(async () => ['live-group']);
+    overrideMembershipLookupForTests(lookup);
+    const token = jwt.sign({ ...payload, groups: ['stale-group'] }, 'test-secret');
     const req = mockReq({ cookies: { access_token: token } });
     const res = mockRes();
 
     await authenticateToken(req, res, next);
 
-    expect(req.userGroups).toEqual(['group-1', 'group-2']);
+    expect(lookup).toHaveBeenCalledWith(expect.objectContaining({ email: 'user@example.com' }));
+    expect(req.userGroups).toEqual(['live-group']);
+    expect(req.user?.groups).toEqual(['live-group']);
+    overrideMembershipLookupForTests();
   });
 
   it('accepts a Bearer token from the Authorization header', async () => {

package/src/middleware/authMiddleware.ts

@@ -4,6 +4,7 @@ import { requireEnv } from '../config/env';
 import { isAccessTokenClaims } from '../oauth/tokens';
 import { UserPayload } from '../types/auth';
 import { isCurrentSession } from '../auth/session';
+import { currentGroupsOf } from '../groups/membership';
 
 /**
  * JWT authentication middleware
@@ -43,9 +44,11 @@ export async function authenticateToken(req: Request, res: Response, next: NextF
       res.status(401).json({ success: false, message: 'Session has ended' });
       return;
     }
-    const user = claims as UserPayload;
-    req.user = user;
-    req.userGroups = user.groups ?? [];
+    // Membership is asked of group-service, not read from the token, so a
+    // change applies within seconds rather than at the next renewal.
+    const groups = await currentGroupsOf(claims as UserPayload);
+    req.user = { ...(claims as UserPayload), groups };
+    req.userGroups = groups;
   } catch (error) {
     res.status(401).json({ success: false, message: 'Invalid or expired token' });
     return;
@@ -76,9 +79,9 @@ export async function optionalAuth(req: Request, _res: Response, next: NextFunct
       // expired cookie, so the route still answers with its public form.
       // An ended session is treated as none, like an expired cookie.
       if (!isAccessTokenClaims(claims) && (await isCurrentSession(claims))) {
-        const user = claims as UserPayload;
-        req.user = user;
-        req.userGroups = user.groups ?? [];
+        const groups = await currentGroupsOf(claims as UserPayload);
+        req.user = { ...(claims as UserPayload), groups };
+        req.userGroups = groups;
       }
     }
   } catch {

package/src/testing/serviceTestSetup.ts

@@ -0,0 +1,17 @@
+import { overrideSessionCheckForTests } from '../auth/session';
+import { overrideMembershipLookupForTests } from '../groups/membership';
+
+/**
+ * Jest setup for service test suites: they sign session tokens without a
+ * session and run with no database or group-service, so every token's session
+ * counts as live and its `groups` claim stands in for group membership.
+ * The session check itself is tested in backend-core (auth/session.test.ts).
+ *
+ * Loaded through the package's test-only entry point:
+ *   setupFiles: ['@tumbaland/backend-core/testing']
+ */
+overrideSessionCheckForTests(async () => true);
+
+// No group-service either: a test token's own `groups` claim is taken as the
+// person's membership. The live lookup is tested in groups/membership.test.ts.
+overrideMembershipLookupForTests(async (user) => user.groups ?? []);

package/testing.js

@@ -1,9 +1,10 @@
 /**
  * Test-only entry point: `@tumbaland/backend-core/testing`.
  *
- * Loading it makes every session token's session count as live, for service
- * test suites that sign tokens without a session and run with no database.
+ * Loading it makes every session token's session count as live, and a test
+ * token's `groups` claim its group membership, for service test suites that
+ * run with no database and no group-service.
  * Kept out of the package's main exports so production code never reaches it.
  * The session check itself is tested in backend-core (src/auth/session.test.ts).
  */
-require('./dist/testing/allowAllSessions');
+require('./dist/testing/serviceTestSetup');

package/dist/testing/allowAllSessions.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=allowAllSessions.d.ts.map

package/dist/testing/allowAllSessions.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"allowAllSessions.d.ts","sourceRoot":"","sources":["../../src/testing/allowAllSessions.ts"],"names":[],"mappings":""}

package/dist/testing/allowAllSessions.js

@@ -1,13 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-const session_1 = require("../auth/session");
-/**
- * Jest setup for service test suites: they sign session tokens without a
- * session and run with no database, so every token's session counts as live.
- * The session check itself is tested in backend-core (auth/session.test.ts).
- *
- * Loaded through the package's test-only entry point:
- *   setupFiles: ['@tumbaland/backend-core/testing']
- */
-(0, session_1.overrideSessionCheckForTests)(async () => true);
-//# sourceMappingURL=allowAllSessions.js.map

package/dist/testing/allowAllSessions.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"allowAllSessions.js","sourceRoot":"","sources":["../../src/testing/allowAllSessions.ts"],"names":[],"mappings":";;AAAA,6CAA+D;AAE/D;;;;;;;GAOG;AACH,IAAA,sCAA4B,EAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC"}

package/src/testing/allowAllSessions.ts

@@ -1,11 +0,0 @@
-import { overrideSessionCheckForTests } from '../auth/session';
-
-/**
- * Jest setup for service test suites: they sign session tokens without a
- * session and run with no database, so every token's session counts as live.
- * The session check itself is tested in backend-core (auth/session.test.ts).
- *
- * Loaded through the package's test-only entry point:
- *   setupFiles: ['@tumbaland/backend-core/testing']
- */
-overrideSessionCheckForTests(async () => true);