@wildo-ai/saas-backend-lib 1.1.1 → 1.1.3

package/dist/esm/security/authorizations/super-admin-floor.backend.utils.d.ts

@@ -139,20 +139,12 @@ export type SuperAdminConferralResolver = () => string[];
  * Every APPLICATION-scope role key whose `inheritFrom` chain reaches `APP_ADMIN_SUPER_ADMIN` — i.e.
  * every role whose holder passes a super-admin gate.
  *
- * Mirrors the authorization layer's own test: `authorize` admits a caller when
- * `getRoleHierarchy(heldRole, scope).includes(requiredRole)`. Deriving the set the same way is what
- * keeps the floor counting exactly the principals the gates would let through — an independently
- * written membership test is how the two would drift.
- *
- * `APP_ADMIN_SUPER_ADMIN` itself is seeded unconditionally rather than being discovered by the walk.
- * If an application's role table somehow omitted the key, `getRoleHierarchy` would return an empty
- * chain, the conferring set would be empty, and the floor would then measure a population that is
- * empty by construction — refusing every removal forever while protecting nothing. Seeding the
- * anchor keeps the primary role counted whatever the table says.
- *
- * ORGANIZATIONS-scope roles are never consulted: `appRoles` is the APPLICATION authority axis, and
- * `getRoleHierarchy` partitions the two tables precisely so an org-scoped role string that happens
- * to spell an app role confers nothing.
+ * This floor's BINDING of the shared conferral derivation. The derivation itself, and the reasoning
+ * that used to be restated here and in the organization-owner floor in two different sets of words,
+ * live in {@link resolveRolesConferringAnchor} — including why the anchor is seeded unconditionally
+ * and why the SCOPE argument is what makes an org-scoped role string that happens to spell an app
+ * role confer nothing. `appRoles` is the APPLICATION authority axis; ORGANIZATIONS-scope roles are
+ * never consulted, and that is now one fact in one place rather than two paragraphs that can drift.
  */
 export declare function resolveSuperAdminConferringRoles(authorizationsService: Pick<AuthorizationsBackendService, 'getAppRoles' | 'getRoleHierarchy'>): string[];
 /**

package/dist/esm/security/authorizations/super-admin-floor.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"super-admin-floor.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/security/authorizations/super-admin-floor.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AAEH,OAAO,EAOL,UAAU,EACV,KAAK,IAAI,EACV,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAC5G,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AACnH,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,oFAAoF,CAAC;AACvI,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAGrK;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,IAAI,CAAC;AAE3C;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qCAAqC,EAAE,SAAS,UAAU,EAAwB,CAAC;AAEhG;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,4FACsD,CAAC;AAE5F;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,2BAA2B,CAAC;AAEzE;;;;GAIG;AACH,oBAAY,6BAA6B;IACvC,mEAAmE;IACnE,YAAY,iBAAiB;IAC7B,gEAAgE;IAChE,aAAa,kBAAkB;IAC/B,4CAA4C;IAC5C,QAAQ,aAAa;IACrB,gEAAgE;IAChE,OAAO,YAAY;CACpB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,2BAA2B,GAAG,MAAM,MAAM,EAAE,CAAC;AAEzD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gCAAgC,CAC9C,qBAAqB,EAAE,IAAI,CAAC,4BAA4B,EAAE,aAAa,GAAG,kBAAkB,CAAC,GAC5F,MAAM,EAAE,CAWV;AAED;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAAC,SAAS,EAAE,SAAS,GAAG,2BAA2B,CAMnG;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAIjG;AAED,oHAAoH;AACpH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAEvE;AAED,mGAAmG;AACnG,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,CAAC,GAAG,SAAS,GAAG,IAAI,EAC1D,eAAe,EAAE,SAAS,MAAM,EAAE,GACjC,OAAO,CAGT;AAKD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,2BAA2B,CAAC,MAAM,EAAE;IACxD,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,MAAM,CAAC,CA2BlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,8BAA8B,CAAC,MAAM,EAAE;IAC3D,+FAA+F;IAC/F,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,KAAK,EAAE,6BAA6B,CAAC;IACrC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,IAAI,CAAC,CAsChB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,2CAA2C,CAAC,MAAM,EAAE;IACxE,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,EAAE,OAAO,CAAC;IACxB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,IAAI,CAAC,CAwBhB;AAED;;;;;;;GAOG;AACH,wBAAsB,wCAAwC,CAAC,MAAM,EAAE;IACrE,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,UAAU,GAAG,QAAQ,CAAC,GAAG,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC;IACpF,KAAK,EAAE,6BAA6B,CAAC;IACrC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBhB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,iDAAiD,EAAE,SAAS,MAAM,EAG9E,CAAC;AAEF,sGAAsG;AACtG,wBAAgB,wCAAwC,CAAC,YAAY,EAAE,OAAO,GAAG,OAAO,CAEvF;AAED;;;;;;;;GAQG;AACH,wBAAsB,8BAA8B,CAAC,MAAM,EAAE;IAC3D,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,mBAAmB,EAAE,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,UAAU,GAAG,QAAQ,CAAC,EAAE,CAAC,CAqBvD;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iCAAiC,CAAC,MAAM,EAAE;IAC9D,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC,GAAG,OAAO,CAAC;IAAE,qBAAqB,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,OAAO,CAAC;IAAC,eAAe,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAe7F;AAED,iFAAiF;AACjF,MAAM,MAAM,qBAAqB,GAAG;IAClC,yBAAyB,EAAE,MAAM,EAAE,CAAC;IACpC,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,sCAAsC,CAAC,MAAM,EAAE;IACnE,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,UAAU,GAAG,QAAQ,CAAC,GAAG,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC;IACpF,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,8FAA8F;IAC9F,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,mFAAmF;IACnF,oBAAoB,CAAC,EAAE,CAAC,MAAM,EAAE,qBAAqB,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAChF,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBhB"}
+{"version":3,"file":"super-admin-floor.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/security/authorizations/super-admin-floor.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AAEH,OAAO,EAOL,UAAU,EACV,KAAK,IAAI,EACV,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAC5G,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AACnH,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,oFAAoF,CAAC;AACvI,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAIrK;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,IAAI,CAAC;AAE3C;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qCAAqC,EAAE,SAAS,UAAU,EAAwB,CAAC;AAEhG;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,4FACsD,CAAC;AAE5F;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,2BAA2B,CAAC;AAEzE;;;;GAIG;AACH,oBAAY,6BAA6B;IACvC,mEAAmE;IACnE,YAAY,iBAAiB;IAC7B,gEAAgE;IAChE,aAAa,kBAAkB;IAC/B,4CAA4C;IAC5C,QAAQ,aAAa;IACrB,gEAAgE;IAChE,OAAO,YAAY;CACpB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,2BAA2B,GAAG,MAAM,MAAM,EAAE,CAAC;AAEzD;;;;;;;;;;GAUG;AACH,wBAAgB,gCAAgC,CAC9C,qBAAqB,EAAE,IAAI,CAAC,4BAA4B,EAAE,aAAa,GAAG,kBAAkB,CAAC,GAC5F,MAAM,EAAE,CAOV;AAED;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAAC,SAAS,EAAE,SAAS,GAAG,2BAA2B,CAMnG;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAIjG;AAED,oHAAoH;AACpH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAEvE;AAED,mGAAmG;AACnG,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,CAAC,GAAG,SAAS,GAAG,IAAI,EAC1D,eAAe,EAAE,SAAS,MAAM,EAAE,GACjC,OAAO,CAGT;AAKD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,2BAA2B,CAAC,MAAM,EAAE;IACxD,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,MAAM,CAAC,CA2BlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,8BAA8B,CAAC,MAAM,EAAE;IAC3D,+FAA+F;IAC/F,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,KAAK,EAAE,6BAA6B,CAAC;IACrC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,IAAI,CAAC,CAsChB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,2CAA2C,CAAC,MAAM,EAAE;IACxE,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,EAAE,OAAO,CAAC;IACxB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,IAAI,CAAC,CAwBhB;AAED;;;;;;;GAOG;AACH,wBAAsB,wCAAwC,CAAC,MAAM,EAAE;IACrE,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,UAAU,GAAG,QAAQ,CAAC,GAAG,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC;IACpF,KAAK,EAAE,6BAA6B,CAAC;IACrC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBhB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,iDAAiD,EAAE,SAAS,MAAM,EAG9E,CAAC;AAEF,sGAAsG;AACtG,wBAAgB,wCAAwC,CAAC,YAAY,EAAE,OAAO,GAAG,OAAO,CAEvF;AAED;;;;;;;;GAQG;AACH,wBAAsB,8BAA8B,CAAC,MAAM,EAAE;IAC3D,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,mBAAmB,EAAE,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,UAAU,GAAG,QAAQ,CAAC,EAAE,CAAC,CAqBvD;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iCAAiC,CAAC,MAAM,EAAE;IAC9D,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC,GAAG,OAAO,CAAC;IAAE,qBAAqB,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,OAAO,CAAC;IAAC,eAAe,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAe7F;AAED,iFAAiF;AACjF,MAAM,MAAM,qBAAqB,GAAG;IAClC,yBAAyB,EAAE,MAAM,EAAE,CAAC;IACpC,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,sCAAsC,CAAC,MAAM,EAAE;IACnE,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,UAAU,GAAG,QAAQ,CAAC,GAAG,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC;IACpF,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,8FAA8F;IAC9F,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,mFAAmF;IACnF,oBAAoB,CAAC,EAAE,CAAC,MAAM,EAAE,qBAAqB,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAChF,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBhB"}

package/dist/esm/security/authorizations/super-admin-floor.backend.utils.js

@@ -68,6 +68,7 @@
  */
 import { AdministrativeContinuityErrorCode, CORE_APP_ROLES, CoreResourceOperation, CoreResourceType, ErrorType, ResourcePrimaryScope, UserStatus, } from '@wildo-ai/saas-models';
 import { SAAS_SERVICE_TYPES } from '../../inject/models/service-types.js';
+import { resolveRolesConferringAnchor } from '../../security/authorizations/role-conferral.backend.utils.js';
 /**
  * The minimum number of administratively usable super-administrators an application must retain.
  *
@@ -128,30 +129,20 @@ export var SuperAdminFloorReductionCause;
  * Every APPLICATION-scope role key whose `inheritFrom` chain reaches `APP_ADMIN_SUPER_ADMIN` — i.e.
  * every role whose holder passes a super-admin gate.
  *
- * Mirrors the authorization layer's own test: `authorize` admits a caller when
- * `getRoleHierarchy(heldRole, scope).includes(requiredRole)`. Deriving the set the same way is what
- * keeps the floor counting exactly the principals the gates would let through — an independently
- * written membership test is how the two would drift.
- *
- * `APP_ADMIN_SUPER_ADMIN` itself is seeded unconditionally rather than being discovered by the walk.
- * If an application's role table somehow omitted the key, `getRoleHierarchy` would return an empty
- * chain, the conferring set would be empty, and the floor would then measure a population that is
- * empty by construction — refusing every removal forever while protecting nothing. Seeding the
- * anchor keeps the primary role counted whatever the table says.
- *
- * ORGANIZATIONS-scope roles are never consulted: `appRoles` is the APPLICATION authority axis, and
- * `getRoleHierarchy` partitions the two tables precisely so an org-scoped role string that happens
- * to spell an app role confers nothing.
+ * This floor's BINDING of the shared conferral derivation. The derivation itself, and the reasoning
+ * that used to be restated here and in the organization-owner floor in two different sets of words,
+ * live in {@link resolveRolesConferringAnchor} — including why the anchor is seeded unconditionally
+ * and why the SCOPE argument is what makes an org-scoped role string that happens to spell an app
+ * role confer nothing. `appRoles` is the APPLICATION authority axis; ORGANIZATIONS-scope roles are
+ * never consulted, and that is now one fact in one place rather than two paragraphs that can drift.
  */
 export function resolveSuperAdminConferringRoles(authorizationsService) {
-    const conferringRoles = new Set([CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN]);
-    for (const roleKey of Object.keys(authorizationsService.getAppRoles() ?? {})) {
-        const conferred = authorizationsService.getRoleHierarchy(roleKey, ResourcePrimaryScope.APPLICATION);
-        if (conferred.includes(CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN)) {
-            conferringRoles.add(roleKey);
-        }
-    }
-    return [...conferringRoles];
+    return resolveRolesConferringAnchor({
+        anchorRole: CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN,
+        scope: ResourcePrimaryScope.APPLICATION,
+        declaredRoleKeys: Object.keys(authorizationsService.getAppRoles() ?? {}),
+        roleHierarchyResolver: (roleKey, scope) => authorizationsService.getRoleHierarchy(roleKey, scope),
+    });
 }
 /**
  * Bind a {@link SuperAdminConferralResolver} to the container's live `AuthorizationsBackendService`.

package/dist/esm/security/authorizations/super-admin-floor.backend.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"super-admin-floor.backend.utils.js","sourceRoot":"","sources":["../../../../../src/security/authorizations/super-admin-floor.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AAEH,OAAO,EACL,iCAAiC,EACjC,cAAc,EACd,qBAAqB,EACrB,gBAAgB,EAChB,SAAS,EACT,oBAAoB,EACpB,UAAU,GAEX,MAAM,uBAAuB,CAAC;AAM/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAEpF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC;AAE3C;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAA0B,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAEhG;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,wBAAwB,GACnC,yFAAyF,CAAC;AAE5F;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,wBAAwB,CAAC;AAEzE;;;;GAIG;AACH,MAAM,CAAN,IAAY,6BASX;AATD,WAAY,6BAA6B;IACvC,mEAAmE;IACnE,8DAA6B,CAAA;IAC7B,gEAAgE;IAChE,gEAA+B,CAAA;IAC/B,4CAA4C;IAC5C,sDAAqB,CAAA;IACrB,gEAAgE;IAChE,oDAAmB,CAAA;AACrB,CAAC,EATW,6BAA6B,KAA7B,6BAA6B,QASxC;AAWD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,gCAAgC,CAC9C,qBAA6F;IAE7F,MAAM,eAAe,GAAG,IAAI,GAAG,CAAS,CAAC,cAAc,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAEhF,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC7E,MAAM,SAAS,GAAG,qBAAqB,CAAC,gBAAgB,CAAC,OAAc,EAAE,oBAAoB,CAAC,WAAW,CAAC,CAAC;QAC3G,IAAI,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,CAAC;YAC7D,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,eAAe,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iCAAiC,CAAC,SAAoB;IACpE,IAAI,qBAA+D,CAAC;IACpE,OAAO,GAAG,EAAE;QACV,qBAAqB,KAAK,SAAS,CAAC,GAAG,CAA+B,kBAAkB,CAAC,qBAAqB,CAAC,CAAC;QAChH,OAAO,gCAAgC,CAAC,qBAAqB,CAAC,CAAC;IACjE,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAc,EAAE,eAAkC;IACtF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IACnD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,oHAAoH;AACpH,MAAM,UAAU,8BAA8B,CAAC,MAAe;IAC5D,OAAO,qCAAqC,CAAC,QAAQ,CAAC,MAAoB,CAAC,CAAC;AAC9E,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,kBAAkB,CAChC,IAA0D,EAC1D,eAAkC;IAElC,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,OAAO,qBAAqB,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,IAAI,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC9G,CAAC;AAKD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,MAOjD;IACC,MAAM,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,GAAG,MAAM,CAAC;IAElI,MAAM,cAAc,GAAG,oBAAoB,CAAC,aAAa,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAElF,4FAA4F;IAC5F,iGAAiG;IACjG,gDAAgD;IAChD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,gBAAgB,EAAE;YACvE,OAAO,EAAE;gBACP,OAAO,EAAE,uFAAuF;gBAChG,YAAY,EAAE,gBAAgB,CAAC,KAAK;gBACpC,mBAAmB;aACpB;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,IAAI,CAA8B,gBAAgB,EAAE;QAC1F,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,eAAe,CAAC,EAAE;QACvC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,qCAAqC,CAAC,EAAE;KAC5D,CAAC,CAAC;IAEH,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC/F,MAAM,IAAI,GAAkC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAExF,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAClF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,MASpD;IACC,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,GAAG,MAAM,CAAC;IAErI,MAAM,0BAA0B,GAAG,MAAM,2BAA2B,CAAC;QACnE,kBAAkB,EAAE,cAAc;QAClC,gBAAgB;QAChB,oBAAoB;QACpB,YAAY;QACZ,eAAe;QACf,mBAAmB;KACpB,CAAC,CAAC;IAEH,IAAI,0BAA0B,IAAI,yBAAyB;QAAE,OAAO;IAEpE,+FAA+F;IAC/F,6FAA6F;IAC7F,iGAAiG;IACjG,iGAAiG;IACjG,uEAAuE;IACvE,MAAM,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;QAClE,OAAO,EAAE;YACP,yFAAyF;YACzF,+FAA+F;YAC/F,2EAA2E;YAC3E,IAAI,EAAE,iCAAiC,CAAC,4BAA4B;YACpE,MAAM,EAAE,gCAAgC;YACxC,OAAO,EACL,gFAAgF;kBAC9E,wBAAwB;YAC5B,KAAK;YACL,mBAAmB;YACnB,cAAc,EAAE,CAAC,GAAG,cAAc,CAAC;YACnC,0BAA0B;YAC1B,yBAAyB,EAAE,yBAAyB;YACpD,eAAe,EAAE,CAAC,GAAG,eAAe,CAAC;YACrC,cAAc,EAAE,CAAC,GAAG,qCAAqC,CAAC;SAC3D;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,2CAA2C,CAAC,MAWjE;IACC,MAAM,EACJ,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,SAAS,EAAE,UAAU,EACnE,gBAAgB,EAAE,oBAAoB,EAAE,YAAY,EAAE,eAAe,EAAE,mBAAmB,GAC3F,GAAG,MAAM,CAAC;IAEX,MAAM,aAAa,GAAG,qBAAqB,CAAC,aAAa,EAAE,eAAe,CAAC,IAAI,8BAA8B,CAAC,cAAc,CAAC,CAAC;IAC9H,IAAI,CAAC,aAAa;QAAE,OAAO;IAE3B,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IAC3E,MAAM,iBAAiB,GAAG,8BAA8B,CAAC,UAAU,CAAC,CAAC;IACrE,IAAI,gBAAgB,IAAI,iBAAiB;QAAE,OAAO;IAElD,MAAM,8BAA8B,CAAC;QACnC,cAAc,EAAE,CAAC,aAAa,CAAC;QAC/B,8FAA8F;QAC9F,gGAAgG;QAChG,KAAK,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,6BAA6B,CAAC,YAAY,CAAC,CAAC,CAAC,6BAA6B,CAAC,aAAa;QACnH,gBAAgB;QAChB,oBAAoB;QACpB,YAAY;QACZ,eAAe;QACf,mBAAmB;KACpB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,wCAAwC,CAAC,MAQ9D;IACC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,GAAG,MAAM,CAAC;IAE/H,MAAM,0BAA0B,GAAG,QAAQ;SACxC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,kBAAkB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;SACjE,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAE1C,IAAI,0BAA0B,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEpD,MAAM,8BAA8B,CAAC;QACnC,cAAc,EAAE,0BAA0B;QAC1C,KAAK;QACL,gBAAgB;QAChB,oBAAoB;QACpB,YAAY;QACZ,eAAe;QACf,mBAAmB;KACpB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iDAAiD,GAAsB;IAClF,gBAAgB,CAAC,KAAK;IACtB,gBAAgB,CAAC,SAAS;CAC3B,CAAC;AAEF,sGAAsG;AACtG,MAAM,UAAU,wCAAwC,CAAC,YAAqB;IAC5E,OAAO,iDAAiD,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,MAMpD;IACC,MAAM,EAAE,UAAU,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,YAAY,EAAE,mBAAmB,EAAE,GAAG,MAAM,CAAC;IAEzG,MAAM,cAAc,GAAG,oBAAoB,CAAC,aAAa,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAElF,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,gBAAgB,EAAE;YACvE,OAAO,EAAE;gBACP,OAAO,EAAE,uFAAuF;gBAChG,YAAY,EAAE,gBAAgB,CAAC,KAAK;gBACpC,mBAAmB;aACpB;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,IAAI,CACxC,gBAAgB,EAChB,CAAC,GAAG,UAAU,CAAC,CAChB,CAAC;IAEF,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;AACjD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,MAKvD;IACC,MAAM,qBAAqB,GAAG,MAAM,2BAA2B,CAAC;QAC9D,kBAAkB,EAAE,EAAE;QACtB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;QACjD,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,mBAAmB,EAAE,qBAAqB,CAAC,IAAI;KAChD,CAAC,CAAC;IAEH,OAAO;QACL,qBAAqB;QACrB,UAAU,EAAE,qBAAqB,IAAI,yBAAyB;QAC9D,eAAe,EAAE,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC;KAC7C,CAAC;AACJ,CAAC;AAQD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAAC,MAW5D;IACC,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAC;QACnC,MAAM,wCAAwC,CAAC;YAC7C,GAAG,MAAM;YACT,KAAK,EAAE,6BAA6B,CAAC,OAAO;SAC7C,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,gGAAgG;IAChG,6FAA6F;IAC7F,6EAA6E;IAC7E,MAAM,yBAAyB,GAAG,MAAM,CAAC,QAAQ;SAC9C,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;SACxE,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAE1C,IAAI,yBAAyB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEnD,MAAM,MAAM,CAAC,oBAAoB,EAAE,CAAC;QAClC,yBAAyB;QACzB,eAAe,EAAE,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC;KAC7C,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * THE last-super-administrator floor — one semantic authority, consumed by every reducing path.\n *\n * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — an application must\n * retain an accountable administrative principal; losing the last one is simultaneously an access-\n * control failure and an availability failure, with no in-product remedy.\n *\n * ## The invariant, stated once\n *\n * An application always retains at least one **administratively usable super-administrator**. Every\n * write that could reduce that population below {@link SUPER_ADMIN_FLOOR_MINIMUM} is refused.\n *\n * ## Why this cannot be left to the operation gates\n *\n * Every path that can remove application authority is itself gated on `APP_ADMIN_SUPER_ADMIN`, so\n * the gates are satisfied precisely by the principal capable of causing the lockout. And every\n * recovery door — `assign_roles`, the core USERS `UPDATE`, the admin console — carries the same\n * gate, so once the population reaches zero there is no in-product way back. That combination is\n * what makes this a fail-closed invariant rather than a warning: the failure is unrecoverable, and\n * the only moment it can be prevented is before the write.\n *\n * ## \"Administratively usable\" — three independent conditions, all resolved toward the SMALLER count\n *\n * 1. **The roles must actually CONFER super-admin.** Testing for the literal\n *    `APP_ADMIN_SUPER_ADMIN` string is wrong: roles are application-configurable\n *    (`initializeRolesWithCustom`), and an app may register a role with\n *    `inheritFrom: APP_ADMIN_SUPER_ADMIN` whose holder passes every super-admin gate —\n *    `authorize` admits any role whose `inheritFrom` chain CONTAINS the required one. The\n *    conferring set is therefore resolved from the live role table at call time; see\n *    {@link resolveSuperAdminConferringRoles}.\n * 2. **The subject must be able to AUTHENTICATE.** `_enforceUserStatus` admits `UserStatus.ACTIVE`\n *    and throws `AUTHENTICATION_ACCOUNT_LOCKED` for every other status. A `SUSPENDED` or\n *    `PENDING_INVITATION` super-admin would satisfy a naive count while being unable to log in —\n *    the exact lockout this module exists to prevent, arriving through the guard itself. See\n *    {@link ADMINISTRATIVELY_USABLE_USER_STATUSES}.\n * 3. **The row must not be retention-hidden.** An erased-but-retained user KEEPS its `appRoles`:\n *    the field carries no `.impersonalizeWith()` because it is `.isAuditEvidence()` — what decided\n *    authority must survive the scrub. So a retained row still MATCHES a role filter while being\n *    invisible and frozen to every ordinary path. This condition needs no code here: the repository\n *    chokepoint applies the retention hide to LIST, so an ordinary request execution context cannot\n *    see retained rows. It is stated because the absence of an explicit filter is otherwise\n *    indistinguishable from having forgotten the case.\n *\n * The direction of every ambiguity is deliberate. **Under-counting refuses a legitimate removal**\n * — recoverable by appointing another administrator. **Over-counting permits the lockout** — not\n * recoverable at all. Anything uncertain therefore resolves toward not counting.\n *\n * ## The floor is a POPULATION rule, not a self-demotion check\n *\n * Nothing here compares the subject to the caller. Two usable administrators → either may be\n * demoted, including by themselves. One → nobody may remove it. The asymmetry that looks like it\n * should matter does not: to reach any of these operations a human caller already satisfies an\n * `APP_ADMIN_SUPER_ADMIN` gate, so demoting SOMEONE ELSE means the caller is themselves a second\n * usable administrator and the floor already holds. In practice the guard fires only on\n * self-demotion — but it is written as a population rule because the system paths it also protects\n * (subject erasure) have no human caller to compare against.\n *\n * ## No system / internal bypass\n *\n * `assertRequestedRolesWithinCallerCeiling` exempts `INTERNALLY_INITIATED_REQUEST` because a system\n * write carries no human ceiling to measure. This module deliberately does NOT copy that exemption:\n * a system write that strips the last administrator produces exactly the same unadministrable\n * application as a human one. The concrete case is subject erasure, and refusing it is the correct\n * compliance answer rather than an obstacle to one — an erasure that leaves the application\n * unadministrable is an availability incident, not a completed data-protection request. The\n * operator appoints a successor and then erases; {@link SUPER_ADMIN_FLOOR_REMEDY} is the text that\n * says so.\n */\n\nimport {\n  AdministrativeContinuityErrorCode,\n  CORE_APP_ROLES,\n  CoreResourceOperation,\n  CoreResourceType,\n  ErrorType,\n  ResourcePrimaryScope,\n  UserStatus,\n  type User,\n} from '@wildo-ai/saas-models';\nimport type { Container } from 'inversify';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport type { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport type { AuthorizationsBackendService } from '~wildo-backend-lib/security/authorizations/services/authorizations.backend.service';\nimport type { RepositoriesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/repositories/repositories-registry-handler.backend.service';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\n\n/**\n * The minimum number of administratively usable super-administrators an application must retain.\n *\n * Named rather than inlined as `> 0` so the several call sites state the same rule, and so a\n * product that ever requires two (a four-eyes administrative policy) has one place to change.\n */\nexport const SUPER_ADMIN_FLOOR_MINIMUM = 1;\n\n/**\n * The statuses in which a user can actually authenticate, and therefore the only ones that count\n * toward the floor.\n *\n * Derived from `AuthenticationOrchestrator._enforceUserStatus`, which returns for\n * {@link UserStatus.ACTIVE} and throws `AUTHENTICATION_ACCOUNT_LOCKED` for everything else.\n *\n * `PENDING_VERIFICATION` is deliberately EXCLUDED even though the verification flow can flip it to\n * `ACTIVE`: a recoverable administrator is not a usable one, and admitting it would let the floor\n * be satisfied by an account nobody can currently log into. Same for `PENDING_INVITATION`, whose\n * subject has no credentials at all.\n *\n * Kept as an explicit list rather than `!== ACTIVE` so that adding a member to {@link UserStatus}\n * forces a decision here instead of silently inheriting \"usable\".\n */\nexport const ADMINISTRATIVELY_USABLE_USER_STATUSES: readonly UserStatus[] = [UserStatus.ACTIVE];\n\n/**\n * The remedy every refusal names.\n *\n * A guard that only says \"no\" on an operation an administrator is authorized to perform reads as a\n * defect. Stating the one action that unblocks it — appoint another administrator first — is what\n * makes the refusal actionable, and it is the same remedy for a human demotion and for a subject\n * erasure blocked by the floor.\n */\nexport const SUPER_ADMIN_FLOOR_REMEDY =\n  'Grant an application super-administrator role to another active user first, then retry.';\n\n/**\n * The reason code every floor refusal carries, so one filter finds them across the trail.\n *\n * INTERNAL. Not the wire contract — `sanitizeErrorForClient` strips `reason` from a CONFLICT and\n * allow-lists `code`, which carries {@link AdministrativeContinuityErrorCode}. Keep them distinct:\n * this one is free to stay richer than the client-facing code.\n */\nexport const SUPER_ADMIN_FLOOR_REFUSAL_REASON = 'last_super_admin_floor';\n\n/**\n * Why a subject would stop counting toward the floor. Rides the refusal so an operator reading the\n * error (or the audit trail) knows which axis of {@link ADMINISTRATIVELY_USABLE_USER_STATUSES} /\n * role conferral / row existence the blocked write was about to change.\n */\nexport enum SuperAdminFloorReductionCause {\n  /** The subject's `appRoles` would no longer confer super-admin. */\n  ROLE_REMOVAL = 'role_removal',\n  /** The subject's `status` would leave the authenticable set. */\n  STATUS_CHANGE = 'status_change',\n  /** The subject's row would be destroyed. */\n  DELETION = 'deletion',\n  /** The subject's row would be scrubbed and retention-hidden. */\n  ERASURE = 'erasure',\n}\n\n/**\n * Resolves the role keys that confer super-admin, from the LIVE application role table.\n *\n * Injected rather than imported for the same reason {@link RoleHierarchyResolver} is: the effective\n * hierarchy is application-configurable, so a statically-derived set would silently disagree with\n * the roles the authorization layer actually honours.\n */\nexport type SuperAdminConferralResolver = () => string[];\n\n/**\n * Every APPLICATION-scope role key whose `inheritFrom` chain reaches `APP_ADMIN_SUPER_ADMIN` — i.e.\n * every role whose holder passes a super-admin gate.\n *\n * Mirrors the authorization layer's own test: `authorize` admits a caller when\n * `getRoleHierarchy(heldRole, scope).includes(requiredRole)`. Deriving the set the same way is what\n * keeps the floor counting exactly the principals the gates would let through — an independently\n * written membership test is how the two would drift.\n *\n * `APP_ADMIN_SUPER_ADMIN` itself is seeded unconditionally rather than being discovered by the walk.\n * If an application's role table somehow omitted the key, `getRoleHierarchy` would return an empty\n * chain, the conferring set would be empty, and the floor would then measure a population that is\n * empty by construction — refusing every removal forever while protecting nothing. Seeding the\n * anchor keeps the primary role counted whatever the table says.\n *\n * ORGANIZATIONS-scope roles are never consulted: `appRoles` is the APPLICATION authority axis, and\n * `getRoleHierarchy` partitions the two tables precisely so an org-scoped role string that happens\n * to spell an app role confers nothing.\n */\nexport function resolveSuperAdminConferringRoles(\n  authorizationsService: Pick<AuthorizationsBackendService, 'getAppRoles' | 'getRoleHierarchy'>,\n): string[] {\n  const conferringRoles = new Set<string>([CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN]);\n\n  for (const roleKey of Object.keys(authorizationsService.getAppRoles() ?? {})) {\n    const conferred = authorizationsService.getRoleHierarchy(roleKey as any, ResourcePrimaryScope.APPLICATION);\n    if (conferred.includes(CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN)) {\n      conferringRoles.add(roleKey);\n    }\n  }\n\n  return [...conferringRoles];\n}\n\n/**\n * Bind a {@link SuperAdminConferralResolver} to the container's live `AuthorizationsBackendService`.\n *\n * Resolution is LAZY then per-call, exactly like `createRoleHierarchyResolver`: custom-implementation\n * factories are constructed during module registration, which can run before the authorization\n * service is bound (an eager `container.get` would turn this into a startup crash), and the role\n * table is mutated in place by `initializeRolesWithCustom`, so the conferring set is recomputed per\n * call rather than memoized. The set is a handful of strings over a table of the same size — the\n * recomputation is far cheaper than the staleness it avoids.\n */\nexport function createSuperAdminConferralResolver(container: Container): SuperAdminConferralResolver {\n  let authorizationsService: AuthorizationsBackendService | undefined;\n  return () => {\n    authorizationsService ??= container.get<AuthorizationsBackendService>(SAAS_SERVICE_TYPES.AuthorizationsService);\n    return resolveSuperAdminConferringRoles(authorizationsService);\n  };\n}\n\n/**\n * Whether a role array confers super-admin.\n *\n * Defensive on the array itself: this runs on values read from unparsed caller input as well as on\n * persisted rows, and a non-array is treated as conferring nothing — which can only ever make the\n * count smaller, the safe direction (see the module header).\n */\nexport function rolesConferSuperAdmin(roles: unknown, conferringRoles: readonly string[]): boolean {\n  if (!Array.isArray(roles)) return false;\n  const conferringRoleSet = new Set(conferringRoles);\n  return roles.some((role) => typeof role === 'string' && conferringRoleSet.has(role));\n}\n\n/** Whether a status leaves the subject able to authenticate — see {@link ADMINISTRATIVELY_USABLE_USER_STATUSES}. */\nexport function isAdministrativelyUsableStatus(status: unknown): boolean {\n  return ADMINISTRATIVELY_USABLE_USER_STATUSES.includes(status as UserStatus);\n}\n\n/** Whether a user row, as it stands, counts as one administratively usable super-administrator. */\nexport function isUsableSuperAdmin(\n  user: Pick<User, 'appRoles' | 'status'> | undefined | null,\n  conferringRoles: readonly string[],\n): boolean {\n  if (!user) return false;\n  return rolesConferSuperAdmin(user.appRoles, conferringRoles) && isAdministrativelyUsableStatus(user.status);\n}\n\n/** The narrow row shape the floor count reads. */\ntype SuperAdminFloorCandidateRow = Pick<User, '_id'>;\n\n/**\n * Count the administratively usable super-administrators OTHER than the named subjects.\n *\n * ## Why a LIST and not a `count`\n *\n * `RepositoryResource.count` requires the resource to declare `CoreResourceOperation.COUNT`, and\n * `USERS` does not — it declares READ / LIST / SEARCH / CREATE / UPDATE / UPDATE_MANY / DELETE. A\n * LIST over an indexed (`appRoles` is `.isDBIndexed()`) predicate that selects only application\n * super-administrators returns a population that is inherently tiny, so materialising it costs\n * nothing worth engineering around. Adding a COUNT operation to `USERS` purely to serve this guard\n * would open a new operation surface (and its DTO, its ACL, its route decision) for an internal\n * arithmetic need — a worse trade.\n *\n * ## Why the subjects are excluded in memory rather than in the query\n *\n * A `_id: {$nin: [...]}` fragment would have to agree with the adapter's id representation —\n * MongoDB stores `_id` as an `ObjectId` while every id crossing the service boundary is a string,\n * and a silent cast miss would leave the subject INSIDE the count, satisfying the floor with the\n * very row about to be removed. Comparing `String(row._id)` after the fact cannot fail that way and\n * is exact on both adapters.\n *\n * ## Retention\n *\n * No retention fragment is built here on purpose. `buildContextualFilter` applies the hide at the\n * repository chokepoint for LIST, so retained rows are already absent. Re-stating it here would be\n * a second copy of a rule the retention authority owns — the precise duplication that produced the\n * G-AGG defect it was created to end.\n */\nexport async function countOtherUsableSuperAdmins(params: {\n  excludedSubjectIds: readonly string[];\n  executionContext: ExecutionContext<any>;\n  repositoriesRegistry: RepositoriesRegistryHandlerBackendService;\n  errorBuilder: ErrorBuilderBackendService;\n  conferringRoles: readonly string[];\n  operationIdentifier: string;\n}): Promise<number> {\n  const { excludedSubjectIds, executionContext, repositoriesRegistry, errorBuilder, conferringRoles, operationIdentifier } = params;\n\n  const userRepository = repositoriesRegistry.getRepository(CoreResourceType.USERS);\n\n  // Fail closed. Without the repository the population is unknowable, and answering \"0\" would\n  // refuse every removal while answering \"many\" would permit the lockout. Neither is a guess worth\n  // making on an invariant with no recovery path.\n  if (!userRepository) {\n    throw errorBuilder.buildError(ErrorType.CONFIGURATION, executionContext, {\n      context: {\n        message: 'Cannot evaluate the super-administrator floor: the users repository is not registered',\n        resourceType: CoreResourceType.USERS,\n        operationIdentifier,\n      },\n    });\n  }\n\n  const candidates = await userRepository.list<SuperAdminFloorCandidateRow>(executionContext, {\n    appRoles: { $in: [...conferringRoles] },\n    status: { $in: [...ADMINISTRATIVELY_USABLE_USER_STATUSES] },\n  });\n\n  const excludedSubjectIdSet = new Set(excludedSubjectIds.map((subjectId) => String(subjectId)));\n  const rows: SuperAdminFloorCandidateRow[] = Array.isArray(candidates) ? candidates : [];\n\n  return rows.filter((row) => !excludedSubjectIdSet.has(String(row?._id))).length;\n}\n\n/**\n * Refuse a write that would leave the application without an administratively usable\n * super-administrator.\n *\n * Call this ONLY once the caller has established that the named subjects currently count toward the\n * floor and would stop counting — the population query is skipped entirely otherwise, so an\n * ordinary user edit, an additive grant, or the deletion of a non-administrator pays nothing.\n *\n * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — refuse the removal of the last\n * accountable administrative principal; the denial is an access-control decision and is recorded as\n * one by the operation's own error path.\n */\nexport async function assertSuperAdminFloorPreserved(params: {\n  /** The subjects about to stop counting. Excluded from the population before it is measured. */\n  subjectUserIds: readonly string[];\n  cause: SuperAdminFloorReductionCause;\n  executionContext: ExecutionContext<any>;\n  repositoriesRegistry: RepositoriesRegistryHandlerBackendService;\n  errorBuilder: ErrorBuilderBackendService;\n  conferringRoles: readonly string[];\n  operationIdentifier: string;\n}): Promise<void> {\n  const { subjectUserIds, cause, executionContext, repositoriesRegistry, errorBuilder, conferringRoles, operationIdentifier } = params;\n\n  const remainingUsableSuperAdmins = await countOtherUsableSuperAdmins({\n    excludedSubjectIds: subjectUserIds,\n    executionContext,\n    repositoriesRegistry,\n    errorBuilder,\n    conferringRoles,\n    operationIdentifier,\n  });\n\n  if (remainingUsableSuperAdmins >= SUPER_ADMIN_FLOOR_MINIMUM) return;\n\n  // CONFLICT, not AUTHORIZATION and not VALIDATION. The request is well-formed and the caller IS\n  // authorized — every one of these operations is gated on the very role being protected. What\n  // forbids the write is the current STATE of the application, which is what CONFLICT means. A 403\n  // would tell an administrator to acquire authority they already hold (and none exists that lifts\n  // this floor); a 400 would tell them to fix a payload that is correct.\n  throw errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n    context: {\n      // The WIRE contract — allow-listed by `sanitizeErrorForClient`, so this is what a client\n      // switches on. Distinct from `reason` below, which is the internal audit/log filter handle and\n      // is deliberately stripped at the boundary; the two must not be conflated.\n      code: AdministrativeContinuityErrorCode.LAST_APPLICATION_SUPER_ADMIN,\n      reason: SUPER_ADMIN_FLOOR_REFUSAL_REASON,\n      message:\n        'Refused: this would leave the application with no usable super-administrator. '\n        + SUPER_ADMIN_FLOOR_REMEDY,\n      cause,\n      operationIdentifier,\n      subjectUserIds: [...subjectUserIds],\n      remainingUsableSuperAdmins,\n      requiredUsableSuperAdmins: SUPER_ADMIN_FLOOR_MINIMUM,\n      conferringRoles: [...conferringRoles],\n      usableStatuses: [...ADMINISTRATIVELY_USABLE_USER_STATUSES],\n    },\n  });\n}\n\n/**\n * The floor check for a role/status TRANSITION on a single subject.\n *\n * Encapsulates the short-circuit that keeps the population query off the hot path: the floor can\n * only be threatened when the subject counted BEFORE the write and would not count AFTER it. A\n * subject who was never a usable super-administrator, or who remains one, costs a set membership\n * test and nothing else.\n *\n * That shape is also why the additive `assign_roles` verb can call this unconditionally — a union\n * can never drop conferral, so it always short-circuits — which removes the standing invitation for\n * a future change to the set algebra to bypass the floor unnoticed.\n */\nexport async function assertSuperAdminFloorPreservedForTransition(params: {\n  subjectUserId: string;\n  previousRoles: unknown;\n  previousStatus: unknown;\n  nextRoles: unknown;\n  nextStatus: unknown;\n  executionContext: ExecutionContext<any>;\n  repositoriesRegistry: RepositoriesRegistryHandlerBackendService;\n  errorBuilder: ErrorBuilderBackendService;\n  conferringRoles: readonly string[];\n  operationIdentifier: string;\n}): Promise<void> {\n  const {\n    subjectUserId, previousRoles, previousStatus, nextRoles, nextStatus,\n    executionContext, repositoriesRegistry, errorBuilder, conferringRoles, operationIdentifier,\n  } = params;\n\n  const countedBefore = rolesConferSuperAdmin(previousRoles, conferringRoles) && isAdministrativelyUsableStatus(previousStatus);\n  if (!countedBefore) return;\n\n  const stillConfersRole = rolesConferSuperAdmin(nextRoles, conferringRoles);\n  const stillUsableStatus = isAdministrativelyUsableStatus(nextStatus);\n  if (stillConfersRole && stillUsableStatus) return;\n\n  await assertSuperAdminFloorPreserved({\n    subjectUserIds: [subjectUserId],\n    // Which axis actually broke it. Role removal is named first when BOTH change in one write: it\n    // is the axis the operator authored against the authority field, and the more specific finding.\n    cause: !stillConfersRole ? SuperAdminFloorReductionCause.ROLE_REMOVAL : SuperAdminFloorReductionCause.STATUS_CHANGE,\n    executionContext,\n    repositoriesRegistry,\n    errorBuilder,\n    conferringRoles,\n    operationIdentifier,\n  });\n}\n\n/**\n * The floor check for a write that removes the subject's row wholesale — a hard DELETE or a subject\n * erasure (which scrubs the row and retention-hides it, so it stops counting just as decisively).\n *\n * Takes the subjects' CURRENT rows rather than a transition: there is no \"after\" state to compare,\n * the row simply stops counting. Subjects that did not count are filtered out first, so deleting a\n * hundred ordinary users never touches the population query.\n */\nexport async function assertSuperAdminFloorPreservedForRemoval(params: {\n  subjects: readonly (Pick<User, '_id' | 'appRoles' | 'status'> | undefined | null)[];\n  cause: SuperAdminFloorReductionCause;\n  executionContext: ExecutionContext<any>;\n  repositoriesRegistry: RepositoriesRegistryHandlerBackendService;\n  errorBuilder: ErrorBuilderBackendService;\n  conferringRoles: readonly string[];\n  operationIdentifier: string;\n}): Promise<void> {\n  const { subjects, cause, executionContext, repositoriesRegistry, errorBuilder, conferringRoles, operationIdentifier } = params;\n\n  const removedUsableSuperAdminIds = subjects\n    .filter((subject) => isUsableSuperAdmin(subject, conferringRoles))\n    .map((subject) => String(subject!._id));\n\n  if (removedUsableSuperAdminIds.length === 0) return;\n\n  await assertSuperAdminFloorPreserved({\n    subjectUserIds: removedUsableSuperAdminIds,\n    cause,\n    executionContext,\n    repositoriesRegistry,\n    errorBuilder,\n    conferringRoles,\n    operationIdentifier,\n  });\n}\n\n/**\n * The resource types whose rows carry the application authority axis, and therefore the subject\n * types whose erasure can breach the floor.\n *\n * `USERS` and `USER_SELF` are two resource configurations over the SAME collection (see\n * `getCollectionNameForResource`), both declaring `RETAIN_AND_IMPERSONALIZE`, so an erasure\n * addressed through either door scrubs and hides the same row.\n */\nexport const SUPER_ADMIN_FLOOR_GOVERNED_SUBJECT_RESOURCE_TYPES: readonly string[] = [\n  CoreResourceType.USERS,\n  CoreResourceType.USER_SELF,\n];\n\n/** Whether an erasure of this subject resource type can reduce the super-administrator population. */\nexport function isSuperAdminFloorGovernedSubjectResource(resourceType: unknown): boolean {\n  return SUPER_ADMIN_FLOOR_GOVERNED_SUBJECT_RESOURCE_TYPES.includes(String(resourceType));\n}\n\n/**\n * Read the subjects an erasure is about to scrub, for the floor check.\n *\n * Reads through the repository so the retention hide applies: a subject ALREADY erased is invisible\n * here, which is correct — it stopped counting at its own erasure, and a re-run must not be refused\n * on account of a row that no longer contributes. A subject that cannot be read is simply absent\n * and contributes nothing, which is the safe direction for a check whose job is to notice the\n * subjects that DO count.\n */\nexport async function readSubjectsForSuperAdminFloor(params: {\n  subjectIds: readonly string[];\n  executionContext: ExecutionContext<any>;\n  repositoriesRegistry: RepositoriesRegistryHandlerBackendService;\n  errorBuilder: ErrorBuilderBackendService;\n  operationIdentifier: string;\n}): Promise<Pick<User, '_id' | 'appRoles' | 'status'>[]> {\n  const { subjectIds, executionContext, repositoriesRegistry, errorBuilder, operationIdentifier } = params;\n\n  const userRepository = repositoriesRegistry.getRepository(CoreResourceType.USERS);\n\n  if (!userRepository) {\n    throw errorBuilder.buildError(ErrorType.CONFIGURATION, executionContext, {\n      context: {\n        message: 'Cannot evaluate the super-administrator floor: the users repository is not registered',\n        resourceType: CoreResourceType.USERS,\n        operationIdentifier,\n      },\n    });\n  }\n\n  const subjects = await userRepository.list<Pick<User, '_id' | 'appRoles' | 'status'>>(\n    executionContext,\n    [...subjectIds],\n  );\n\n  return Array.isArray(subjects) ? subjects : [];\n}\n\n/**\n * Measure the floor without refusing anything — the boot-time report.\n *\n * Separate from {@link assertSuperAdminFloorPreserved} because it answers a different question at a\n * moment when refusing is not an option: a fresh application legitimately boots with zero users\n * (the first administrator arrives through seeding or first-run registration), so a startup that\n * failed on this condition would brick every greenfield app. What it CAN do is observe the states\n * no write guard ever saw — a direct database edit, a restore from a backup taken mid-erasure, a\n * seed that authored no administrator, or a role-table reconfiguration that changed which roles\n * confer super-admin out from under an existing population.\n */\nexport async function measureUsableSuperAdminPopulation(params: {\n  executionContext: ExecutionContext<any>;\n  repositoriesRegistry: RepositoriesRegistryHandlerBackendService;\n  errorBuilder: ErrorBuilderBackendService;\n  conferringRoles: readonly string[];\n}): Promise<{ usableSuperAdminCount: number; meetsFloor: boolean; conferringRoles: string[] }> {\n  const usableSuperAdminCount = await countOtherUsableSuperAdmins({\n    excludedSubjectIds: [],\n    executionContext: params.executionContext,\n    repositoriesRegistry: params.repositoriesRegistry,\n    errorBuilder: params.errorBuilder,\n    conferringRoles: params.conferringRoles,\n    operationIdentifier: CoreResourceOperation.LIST,\n  });\n\n  return {\n    usableSuperAdminCount,\n    meetsFloor: usableSuperAdminCount >= SUPER_ADMIN_FLOOR_MINIMUM,\n    conferringRoles: [...params.conferringRoles],\n  };\n}\n\n/** One acknowledged breach of the application floor — reported, never thrown. */\nexport type SuperAdminFloorBreach = {\n  erasedUsableSuperAdminIds: string[];\n  conferringRoles: string[];\n};\n\n/**\n * The erasure door: refuse by default, defeasible by an explicit controller acknowledgement.\n *\n * The application twin of `assertOrganizationOwnerFloorForSubjectErasure`, and it exists for the same\n * reason that one does — so the POLICY lives in the authority rather than in whichever service\n * happens to call it. A caller that owns the decision must not also own the rule.\n *\n * ## Why this door alone is defeasible\n *\n * See `.claude/rules/administrative-continuity-floors.md`. In short: GDPR Art. 17(3) is a closed list\n * of grounds for refusing an erasure and \"the application would become unadministrable\" is not on it,\n * while Art. 12(3) requires an answer without undue delay. A framework that refuses indefinitely\n * takes that choice away from the application, which is the controller that owes the data subject an\n * answer. Every ADMINISTRATIVE door — `revoke_roles`, core UPDATE, core DELETE — stays unconditional,\n * because nobody holds a right to have their administrative role removed.\n *\n * ## Why the stakes argue FOR the escape, not against it\n *\n * A stranded application is worse than a stranded tenant: there is no scope above it, so there is no\n * higher-tier repair door to reach for, and recovery is necessarily a seed or a direct database\n * write. That is precisely why the escape must be explicit, per-request, non-default and LOUD — the\n * operator's only chance to act is the record this emits, since nobody will discover the state by\n * being denied something later.\n */\nexport async function assertSuperAdminFloorForSubjectErasure(params: {\n  subjects: readonly (Pick<User, '_id' | 'appRoles' | 'status'> | undefined | null)[];\n  executionContext: ExecutionContext<any>;\n  repositoriesRegistry: RepositoriesRegistryHandlerBackendService;\n  errorBuilder: ErrorBuilderBackendService;\n  conferringRoles: readonly string[];\n  operationIdentifier: string;\n  /** The controller's explicit decision to complete an erasure that strands the application. */\n  acknowledgeFloorBreach?: boolean;\n  /** Invoked when the breach is acknowledged AND real. Never on the refusal path. */\n  onAcknowledgedBreach?: (breach: SuperAdminFloorBreach) => Promise<void> | void;\n}): Promise<void> {\n  if (!params.acknowledgeFloorBreach) {\n    await assertSuperAdminFloorPreservedForRemoval({\n      ...params,\n      cause: SuperAdminFloorReductionCause.ERASURE,\n    });\n    return;\n  }\n\n  // Acknowledged: nothing is refused, so the only remaining obligation is that the consequence is\n  // never silent. The same usability test still runs — an acknowledged erasure that removes no\n  // usable administrator must stay quiet, or the alert stops meaning anything.\n  const erasedUsableSuperAdminIds = params.subjects\n    .filter((subject) => isUsableSuperAdmin(subject, params.conferringRoles))\n    .map((subject) => String(subject!._id));\n\n  if (erasedUsableSuperAdminIds.length === 0) return;\n\n  await params.onAcknowledgedBreach?.({\n    erasedUsableSuperAdminIds,\n    conferringRoles: [...params.conferringRoles],\n  });\n}\n"]}
+{"version":3,"file":"super-admin-floor.backend.utils.js","sourceRoot":"","sources":["../../../../../src/security/authorizations/super-admin-floor.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AAEH,OAAO,EACL,iCAAiC,EACjC,cAAc,EACd,qBAAqB,EACrB,gBAAgB,EAChB,SAAS,EACT,oBAAoB,EACpB,UAAU,GAEX,MAAM,uBAAuB,CAAC;AAM/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,4BAA4B,EAAE,MAAM,yEAAyE,CAAC;AAEvH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC;AAE3C;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAA0B,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAEhG;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,wBAAwB,GACnC,yFAAyF,CAAC;AAE5F;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,wBAAwB,CAAC;AAEzE;;;;GAIG;AACH,MAAM,CAAN,IAAY,6BASX;AATD,WAAY,6BAA6B;IACvC,mEAAmE;IACnE,8DAA6B,CAAA;IAC7B,gEAAgE;IAChE,gEAA+B,CAAA;IAC/B,4CAA4C;IAC5C,sDAAqB,CAAA;IACrB,gEAAgE;IAChE,oDAAmB,CAAA;AACrB,CAAC,EATW,6BAA6B,KAA7B,6BAA6B,QASxC;AAWD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gCAAgC,CAC9C,qBAA6F;IAE7F,OAAO,4BAA4B,CAAC;QAClC,UAAU,EAAE,cAAc,CAAC,qBAAqB;QAChD,KAAK,EAAE,oBAAoB,CAAC,WAAW;QACvC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;QACxE,qBAAqB,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,OAAc,EAAE,KAAK,CAAC;KACzG,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iCAAiC,CAAC,SAAoB;IACpE,IAAI,qBAA+D,CAAC;IACpE,OAAO,GAAG,EAAE;QACV,qBAAqB,KAAK,SAAS,CAAC,GAAG,CAA+B,kBAAkB,CAAC,qBAAqB,CAAC,CAAC;QAChH,OAAO,gCAAgC,CAAC,qBAAqB,CAAC,CAAC;IACjE,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAc,EAAE,eAAkC;IACtF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IACnD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,oHAAoH;AACpH,MAAM,UAAU,8BAA8B,CAAC,MAAe;IAC5D,OAAO,qCAAqC,CAAC,QAAQ,CAAC,MAAoB,CAAC,CAAC;AAC9E,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,kBAAkB,CAChC,IAA0D,EAC1D,eAAkC;IAElC,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,OAAO,qBAAqB,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,IAAI,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC9G,CAAC;AAKD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,MAOjD;IACC,MAAM,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,GAAG,MAAM,CAAC;IAElI,MAAM,cAAc,GAAG,oBAAoB,CAAC,aAAa,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAElF,4FAA4F;IAC5F,iGAAiG;IACjG,gDAAgD;IAChD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,gBAAgB,EAAE;YACvE,OAAO,EAAE;gBACP,OAAO,EAAE,uFAAuF;gBAChG,YAAY,EAAE,gBAAgB,CAAC,KAAK;gBACpC,mBAAmB;aACpB;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,IAAI,CAA8B,gBAAgB,EAAE;QAC1F,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,eAAe,CAAC,EAAE;QACvC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,qCAAqC,CAAC,EAAE;KAC5D,CAAC,CAAC;IAEH,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC/F,MAAM,IAAI,GAAkC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAExF,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAClF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,MASpD;IACC,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,GAAG,MAAM,CAAC;IAErI,MAAM,0BAA0B,GAAG,MAAM,2BAA2B,CAAC;QACnE,kBAAkB,EAAE,cAAc;QAClC,gBAAgB;QAChB,oBAAoB;QACpB,YAAY;QACZ,eAAe;QACf,mBAAmB;KACpB,CAAC,CAAC;IAEH,IAAI,0BAA0B,IAAI,yBAAyB;QAAE,OAAO;IAEpE,+FAA+F;IAC/F,6FAA6F;IAC7F,iGAAiG;IACjG,iGAAiG;IACjG,uEAAuE;IACvE,MAAM,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;QAClE,OAAO,EAAE;YACP,yFAAyF;YACzF,+FAA+F;YAC/F,2EAA2E;YAC3E,IAAI,EAAE,iCAAiC,CAAC,4BAA4B;YACpE,MAAM,EAAE,gCAAgC;YACxC,OAAO,EACL,gFAAgF;kBAC9E,wBAAwB;YAC5B,KAAK;YACL,mBAAmB;YACnB,cAAc,EAAE,CAAC,GAAG,cAAc,CAAC;YACnC,0BAA0B;YAC1B,yBAAyB,EAAE,yBAAyB;YACpD,eAAe,EAAE,CAAC,GAAG,eAAe,CAAC;YACrC,cAAc,EAAE,CAAC,GAAG,qCAAqC,CAAC;SAC3D;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,2CAA2C,CAAC,MAWjE;IACC,MAAM,EACJ,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,SAAS,EAAE,UAAU,EACnE,gBAAgB,EAAE,oBAAoB,EAAE,YAAY,EAAE,eAAe,EAAE,mBAAmB,GAC3F,GAAG,MAAM,CAAC;IAEX,MAAM,aAAa,GAAG,qBAAqB,CAAC,aAAa,EAAE,eAAe,CAAC,IAAI,8BAA8B,CAAC,cAAc,CAAC,CAAC;IAC9H,IAAI,CAAC,aAAa;QAAE,OAAO;IAE3B,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IAC3E,MAAM,iBAAiB,GAAG,8BAA8B,CAAC,UAAU,CAAC,CAAC;IACrE,IAAI,gBAAgB,IAAI,iBAAiB;QAAE,OAAO;IAElD,MAAM,8BAA8B,CAAC;QACnC,cAAc,EAAE,CAAC,aAAa,CAAC;QAC/B,8FAA8F;QAC9F,gGAAgG;QAChG,KAAK,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,6BAA6B,CAAC,YAAY,CAAC,CAAC,CAAC,6BAA6B,CAAC,aAAa;QACnH,gBAAgB;QAChB,oBAAoB;QACpB,YAAY;QACZ,eAAe;QACf,mBAAmB;KACpB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,wCAAwC,CAAC,MAQ9D;IACC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,GAAG,MAAM,CAAC;IAE/H,MAAM,0BAA0B,GAAG,QAAQ;SACxC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,kBAAkB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;SACjE,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAE1C,IAAI,0BAA0B,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEpD,MAAM,8BAA8B,CAAC;QACnC,cAAc,EAAE,0BAA0B;QAC1C,KAAK;QACL,gBAAgB;QAChB,oBAAoB;QACpB,YAAY;QACZ,eAAe;QACf,mBAAmB;KACpB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iDAAiD,GAAsB;IAClF,gBAAgB,CAAC,KAAK;IACtB,gBAAgB,CAAC,SAAS;CAC3B,CAAC;AAEF,sGAAsG;AACtG,MAAM,UAAU,wCAAwC,CAAC,YAAqB;IAC5E,OAAO,iDAAiD,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,MAMpD;IACC,MAAM,EAAE,UAAU,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,YAAY,EAAE,mBAAmB,EAAE,GAAG,MAAM,CAAC;IAEzG,MAAM,cAAc,GAAG,oBAAoB,CAAC,aAAa,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAElF,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,gBAAgB,EAAE;YACvE,OAAO,EAAE;gBACP,OAAO,EAAE,uFAAuF;gBAChG,YAAY,EAAE,gBAAgB,CAAC,KAAK;gBACpC,mBAAmB;aACpB;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,IAAI,CACxC,gBAAgB,EAChB,CAAC,GAAG,UAAU,CAAC,CAChB,CAAC;IAEF,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;AACjD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,MAKvD;IACC,MAAM,qBAAqB,GAAG,MAAM,2BAA2B,CAAC;QAC9D,kBAAkB,EAAE,EAAE;QACtB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;QACjD,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,mBAAmB,EAAE,qBAAqB,CAAC,IAAI;KAChD,CAAC,CAAC;IAEH,OAAO;QACL,qBAAqB;QACrB,UAAU,EAAE,qBAAqB,IAAI,yBAAyB;QAC9D,eAAe,EAAE,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC;KAC7C,CAAC;AACJ,CAAC;AAQD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAAC,MAW5D;IACC,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAC;QACnC,MAAM,wCAAwC,CAAC;YAC7C,GAAG,MAAM;YACT,KAAK,EAAE,6BAA6B,CAAC,OAAO;SAC7C,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,gGAAgG;IAChG,6FAA6F;IAC7F,6EAA6E;IAC7E,MAAM,yBAAyB,GAAG,MAAM,CAAC,QAAQ;SAC9C,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;SACxE,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAE1C,IAAI,yBAAyB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEnD,MAAM,MAAM,CAAC,oBAAoB,EAAE,CAAC;QAClC,yBAAyB;QACzB,eAAe,EAAE,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC;KAC7C,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * THE last-super-administrator floor — one semantic authority, consumed by every reducing path.\n *\n * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — an application must\n * retain an accountable administrative principal; losing the last one is simultaneously an access-\n * control failure and an availability failure, with no in-product remedy.\n *\n * ## The invariant, stated once\n *\n * An application always retains at least one **administratively usable super-administrator**. Every\n * write that could reduce that population below {@link SUPER_ADMIN_FLOOR_MINIMUM} is refused.\n *\n * ## Why this cannot be left to the operation gates\n *\n * Every path that can remove application authority is itself gated on `APP_ADMIN_SUPER_ADMIN`, so\n * the gates are satisfied precisely by the principal capable of causing the lockout. And every\n * recovery door — `assign_roles`, the core USERS `UPDATE`, the admin console — carries the same\n * gate, so once the population reaches zero there is no in-product way back. That combination is\n * what makes this a fail-closed invariant rather than a warning: the failure is unrecoverable, and\n * the only moment it can be prevented is before the write.\n *\n * ## \"Administratively usable\" — three independent conditions, all resolved toward the SMALLER count\n *\n * 1. **The roles must actually CONFER super-admin.** Testing for the literal\n *    `APP_ADMIN_SUPER_ADMIN` string is wrong: roles are application-configurable\n *    (`initializeRolesWithCustom`), and an app may register a role with\n *    `inheritFrom: APP_ADMIN_SUPER_ADMIN` whose holder passes every super-admin gate —\n *    `authorize` admits any role whose `inheritFrom` chain CONTAINS the required one. The\n *    conferring set is therefore resolved from the live role table at call time; see\n *    {@link resolveSuperAdminConferringRoles}.\n * 2. **The subject must be able to AUTHENTICATE.** `_enforceUserStatus` admits `UserStatus.ACTIVE`\n *    and throws `AUTHENTICATION_ACCOUNT_LOCKED` for every other status. A `SUSPENDED` or\n *    `PENDING_INVITATION` super-admin would satisfy a naive count while being unable to log in —\n *    the exact lockout this module exists to prevent, arriving through the guard itself. See\n *    {@link ADMINISTRATIVELY_USABLE_USER_STATUSES}.\n * 3. **The row must not be retention-hidden.** An erased-but-retained user KEEPS its `appRoles`:\n *    the field carries no `.impersonalizeWith()` because it is `.isAuditEvidence()` — what decided\n *    authority must survive the scrub. So a retained row still MATCHES a role filter while being\n *    invisible and frozen to every ordinary path. This condition needs no code here: the repository\n *    chokepoint applies the retention hide to LIST, so an ordinary request execution context cannot\n *    see retained rows. It is stated because the absence of an explicit filter is otherwise\n *    indistinguishable from having forgotten the case.\n *\n * The direction of every ambiguity is deliberate. **Under-counting refuses a legitimate removal**\n * — recoverable by appointing another administrator. **Over-counting permits the lockout** — not\n * recoverable at all. Anything uncertain therefore resolves toward not counting.\n *\n * ## The floor is a POPULATION rule, not a self-demotion check\n *\n * Nothing here compares the subject to the caller. Two usable administrators → either may be\n * demoted, including by themselves. One → nobody may remove it. The asymmetry that looks like it\n * should matter does not: to reach any of these operations a human caller already satisfies an\n * `APP_ADMIN_SUPER_ADMIN` gate, so demoting SOMEONE ELSE means the caller is themselves a second\n * usable administrator and the floor already holds. In practice the guard fires only on\n * self-demotion — but it is written as a population rule because the system paths it also protects\n * (subject erasure) have no human caller to compare against.\n *\n * ## No system / internal bypass\n *\n * `assertRequestedRolesWithinCallerCeiling` exempts `INTERNALLY_INITIATED_REQUEST` because a system\n * write carries no human ceiling to measure. This module deliberately does NOT copy that exemption:\n * a system write that strips the last administrator produces exactly the same unadministrable\n * application as a human one. The concrete case is subject erasure, and refusing it is the correct\n * compliance answer rather than an obstacle to one — an erasure that leaves the application\n * unadministrable is an availability incident, not a completed data-protection request. The\n * operator appoints a successor and then erases; {@link SUPER_ADMIN_FLOOR_REMEDY} is the text that\n * says so.\n */\n\nimport {\n  AdministrativeContinuityErrorCode,\n  CORE_APP_ROLES,\n  CoreResourceOperation,\n  CoreResourceType,\n  ErrorType,\n  ResourcePrimaryScope,\n  UserStatus,\n  type User,\n} from '@wildo-ai/saas-models';\nimport type { Container } from 'inversify';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport type { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport type { AuthorizationsBackendService } from '~wildo-backend-lib/security/authorizations/services/authorizations.backend.service';\nimport type { RepositoriesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/repositories/repositories-registry-handler.backend.service';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { resolveRolesConferringAnchor } from '~wildo-backend-lib/security/authorizations/role-conferral.backend.utils';\n\n/**\n * The minimum number of administratively usable super-administrators an application must retain.\n *\n * Named rather than inlined as `> 0` so the several call sites state the same rule, and so a\n * product that ever requires two (a four-eyes administrative policy) has one place to change.\n */\nexport const SUPER_ADMIN_FLOOR_MINIMUM = 1;\n\n/**\n * The statuses in which a user can actually authenticate, and therefore the only ones that count\n * toward the floor.\n *\n * Derived from `AuthenticationOrchestrator._enforceUserStatus`, which returns for\n * {@link UserStatus.ACTIVE} and throws `AUTHENTICATION_ACCOUNT_LOCKED` for everything else.\n *\n * `PENDING_VERIFICATION` is deliberately EXCLUDED even though the verification flow can flip it to\n * `ACTIVE`: a recoverable administrator is not a usable one, and admitting it would let the floor\n * be satisfied by an account nobody can currently log into. Same for `PENDING_INVITATION`, whose\n * subject has no credentials at all.\n *\n * Kept as an explicit list rather than `!== ACTIVE` so that adding a member to {@link UserStatus}\n * forces a decision here instead of silently inheriting \"usable\".\n */\nexport const ADMINISTRATIVELY_USABLE_USER_STATUSES: readonly UserStatus[] = [UserStatus.ACTIVE];\n\n/**\n * The remedy every refusal names.\n *\n * A guard that only says \"no\" on an operation an administrator is authorized to perform reads as a\n * defect. Stating the one action that unblocks it — appoint another administrator first — is what\n * makes the refusal actionable, and it is the same remedy for a human demotion and for a subject\n * erasure blocked by the floor.\n */\nexport const SUPER_ADMIN_FLOOR_REMEDY =\n  'Grant an application super-administrator role to another active user first, then retry.';\n\n/**\n * The reason code every floor refusal carries, so one filter finds them across the trail.\n *\n * INTERNAL. Not the wire contract — `sanitizeErrorForClient` strips `reason` from a CONFLICT and\n * allow-lists `code`, which carries {@link AdministrativeContinuityErrorCode}. Keep them distinct:\n * this one is free to stay richer than the client-facing code.\n */\nexport const SUPER_ADMIN_FLOOR_REFUSAL_REASON = 'last_super_admin_floor';\n\n/**\n * Why a subject would stop counting toward the floor. Rides the refusal so an operator reading the\n * error (or the audit trail) knows which axis of {@link ADMINISTRATIVELY_USABLE_USER_STATUSES} /\n * role conferral / row existence the blocked write was about to change.\n */\nexport enum SuperAdminFloorReductionCause {\n  /** The subject's `appRoles` would no longer confer super-admin. */\n  ROLE_REMOVAL = 'role_removal',\n  /** The subject's `status` would leave the authenticable set. */\n  STATUS_CHANGE = 'status_change',\n  /** The subject's row would be destroyed. */\n  DELETION = 'deletion',\n  /** The subject's row would be scrubbed and retention-hidden. */\n  ERASURE = 'erasure',\n}\n\n/**\n * Resolves the role keys that confer super-admin, from the LIVE application role table.\n *\n * Injected rather than imported for the same reason {@link RoleHierarchyResolver} is: the effective\n * hierarchy is application-configurable, so a statically-derived set would silently disagree with\n * the roles the authorization layer actually honours.\n */\nexport type SuperAdminConferralResolver = () => string[];\n\n/**\n * Every APPLICATION-scope role key whose `inheritFrom` chain reaches `APP_ADMIN_SUPER_ADMIN` — i.e.\n * every role whose holder passes a super-admin gate.\n *\n * This floor's BINDING of the shared conferral derivation. The derivation itself, and the reasoning\n * that used to be restated here and in the organization-owner floor in two different sets of words,\n * live in {@link resolveRolesConferringAnchor} — including why the anchor is seeded unconditionally\n * and why the SCOPE argument is what makes an org-scoped role string that happens to spell an app\n * role confer nothing. `appRoles` is the APPLICATION authority axis; ORGANIZATIONS-scope roles are\n * never consulted, and that is now one fact in one place rather than two paragraphs that can drift.\n */\nexport function resolveSuperAdminConferringRoles(\n  authorizationsService: Pick<AuthorizationsBackendService, 'getAppRoles' | 'getRoleHierarchy'>,\n): string[] {\n  return resolveRolesConferringAnchor({\n    anchorRole: CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN,\n    scope: ResourcePrimaryScope.APPLICATION,\n    declaredRoleKeys: Object.keys(authorizationsService.getAppRoles() ?? {}),\n    roleHierarchyResolver: (roleKey, scope) => authorizationsService.getRoleHierarchy(roleKey as any, scope),\n  });\n}\n\n/**\n * Bind a {@link SuperAdminConferralResolver} to the container's live `AuthorizationsBackendService`.\n *\n * Resolution is LAZY then per-call, exactly like `createRoleHierarchyResolver`: custom-implementation\n * factories are constructed during module registration, which can run before the authorization\n * service is bound (an eager `container.get` would turn this into a startup crash), and the role\n * table is mutated in place by `initializeRolesWithCustom`, so the conferring set is recomputed per\n * call rather than memoized. The set is a handful of strings over a table of the same size — the\n * recomputation is far cheaper than the staleness it avoids.\n */\nexport function createSuperAdminConferralResolver(container: Container): SuperAdminConferralResolver {\n  let authorizationsService: AuthorizationsBackendService | undefined;\n  return () => {\n    authorizationsService ??= container.get<AuthorizationsBackendService>(SAAS_SERVICE_TYPES.AuthorizationsService);\n    return resolveSuperAdminConferringRoles(authorizationsService);\n  };\n}\n\n/**\n * Whether a role array confers super-admin.\n *\n * Defensive on the array itself: this runs on values read from unparsed caller input as well as on\n * persisted rows, and a non-array is treated as conferring nothing — which can only ever make the\n * count smaller, the safe direction (see the module header).\n */\nexport function rolesConferSuperAdmin(roles: unknown, conferringRoles: readonly string[]): boolean {\n  if (!Array.isArray(roles)) return false;\n  const conferringRoleSet = new Set(conferringRoles);\n  return roles.some((role) => typeof role === 'string' && conferringRoleSet.has(role));\n}\n\n/** Whether a status leaves the subject able to authenticate — see {@link ADMINISTRATIVELY_USABLE_USER_STATUSES}. */\nexport function isAdministrativelyUsableStatus(status: unknown): boolean {\n  return ADMINISTRATIVELY_USABLE_USER_STATUSES.includes(status as UserStatus);\n}\n\n/** Whether a user row, as it stands, counts as one administratively usable super-administrator. */\nexport function isUsableSuperAdmin(\n  user: Pick<User, 'appRoles' | 'status'> | undefined | null,\n  conferringRoles: readonly string[],\n): boolean {\n  if (!user) return false;\n  return rolesConferSuperAdmin(user.appRoles, conferringRoles) && isAdministrativelyUsableStatus(user.status);\n}\n\n/** The narrow row shape the floor count reads. */\ntype SuperAdminFloorCandidateRow = Pick<User, '_id'>;\n\n/**\n * Count the administratively usable super-administrators OTHER than the named subjects.\n *\n * ## Why a LIST and not a `count`\n *\n * `RepositoryResource.count` requires the resource to declare `CoreResourceOperation.COUNT`, and\n * `USERS` does not — it declares READ / LIST / SEARCH / CREATE / UPDATE / UPDATE_MANY / DELETE. A\n * LIST over an indexed (`appRoles` is `.isDBIndexed()`) predicate that selects only application\n * super-administrators returns a population that is inherently tiny, so materialising it costs\n * nothing worth engineering around. Adding a COUNT operation to `USERS` purely to serve this guard\n * would open a new operation surface (and its DTO, its ACL, its route decision) for an internal\n * arithmetic need — a worse trade.\n *\n * ## Why the subjects are excluded in memory rather than in the query\n *\n * A `_id: {$nin: [...]}` fragment would have to agree with the adapter's id representation —\n * MongoDB stores `_id` as an `ObjectId` while every id crossing the service boundary is a string,\n * and a silent cast miss would leave the subject INSIDE the count, satisfying the floor with the\n * very row about to be removed. Comparing `String(row._id)` after the fact cannot fail that way and\n * is exact on both adapters.\n *\n * ## Retention\n *\n * No retention fragment is built here on purpose. `buildContextualFilter` applies the hide at the\n * repository chokepoint for LIST, so retained rows are already absent. Re-stating it here would be\n * a second copy of a rule the retention authority owns — the precise duplication that produced the\n * G-AGG defect it was created to end.\n */\nexport async function countOtherUsableSuperAdmins(params: {\n  excludedSubjectIds: readonly string[];\n  executionContext: ExecutionContext<any>;\n  repositoriesRegistry: RepositoriesRegistryHandlerBackendService;\n  errorBuilder: ErrorBuilderBackendService;\n  conferringRoles: readonly string[];\n  operationIdentifier: string;\n}): Promise<number> {\n  const { excludedSubjectIds, executionContext, repositoriesRegistry, errorBuilder, conferringRoles, operationIdentifier } = params;\n\n  const userRepository = repositoriesRegistry.getRepository(CoreResourceType.USERS);\n\n  // Fail closed. Without the repository the population is unknowable, and answering \"0\" would\n  // refuse every removal while answering \"many\" would permit the lockout. Neither is a guess worth\n  // making on an invariant with no recovery path.\n  if (!userRepository) {\n    throw errorBuilder.buildError(ErrorType.CONFIGURATION, executionContext, {\n      context: {\n        message: 'Cannot evaluate the super-administrator floor: the users repository is not registered',\n        resourceType: CoreResourceType.USERS,\n        operationIdentifier,\n      },\n    });\n  }\n\n  const candidates = await userRepository.list<SuperAdminFloorCandidateRow>(executionContext, {\n    appRoles: { $in: [...conferringRoles] },\n    status: { $in: [...ADMINISTRATIVELY_USABLE_USER_STATUSES] },\n  });\n\n  const excludedSubjectIdSet = new Set(excludedSubjectIds.map((subjectId) => String(subjectId)));\n  const rows: SuperAdminFloorCandidateRow[] = Array.isArray(candidates) ? candidates : [];\n\n  return rows.filter((row) => !excludedSubjectIdSet.has(String(row?._id))).length;\n}\n\n/**\n * Refuse a write that would leave the application without an administratively usable\n * super-administrator.\n *\n * Call this ONLY once the caller has established that the named subjects currently count toward the\n * floor and would stop counting — the population query is skipped entirely otherwise, so an\n * ordinary user edit, an additive grant, or the deletion of a non-administrator pays nothing.\n *\n * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — refuse the removal of the last\n * accountable administrative principal; the denial is an access-control decision and is recorded as\n * one by the operation's own error path.\n */\nexport async function assertSuperAdminFloorPreserved(params: {\n  /** The subjects about to stop counting. Excluded from the population before it is measured. */\n  subjectUserIds: readonly string[];\n  cause: SuperAdminFloorReductionCause;\n  executionContext: ExecutionContext<any>;\n  repositoriesRegistry: RepositoriesRegistryHandlerBackendService;\n  errorBuilder: ErrorBuilderBackendService;\n  conferringRoles: readonly string[];\n  operationIdentifier: string;\n}): Promise<void> {\n  const { subjectUserIds, cause, executionContext, repositoriesRegistry, errorBuilder, conferringRoles, operationIdentifier } = params;\n\n  const remainingUsableSuperAdmins = await countOtherUsableSuperAdmins({\n    excludedSubjectIds: subjectUserIds,\n    executionContext,\n    repositoriesRegistry,\n    errorBuilder,\n    conferringRoles,\n    operationIdentifier,\n  });\n\n  if (remainingUsableSuperAdmins >= SUPER_ADMIN_FLOOR_MINIMUM) return;\n\n  // CONFLICT, not AUTHORIZATION and not VALIDATION. The request is well-formed and the caller IS\n  // authorized — every one of these operations is gated on the very role being protected. What\n  // forbids the write is the current STATE of the application, which is what CONFLICT means. A 403\n  // would tell an administrator to acquire authority they already hold (and none exists that lifts\n  // this floor); a 400 would tell them to fix a payload that is correct.\n  throw errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n    context: {\n      // The WIRE contract — allow-listed by `sanitizeErrorForClient`, so this is what a client\n      // switches on. Distinct from `reason` below, which is the internal audit/log filter handle and\n      // is deliberately stripped at the boundary; the two must not be conflated.\n      code: AdministrativeContinuityErrorCode.LAST_APPLICATION_SUPER_ADMIN,\n      reason: SUPER_ADMIN_FLOOR_REFUSAL_REASON,\n      message:\n        'Refused: this would leave the application with no usable super-administrator. '\n        + SUPER_ADMIN_FLOOR_REMEDY,\n      cause,\n      operationIdentifier,\n      subjectUserIds: [...subjectUserIds],\n      remainingUsableSuperAdmins,\n      requiredUsableSuperAdmins: SUPER_ADMIN_FLOOR_MINIMUM,\n      conferringRoles: [...conferringRoles],\n      usableStatuses: [...ADMINISTRATIVELY_USABLE_USER_STATUSES],\n    },\n  });\n}\n\n/**\n * The floor check for a role/status TRANSITION on a single subject.\n *\n * Encapsulates the short-circuit that keeps the population query off the hot path: the floor can\n * only be threatened when the subject counted BEFORE the write and would not count AFTER it. A\n * subject who was never a usable super-administrator, or who remains one, costs a set membership\n * test and nothing else.\n *\n * That shape is also why the additive `assign_roles` verb can call this unconditionally — a union\n * can never drop conferral, so it always short-circuits — which removes the standing invitation for\n * a future change to the set algebra to bypass the floor unnoticed.\n */\nexport async function assertSuperAdminFloorPreservedForTransition(params: {\n  subjectUserId: string;\n  previousRoles: unknown;\n  previousStatus: unknown;\n  nextRoles: unknown;\n  nextStatus: unknown;\n  executionContext: ExecutionContext<any>;\n  repositoriesRegistry: RepositoriesRegistryHandlerBackendService;\n  errorBuilder: ErrorBuilderBackendService;\n  conferringRoles: readonly string[];\n  operationIdentifier: string;\n}): Promise<void> {\n  const {\n    subjectUserId, previousRoles, previousStatus, nextRoles, nextStatus,\n    executionContext, repositoriesRegistry, errorBuilder, conferringRoles, operationIdentifier,\n  } = params;\n\n  const countedBefore = rolesConferSuperAdmin(previousRoles, conferringRoles) && isAdministrativelyUsableStatus(previousStatus);\n  if (!countedBefore) return;\n\n  const stillConfersRole = rolesConferSuperAdmin(nextRoles, conferringRoles);\n  const stillUsableStatus = isAdministrativelyUsableStatus(nextStatus);\n  if (stillConfersRole && stillUsableStatus) return;\n\n  await assertSuperAdminFloorPreserved({\n    subjectUserIds: [subjectUserId],\n    // Which axis actually broke it. Role removal is named first when BOTH change in one write: it\n    // is the axis the operator authored against the authority field, and the more specific finding.\n    cause: !stillConfersRole ? SuperAdminFloorReductionCause.ROLE_REMOVAL : SuperAdminFloorReductionCause.STATUS_CHANGE,\n    executionContext,\n    repositoriesRegistry,\n    errorBuilder,\n    conferringRoles,\n    operationIdentifier,\n  });\n}\n\n/**\n * The floor check for a write that removes the subject's row wholesale — a hard DELETE or a subject\n * erasure (which scrubs the row and retention-hides it, so it stops counting just as decisively).\n *\n * Takes the subjects' CURRENT rows rather than a transition: there is no \"after\" state to compare,\n * the row simply stops counting. Subjects that did not count are filtered out first, so deleting a\n * hundred ordinary users never touches the population query.\n */\nexport async function assertSuperAdminFloorPreservedForRemoval(params: {\n  subjects: readonly (Pick<User, '_id' | 'appRoles' | 'status'> | undefined | null)[];\n  cause: SuperAdminFloorReductionCause;\n  executionContext: ExecutionContext<any>;\n  repositoriesRegistry: RepositoriesRegistryHandlerBackendService;\n  errorBuilder: ErrorBuilderBackendService;\n  conferringRoles: readonly string[];\n  operationIdentifier: string;\n}): Promise<void> {\n  const { subjects, cause, executionContext, repositoriesRegistry, errorBuilder, conferringRoles, operationIdentifier } = params;\n\n  const removedUsableSuperAdminIds = subjects\n    .filter((subject) => isUsableSuperAdmin(subject, conferringRoles))\n    .map((subject) => String(subject!._id));\n\n  if (removedUsableSuperAdminIds.length === 0) return;\n\n  await assertSuperAdminFloorPreserved({\n    subjectUserIds: removedUsableSuperAdminIds,\n    cause,\n    executionContext,\n    repositoriesRegistry,\n    errorBuilder,\n    conferringRoles,\n    operationIdentifier,\n  });\n}\n\n/**\n * The resource types whose rows carry the application authority axis, and therefore the subject\n * types whose erasure can breach the floor.\n *\n * `USERS` and `USER_SELF` are two resource configurations over the SAME collection (see\n * `getCollectionNameForResource`), both declaring `RETAIN_AND_IMPERSONALIZE`, so an erasure\n * addressed through either door scrubs and hides the same row.\n */\nexport const SUPER_ADMIN_FLOOR_GOVERNED_SUBJECT_RESOURCE_TYPES: readonly string[] = [\n  CoreResourceType.USERS,\n  CoreResourceType.USER_SELF,\n];\n\n/** Whether an erasure of this subject resource type can reduce the super-administrator population. */\nexport function isSuperAdminFloorGovernedSubjectResource(resourceType: unknown): boolean {\n  return SUPER_ADMIN_FLOOR_GOVERNED_SUBJECT_RESOURCE_TYPES.includes(String(resourceType));\n}\n\n/**\n * Read the subjects an erasure is about to scrub, for the floor check.\n *\n * Reads through the repository so the retention hide applies: a subject ALREADY erased is invisible\n * here, which is correct — it stopped counting at its own erasure, and a re-run must not be refused\n * on account of a row that no longer contributes. A subject that cannot be read is simply absent\n * and contributes nothing, which is the safe direction for a check whose job is to notice the\n * subjects that DO count.\n */\nexport async function readSubjectsForSuperAdminFloor(params: {\n  subjectIds: readonly string[];\n  executionContext: ExecutionContext<any>;\n  repositoriesRegistry: RepositoriesRegistryHandlerBackendService;\n  errorBuilder: ErrorBuilderBackendService;\n  operationIdentifier: string;\n}): Promise<Pick<User, '_id' | 'appRoles' | 'status'>[]> {\n  const { subjectIds, executionContext, repositoriesRegistry, errorBuilder, operationIdentifier } = params;\n\n  const userRepository = repositoriesRegistry.getRepository(CoreResourceType.USERS);\n\n  if (!userRepository) {\n    throw errorBuilder.buildError(ErrorType.CONFIGURATION, executionContext, {\n      context: {\n        message: 'Cannot evaluate the super-administrator floor: the users repository is not registered',\n        resourceType: CoreResourceType.USERS,\n        operationIdentifier,\n      },\n    });\n  }\n\n  const subjects = await userRepository.list<Pick<User, '_id' | 'appRoles' | 'status'>>(\n    executionContext,\n    [...subjectIds],\n  );\n\n  return Array.isArray(subjects) ? subjects : [];\n}\n\n/**\n * Measure the floor without refusing anything — the boot-time report.\n *\n * Separate from {@link assertSuperAdminFloorPreserved} because it answers a different question at a\n * moment when refusing is not an option: a fresh application legitimately boots with zero users\n * (the first administrator arrives through seeding or first-run registration), so a startup that\n * failed on this condition would brick every greenfield app. What it CAN do is observe the states\n * no write guard ever saw — a direct database edit, a restore from a backup taken mid-erasure, a\n * seed that authored no administrator, or a role-table reconfiguration that changed which roles\n * confer super-admin out from under an existing population.\n */\nexport async function measureUsableSuperAdminPopulation(params: {\n  executionContext: ExecutionContext<any>;\n  repositoriesRegistry: RepositoriesRegistryHandlerBackendService;\n  errorBuilder: ErrorBuilderBackendService;\n  conferringRoles: readonly string[];\n}): Promise<{ usableSuperAdminCount: number; meetsFloor: boolean; conferringRoles: string[] }> {\n  const usableSuperAdminCount = await countOtherUsableSuperAdmins({\n    excludedSubjectIds: [],\n    executionContext: params.executionContext,\n    repositoriesRegistry: params.repositoriesRegistry,\n    errorBuilder: params.errorBuilder,\n    conferringRoles: params.conferringRoles,\n    operationIdentifier: CoreResourceOperation.LIST,\n  });\n\n  return {\n    usableSuperAdminCount,\n    meetsFloor: usableSuperAdminCount >= SUPER_ADMIN_FLOOR_MINIMUM,\n    conferringRoles: [...params.conferringRoles],\n  };\n}\n\n/** One acknowledged breach of the application floor — reported, never thrown. */\nexport type SuperAdminFloorBreach = {\n  erasedUsableSuperAdminIds: string[];\n  conferringRoles: string[];\n};\n\n/**\n * The erasure door: refuse by default, defeasible by an explicit controller acknowledgement.\n *\n * The application twin of `assertOrganizationOwnerFloorForSubjectErasure`, and it exists for the same\n * reason that one does — so the POLICY lives in the authority rather than in whichever service\n * happens to call it. A caller that owns the decision must not also own the rule.\n *\n * ## Why this door alone is defeasible\n *\n * See `.claude/rules/administrative-continuity-floors.md`. In short: GDPR Art. 17(3) is a closed list\n * of grounds for refusing an erasure and \"the application would become unadministrable\" is not on it,\n * while Art. 12(3) requires an answer without undue delay. A framework that refuses indefinitely\n * takes that choice away from the application, which is the controller that owes the data subject an\n * answer. Every ADMINISTRATIVE door — `revoke_roles`, core UPDATE, core DELETE — stays unconditional,\n * because nobody holds a right to have their administrative role removed.\n *\n * ## Why the stakes argue FOR the escape, not against it\n *\n * A stranded application is worse than a stranded tenant: there is no scope above it, so there is no\n * higher-tier repair door to reach for, and recovery is necessarily a seed or a direct database\n * write. That is precisely why the escape must be explicit, per-request, non-default and LOUD — the\n * operator's only chance to act is the record this emits, since nobody will discover the state by\n * being denied something later.\n */\nexport async function assertSuperAdminFloorForSubjectErasure(params: {\n  subjects: readonly (Pick<User, '_id' | 'appRoles' | 'status'> | undefined | null)[];\n  executionContext: ExecutionContext<any>;\n  repositoriesRegistry: RepositoriesRegistryHandlerBackendService;\n  errorBuilder: ErrorBuilderBackendService;\n  conferringRoles: readonly string[];\n  operationIdentifier: string;\n  /** The controller's explicit decision to complete an erasure that strands the application. */\n  acknowledgeFloorBreach?: boolean;\n  /** Invoked when the breach is acknowledged AND real. Never on the refusal path. */\n  onAcknowledgedBreach?: (breach: SuperAdminFloorBreach) => Promise<void> | void;\n}): Promise<void> {\n  if (!params.acknowledgeFloorBreach) {\n    await assertSuperAdminFloorPreservedForRemoval({\n      ...params,\n      cause: SuperAdminFloorReductionCause.ERASURE,\n    });\n    return;\n  }\n\n  // Acknowledged: nothing is refused, so the only remaining obligation is that the consequence is\n  // never silent. The same usability test still runs — an acknowledged erasure that removes no\n  // usable administrator must stay quiet, or the alert stops meaning anything.\n  const erasedUsableSuperAdminIds = params.subjects\n    .filter((subject) => isUsableSuperAdmin(subject, params.conferringRoles))\n    .map((subject) => String(subject!._id));\n\n  if (erasedUsableSuperAdminIds.length === 0) return;\n\n  await params.onAcknowledgedBreach?.({\n    erasedUsableSuperAdminIds,\n    conferringRoles: [...params.conferringRoles],\n  });\n}\n"]}

package/dist/esm/security/connected-accounts/connection-target-authorization.backend.d.ts

@@ -0,0 +1,60 @@
+/**
+ * MAY this execution act for THAT owner — the authorization half of a connection target.
+ *
+ * assurance-control: WILDO.ACCESS.SCOPE_CONFINEMENT — confines whose third-party account an execution
+ * may spend to the tenants the initiator actually belongs to.
+ * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — a unit-scoped grant confers no organization-wide
+ * authority here, and a platform operator's administrative reach does not extend to acting as a
+ * tenant toward a third party.
+ *
+ * The call NAMES whose account it spends; this decides whether it may. Keeping the two apart is what
+ * lets the target vary within one execution: a single user action pushing a message to every
+ * organization that user belongs to issues N calls with N owners and one initiator, so an authority
+ * derived from the ambient scope could not answer for more than the first.
+ *
+ * ## Membership, not current scope — and the difference is the whole point
+ *
+ * `initiatorIds.organizationId` is the tenant the request is ACTING IN, and it is trustworthy: the
+ * execution-context creator validates a requested organization against the caller's memberships and
+ * refuses one they do not belong to. It is also singular, so testing against it would refuse the
+ * fan-out above — the caller legitimately spends several tenants' accounts under one ambient scope.
+ *
+ * `initiatorRoles` carries the full set: one entry per organization the initiator belongs to, built
+ * at authentication from real memberships and not authorable by a caller. That set is exactly the
+ * question this asks, and asking it needs no database read — which matters, because this runs on
+ * every outbound provider call.
+ *
+ * ## Organization-WIDE membership only
+ *
+ * A unit-scoped role entry is deliberately not enough. Spending a tenant's credential acts as the
+ * WHOLE workspace toward the vendor — there is no such thing as sending a Slack message as one
+ * department — so admitting a unit-scoped grant would turn "manager of Sales" into "may act as the
+ * entire tenant toward every third party it has connected". That is the escalation
+ * `isOrganizationWideRoleInfo` exists to prevent, and this asks through it rather than testing the
+ * narrowing field by hand.
+ *
+ * ## What is deliberately REFUSED here, rather than forgotten
+ *
+ * A platform operator who is not a member cannot spend a tenant's provider credential, even holding
+ * `APP_ADMIN_SUPER_ADMIN`. Cross-tenant administrative reach exists and is declared per operation
+ * variant, and since the access-grant work it also requires a usable, time-bound grant — but none of
+ * that has been extended to mean "may act as this tenant toward a third party", which is a different
+ * and larger act than administering its rows: it produces effects in a system Wildo does not own,
+ * under the tenant's identity, where no later review can reach them. Admitting it is a decision with
+ * its own evidence, not a corollary of an existing door.
+ *
+ * An unattributed internal call is refused for a mechanical reason on top of that one: an
+ * `INTERNALLY_INITIATED_REQUEST` is forbidden from carrying an `organizationId` at all, so a
+ * background job that must spend a tenant's account has to run under the originating principal
+ * (`createForDeferredAuthorizedEffect`) or an `ORGANIZATION_MACHINE` identity. Falling back to the
+ * application's account instead is the substitution this whole subsystem exists to remove.
+ */
+import type { ExternalProvider_ConnectionTarget } from '@wildo-ai/external-connectors-models';
+import type { ExecutionContext } from '../../runtime/models/execution-context.backend.schemas';
+import type { ConnectionTargetAuthorizationPort } from '../../base-classes/services/repositories/http-api/http-api-provider-access.backend';
+/** Every organization the initiator belongs to ORGANIZATION-WIDE. */
+export declare function organizationWideMembershipsOf(executionContext: unknown): readonly string[];
+export declare class InitiatorMembershipConnectionTargetAuthorization implements ConnectionTargetAuthorizationPort {
+    mayActFor(target: ExternalProvider_ConnectionTarget, executionContext: ExecutionContext<any>): Promise<boolean>;
+}
+//# sourceMappingURL=connection-target-authorization.backend.d.ts.map

package/dist/esm/security/connected-accounts/connection-target-authorization.backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-target-authorization.backend.d.ts","sourceRoot":"","sources":["../../../../../src/security/connected-accounts/connection-target-authorization.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAIH,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,sCAAsC,CAAC;AAE9F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAC5G,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,iGAAiG,CAAC;AAazJ,qEAAqE;AACrE,wBAAgB,6BAA6B,CAAC,gBAAgB,EAAE,OAAO,GAAG,SAAS,MAAM,EAAE,CAW1F;AAED,qBAAa,gDAAiD,YAAW,iCAAiC;IAC3F,SAAS,CACpB,MAAM,EAAE,iCAAiC,EACzC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,OAAO,CAAC;CAapB"}

package/dist/esm/security/connected-accounts/connection-target-authorization.backend.js

@@ -0,0 +1,79 @@
+/**
+ * MAY this execution act for THAT owner — the authorization half of a connection target.
+ *
+ * assurance-control: WILDO.ACCESS.SCOPE_CONFINEMENT — confines whose third-party account an execution
+ * may spend to the tenants the initiator actually belongs to.
+ * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — a unit-scoped grant confers no organization-wide
+ * authority here, and a platform operator's administrative reach does not extend to acting as a
+ * tenant toward a third party.
+ *
+ * The call NAMES whose account it spends; this decides whether it may. Keeping the two apart is what
+ * lets the target vary within one execution: a single user action pushing a message to every
+ * organization that user belongs to issues N calls with N owners and one initiator, so an authority
+ * derived from the ambient scope could not answer for more than the first.
+ *
+ * ## Membership, not current scope — and the difference is the whole point
+ *
+ * `initiatorIds.organizationId` is the tenant the request is ACTING IN, and it is trustworthy: the
+ * execution-context creator validates a requested organization against the caller's memberships and
+ * refuses one they do not belong to. It is also singular, so testing against it would refuse the
+ * fan-out above — the caller legitimately spends several tenants' accounts under one ambient scope.
+ *
+ * `initiatorRoles` carries the full set: one entry per organization the initiator belongs to, built
+ * at authentication from real memberships and not authorable by a caller. That set is exactly the
+ * question this asks, and asking it needs no database read — which matters, because this runs on
+ * every outbound provider call.
+ *
+ * ## Organization-WIDE membership only
+ *
+ * A unit-scoped role entry is deliberately not enough. Spending a tenant's credential acts as the
+ * WHOLE workspace toward the vendor — there is no such thing as sending a Slack message as one
+ * department — so admitting a unit-scoped grant would turn "manager of Sales" into "may act as the
+ * entire tenant toward every third party it has connected". That is the escalation
+ * `isOrganizationWideRoleInfo` exists to prevent, and this asks through it rather than testing the
+ * narrowing field by hand.
+ *
+ * ## What is deliberately REFUSED here, rather than forgotten
+ *
+ * A platform operator who is not a member cannot spend a tenant's provider credential, even holding
+ * `APP_ADMIN_SUPER_ADMIN`. Cross-tenant administrative reach exists and is declared per operation
+ * variant, and since the access-grant work it also requires a usable, time-bound grant — but none of
+ * that has been extended to mean "may act as this tenant toward a third party", which is a different
+ * and larger act than administering its rows: it produces effects in a system Wildo does not own,
+ * under the tenant's identity, where no later review can reach them. Admitting it is a decision with
+ * its own evidence, not a corollary of an existing door.
+ *
+ * An unattributed internal call is refused for a mechanical reason on top of that one: an
+ * `INTERNALLY_INITIATED_REQUEST` is forbidden from carrying an `organizationId` at all, so a
+ * background job that must spend a tenant's account has to run under the originating principal
+ * (`createForDeferredAuthorizedEffect`) or an `ORGANIZATION_MACHINE` identity. Falling back to the
+ * application's account instead is the substitution this whole subsystem exists to remove.
+ */
+import { ResourcePrimaryScope, isOrganizationWideRoleInfo } from '@wildo-ai/saas-models';
+import { ExternalProvider_Connection_OwnerScope } from '@wildo-ai/external-connectors-models';
+/** Every organization the initiator belongs to ORGANIZATION-WIDE. */
+export function organizationWideMembershipsOf(executionContext) {
+    const signal = executionContext;
+    return [
+        ...new Set((signal.initiatorRoles ?? [])
+            .filter((roleInfo) => roleInfo.relatedPrimaryScope === ResourcePrimaryScope.ORGANIZATIONS)
+            .filter((roleInfo) => isOrganizationWideRoleInfo(roleInfo))
+            .map((roleInfo) => roleInfo.relatedResourceId)
+            .filter((organizationId) => typeof organizationId === 'string' && organizationId.length > 0)),
+    ];
+}
+export class InitiatorMembershipConnectionTargetAuthorization {
+    async mayActFor(target, executionContext) {
+        if (target.ownerScope === ExternalProvider_Connection_OwnerScope.APPLICATION)
+            return true;
+        if (target.ownerScope === ExternalProvider_Connection_OwnerScope.USER) {
+            // Only the person themselves. A personal key is not something an administrator may spend on
+            // the holder's behalf: the vendor would record the act as the holder's, and consent to store
+            // a key is not consent for someone else to use it.
+            const userId = executionContext.initiatorIds?.userId;
+            return typeof userId === 'string' && userId === target.ownerId;
+        }
+        return organizationWideMembershipsOf(executionContext).includes(target.ownerId ?? '');
+    }
+}
+//# sourceMappingURL=connection-target-authorization.backend.js.map

package/dist/esm/security/connected-accounts/connection-target-authorization.backend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-target-authorization.backend.js","sourceRoot":"","sources":["../../../../../src/security/connected-accounts/connection-target-authorization.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAEH,OAAO,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACzF,OAAO,EAAE,sCAAsC,EAAE,MAAM,sCAAsC,CAAC;AAiB9F,qEAAqE;AACrE,MAAM,UAAU,6BAA6B,CAAC,gBAAyB;IACrE,MAAM,MAAM,GAAG,gBAAmC,CAAC;IACnD,OAAO;QACL,GAAG,IAAI,GAAG,CACR,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,mBAAmB,KAAK,oBAAoB,CAAC,aAAa,CAAC;aACzF,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,0BAA0B,CAAC,QAAiB,CAAC,CAAC;aACnE,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC;aAC7C,MAAM,CAAC,CAAC,cAAc,EAA4B,EAAE,CAAC,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CACzH;KACF,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,gDAAgD;IACpD,KAAK,CAAC,SAAS,CACpB,MAAyC,EACzC,gBAAuC;QAEvC,IAAI,MAAM,CAAC,UAAU,KAAK,sCAAsC,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QAE1F,IAAI,MAAM,CAAC,UAAU,KAAK,sCAAsC,CAAC,IAAI,EAAE,CAAC;YACtE,4FAA4F;YAC5F,6FAA6F;YAC7F,mDAAmD;YACnD,MAAM,MAAM,GAAI,gBAAoC,CAAC,YAAY,EAAE,MAAM,CAAC;YAC1E,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,MAAM,CAAC,OAAO,CAAC;QACjE,CAAC;QAED,OAAO,6BAA6B,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IACxF,CAAC;CACF","sourcesContent":["/**\n * MAY this execution act for THAT owner — the authorization half of a connection target.\n *\n * assurance-control: WILDO.ACCESS.SCOPE_CONFINEMENT — confines whose third-party account an execution\n * may spend to the tenants the initiator actually belongs to.\n * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — a unit-scoped grant confers no organization-wide\n * authority here, and a platform operator's administrative reach does not extend to acting as a\n * tenant toward a third party.\n *\n * The call NAMES whose account it spends; this decides whether it may. Keeping the two apart is what\n * lets the target vary within one execution: a single user action pushing a message to every\n * organization that user belongs to issues N calls with N owners and one initiator, so an authority\n * derived from the ambient scope could not answer for more than the first.\n *\n * ## Membership, not current scope — and the difference is the whole point\n *\n * `initiatorIds.organizationId` is the tenant the request is ACTING IN, and it is trustworthy: the\n * execution-context creator validates a requested organization against the caller's memberships and\n * refuses one they do not belong to. It is also singular, so testing against it would refuse the\n * fan-out above — the caller legitimately spends several tenants' accounts under one ambient scope.\n *\n * `initiatorRoles` carries the full set: one entry per organization the initiator belongs to, built\n * at authentication from real memberships and not authorable by a caller. That set is exactly the\n * question this asks, and asking it needs no database read — which matters, because this runs on\n * every outbound provider call.\n *\n * ## Organization-WIDE membership only\n *\n * A unit-scoped role entry is deliberately not enough. Spending a tenant's credential acts as the\n * WHOLE workspace toward the vendor — there is no such thing as sending a Slack message as one\n * department — so admitting a unit-scoped grant would turn \"manager of Sales\" into \"may act as the\n * entire tenant toward every third party it has connected\". That is the escalation\n * `isOrganizationWideRoleInfo` exists to prevent, and this asks through it rather than testing the\n * narrowing field by hand.\n *\n * ## What is deliberately REFUSED here, rather than forgotten\n *\n * A platform operator who is not a member cannot spend a tenant's provider credential, even holding\n * `APP_ADMIN_SUPER_ADMIN`. Cross-tenant administrative reach exists and is declared per operation\n * variant, and since the access-grant work it also requires a usable, time-bound grant — but none of\n * that has been extended to mean \"may act as this tenant toward a third party\", which is a different\n * and larger act than administering its rows: it produces effects in a system Wildo does not own,\n * under the tenant's identity, where no later review can reach them. Admitting it is a decision with\n * its own evidence, not a corollary of an existing door.\n *\n * An unattributed internal call is refused for a mechanical reason on top of that one: an\n * `INTERNALLY_INITIATED_REQUEST` is forbidden from carrying an `organizationId` at all, so a\n * background job that must spend a tenant's account has to run under the originating principal\n * (`createForDeferredAuthorizedEffect`) or an `ORGANIZATION_MACHINE` identity. Falling back to the\n * application's account instead is the substitution this whole subsystem exists to remove.\n */\n\nimport { ResourcePrimaryScope, isOrganizationWideRoleInfo } from '@wildo-ai/saas-models';\nimport { ExternalProvider_Connection_OwnerScope } from '@wildo-ai/external-connectors-models';\nimport type { ExternalProvider_ConnectionTarget } from '@wildo-ai/external-connectors-models';\n\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport type { ConnectionTargetAuthorizationPort } from '~wildo-backend-lib/base-classes/services/repositories/http-api/http-api-provider-access.backend';\n\n/** The narrow view this authority needs. Kept minimal so a unit harness need not build a context. */\ninterface InitiatorSignal {\n  readonly initiatorIds?: { readonly userId?: string | null } | null;\n  readonly initiatorRoles?: readonly {\n    readonly relatedPrimaryScope: ResourcePrimaryScope;\n    readonly relatedResourceId?: string;\n    readonly organizationUnitId?: string;\n    readonly roles: readonly string[];\n  }[] | null;\n}\n\n/** Every organization the initiator belongs to ORGANIZATION-WIDE. */\nexport function organizationWideMembershipsOf(executionContext: unknown): readonly string[] {\n  const signal = executionContext as InitiatorSignal;\n  return [\n    ...new Set(\n      (signal.initiatorRoles ?? [])\n        .filter((roleInfo) => roleInfo.relatedPrimaryScope === ResourcePrimaryScope.ORGANIZATIONS)\n        .filter((roleInfo) => isOrganizationWideRoleInfo(roleInfo as never))\n        .map((roleInfo) => roleInfo.relatedResourceId)\n        .filter((organizationId): organizationId is string => typeof organizationId === 'string' && organizationId.length > 0),\n    ),\n  ];\n}\n\nexport class InitiatorMembershipConnectionTargetAuthorization implements ConnectionTargetAuthorizationPort {\n  public async mayActFor(\n    target: ExternalProvider_ConnectionTarget,\n    executionContext: ExecutionContext<any>,\n  ): Promise<boolean> {\n    if (target.ownerScope === ExternalProvider_Connection_OwnerScope.APPLICATION) return true;\n\n    if (target.ownerScope === ExternalProvider_Connection_OwnerScope.USER) {\n      // Only the person themselves. A personal key is not something an administrator may spend on\n      // the holder's behalf: the vendor would record the act as the holder's, and consent to store\n      // a key is not consent for someone else to use it.\n      const userId = (executionContext as InitiatorSignal).initiatorIds?.userId;\n      return typeof userId === 'string' && userId === target.ownerId;\n    }\n\n    return organizationWideMembershipsOf(executionContext).includes(target.ownerId ?? '');\n  }\n}\n"]}

package/dist/esm/security/connected-accounts/controllers/provider-connection.controller.backend.service.d.ts

@@ -0,0 +1,161 @@
+/**
+ * Connecting a third-party account — the two HTTP legs of the authorization-code flow.
+ *
+ * `POST /connections/:providerRef/start` answers with the URL to send somebody to.
+ * `GET  /connections/callback`           receives them back and stores the grant.
+ *
+ * ## The opposite direction from the OAuth controller next door
+ *
+ * `oauth-provider-controller` makes this application an OAuth PROVIDER, and
+ * `authentication-controller` signs people IN using a vendor as their identity provider. This
+ * connects a vendor account so the application can act AS that account. Same RFC, opposite arrow,
+ * and nothing is shared but the specification.
+ *
+ * ## Everything arriving on the callback is attacker-controllable
+ *
+ * The callback is reached by a redirect through the person's own browser. Its query string is
+ * whatever somebody put there. So the callback trusts NOTHING from its own URL except the `state`,
+ * which it uses only as a lookup key — the provider, the owner, the PKCE verifier and the redirect
+ * URI all come from the record that was written when the redirect went out. A callback that read the
+ * owner from a query parameter would let anybody choose whose account a grant is stored against.
+ *
+ * ## Why the start leg returns a URL instead of redirecting
+ *
+ * The caller is a fetch from a settings screen, not a browser navigation. A 302 to a vendor would be
+ * followed by the fetch, produce an opaque cross-origin response, and never reach the person — the
+ * consent screen would render into a response body nobody sees. The screen navigates itself.
+ *
+ * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — a principal authorizes this
+ * application to act toward a named third party on their behalf.
+ */
+import 'reflect-metadata';
+import { AbstractControllerBackendService } from '../../../base-classes/services/controllers/abstract-controller.backend.service';
+import type { LoggerService } from '../../../monitoring/logger/services/logger.service';
+import type { ErrorBuilderBackendService } from '../../../errors/services/error-builder.backend.service';
+import type { ErrorHandlerService } from '../../../errors/services/error-handler.backend.service';
+import type { AuthJwtGuardBackendService } from '../../../security/jwt/services/auth-jwt-guard.backend.service';
+import type { AuthExecutionContextFactoryBackendService } from '../../../security/authentications/services/auth-execution-context-factory.backend.service';
+import type { ExternalProvidersRegistryBackendService } from '../../../external-providers/services/external-providers-registry.backend.service';
+import type { ConnectionTargetAuthorizationPort } from '../../../base-classes/services/repositories/http-api/http-api-provider-access.backend';
+import type { AppConfigurationService } from '../../../config/services/app-configuration.backend.service';
+import type { ProviderOAuth2PendingAuthorizationBackendService } from '../services/provider-oauth2-pending-authorization.backend.service';
+import type { UserProviderCredentialStoreBackendService } from '../services/user-provider-credential-store.backend.service';
+import type { OrganizationProviderCredentialStoreBackendService } from '../services/organization-provider-credential-store.backend.service';
+export declare class ProviderConnectionControllerBackendService extends AbstractControllerBackendService {
+    private readonly authJwtGuard;
+    private readonly authEcFactory;
+    private readonly registry;
+    private readonly pending;
+    private readonly targetAuthorization;
+    private readonly userCredentials;
+    private readonly organizationCredentials;
+    private readonly appConfig;
+    constructor(logger: LoggerService, errorBuilder: ErrorBuilderBackendService, errorHandler: ErrorHandlerService, authJwtGuard: AuthJwtGuardBackendService, authEcFactory: AuthExecutionContextFactoryBackendService, registry: ExternalProvidersRegistryBackendService, pending: ProviderOAuth2PendingAuthorizationBackendService, targetAuthorization: ConnectionTargetAuthorizationPort, userCredentials: UserProviderCredentialStoreBackendService, organizationCredentials: OrganizationProviderCredentialStoreBackendService, appConfig: AppConfigurationService);
+    protected setupRoutes(): void;
+    /**
+     * What can be connected — the question the stored-credential list cannot answer.
+     *
+     * A settings screen listing somebody's connections shows an empty table on the day they have none,
+     * which is precisely the day they need to learn what they might connect. So the CATALOGUE and the
+     * ROWS are two reads, deliberately: this one is about the provider, the resource LIST is about the
+     * person, and merging them would make "nothing connected" and "nothing connectable" indistinguishable.
+     *
+     * ## It reports a DECISION, and computes nothing
+     *
+     * `admissibleConnections` is the recorded decision in the provider's catalogue record — never
+     * derived from what a vendor's API happens to support. A vendor with a personal-token endpoint does
+     * not thereby become a provider a person may connect individually; somebody decided that, and this
+     * route repeats what they decided.
+     *
+     * ## It answers ADMISSIBILITY, not AUTHORIZATION, and that split is not laziness
+     *
+     * Whether this caller may act for a given owner depends on the owner's ID, which a catalogue has
+     * none of — an organization-scoped shape is admissible for the provider while the caller may be
+     * entitled to act for one tenant and not another. So the start leg keeps both gates in the same
+     * order every credential path uses, and a screen that renders an owner it cannot act for gets a
+     * 403 there rather than a silently missing row here.
+     *
+     * ## Nothing here is a secret
+     *
+     * Which vendors an application integrates with is a property of the application, visible on its own
+     * marketing pages. No token, no client secret, no env-var VALUE is reported — `connectionParameters`
+     * names the placeholders a connection must ANSWER, which is an input to ask a person for.
+     */
+    private handleCatalogue;
+    /**
+     * Leg one: decide whether this caller may connect this target, and hand back the URL.
+     *
+     * The two gates are the SAME pair every credential path goes through, in the same order.
+     * ADMISSIBLE — does this provider admit this owner scope at all? AUTHORIZED — may this execution
+     * act for that owner? Running them here rather than only at the callback means a person who cannot
+     * connect is told so before being sent to a vendor, rather than after granting consent.
+     */
+    private handleStart;
+    /**
+     * Leg two: the person comes back with a code.
+     *
+     * Consuming the record is the first thing that happens, and it is atomic — so a replayed callback
+     * finds nothing and there is no window in which two concurrent callbacks both proceed.
+     */
+    private handleCallback;
+    /**
+     * End the callback the way a BROWSER expects: a redirect, never a payload.
+     *
+     * This leg is reached by the vendor redirecting the person's own browser. Whatever it writes is
+     * rendered as a page, so answering `res.json(...)` — which this flow did until it was driven —
+     * shows somebody who has just granted consent a raw JSON blob on a backend origin, with no way
+     * back. Every exit therefore lands them on the settings screen they started from, with the outcome
+     * in the query string for that screen to render.
+     *
+     * The frontend is resolved from the RECORD's `frontendServiceName`, never from a header: the
+     * vendor's redirect carries none of Wildo's own headers. When it cannot be resolved — an attempt
+     * whose record is exactly what is missing, or a caller that omitted the header at start — the
+     * fallback is a minimal HTML page rather than JSON. It says the same thing in the same medium the
+     * browser is already rendering.
+     *
+     * Status is 303, not 302: the callback arrives as a GET and the destination is a different
+     * resource to fetch with GET, which is what 303 means.
+     * spec-cite: RFC 9110 §15.4.4 (303 See Other).
+     */
+    private finishInBrowser;
+    /**
+     * Route the minted grant to the store that owns the owner's table.
+     *
+     * The target comes from the PENDING RECORD, so the row is written for whoever the authorized
+     * attempt named. Reading it from the callback's request instead would let somebody choose whose
+     * account a grant lands on — the failure the whole state mechanism exists to prevent.
+     *
+     * An APPLICATION target has no store: the deployment's own credential lives in the environment,
+     * and a connect flow that produced one would be writing a row nobody reads.
+     */
+    private storeGrantForTarget;
+    /**
+     * May this caller act for that owner?
+     *
+     * An APPLICATION target has exactly one instance and the application IS the caller, so there is no
+     * second party whose account might be spent. Every other target goes through the same membership
+     * port the resolution path uses — one answer to "may this execution act for that owner", not two
+     * that can disagree.
+     */
+    private mayActFor;
+    private requireClientId;
+    private requireClientSecret;
+    /**
+     * The redirect URI, built once and then carried in the pending record.
+     *
+     * Derived from the request's own origin so a deployment needs no extra configuration, and stored
+     * rather than rebuilt at the callback: a vendor verifies it byte-for-byte, and a proxy that
+     * rewrites the host would make the rebuilt one differ from the authorized one.
+     */
+    private callbackUrlFor;
+    private extractCaller;
+    /**
+     * One shape for every failure, and never the vendor's response body.
+     *
+     * A token endpoint's reply carries credentials even when it fails — several vendors echo the
+     * submitted client secret back in a validation message — so the message is logged with its detail
+     * and answered without it.
+     */
+    private handleControllerError;
+}
+//# sourceMappingURL=provider-connection.controller.backend.service.d.ts.map