@wildo-ai/saas-backend-lib 1.1.1 → 1.1.3

package/dist/esm/security/authorizations/scope-root-collection-confinement.backend.js.map

@@ -1 +1 @@
-{"version":3,"file":"scope-root-collection-confinement.backend.js","sourceRoot":"","sources":["../../../../../src/security/authorizations/scope-root-collection-confinement.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,OAAO,EACL,qBAAqB,EACrB,8BAA8B,EAC9B,mCAAmC,EACnC,oBAAoB,EACpB,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAE/B,kGAAkG;AAClG,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAElD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,8BAA8B,GAAqC;IACvE,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,KAAK;IAC3B,qBAAqB,CAAC,WAAW;IACjC,qBAAqB,CAAC,WAAW;CAClC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,6CAA6C,GAA8C;IAC/F,8BAA8B,CAAC,4BAA4B;IAC3D,8BAA8B,CAAC,gBAAgB;CAChD,CAAC;AA8BF;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAgD;IACrF,MAAM,KAAK,GAAG,QAAQ,CAAC,oBAAoB,CAAC;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,gBAAgB,GAAG,mCAAmC,CAAC,KAA6B,CAAC,CAAC;IAC5F,OAAO,OAAO,CAAC,gBAAgB,CAAC,IAAI,QAAQ,CAAC,kBAAkB,KAAK,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAC/F,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,kCAAkC,CAAC,MAIlD;IACC,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,qBAAqB,CAAC;QAAE,OAAO,KAAK,CAAC;IACxE,IAAI,CAAC,MAAM,CAAC,qBAAqB;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,CAAC,8BAA8B,CAAC,QAAQ,CAAC,MAAM,CAAC,qBAAqB,CAAC;QAAE,OAAO,KAAK,CAAC;IACzF,IAAI,6CAA6C,CAAC,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC;QAAE,OAAO,KAAK,CAAC;IAEhH,kGAAkG;IAClG,yEAAyE;IACzE,OAAO,CAAC,4CAA4C,CAAC;QACnD,MAAM,EAAE,EAAE;QACV,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;QACnD,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;KACpD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAC1C,gBAAsD;IAEtD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,QAAQ,IAAI,CAAC,gBAAgB,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,0BAAmC,CAAC,EAAE,CAAC;QAC3G,MAAM,KAAK,GAAG,QAA+E,CAAC;QAC9F,IAAI,KAAK,CAAC,mBAAmB,KAAK,oBAAoB,CAAC,aAAa;YAAE,SAAS;QAC/E,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;QACjD,IAAI,EAAE;YAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,4CAA4C,CAAyB,MAMpF;IACC,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,qBAAqB,CAAC;QAAE,OAAO,KAAK,CAAC;IACxE,+FAA+F;IAC/F,gGAAgG;IAChG,mGAAmG;IACnG,IAAI,MAAM,CAAC,qBAAqB,CAAC,oBAAoB,KAAK,oBAAoB,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC;IAE3G,IAAI,CAAC,MAAM,CAAC,qBAAqB;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,CAAC,8BAA8B,CAAC,QAAQ,CAAC,MAAM,CAAC,qBAAqB,CAAC;QAAE,OAAO,KAAK,CAAC;IAEzF,IAAI,6CAA6C,CAAC,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC;QAAE,OAAO,KAAK,CAAC;IAEhH,8FAA8F;IAC9F,kGAAkG;IAClG,IAAI,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,uCAAuC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAEtG,MAAM,qBAAqB,GAAG,4BAA4B,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACpF,MAAM,SAAS,GAAI,MAAM,CAAC,MAAkC,CAAC,4BAA4B,CAAC,CAAC;IAC3F,MAAM,WAAW,GAAG,mCAAmC,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC;IAEzF,MAAM,CAAC,MAAkC,CAAC,4BAA4B,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;IAChG,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,SAAS,mCAAmC,CAAC,SAAkB,EAAE,aAAgC;IAC/F,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,CAAC,GAAG,aAAa,CAAC,CAAC;IAE7E,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IAE1C,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,OAAO,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,SAAoC,CAAC,CAAC;QACpE,MAAM,OAAO,GAAI,SAA+B,CAAC,GAAG,CAAC;QACrD,gGAAgG;QAChG,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/E,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC","sourcesContent":["/**\n * # Scope-ROOT collection confinement — ONE definition, compiled by both adapters\n *\n * assurance-control: WILDO.ACCESS.SCOPE_CONFINEMENT — confines a collection read of the tenant\n * resource itself to the tenants the caller belongs to.\n *\n * ## The hole this closes\n *\n * Every ORGANIZATIONS-scoped resource is confined by `assignInitiatorOrganizationConfinementToFilter`\n * (D3) or by the context-entry loop, both keyed on the `organizationId` COLUMN the row carries.\n * `organizations` carries no such column: it IS the tenant, addressed by `_id`. Both adapters then\n * lose the axis twice over, and independently —\n *\n *  1. `blacklistedFields` is seeded with the resource's own `resourceFieldIdentifier` \"to avoid\n *     self-reference in filtering\". For the scope root that identifier IS the scope field, so the\n *     context loop skips it and D3 returns `false` at its blacklist check;\n *  2. `OrganizationSchema` models no `organizationId` path (and PostgreSQL plans no such column), so\n *     even an admitted D3 would find nothing to write.\n *\n * Measured, not reasoned: a scope-root LIST compiled to `{}` — the empty filter, no tenant predicate\n * at all — on BOTH adapters, while a non-root org-scoped resource on the identical execution context\n * compiled to `{organizationId: 'org-caller'}`. See\n * `base-classes/__tests__/scope-root-collection-confinement.probe.test.ts`.\n *\n * Nothing leaked, because the ORGANIZATIONS branch of `validateParentScopeAccess` refused every\n * caller before the repository ran — it demands a PARENT organization scope, which the scope root\n * structurally does not have. So the gate was the SOLE control standing between an APPLICATION-role\n * caller and an unconfined cross-tenant tenant directory, and the two-line \"fix\" to that gate would\n * have been a full cross-tenant disclosure that turned every existing pin green.\n *\n * This module is therefore the half that had to land FIRST. See\n * `.claude/plans/organizations-scope-root-collection-gate-analysis.md`.\n *\n * ## Why an authority module and not two repository branches\n *\n * There are two `buildContextualFilter` implementations. The retention hide learned the cost of a\n * hand-written copy on each side (gate G-PG-NULL); D3 learned it again — it existed on PostgreSQL\n * and not on MongoDB, \"the only measured divergence where the two adapters disagreed about WHO CAN\n * SEE WHOSE ROWS\". A tenancy predicate present on one adapter and absent on the other is not a gap,\n * it is a bypass on the adapter that lacks it (`.claude/rules/invariant-call-site-enumeration.md`).\n *\n * ## Membership comes from ROLE ENTRIES, never from `initiatorIds`\n *\n * `initiatorIds.organizationId` names the ONE tenant the request is acting in, which is the wrong\n * question here: a collection read of the tenant resource asks \"which tenants are yours\", plural.\n * Role entries are also the one input a request cannot author for itself — the same reasoning\n * `holdsOrganizationWideEntryFor` and `authorizeOrganizations` rest on.\n *\n * ORGANIZATION-WIDE entries only. A unit-narrowed grant confers authority over a unit inside a\n * tenant, not over the tenant row, and every org-wide gate in the authorization service filters\n * those out; counting one here would let a unit member enumerate the tenant they are narrowed inside.\n */\n\nimport {\n  CoreResourceOperation,\n  ExecutionContext_ExecutionType,\n  PRIMARY_SCOPE_TO_CORE_RESOURCE_TYPE,\n  ResourcePrimaryScope,\n  isOrganizationWideRoleInfo,\n} from '@wildo-ai/saas-models';\n\n/** The queryable key a scope-root row is addressed by. Named once so no call site can typo it. */\nexport const SCOPE_ROOT_CONFINEMENT_FIELD = '_id';\n\n/**\n * The operations this confinement governs: those that resolve a SET of rows with no per-row\n * authorization behind them.\n *\n * Per-INSTANCE operations are deliberately absent, and this is a decision rather than an oversight.\n * `authorizeOrganizations` fetches the row and compares its tenant against the caller's org-wide\n * role entries, refusing a non-member — that gate was hardened on 2026-08-05 and is measured healthy\n * (a per-instance READ answers 200 for a member while every collection call answers 403). Adding a\n * row filter underneath it would buy no isolation and would actively BREAK the declared cross-tenant\n * repair doors (`restore`, `activate`, `requestDeletion: admin`), every one of which is per-instance\n * — silently filtering an operation authorization deliberately admitted, which is the precise\n * failure `.claude/rules/administrative-continuity-floors.md` warns about and which D3's own\n * crossing-awareness exists to prevent.\n *\n * The write-family bulk verbs ARE included. `organizations` declares none today, so including them\n * is free; excluding them would leave a set-shaped write on the tenant resource unconfined the day\n * one is declared, which is exactly how a scope-root hole comes back.\n */\nconst SCOPE_ROOT_CONFINED_OPERATIONS: readonly CoreResourceOperation[] = [\n  CoreResourceOperation.LIST,\n  CoreResourceOperation.SEARCH,\n  CoreResourceOperation.COUNT,\n  CoreResourceOperation.UPDATE_MANY,\n  CoreResourceOperation.DELETE_MANY,\n];\n\n/**\n * Execution types that carry no membership by construction and must not be confined.\n *\n * Mirrors {@link ORGANIZATION_UNIT_NARROWING_EXEMPT_EXECUTION_TYPES} and is exempt for the same\n * reason: `INTERNALLY_INITIATED_REQUEST` is the framework's context-free system actor (batch, cron,\n * cascade, bootstrap) and `WEBHOOK_CALLBACK` is trusted after signature verification. Neither holds\n * role entries, so confining them would not fail closed — it would empty every tenant sweep, purge\n * and cascade, presenting a broken system as \"no rows\".\n *\n * ⚠️ Every OTHER execution type — user, machine, anonymous, consumable-token, public — is confined,\n * and a principal with no org-wide entry is confined to the EMPTY set rather than exempted. Adding a\n * member here removes a tenant-isolation check.\n */\nconst SCOPE_ROOT_CONFINEMENT_EXEMPT_EXECUTION_TYPES: readonly ExecutionContext_ExecutionType[] = [\n  ExecutionContext_ExecutionType.INTERNALLY_INITIATED_REQUEST,\n  ExecutionContext_ExecutionType.WEBHOOK_CALLBACK,\n];\n\n/** What this authority needs from the execution context. Deliberately narrow, like its siblings. */\nexport interface ScopeRootCollectionConfinementSignal {\n  readonly executionType: ExecutionContext_ExecutionType;\n  readonly initiatorRoles?: readonly {\n    readonly relatedPrimaryScope?: string;\n    readonly relatedResourceId?: string | null;\n    readonly roles?: readonly string[];\n    /**\n     * Present ⇒ the entry is a UNIT grant, not tenant membership. Declared here rather than left\n     * implicit because omitting it is how a test fixture builds an entry that LOOKS unit-scoped and\n     * is silently treated as organization-wide — which is how the first draft of this module's own\n     * pin passed for the wrong reason.\n     */\n    readonly organizationUnitId?: string;\n  }[] | null;\n  /**\n   * Only the crossing declaration is read. An operation that did NOT declare one is confined, which\n   * is what keeps the opt-in enumerable rather than a privilege-based bypass.\n   */\n  readonly operation?: { readonly admitsCrossTenantPlatformAdministration?: boolean } | null;\n}\n\n/** What this authority needs from the resource configuration. */\nexport interface ScopeRootCollectionConfinementResource {\n  readonly resourceIdentifier?: string;\n  readonly resourcePrimaryScope?: string;\n}\n\n/**\n * Is this resource the ROOT of its own primary scope — the tenant row itself rather than a row\n * inside a tenant?\n *\n * Structural (`resourceIdentifier === PRIMARY_SCOPE_TO_CORE_RESOURCE_TYPE[scope]`) rather than a\n * comparison against `CoreResourceType.ORGANIZATIONS`, so a future tenant scope is covered the day\n * it is declared.\n *\n * **Exported because the authorization GATE asks the same question**, and the gate's answer and the\n * filter's answer must be the SAME answer. A gate that opens for a scope root the filter does not\n * recognise is precisely the disclosure this whole module exists to prevent, and two look-alike\n * derivations of one predicate is how that happens (`.claude/rules/invariant-call-site-enumeration.md`).\n */\nexport function isOwnScopeRootResource(resource: ScopeRootCollectionConfinementResource): boolean {\n  const scope = resource.resourcePrimaryScope;\n  if (!scope) return false;\n  const rootResourceType = PRIMARY_SCOPE_TO_CORE_RESOURCE_TYPE[scope as ResourcePrimaryScope];\n  return Boolean(rootResourceType) && resource.resourceIdentifier === String(rootResourceType);\n}\n\n/**\n * Is this collection read an APPLICATION-WIDE directory enumeration — a scope-root collection whose\n * rows are NOT confined to any one tenant?\n *\n * This is the audit trigger's question, and it is deliberately the exact complement of the\n * confinement decision above rather than a second, similar-looking rule. A resource is a directory\n * precisely when it is its own scope root AND this authority declines to confine it: today that is\n * `users`, `applications` and `anonymousUsers` (non-tenant scope roots), and it would become false\n * for any of them the moment the confinement is widened to their axis. Deriving the two answers from\n * one predicate is what stops the trail claiming \"unconfined\" about a read that has since been\n * confined.\n *\n * An exempt execution type is NOT a directory read for audit purposes: a batch or webhook has no\n * operator to attribute, and recording framework machinery as operator browsing would bury the\n * signal the event exists to carry.\n */\nexport function isUnconfinedScopeRootDirectoryRead(params: {\n  readonly executionContext: ScopeRootCollectionConfinementSignal;\n  readonly resourceConfiguration: ScopeRootCollectionConfinementResource;\n  readonly executedCoreOperation: CoreResourceOperation | undefined;\n}): boolean {\n  if (!isOwnScopeRootResource(params.resourceConfiguration)) return false;\n  if (!params.executedCoreOperation) return false;\n  if (!SCOPE_ROOT_CONFINED_OPERATIONS.includes(params.executedCoreOperation)) return false;\n  if (SCOPE_ROOT_CONFINEMENT_EXEMPT_EXECUTION_TYPES.includes(params.executionContext.executionType)) return false;\n\n  // Confined ⇒ not a directory. Asked of a throwaway filter so the question can be answered without\n  // a caller having to own one, and so the two answers can never disagree.\n  return !assignScopeRootCollectionConfinementToFilter({\n    filter: {},\n    executionContext: params.executionContext,\n    resourceConfiguration: params.resourceConfiguration,\n    executedCoreOperation: params.executedCoreOperation,\n  });\n}\n\n/**\n * The tenant ids the caller holds an organization-WIDE role entry for.\n *\n * Exported so the authorization gate can report the same set it is about to confine to, rather than\n * re-deriving it — two derivations of one membership set is how a gate and a filter start\n * disagreeing about who is a member.\n */\nexport function resolveCallerOrganizationIds(\n  executionContext: ScopeRootCollectionConfinementSignal,\n): string[] {\n  const ids = new Set<string>();\n  for (const roleInfo of (executionContext.initiatorRoles ?? []).filter(isOrganizationWideRoleInfo as never)) {\n    const entry = roleInfo as { relatedPrimaryScope?: string; relatedResourceId?: string | null };\n    if (entry.relatedPrimaryScope !== ResourcePrimaryScope.ORGANIZATIONS) continue;\n    const id = String(entry.relatedResourceId ?? '');\n    if (id) ids.add(id);\n  }\n  return [...ids];\n}\n\n/**\n * Confine `filter` to the caller's own tenants, in place. Returns whether it was applied.\n *\n * ## Composition with a caller-supplied `_id`\n *\n * The sibling authorities OVERWRITE at the top level, because for them a caller-supplied value for\n * the confined field is an attempt to widen and must be neutralised. Here the same reasoning gives a\n * different mechanic: `_id` is also how a legitimate request NARROWS, so an overwrite would silently\n * discard a caller's own filter and hand back MORE rows than they asked for.\n *\n * So this INTERSECTS — never skips. The result is always a subset of both the caller's request and\n * the caller's membership, so it cannot be widened by anything a caller sends. A shape the\n * intersection cannot interpret (a `$ne`, a regex, an operator object) resolves to the EMPTY set\n * rather than being passed through: an uninterpretable narrowing is not a licence to drop the\n * confinement.\n *\n * A \"skip if the caller already set `_id`\" guard would be the fail-OPEN version of this. Do not\n * add one.\n *\n * `$in: []` is the portable match-nothing: MongoDB matches nothing, and the PostgreSQL compiler\n * emits `FALSE` rather than the `IN ()` syntax error a naive translation would produce (gate\n * G-PG-NULL). One emitter covers the confined case and the deny-all case on both adapters.\n */\nexport function assignScopeRootCollectionConfinementToFilter<TFilter extends object>(params: {\n  readonly filter: TFilter;\n  readonly executionContext: ScopeRootCollectionConfinementSignal;\n  readonly resourceConfiguration: ScopeRootCollectionConfinementResource;\n  /** The core operation THIS repository call executes — NOT `executionContext.operation`. */\n  readonly executedCoreOperation: CoreResourceOperation | undefined;\n}): boolean {\n  if (!isOwnScopeRootResource(params.resourceConfiguration)) return false;\n  // Only the tenant axis. `users`, `applications` and `anonymous_users` are also their own scope\n  // roots, but they are APPLICATION-level directories rather than tenant data, and confining them\n  // would change four surfaces this analysis did not measure. See the analysis plan's open question.\n  if (params.resourceConfiguration.resourcePrimaryScope !== ResourcePrimaryScope.ORGANIZATIONS) return false;\n\n  if (!params.executedCoreOperation) return false;\n  if (!SCOPE_ROOT_CONFINED_OPERATIONS.includes(params.executedCoreOperation)) return false;\n\n  if (SCOPE_ROOT_CONFINEMENT_EXEMPT_EXECUTION_TYPES.includes(params.executionContext.executionType)) return false;\n\n  // A DECLARED crossing was admitted at the authorization layer, deliberately and with an audit\n  // record. Re-confining it here would undo that decision one layer down — D3's documented failure.\n  if (params.executionContext.operation?.admitsCrossTenantPlatformAdministration === true) return false;\n\n  const callerOrganizationIds = resolveCallerOrganizationIds(params.executionContext);\n  const requested = (params.filter as Record<string, unknown>)[SCOPE_ROOT_CONFINEMENT_FIELD];\n  const confinedIds = intersectRequestedIdsWithMembership(requested, callerOrganizationIds);\n\n  (params.filter as Record<string, unknown>)[SCOPE_ROOT_CONFINEMENT_FIELD] = { $in: confinedIds };\n  return true;\n}\n\n/**\n * Intersect whatever the caller asked for with what they are a member of.\n *\n * Fail-closed on every shape that is not plainly an id or a set of ids: an operator object could\n * express a superset (`$ne`, `$nin`, a regex), and there is no honest intersection with a predicate\n * whose extension is unknown here.\n */\nfunction intersectRequestedIdsWithMembership(requested: unknown, membershipIds: readonly string[]): string[] {\n  if (requested === undefined || requested === null) return [...membershipIds];\n\n  const membership = new Set(membershipIds);\n\n  if (typeof requested === 'string') {\n    return membership.has(requested) ? [requested] : [];\n  }\n\n  if (Array.isArray(requested)) {\n    return requested.map(String).filter((id) => membership.has(id));\n  }\n\n  if (typeof requested === 'object') {\n    const operators = Object.keys(requested as Record<string, unknown>);\n    const inValue = (requested as { $in?: unknown }).$in;\n    // ONLY a lone `$in`. A mixed operator object ({$in, $ne}) has an extension this cannot compute.\n    if (operators.length === 1 && operators[0] === '$in' && Array.isArray(inValue)) {\n      return inValue.map(String).filter((id) => membership.has(id));\n    }\n    return [];\n  }\n\n  return [];\n}\n"]}
+{"version":3,"file":"scope-root-collection-confinement.backend.js","sourceRoot":"","sources":["../../../../../src/security/authorizations/scope-root-collection-confinement.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,OAAO,EACL,qBAAqB,EACrB,8BAA8B,EAC9B,mCAAmC,EACnC,oBAAoB,EACpB,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAE/B,kGAAkG;AAClG,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAElD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAN,IAAY,+BAkFX;AAlFD,WAAY,+BAA+B;IACzC;;;OAGG;IACH,wGAAqE,CAAA;IACrE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoDG;IACH,kHAA+E,CAAA;IAC/E;;;;;;;;;;;OAWG;IACH,kHAA+E,CAAA;IAC/E;;;;;;;OAOG;IACH,gHAA6E,CAAA;AAC/E,CAAC,EAlFW,+BAA+B,KAA/B,+BAA+B,QAkF1C;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAA4E,MAAM,CAAC,MAAM,CAAC;IACxI,CAAC,oBAAoB,CAAC,aAAa,CAAC,EAAE,+BAA+B,CAAC,gCAAgC;IACtG,CAAC,oBAAoB,CAAC,SAAS,CAAC,EAAE,+BAA+B,CAAC,qCAAqC;IACvG,CAAC,oBAAoB,CAAC,WAAW,CAAC,EAAE,+BAA+B,CAAC,qCAAqC;IACzG,CAAC,oBAAoB,CAAC,SAAS,CAAC,EAAE,+BAA+B,CAAC,oCAAoC;CACvG,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,sCAAsC,CACpD,QAAgD;IAEhD,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IACxD,OAAO,mCAAmC,CAAC,QAAQ,CAAC,oBAA4C,CAAC,CAAC;AACpG,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,8BAA8B,GAAqC;IACvE,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,KAAK;IAC3B,qBAAqB,CAAC,WAAW;IACjC,qBAAqB,CAAC,WAAW;CAClC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,6CAA6C,GAA8C;IAC/F,8BAA8B,CAAC,4BAA4B;IAC3D,8BAA8B,CAAC,gBAAgB;CAChD,CAAC;AA8BF;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAgD;IACrF,MAAM,KAAK,GAAG,QAAQ,CAAC,oBAAoB,CAAC;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,gBAAgB,GAAG,mCAAmC,CAAC,KAA6B,CAAC,CAAC;IAC5F,OAAO,OAAO,CAAC,gBAAgB,CAAC,IAAI,QAAQ,CAAC,kBAAkB,KAAK,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAC/F,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,kCAAkC,CAAC,MAIlD;IACC,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,qBAAqB,CAAC;QAAE,OAAO,KAAK,CAAC;IACxE,IAAI,CAAC,MAAM,CAAC,qBAAqB;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,CAAC,8BAA8B,CAAC,QAAQ,CAAC,MAAM,CAAC,qBAAqB,CAAC;QAAE,OAAO,KAAK,CAAC;IACzF,IAAI,6CAA6C,CAAC,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC;QAAE,OAAO,KAAK,CAAC;IAEhH,kGAAkG;IAClG,yEAAyE;IACzE,OAAO,CAAC,4CAA4C,CAAC;QACnD,MAAM,EAAE,EAAE;QACV,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;QACnD,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;KACpD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAC1C,gBAAsD;IAEtD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,QAAQ,IAAI,CAAC,gBAAgB,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,0BAAmC,CAAC,EAAE,CAAC;QAC3G,MAAM,KAAK,GAAG,QAA+E,CAAC;QAC9F,IAAI,KAAK,CAAC,mBAAmB,KAAK,oBAAoB,CAAC,aAAa;YAAE,SAAS;QAC/E,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;QACjD,IAAI,EAAE;YAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,4CAA4C,CAAyB,MAMpF;IACC,MAAM,WAAW,GAAG,sCAAsC,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;IACzF,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/B,+FAA+F;IAC/F,mFAAmF;IACnF,qGAAqG;IACrG,+FAA+F;IAC/F,gGAAgG;IAChG,mCAAmC;IACnC,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,+BAA+B,CAAC,gCAAgC;QAAE,OAAO,KAAK,CAAC;IAEhI,IAAI,CAAC,MAAM,CAAC,qBAAqB;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,CAAC,8BAA8B,CAAC,QAAQ,CAAC,MAAM,CAAC,qBAAqB,CAAC;QAAE,OAAO,KAAK,CAAC;IAEzF,IAAI,6CAA6C,CAAC,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC;QAAE,OAAO,KAAK,CAAC;IAEhH,8FAA8F;IAC9F,kGAAkG;IAClG,IAAI,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,uCAAuC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAEtG,MAAM,qBAAqB,GAAG,4BAA4B,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACpF,MAAM,SAAS,GAAI,MAAM,CAAC,MAAkC,CAAC,4BAA4B,CAAC,CAAC;IAC3F,MAAM,WAAW,GAAG,mCAAmC,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC;IAEzF,MAAM,CAAC,MAAkC,CAAC,4BAA4B,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;IAChG,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,SAAS,mCAAmC,CAAC,SAAkB,EAAE,aAAgC;IAC/F,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,CAAC,GAAG,aAAa,CAAC,CAAC;IAE7E,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IAE1C,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,OAAO,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,SAAoC,CAAC,CAAC;QACpE,MAAM,OAAO,GAAI,SAA+B,CAAC,GAAG,CAAC;QACrD,gGAAgG;QAChG,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/E,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC","sourcesContent":["/**\n * # Scope-ROOT collection confinement — ONE definition, compiled by both adapters\n *\n * assurance-control: WILDO.ACCESS.SCOPE_CONFINEMENT — confines a collection read of the tenant\n * resource itself to the tenants the caller belongs to.\n *\n * ## The hole this closes\n *\n * Every ORGANIZATIONS-scoped resource is confined by `assignInitiatorOrganizationConfinementToFilter`\n * (D3) or by the context-entry loop, both keyed on the `organizationId` COLUMN the row carries.\n * `organizations` carries no such column: it IS the tenant, addressed by `_id`. Both adapters then\n * lose the axis twice over, and independently —\n *\n *  1. `blacklistedFields` is seeded with the resource's own `resourceFieldIdentifier` \"to avoid\n *     self-reference in filtering\". For the scope root that identifier IS the scope field, so the\n *     context loop skips it and D3 returns `false` at its blacklist check;\n *  2. `OrganizationSchema` models no `organizationId` path (and PostgreSQL plans no such column), so\n *     even an admitted D3 would find nothing to write.\n *\n * Measured, not reasoned: a scope-root LIST compiled to `{}` — the empty filter, no tenant predicate\n * at all — on BOTH adapters, while a non-root org-scoped resource on the identical execution context\n * compiled to `{organizationId: 'org-caller'}`. See\n * `base-classes/__tests__/scope-root-collection-confinement.probe.test.ts`.\n *\n * Nothing leaked, because the ORGANIZATIONS branch of `validateParentScopeAccess` refused every\n * caller before the repository ran — it demands a PARENT organization scope, which the scope root\n * structurally does not have. So the gate was the SOLE control standing between an APPLICATION-role\n * caller and an unconfined cross-tenant tenant directory, and the two-line \"fix\" to that gate would\n * have been a full cross-tenant disclosure that turned every existing pin green.\n *\n * This module is therefore the half that had to land FIRST. See\n * `.claude/plans/organizations-scope-root-collection-gate-analysis.md`.\n *\n * ## Why an authority module and not two repository branches\n *\n * There are two `buildContextualFilter` implementations. The retention hide learned the cost of a\n * hand-written copy on each side (gate G-PG-NULL); D3 learned it again — it existed on PostgreSQL\n * and not on MongoDB, \"the only measured divergence where the two adapters disagreed about WHO CAN\n * SEE WHOSE ROWS\". A tenancy predicate present on one adapter and absent on the other is not a gap,\n * it is a bypass on the adapter that lacks it (`.claude/rules/invariant-call-site-enumeration.md`).\n *\n * ## Membership comes from ROLE ENTRIES, never from `initiatorIds`\n *\n * `initiatorIds.organizationId` names the ONE tenant the request is acting in, which is the wrong\n * question here: a collection read of the tenant resource asks \"which tenants are yours\", plural.\n * Role entries are also the one input a request cannot author for itself — the same reasoning\n * `holdsOrganizationWideEntryFor` and `authorizeOrganizations` rest on.\n *\n * ORGANIZATION-WIDE entries only. A unit-narrowed grant confers authority over a unit inside a\n * tenant, not over the tenant row, and every org-wide gate in the authorization service filters\n * those out; counting one here would let a unit member enumerate the tenant they are narrowed inside.\n */\n\nimport {\n  CoreResourceOperation,\n  ExecutionContext_ExecutionType,\n  PRIMARY_SCOPE_TO_CORE_RESOURCE_TYPE,\n  ResourcePrimaryScope,\n  isOrganizationWideRoleInfo,\n} from '@wildo-ai/saas-models';\n\n/** The queryable key a scope-root row is addressed by. Named once so no call site can typo it. */\nexport const SCOPE_ROOT_CONFINEMENT_FIELD = '_id';\n\n/**\n * WHY a given scope root is, or is not, row-confined.\n *\n * A named vocabulary rather than four prose comments, because \"which roots owe confinement\" is a\n * closed semantic question and had been answered four times, in four files, in four different words\n * — the shape `CLAUDE.md` asks to have one runtime source for. It also makes the answer READABLE\n * from the authority itself instead of from the resource configs it governs.\n *\n * THE RULE THAT DECIDES MEMBERSHIP, stated once so the next scope is not settled by taste:\n *\n * > **A scope root owes row confinement exactly when a caller's authority for that scope names ONE\n * > INSTANCE of it, while the collection holds every instance.**\n *\n * That is a fact about ROLE ENTRIES, and it is measurable rather than a judgement: only an\n * `ORGANIZATIONS` entry carries a `relatedResourceId` selecting a particular scope instance. An\n * `APPLICATION` entry names the deployment (there is one), and `USER_SELF` / `ANONYMOUS` have no\n * role entries at all — their instance comes from `initiatorIds`, which the request supplies about\n * ITSELF and which therefore cannot be an authority set. So on today's vocabulary exactly one root\n * owes it, and that is a derivation, not a denominator someone chose.\n */\nexport enum ScopeRootConfinementDisposition {\n  /**\n   * Confined to the tenants the caller holds an organization-WIDE role entry for. The only\n   * disposition that produces a predicate.\n   */\n  CONFINED_TO_CALLER_ORGANIZATIONS = 'CONFINED_TO_CALLER_ORGANIZATIONS',\n  /**\n   * The root's HTTP collection surface is the APPLICATION-tier administrative directory, and the\n   * caller's authority for it is application-wide — so \"all rows\" is not wider than the authority\n   * that reached them. Narrower callers reach the same rows only through a route that confines them\n   * by a DIFFERENT mechanism (`users` is enumerated per tenant through\n   * `/organizations/{organizationId}/users/search`, whose junction filter intersects `_id` with the\n   * tenant's membership; the global routes stay admin-gated).\n   *\n   * ## ⚠️ The ELEVATION asymmetry this disposition carries, stated so nobody has to re-derive it\n   *\n   * Read against the per-row door, the sentence above is the whole of the control and it is a\n   * statement about a STANDING role. Measured 2026-09-09:\n   *\n   * | | per-row crossing | this directory read |\n   * |---|---|---|\n   * | declared per variant | `admitsCrossTenantPlatformAdministration` | nothing |\n   * | elevation required | a usable, time-bound, justified `platformAccessGrants` row | none |\n   * | role tier | `APP_ADMIN_SUPER_ADMIN` | `APP_ADMIN_VIEWER` (`users`), `ORG_MEMBER` (`applications` LIST) |\n   * | evidence | `CROSS_TENANT_ADMINISTRATIVE_ACCESS`, naming the authorizing grant | `PLATFORM_DIRECTORY_ACCESS`, naming no elevation |\n   *\n   * So the NARROW act is governed and the WIDE one is not, and the wide one sits at a strictly lower\n   * role tier. That is the correct reading of the finding, and it is worse than \"not symmetric\".\n   *\n   * ## Why the grant model cannot govern it, and what that does NOT mean\n   *\n   * `hasUsablePlatformAccessGrant` needs a TARGET tenant and answers `false` on an empty one; a\n   * collection call names none. So the EXISTING mechanism is structurally inapplicable here — but\n   * that is a fact about the mechanism, not a proof that prevention is impossible, and the\n   * distinction matters because the shipped `PLATFORM_DIRECTORY_ACCESS` JSDoc states the stronger\n   * form and a reader could take it as \"do not try\".\n   *\n   * An application-wide grant KIND is buildable. What blocks it is a decision, not structure, and the\n   * decision is WHO APPROVES: a tenant grant is approved by the tenant it names (Lockbox), and an\n   * application-wide one names none — so it is either self-service (auto-approved, which is the\n   * grant model's own default posture) or two-person, which\n   * `.claude/rules/administrative-continuity-floors.md` recommends for the widest acts. Nobody may\n   * pick that unilaterally.\n   *\n   * A related choice is already RECORDED and should not be quietly reversed: a browsable platform\n   * tenant directory was considered and rejected, on the reasoning that industry practice (Customer\n   * Lockbox, Access Approval) has the tenant id arrive out of band with the customer's support\n   * ticket. That reasoning also answers the grant flow's bootstrap gap — an operator needs an\n   * `organizationId` to request a grant and no surface yields one — so reopening the elevation\n   * question means reopening that decision too.\n   *\n   * ## What was rejected on MEASUREMENT rather than on cost\n   *\n   * Confining this read to tenants the caller holds a grant for is not merely undesirable here, it\n   * is structurally unavailable for the widest case: `users` rows carry NO tenant column at all\n   * (membership lives in `organizationMembers`), so there is nothing for a tenant predicate to bind\n   * to. Any such confinement would be a junction query that also removes the tenant-less user — the\n   * person who has just signed up and belongs to nobody — from the only surface that can find them.\n   */\n  UNCONFINED_APPLICATION_TIER_DIRECTORY = 'UNCONFINED_APPLICATION_TIER_DIRECTORY',\n  /**\n   * ONE DATABASE PER APPLICATION. \"An application's organizations live in that application's own\n   * database\" — so this collection holds this deployment's own row and a caller can only ever see\n   * the application they are already using. Safe by ARCHITECTURE, not by a predicate, which is why\n   * it is spelled out: the default LIST/SEARCH variants are gated `ORG_MEMBER`, one role tier BELOW\n   * the `organizations` hole, and would be a full directory the day a second row existed.\n   *\n   * The premise is ASSERTED rather than assumed, and only a lane with a real store can assert it:\n   * `examples/wonder-todos/e2e/applications-scope-root-list-confinement.e2e.ts` fails if the\n   * deployment ever holds more than one application row. (The unit probe beside this authority\n   * asserts the complementary half — that this declaration and the compiled filter agree.)\n   */\n  UNCONFINED_SINGLE_ROW_BY_ARCHITECTURE = 'UNCONFINED_SINGLE_ROW_BY_ARCHITECTURE',\n  /**\n   * There is NOTHING to confine to. An anonymous session is a pre-authentication visitor of the\n   * application; it has no organization, so a \"confined\" listing would name a relationship that does\n   * not exist. `APP_ADMIN_SUPER_ADMIN` is the whole of the control, and it is the right one.\n   *\n   * ⚠️ If anonymous sessions ever gain a tenant association this becomes an ORGANIZATIONS-axis\n   * question and the disposition moves to {@link ScopeRootConfinementDisposition.CONFINED_TO_CALLER_ORGANIZATIONS}.\n   */\n  UNCONFINED_NO_CONFINING_RELATIONSHIP = 'UNCONFINED_NO_CONFINING_RELATIONSHIP',\n}\n\n/**\n * The disposition of every scope root, TOTAL over `ResourcePrimaryScope`.\n *\n * Total on purpose (`.claude/rules/derive-before-you-ask.md` #3): a scope added to the vocabulary\n * tomorrow is a COMPILE ERROR here, so someone has to answer the rule above for it rather than\n * inheriting silence. The predicate this replaced was `resourcePrimaryScope !== ORGANIZATIONS` with\n * a comment saying the other three \"would change four surfaces this analysis did not measure\" —\n * true when written, and by then no longer true: all four had since been measured\n * (`scope-root-collection-confinement.probe.test.ts`, the RESIDUAL sweep) and each answer recorded\n * in a different resource config. This map is where that answer now lives, once.\n */\nexport const SCOPE_ROOT_CONFINEMENT_DISPOSITIONS: Readonly<Record<ResourcePrimaryScope, ScopeRootConfinementDisposition>> = Object.freeze({\n  [ResourcePrimaryScope.ORGANIZATIONS]: ScopeRootConfinementDisposition.CONFINED_TO_CALLER_ORGANIZATIONS,\n  [ResourcePrimaryScope.USER_SELF]: ScopeRootConfinementDisposition.UNCONFINED_APPLICATION_TIER_DIRECTORY,\n  [ResourcePrimaryScope.APPLICATION]: ScopeRootConfinementDisposition.UNCONFINED_SINGLE_ROW_BY_ARCHITECTURE,\n  [ResourcePrimaryScope.ANONYMOUS]: ScopeRootConfinementDisposition.UNCONFINED_NO_CONFINING_RELATIONSHIP,\n});\n\n/**\n * The disposition governing this resource, or `undefined` when it is not a scope root at all.\n *\n * Exported so a test — or a future gate — can ask the SAME question this authority answers instead\n * of re-deriving it from the resource configs, which is how the four recorded answers came to be\n * four separate paragraphs in the first place.\n */\nexport function resolveScopeRootConfinementDisposition(\n  resource: ScopeRootCollectionConfinementResource,\n): ScopeRootConfinementDisposition | undefined {\n  if (!isOwnScopeRootResource(resource)) return undefined;\n  return SCOPE_ROOT_CONFINEMENT_DISPOSITIONS[resource.resourcePrimaryScope as ResourcePrimaryScope];\n}\n\n/**\n * The operations this confinement governs: those that resolve a SET of rows with no per-row\n * authorization behind them.\n *\n * Per-INSTANCE operations are deliberately absent, and this is a decision rather than an oversight.\n * `authorizeOrganizations` fetches the row and compares its tenant against the caller's org-wide\n * role entries, refusing a non-member — that gate was hardened on 2026-08-05 and is measured healthy\n * (a per-instance READ answers 200 for a member while every collection call answers 403). Adding a\n * row filter underneath it would buy no isolation and would actively BREAK the declared cross-tenant\n * repair doors (`restore`, `activate`, `requestDeletion: admin`), every one of which is per-instance\n * — silently filtering an operation authorization deliberately admitted, which is the precise\n * failure `.claude/rules/administrative-continuity-floors.md` warns about and which D3's own\n * crossing-awareness exists to prevent.\n *\n * The write-family bulk verbs ARE included. `organizations` declares none today, so including them\n * is free; excluding them would leave a set-shaped write on the tenant resource unconfined the day\n * one is declared, which is exactly how a scope-root hole comes back.\n */\nconst SCOPE_ROOT_CONFINED_OPERATIONS: readonly CoreResourceOperation[] = [\n  CoreResourceOperation.LIST,\n  CoreResourceOperation.SEARCH,\n  CoreResourceOperation.COUNT,\n  CoreResourceOperation.UPDATE_MANY,\n  CoreResourceOperation.DELETE_MANY,\n];\n\n/**\n * Execution types that carry no membership by construction and must not be confined.\n *\n * Mirrors {@link ORGANIZATION_UNIT_NARROWING_EXEMPT_EXECUTION_TYPES} and is exempt for the same\n * reason: `INTERNALLY_INITIATED_REQUEST` is the framework's context-free system actor (batch, cron,\n * cascade, bootstrap) and `WEBHOOK_CALLBACK` is trusted after signature verification. Neither holds\n * role entries, so confining them would not fail closed — it would empty every tenant sweep, purge\n * and cascade, presenting a broken system as \"no rows\".\n *\n * ⚠️ Every OTHER execution type — user, machine, anonymous, consumable-token, public — is confined,\n * and a principal with no org-wide entry is confined to the EMPTY set rather than exempted. Adding a\n * member here removes a tenant-isolation check.\n */\nconst SCOPE_ROOT_CONFINEMENT_EXEMPT_EXECUTION_TYPES: readonly ExecutionContext_ExecutionType[] = [\n  ExecutionContext_ExecutionType.INTERNALLY_INITIATED_REQUEST,\n  ExecutionContext_ExecutionType.WEBHOOK_CALLBACK,\n];\n\n/** What this authority needs from the execution context. Deliberately narrow, like its siblings. */\nexport interface ScopeRootCollectionConfinementSignal {\n  readonly executionType: ExecutionContext_ExecutionType;\n  readonly initiatorRoles?: readonly {\n    readonly relatedPrimaryScope?: string;\n    readonly relatedResourceId?: string | null;\n    readonly roles?: readonly string[];\n    /**\n     * Present ⇒ the entry is a UNIT grant, not tenant membership. Declared here rather than left\n     * implicit because omitting it is how a test fixture builds an entry that LOOKS unit-scoped and\n     * is silently treated as organization-wide — which is how the first draft of this module's own\n     * pin passed for the wrong reason.\n     */\n    readonly organizationUnitId?: string;\n  }[] | null;\n  /**\n   * Only the crossing declaration is read. An operation that did NOT declare one is confined, which\n   * is what keeps the opt-in enumerable rather than a privilege-based bypass.\n   */\n  readonly operation?: { readonly admitsCrossTenantPlatformAdministration?: boolean } | null;\n}\n\n/** What this authority needs from the resource configuration. */\nexport interface ScopeRootCollectionConfinementResource {\n  readonly resourceIdentifier?: string;\n  readonly resourcePrimaryScope?: string;\n}\n\n/**\n * Is this resource the ROOT of its own primary scope — the tenant row itself rather than a row\n * inside a tenant?\n *\n * Structural (`resourceIdentifier === PRIMARY_SCOPE_TO_CORE_RESOURCE_TYPE[scope]`) rather than a\n * comparison against `CoreResourceType.ORGANIZATIONS`, so a future tenant scope is covered the day\n * it is declared.\n *\n * **Exported because the authorization GATE asks the same question**, and the gate's answer and the\n * filter's answer must be the SAME answer. A gate that opens for a scope root the filter does not\n * recognise is precisely the disclosure this whole module exists to prevent, and two look-alike\n * derivations of one predicate is how that happens (`.claude/rules/invariant-call-site-enumeration.md`).\n */\nexport function isOwnScopeRootResource(resource: ScopeRootCollectionConfinementResource): boolean {\n  const scope = resource.resourcePrimaryScope;\n  if (!scope) return false;\n  const rootResourceType = PRIMARY_SCOPE_TO_CORE_RESOURCE_TYPE[scope as ResourcePrimaryScope];\n  return Boolean(rootResourceType) && resource.resourceIdentifier === String(rootResourceType);\n}\n\n/**\n * Is this collection read an APPLICATION-WIDE directory enumeration — a scope-root collection whose\n * rows are NOT confined to any one tenant?\n *\n * This is the audit trigger's question, and it is deliberately the exact complement of the\n * confinement decision above rather than a second, similar-looking rule. A resource is a directory\n * precisely when it is its own scope root AND this authority declines to confine it: today that is\n * `users`, `applications` and `anonymousUsers` (non-tenant scope roots), and it would become false\n * for any of them the moment the confinement is widened to their axis. Deriving the two answers from\n * one predicate is what stops the trail claiming \"unconfined\" about a read that has since been\n * confined.\n *\n * An exempt execution type is NOT a directory read for audit purposes: a batch or webhook has no\n * operator to attribute, and recording framework machinery as operator browsing would bury the\n * signal the event exists to carry.\n */\nexport function isUnconfinedScopeRootDirectoryRead(params: {\n  readonly executionContext: ScopeRootCollectionConfinementSignal;\n  readonly resourceConfiguration: ScopeRootCollectionConfinementResource;\n  readonly executedCoreOperation: CoreResourceOperation | undefined;\n}): boolean {\n  if (!isOwnScopeRootResource(params.resourceConfiguration)) return false;\n  if (!params.executedCoreOperation) return false;\n  if (!SCOPE_ROOT_CONFINED_OPERATIONS.includes(params.executedCoreOperation)) return false;\n  if (SCOPE_ROOT_CONFINEMENT_EXEMPT_EXECUTION_TYPES.includes(params.executionContext.executionType)) return false;\n\n  // Confined ⇒ not a directory. Asked of a throwaway filter so the question can be answered without\n  // a caller having to own one, and so the two answers can never disagree.\n  return !assignScopeRootCollectionConfinementToFilter({\n    filter: {},\n    executionContext: params.executionContext,\n    resourceConfiguration: params.resourceConfiguration,\n    executedCoreOperation: params.executedCoreOperation,\n  });\n}\n\n/**\n * The tenant ids the caller holds an organization-WIDE role entry for.\n *\n * Exported so the authorization gate can report the same set it is about to confine to, rather than\n * re-deriving it — two derivations of one membership set is how a gate and a filter start\n * disagreeing about who is a member.\n */\nexport function resolveCallerOrganizationIds(\n  executionContext: ScopeRootCollectionConfinementSignal,\n): string[] {\n  const ids = new Set<string>();\n  for (const roleInfo of (executionContext.initiatorRoles ?? []).filter(isOrganizationWideRoleInfo as never)) {\n    const entry = roleInfo as { relatedPrimaryScope?: string; relatedResourceId?: string | null };\n    if (entry.relatedPrimaryScope !== ResourcePrimaryScope.ORGANIZATIONS) continue;\n    const id = String(entry.relatedResourceId ?? '');\n    if (id) ids.add(id);\n  }\n  return [...ids];\n}\n\n/**\n * Confine `filter` to the caller's own tenants, in place. Returns whether it was applied.\n *\n * ## Composition with a caller-supplied `_id`\n *\n * The sibling authorities OVERWRITE at the top level, because for them a caller-supplied value for\n * the confined field is an attempt to widen and must be neutralised. Here the same reasoning gives a\n * different mechanic: `_id` is also how a legitimate request NARROWS, so an overwrite would silently\n * discard a caller's own filter and hand back MORE rows than they asked for.\n *\n * So this INTERSECTS — never skips. The result is always a subset of both the caller's request and\n * the caller's membership, so it cannot be widened by anything a caller sends. A shape the\n * intersection cannot interpret (a `$ne`, a regex, an operator object) resolves to the EMPTY set\n * rather than being passed through: an uninterpretable narrowing is not a licence to drop the\n * confinement.\n *\n * A \"skip if the caller already set `_id`\" guard would be the fail-OPEN version of this. Do not\n * add one.\n *\n * `$in: []` is the portable match-nothing: MongoDB matches nothing, and the PostgreSQL compiler\n * emits `FALSE` rather than the `IN ()` syntax error a naive translation would produce (gate\n * G-PG-NULL). One emitter covers the confined case and the deny-all case on both adapters.\n */\nexport function assignScopeRootCollectionConfinementToFilter<TFilter extends object>(params: {\n  readonly filter: TFilter;\n  readonly executionContext: ScopeRootCollectionConfinementSignal;\n  readonly resourceConfiguration: ScopeRootCollectionConfinementResource;\n  /** The core operation THIS repository call executes — NOT `executionContext.operation`. */\n  readonly executedCoreOperation: CoreResourceOperation | undefined;\n}): boolean {\n  const disposition = resolveScopeRootConfinementDisposition(params.resourceConfiguration);\n  if (!disposition) return false;\n  // Which roots owe a predicate is DECLARED, total over the scope vocabulary, with the rule that\n  // decides membership stated on the enum. An unrecognised scope cannot reach here —\n  // `isOwnScopeRootResource` already refuses a scope absent from `PRIMARY_SCOPE_TO_CORE_RESOURCE_TYPE`\n  // — but were the two maps ever to disagree, `undefined` falls through this check and CONFINES,\n  // which yields the caller's organization ids as `_id`s of some other resource: no rows, loudly,\n  // rather than every row, silently.\n  if (disposition !== undefined && disposition !== ScopeRootConfinementDisposition.CONFINED_TO_CALLER_ORGANIZATIONS) return false;\n\n  if (!params.executedCoreOperation) return false;\n  if (!SCOPE_ROOT_CONFINED_OPERATIONS.includes(params.executedCoreOperation)) return false;\n\n  if (SCOPE_ROOT_CONFINEMENT_EXEMPT_EXECUTION_TYPES.includes(params.executionContext.executionType)) return false;\n\n  // A DECLARED crossing was admitted at the authorization layer, deliberately and with an audit\n  // record. Re-confining it here would undo that decision one layer down — D3's documented failure.\n  if (params.executionContext.operation?.admitsCrossTenantPlatformAdministration === true) return false;\n\n  const callerOrganizationIds = resolveCallerOrganizationIds(params.executionContext);\n  const requested = (params.filter as Record<string, unknown>)[SCOPE_ROOT_CONFINEMENT_FIELD];\n  const confinedIds = intersectRequestedIdsWithMembership(requested, callerOrganizationIds);\n\n  (params.filter as Record<string, unknown>)[SCOPE_ROOT_CONFINEMENT_FIELD] = { $in: confinedIds };\n  return true;\n}\n\n/**\n * Intersect whatever the caller asked for with what they are a member of.\n *\n * Fail-closed on every shape that is not plainly an id or a set of ids: an operator object could\n * express a superset (`$ne`, `$nin`, a regex), and there is no honest intersection with a predicate\n * whose extension is unknown here.\n */\nfunction intersectRequestedIdsWithMembership(requested: unknown, membershipIds: readonly string[]): string[] {\n  if (requested === undefined || requested === null) return [...membershipIds];\n\n  const membership = new Set(membershipIds);\n\n  if (typeof requested === 'string') {\n    return membership.has(requested) ? [requested] : [];\n  }\n\n  if (Array.isArray(requested)) {\n    return requested.map(String).filter((id) => membership.has(id));\n  }\n\n  if (typeof requested === 'object') {\n    const operators = Object.keys(requested as Record<string, unknown>);\n    const inValue = (requested as { $in?: unknown }).$in;\n    // ONLY a lone `$in`. A mixed operator object ({$in, $ne}) has an extension this cannot compute.\n    if (operators.length === 1 && operators[0] === '$in' && Array.isArray(inValue)) {\n      return inValue.map(String).filter((id) => membership.has(id));\n    }\n    return [];\n  }\n\n  return [];\n}\n"]}

package/dist/esm/security/authorizations/services/authorizations.backend.service.d.ts

@@ -40,8 +40,16 @@ export declare class AuthorizationsBackendService {
      *
      * Emission is deliberately BEST-EFFORT and can never alter the authorization outcome: the caller
      * has already been refused by the time this is consulted, so letting an audit-store problem turn
-     * a correct 403 into a 500 would degrade the system to protect a log. Detection of that gap is
-     * the audit pipeline's own control (`audit_store_failure_total`), not this gate's.
+     * a correct 403 into a 500 would degrade the system to protect a log.
+     *
+     * Detection of the resulting gap is SPLIT, and an earlier revision of this paragraph got it
+     * wrong by naming only half. It said detection was "the audit pipeline's own control
+     * (`audit_store_failure_total`), not this gate's" — true of a store that REFUSED a write it
+     * received, and false of the case this gate actually produces most often, where the audit
+     * service is unbound and `_createAuditLog` is never reached at all. This gate now counts its own
+     * drops into `audit_observation_dropped_total` through
+     * `~wildo-backend-lib/monitoring/observability/audit-observation-emission.backend`; the store's
+     * control is unchanged and still owns the shape it can see.
      *
      * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT
      */
@@ -79,8 +87,16 @@ export declare class AuthorizationsBackendService {
      *
      * Emission is deliberately BEST-EFFORT and can never alter the authorization outcome: the caller
      * has already been refused by the time this is consulted, so letting an audit-store problem turn
-     * a correct 403 into a 500 would degrade the system to protect a log. Detection of that gap is
-     * the audit pipeline's own control (`audit_store_failure_total`), not this gate's.
+     * a correct 403 into a 500 would degrade the system to protect a log.
+     *
+     * Detection of the resulting gap is SPLIT, and an earlier revision of this paragraph got it
+     * wrong by naming only half. It said detection was "the audit pipeline's own control
+     * (`audit_store_failure_total`), not this gate's" — true of a store that REFUSED a write it
+     * received, and false of the case this gate actually produces most often, where the audit
+     * service is unbound and `_createAuditLog` is never reached at all. This gate now counts its own
+     * drops into `audit_observation_dropped_total` through
+     * `~wildo-backend-lib/monitoring/observability/audit-observation-emission.backend`; the store's
+     * control is unchanged and still owns the shape it can see.
      *
      * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT
      */
@@ -211,6 +227,13 @@ export declare class AuthorizationsBackendService {
      *
      * Read from the OPERATION rather than inferred from the context, so the public carve-out above
      * cannot be satisfied by the caller's side of the request alone.
+     *
+     * Delegates to {@link requiredRolesDeclarePublicAccess}, the ONE named source for what
+     * `APP_PUBLIC` means. This used to be a private re-derivation of the same two-line test, and it
+     * was one of FOUR such copies (this one, the authentication tier's `operationAdmitsPublicAccess`,
+     * and the two role gates that did not have one and therefore refused credentialed callers). A
+     * policy expressed as a module-private constant reaches exactly the sites that already agree with
+     * it — see `.claude/rules/invariant-call-site-enumeration.md` #13.
      */
     private operationDeclaresPublicAccess;
     authorizeInRepositoryAndService(id_or_ids: IdOrIdsOrFilterType, operation: ResourceConfiguration_Operation<any, any, any>, executionContext: ExecutionContext<any>): Promise<void>;
@@ -233,7 +256,7 @@ export declare class AuthorizationsBackendService {
      * `USERS` is a self-anchor scope root, so its `resourcePrimaryScope` IS `USER_SELF` and every
      * USERS operation lands here. Without an admission this check made the whole administrative
      * surface self-only: `assign_roles`, `revoke_roles`, `suspend_user`, `unsuspend_user`,
-     * `force_password_reset`, the admin READ and the core UPDATE/DELETE all refused against another
+     * `reactivate_user`, `force_password_reset`, the admin READ and the core UPDATE/DELETE all refused against another
      * user, contradicting both the resource specification and the admin UI that surfaces them as
      * per-row actions.
      *
@@ -353,9 +376,30 @@ export declare class AuthorizationsBackendService {
      *
      * Fire-and-forget by construction: no `await`, and the promise's rejection is swallowed. An
      * operator's request must not fail because the audit sink is down, and a fail-closed variant would
-     * hand anyone a way to disable operator support by breaking the sink.
+     * hand anyone a way to disable operator support by breaking the sink. That contract is unchanged
+     * and must stay unchanged.
+     *
+     * ## The loss is COUNTED — added 2026-09-09
+     *
+     * Fire-and-forget was the right trade and it was shipped without the other half: nothing recorded
+     * the drops, so an empty operator-crossing trail read identically whether no operator crossed a
+     * boundary or the audit service had been unbound since boot. That is the property that makes the
+     * evidence worthless, and it is the shape
+     * `.claude/rules/negative-results-require-a-positive-probe.md` names — an empty result is evidence
+     * about the pipeline, never about the world.
+     *
+     * Every emission now goes through {@link emitAuditObservation}, which counts an unavailable
+     * service, a synchronous throw and a rejected promise into `audit_observation_dropped_total` and
+     * logs one throttled `error` line per loss shape. It never throws and never awaits, so the
+     * contract above is preserved exactly — read that seam's header before changing anything here.
+     *
+     * **Do not restore the "`audit_store_failure_total` covers this" reading.** It does not, and that
+     * claim was carried at three sites in this package: that counter lives INSIDE
+     * `AuditLogsBackendService._createAuditLog`, so it only ever sees an emission that reached the
+     * audit service. The three shapes counted here never get that far.
      *
      * assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION
+     * assurance-control: WILDO.AUDIT.SECURITY_EVENT — the loss of this evidence is itself detectable.
      */
     private recordCrossTenantAdministrativeAccess;
     /**
@@ -394,8 +438,46 @@ export declare class AuthorizationsBackendService {
      */
     private buildTenantBoundaryNotFound;
     private authorizeOrganizations;
+    /**
+     * Does this resource DERIVE tenant-anchorless rows rather than store rows under the application?
+     *
+     * An INTROSPECTION resource declaring {@link IntrospectionTenancyStance.APPLICATION_STRUCTURE} or
+     * {@link IntrospectionTenancyStance.APPLICATION_RUNTIME} has no per-row application anchor, and
+     * that is its contract rather than an omission: its rows are DERIVED per read (from a companion
+     * behavior over the application's source, or from the companion's own runtime services), there is
+     * no store to hold a foreign key, and both stances say outright that there is no tenant dimension
+     * for a scope predicate to filter on. What separates the two stances is the READ POSTURE
+     * (structure may be `APP_PUBLIC`; runtime must be role-gated), which is the operation variants'
+     * job and ran before this method — not the anchor question answered here.
+     *
+     * Fails CLOSED in both directions that matter. With no registry bound the answer is `false`, so
+     * the anchor check below still runs; and the stance must be one of the two enumerated anchorless
+     * members, so an introspection resource that projects anything else — including a future scoped
+     * stance — keeps the check.
+     */
+    private projectsAnchorlessIntrospection;
     /**
      * Authorize APPLICATION scope
+     *
+     * ## What the per-row anchor check does, and what it cannot do
+     *
+     * The application is a SINGLETON per database — `ExecutionContextCreator.getApplicationId()` reads
+     * the APPLICATION row with an empty filter, on the stated grounds that "there is one APPLICATION
+     * row, so nothing can usefully narrow this read". So `appIdFromResource !== applicationId` cannot
+     * discriminate between applications within a database: both sides resolve to the same row. It is a
+     * consistency assertion about correctly-populated rows, not a cross-application isolation control.
+     *
+     * The `!appIdFromResource` branch is the one with teeth, and for a STORED resource it is right —
+     * every `APPLICATION`-anchored resource in the engine declares
+     * `parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION]`, so its
+     * rows carry the FK and a row without one is malformed.
+     *
+     * A projection cannot satisfy it at all, which is why the stance is consulted first. Measured
+     * before the carve-out existed: an addressed READ on `workbenchApplicationModules` answered 200 to
+     * an anonymous caller (the public-execution path returns before this method) and 403 to an
+     * authenticated one, while LIST answered 200 to both (collection operations run no row check). The
+     * resource could not be fixed from the application side without inventing a field its schema does
+     * not declare.
      */
     private authorizeApplication;
     /**
@@ -413,6 +495,21 @@ export declare class AuthorizationsBackendService {
      * for why this cannot be a constructor injection.
      */
     private resolveAuditLogsService;
+    /**
+     * Lazy getter for the metrics recorder behind {@link emitAuditObservation}'s loss counter.
+     *
+     * Resolved from the container rather than constructor-injected for the SAME reason the audit
+     * service is (see the `container` param's JSDoc) — but a weaker one: `MetricsService` has a
+     * zero-argument constructor and closes no dependency cycle. What the lazy form actually buys is
+     * that every partial-container test and every positional construction keeps working unchanged,
+     * which is the property this class's whole optional-dependency tail is built around.
+     *
+     * Wrapped, because this runs on the observation path: a container that throws while resolving a
+     * binding must not be able to fail the request the observation is about. Returning `undefined`
+     * degrades the loss signal to its log channel, which is the correct direction — an observability
+     * gap is never a reason to refuse.
+     */
+    private resolveMetricsService;
     /**
      * Record a refusal as a `RESOURCE_OPERATION_DENIED` audit event.
      *
@@ -442,11 +539,25 @@ export declare class AuthorizationsBackendService {
      * ## Never affects the outcome
      *
      * Every path here is swallowed. The caller has already been correctly refused; an audit-store
-     * problem must not convert that clean refusal into a 500. Detection of a lost row is the audit
-     * pipeline's own control (`audit_store_failure_total`), not this gate's.
+     * problem must not convert that clean refusal into a 500. That stays true.
+     *
+     * ## But the swallow is now COUNTED — corrected 2026-09-09
+     *
+     * This paragraph used to end "detection of a lost row is the audit pipeline's own control
+     * (`audit_store_failure_total`), not this gate's", and that was **false for the shape this method
+     * loses most often**. That counter lives inside `AuditLogsBackendService._createAuditLog`, so it
+     * only ever sees an emission that reached the audit service. When the service is unbound — a
+     * partial DI binding, a host binding an older audit service — this method returned in silence and
+     * NOTHING anywhere recorded that every refusal in the deployment was going unaudited.
+     *
+     * Both exits now report into `audit_observation_dropped_total` via `recordAuditObservationLoss`.
+     * Three paths deliberately do NOT: an absent `operation` (nothing was owed), the `AUDIT_LOGS`
+     * recursion guard, and a dedup decision of `shouldEmit: false`. Each is a suppression the design
+     * asked for, and a loss counter that fires on correct behaviour is one operators learn to ignore.
      *
      * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — the negative access decision is
      * recorded, attributable, and carries the authority context needed to review it.
+     * assurance-control: WILDO.AUDIT.SECURITY_EVENT — and its LOSS is detectable rather than silent.
      */
     private emitAuthorizationDenialAudit;
     /**
@@ -471,6 +582,29 @@ export declare class AuthorizationsBackendService {
      * - id_or_ids must be a valid string or array
      * - Authorization additionally verifies access to the specific resource(s)
      */
+    /**
+     * Authorize an operation on ROLES ALONE, with no row to fetch.
+     *
+     * ## Why this exists, and why it is deliberately narrow
+     *
+     * Every other entry point here authorizes an operation against ROWS — it pre-fetches them, checks
+     * scope, checks FK reachability, then checks roles. That is right whenever there is a row.
+     *
+     * A WebSocket SCOPE subscription has none. It says "tell me when anything of this type changes
+     * under this scope", which addresses no instance, so the row-shaped questions have no subject and
+     * only the role question remains. Passing a scope id in the row's place is the trap this avoids:
+     * it would authorize a READ of a row of the subscribed type whose id happens to be an application
+     * id, which is not a question anyone asked and which fails for the wrong reason.
+     *
+     * **This is strictly WEAKER than `authorizeInController` and must never be substituted for it on a
+     * path that has an id.** It answers "may this principal invoke this operation at all", not "may
+     * this principal reach this row". Its only caller is the scope-subscription gate, where the
+     * notification it admits carries row identities the caller could have listed anyway.
+     *
+     * Unit narrowing still applies: `resourceIdentifier` is forwarded, so a unit-scoped grant can
+     * rescue a failing role check exactly as it does everywhere else.
+     */
+    authorizeOperationRolesOnly(operation: ResourceConfiguration_Operation<any, any, any>, executionContext: ExecutionContext<any>): Promise<void>;
     authorizeInController(id_or_ids: string | string[] | undefined, executionContext: ExecutionContext<any>): Promise<void>;
     /**
      * Authorize a NON-CONTROLLER surface that will itself perform row-scoped reads.
@@ -576,11 +710,24 @@ export declare class AuthorizationsBackendService {
      * This prevents users from accessing resources assigned to or created by other users
      * by manipulating the URL path.
      *
-     * Authorization behavior by execution type:
-     * - USER_REQUEST: Must match the authenticated user's ID
-     * - API_KEY: Allowed - API keys have broader access within their scope
-     * - INTERNAL: Allowed - internal operations bypass FK validation
-     * - PUBLIC: Allowed - public operations don't have identity context
+     * The gate is on IDENTITY, not on execution type (issue #321). A context is admitted on a user-FK
+     * path when it carries a `userId` AND that id equals the one in the path — whatever established the
+     * identity. Two execution types carry a `userId`:
+     * - USER_REQUEST — the session's own user;
+     * - CONSUMABLE_TOKEN — the `userId` the token was MINTED for (`createExecutionContextFromRequest`
+     *   copies `consumableTokenObject.userId` onto `initiatorIds`). It is server-minted, so a bearer can
+     *   only act as that subject on that path — the same trust a session confers.
+     * Machine principals, INTERNAL, PUBLIC, WEBHOOK and ANONYMOUS_SESSION never reach the gate: the
+     * early return below skips FK matching for them entirely (machine principals have broader access
+     * within their scope; the others carry no person to match). So the identity gate is evaluated for
+     * exactly two execution types — USER_REQUEST and CONSUMABLE_TOKEN — and a context of either kind
+     * WITHOUT a `userId` is refused: a user-FK path names a person, and a caller with no person cannot
+     * be that person.
+     *
+     * History: after the early return, this used to refuse every non-USER_REQUEST type — which, given
+     * that return, meant exactly CONSUMABLE_TOKEN — on the stated premise that "only USER_REQUEST has a
+     * userId". The premise was false when written (the token bridge already set it); the effect was
+     * that no token could act on a user-FK path even for the very user it was minted for.
      */
     private validateFKRelationshipAccess;
     /**
@@ -597,7 +744,21 @@ export declare class AuthorizationsBackendService {
      * Validate that user's roles satisfy the required operation roles
      * Considers role hierarchy within the given scope
      *
-     * @returns true if user has at least one of the required roles
+     * The SECOND role gate in this class, and the reason the `APP_PUBLIC` admission below is repeated
+     * rather than inherited: an ORGANIZATIONS-scoped operation resolves its roles HERE, inside
+     * `validateParentScopeAccess`, and never reaches {@link validateOperationRoles} —
+     * `authorizeCollectionOperation` skips that call for ORGANIZATIONS scope precisely because this
+     * branch has already answered the question. A public declaration honoured at only one of the two
+     * would mean `APP_PUBLIC` worked on APPLICATION-scoped resources and refused on organization-scoped
+     * ones, which is the same defect one scope over.
+     *
+     * The caller has ALREADY proven tenancy by the time this runs — the ORGANIZATIONS branch resolves
+     * an `orgRoleInfo` for this specific organization, and the scope-root branch confines the read
+     * separately — so admitting on a public declaration here grants the right to ASK, never a wider
+     * set of rows.
+     *
+     * @returns true if user has at least one of the required roles, or the operation declares public
+     *   access (in which case it requires none)
      */
     private validateRolesForScope;
 }

package/dist/esm/security/authorizations/services/authorizations.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorizations.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authorizations/services/authorizations.backend.service.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAEhI,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,mBAAmB,EAAE,MAAM,qEAAqE,CAAC;AAC1G,OAAO,EACL,+BAA+B,EAM/B,oBAAoB,EAMpB,kBAAkB,EAClB,cAAc,EAGd,KAAK,EACL,QAAQ,EACR,QAAQ,EAKT,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACxF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAG3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAGvG,qBACa,4BAA4B;IAUF,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IACd,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IACpG;;;;;;OAMG;IAC6D,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IACnG;;;;OAIG;IACkD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IACnF;;;;;;;;;;;;;;;;;;;OAmBG;IAC8B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IA5C9D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;IAGxF,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,QAAQ,CAAqB;gBAGiB,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EACzB,oBAAoB,EAAE,yCAAyC;IAC/I;;;;;;OAMG;IAC8E,iBAAiB,CAAC,EAAE,+BAA+B;IACpI;;;;OAIG;IACmE,YAAY,CAAC,EAAE,YAAY;IACjG;;;;;;;;;;;;;;;;;;;OAmBG;IAC+C,SAAS,CAAC,EAAE,SAAS;IAUzE;;OAEG;IACH,OAAO,CAAC,eAAe;IAavB;;OAEG;IACI,yBAAyB,CAAC,WAAW,EAAE,kBAAkB,GAAG,IAAI;IAIvE;;OAEG;IACH,OAAO,CAAC,cAAc;IA4Cf,sBAAsB,CAAC,WAAW,EAAE,kBAAkB,GAAG,IAAI;IAI7D,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,cAAc,GAAG,IAAI;IAanE,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,cAAc,GAAG,IAAI;IAanE,UAAU,CAAC,OAAO,EAAE,QAAQ,GAAG,cAAc,GAAG,SAAS;IAIzD,UAAU,CAAC,OAAO,EAAE,QAAQ,GAAG,cAAc,GAAG,SAAS;IAIzD,WAAW,IAAI,kBAAkB;IAIjC,WAAW,IAAI,kBAAkB;IAIjC,UAAU,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO;IAItC,UAAU,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO;IAItC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,GAAG,MAAM,EAAE;IAavE,oBAAoB,IAAI,IAAI;IAKnC;;OAEG;IACI,8BAA8B,CAAC,WAAW,EAAE,kBAAkB,GAAG,IAAI;IAK5E;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH;;;;;;;;;;;;;;;;;OAiBG;IACU,0CAA0C,CACrD,SAAS,EAAE,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EACzD,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC;YAIF,wCAAwC;IAiEtD;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH;;;;;;;;;;;;;;;;;OAiBG;YACW,iCAAiC;YAkBjC,2BAA2B;IA+BzC;;;;;;;OAOG;IACH,OAAO,CAAC,2BAA2B;IAKnC;;;;;OAKG;IACH,OAAO,CAAC,6BAA6B;IAKxB,+BAA+B,CAAC,SAAS,EAAG,mBAAmB,EAAE,SAAS,EAAE,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAsThM;;;;OAIG;IACH,OAAO,CAAC,qBAAqB;IAU7B;;OAEG;YACW,gCAAgC;IAyC9C;;;;;;;;;;;;;;;;;;;;;;;OAuBG;YACW,iBAAiB;IA6D/B;;OAEG;IACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8CG;YACW,uCAAuC;IAgDrD;;;;;;;;;OASG;IACH;;;;;;;OAOG;YACW,iCAAiC;YASjC,4BAA4B;IA4C1C;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,6BAA6B;IAOrC,gGAAgG;IAChG,OAAO,CAAC,wBAAwB;IAMhC;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,OAAO,CAAC,qCAAqC;IA8C7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,OAAO,CAAC,2BAA2B;YAarB,sBAAsB;IA8FpC;;OAEG;YACW,oBAAoB;IAgDlC;;;;OAIG;YACW,kBAAkB;IAchC;;OAEG;YACW,sBAAsB;IAkEpC;;;OAGG;IACH,OAAO,CAAC,uBAAuB;IAK/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;YACW,4BAA4B;IA+E1C;;;;;;OAMG;YACW,qBAAqB;IAkBnC;;;;;;;;;;;;;OAaG;IACU,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAyCpI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgFG;IACU,8BAA8B,CACzC,SAAS,EAAE,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EACzD,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC;IAWhB;;;;;;;;;OASG;YACW,4BAA4B;IAmE1C;;;;;;;;;;;;;;;;OAgBG;YACW,4BAA4B;IAuF1C;;;;;;;;OAQG;YACW,yBAAyB;IAoPvC;;;;;OAKG;IACH,OAAO,CAAC,qBAAqB;CAY9B"}
+{"version":3,"file":"authorizations.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authorizations/services/authorizations.backend.service.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAEhI,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,mBAAmB,EAAE,MAAM,qEAAqE,CAAC;AAC1G,OAAO,EACL,+BAA+B,EAQ/B,oBAAoB,EAMpB,kBAAkB,EAClB,cAAc,EAGd,KAAK,EACL,QAAQ,EACR,QAAQ,EAKT,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACxF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAU3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAGvG,qBACa,4BAA4B;IAUF,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IACd,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IACpG;;;;;;OAMG;IAC6D,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IACnG;;;;OAIG;IACkD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IACnF;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IAC8B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IApD9D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;IAGxF,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,QAAQ,CAAqB;gBAGiB,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EACzB,oBAAoB,EAAE,yCAAyC;IAC/I;;;;;;OAMG;IAC8E,iBAAiB,CAAC,EAAE,+BAA+B;IACpI;;;;OAIG;IACmE,YAAY,CAAC,EAAE,YAAY;IACjG;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IAC+C,SAAS,CAAC,EAAE,SAAS;IAUzE;;OAEG;IACH,OAAO,CAAC,eAAe;IAavB;;OAEG;IACI,yBAAyB,CAAC,WAAW,EAAE,kBAAkB,GAAG,IAAI;IAIvE;;OAEG;IACH,OAAO,CAAC,cAAc;IAuDf,sBAAsB,CAAC,WAAW,EAAE,kBAAkB,GAAG,IAAI;IAI7D,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,cAAc,GAAG,IAAI;IAanE,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,cAAc,GAAG,IAAI;IAanE,UAAU,CAAC,OAAO,EAAE,QAAQ,GAAG,cAAc,GAAG,SAAS;IAIzD,UAAU,CAAC,OAAO,EAAE,QAAQ,GAAG,cAAc,GAAG,SAAS;IAIzD,WAAW,IAAI,kBAAkB;IAIjC,WAAW,IAAI,kBAAkB;IAIjC,UAAU,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO;IAItC,UAAU,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO;IAItC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,GAAG,MAAM,EAAE;IAavE,oBAAoB,IAAI,IAAI;IAKnC;;OAEG;IACI,8BAA8B,CAAC,WAAW,EAAE,kBAAkB,GAAG,IAAI;IAK5E;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH;;;;;;;;;;;;;;;;;OAiBG;IACU,0CAA0C,CACrD,SAAS,EAAE,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EACzD,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC;YAIF,wCAAwC;IAiEtD;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH;;;;;;;;;;;;;;;;;OAiBG;YACW,iCAAiC;YAkBjC,2BAA2B;IA+BzC;;;;;;;OAOG;IACH,OAAO,CAAC,2BAA2B;IAKnC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,6BAA6B;IAIxB,+BAA+B,CAAC,SAAS,EAAG,mBAAmB,EAAE,SAAS,EAAE,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IA4WhM;;;;OAIG;IACH,OAAO,CAAC,qBAAqB;IAU7B;;OAEG;YACW,gCAAgC;IAyC9C;;;;;;;;;;;;;;;;;;;;;;;OAuBG;YACW,iBAAiB;IA6D/B;;OAEG;IACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8CG;YACW,uCAAuC;IAgDrD;;;;;;;;;OASG;IACH;;;;;;;OAOG;YACW,iCAAiC;YASjC,4BAA4B;IA4C1C;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,6BAA6B;IAOrC,gGAAgG;IAChG,OAAO,CAAC,wBAAwB;IAMhC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0CG;IACH,OAAO,CAAC,qCAAqC;IA8D7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,OAAO,CAAC,2BAA2B;YAarB,sBAAsB;IA8FpC;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,+BAA+B;IAQvC;;;;;;;;;;;;;;;;;;;;;;OAsBG;YACW,oBAAoB;IAoFlC;;;;OAIG;YACW,kBAAkB;IAchC;;OAEG;YACW,sBAAsB;IA0FpC;;;OAGG;IACH,OAAO,CAAC,uBAAuB;IAK/B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,qBAAqB;IAS7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgDG;YACW,4BAA4B;IAgI1C;;;;;;OAMG;YACW,qBAAqB;IAkBnC;;;;;;;;;;;;;OAaG;IACH;;;;;;;;;;;;;;;;;;;;;OAqBG;IACU,2BAA2B,CACtC,SAAS,EAAE,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EACzD,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC;IAKH,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAyCpI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgFG;IACU,8BAA8B,CACzC,SAAS,EAAE,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EACzD,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC;IAWhB;;;;;;;;;OASG;YACW,4BAA4B;IAmE1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;YACW,4BAA4B;IA0E1C;;;;;;;;OAQG;YACW,yBAAyB;IAoPvC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,qBAAqB;CAc9B"}