@wildo-ai/saas-backend-lib 1.1.1 → 1.1.3

package/dist/esm/data-seeding/services/shared/data-seed-scope-iteration.shared.utils.d.ts

@@ -69,7 +69,7 @@ import type { DataSeedScopeResolverRegistryBackendService } from '../../../data-
 import { DataSeedScopeIterationStrategy } from '../../../data-seeding/models/data-seed.shared.schemas';
 /**
  * Page size for resource-table walks. Matches the schema cap on
- * `Resouces_PaginationRequestSchema.limit` (`max(100)`), which is the largest
+ * `Resources_PaginationRequestSchema.limit` (`max(100)`), which is the largest
  * value `repo.list({ paginated: true })` will accept. Going larger would be
  * silently rejected by the pagination Zod parse.
  */
@@ -159,7 +159,7 @@ export declare function iterateGlobal(): AsyncGenerator<DataSeedScopeIterationIt
  * the `DataSeedScopeIterationItem` union and instead consumes the bare
  * `{ relatedId }` form directly.
  *
- * Pagination is page-based (matches the `Resouces_PaginationRequestSchema`
+ * Pagination is page-based (matches the `Resources_PaginationRequestSchema`
  * `{ page, limit }` shape) — NOT skip-based. A page slip caused by
  * concurrent inserts/deletes is acceptable for cron seeding (the next tick
  * picks up the missed row); cursor-based stable pagination would add

package/dist/esm/data-seeding/services/shared/data-seed-scope-iteration.shared.utils.js

@@ -69,7 +69,7 @@ import { DataSeedScopeIterationStrategy } from '../../../data-seeding/models/dat
 // --------------------------------------------------------------------------
 /**
  * Page size for resource-table walks. Matches the schema cap on
- * `Resouces_PaginationRequestSchema.limit` (`max(100)`), which is the largest
+ * `Resources_PaginationRequestSchema.limit` (`max(100)`), which is the largest
  * value `repo.list({ paginated: true })` will accept. Going larger would be
  * silently rejected by the pagination Zod parse.
  */
@@ -106,7 +106,7 @@ export async function* iterateGlobal() {
  * the `DataSeedScopeIterationItem` union and instead consumes the bare
  * `{ relatedId }` form directly.
  *
- * Pagination is page-based (matches the `Resouces_PaginationRequestSchema`
+ * Pagination is page-based (matches the `Resources_PaginationRequestSchema`
  * `{ page, limit }` shape) — NOT skip-based. A page slip caused by
  * concurrent inserts/deletes is acceptable for cron seeding (the next tick
  * picks up the missed row); cursor-based stable pagination would add

package/dist/esm/data-seeding/services/shared/data-seed-scope-iteration.shared.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"data-seed-scope-iteration.shared.utils.js","sourceRoot":"","sources":["../../../../../../src/data-seeding/services/shared/data-seed-scope-iteration.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AAMH,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,8BAA8B,EAAE,MAAM,iEAAiE,CAAC;AAEjH,6EAA6E;AAC7E,WAAW;AACX,6EAA6E;AAE7E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4CAA4C,GAAG,GAAG,CAAC;AAEhE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAG,IAAI,CAAC;AA2EhE,6EAA6E;AAC7E,yBAAyB;AACzB,6EAA6E;AAE7E;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,aAAa;IAClC,MAAM,EAAE,IAAI,EAAE,8BAA8B,CAAC,MAAM,EAAE,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,oBAAoB,CACzC,YAAoB,EACpB,SAAgC,EAChC,IAAwC,EACxC,UAAyC,EAAE;IAE3C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,4CAA4C,CAAC;IACpF,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,2CAA2C,CAAC;IAEjF,MAAM,IAAI,GAAG,IAAI,CAAC,oBAAoB,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAE1E,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,OAAO,GAAG,IAAI,CAAC;IAEnB,OAAO,OAAO,IAAI,IAAI,IAAI,QAAQ,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAC5B,SAAS,EACT,EAAE,EACF,EAAE,SAAS,EAAE,IAAa,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CACtE,CAAC;QAEF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;QAC/B,CAAC;QAED,kEAAkE;QAClE,oDAAoD;QACpD,kEAAkE;QAClE,iEAAiE;QACjE,iEAAiE;QACjE,+DAA+D;QAC/D,iEAAiE;QACjE,8DAA8D;QAC9D,kEAAkE;QAClE,0DAA0D;QAC1D,mBAAmB;QACnB,MAAM,kBAAkB,GAAI,MAA8D,EAAE,UAAU,EAAE,UAAU,CAAC;QACnH,IAAI,OAAO,kBAAkB,KAAK,QAAQ,IAAI,kBAAkB,GAAG,CAAC,IAAI,IAAI,IAAI,kBAAkB,EAAE,CAAC;YACnG,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC;QAC7C,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC;IAED,IAAI,OAAO,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,wCAAwC,QAAQ,aAAa,YAAY,4BAA4B,EACrG,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,CACtC,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,sBAAsB,CAC3C,SAAgC,EAChC,IAAwC,EACxC,UAAyC,EAAE;IAE3C,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,oBAAoB,CAAC,gBAAgB,CAAC,WAAqB,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;QAChH,MAAM;YACJ,IAAI,EAAE,8BAA8B,CAAC,gBAAgB;YACrD,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,uBAAuB,CAC5C,SAAgC,EAChC,IAAwC,EACxC,UAAyC,EAAE;IAE3C,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,oBAAoB,CAAC,gBAAgB,CAAC,aAAuB,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;QAClH,MAAM;YACJ,IAAI,EAAE,8BAA8B,CAAC,iBAAiB;YACtD,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,eAAe,CACpC,SAAgC,EAChC,IAAwC,EACxC,UAAyC,EAAE;IAE3C,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,oBAAoB,CAAC,gBAAgB,CAAC,KAAe,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;QAC1G,MAAM;YACJ,IAAI,EAAE,8BAA8B,CAAC,SAAS;YAC9C,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,qBAAqB,CAC1C,iBAAyB,EACzB,SAAgC,EAChC,IAA+D;IAE/D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;IACpF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM;YACJ,IAAI,EAAE,8BAA8B,CAAC,eAAe;YACpD,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,aAAa;AACb,6EAA6E;AAE7E;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,YAAY,CAAC,KAM5B;IACC,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAExE,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,8BAA8B,CAAC,MAAM;YACxC,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CACb,wEAAwE,iBAAiB,mHAAmH,CAC7M,CAAC;YACJ,CAAC;YACD,OAAO,aAAa,EAAE,CAAC;QAEzB,KAAK,8BAA8B,CAAC,gBAAgB;YAClD,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CACb,kFAAkF,iBAAiB,KAAK,CACzG,CAAC;YACJ,CAAC;YACD,OAAO,sBAAsB,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAE1D,KAAK,8BAA8B,CAAC,iBAAiB;YACnD,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CACb,mFAAmF,iBAAiB,KAAK,CAC1G,CAAC;YACJ,CAAC;YACD,OAAO,uBAAuB,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAE3D,KAAK,8BAA8B,CAAC,SAAS;YAC3C,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CACb,2EAA2E,iBAAiB,KAAK,CAClG,CAAC;YACJ,CAAC;YACD,OAAO,eAAe,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAEnD,KAAK,8BAA8B,CAAC,eAAe;YACjD,IAAI,iBAAiB,KAAK,SAAS,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtE,MAAM,IAAI,KAAK,CACb,8LAA8L,CAC/L,CAAC;YACJ,CAAC;YACD,OAAO,qBAAqB,CAAC,iBAAiB,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACrE,CAAC;AACH,CAAC","sourcesContent":["/**\n * `data-seed-scope-iteration` — pure async-iterator helpers that translate a\n * {@link DataSeedScopeIterationStrategy} into a stream of `relatedId`s to\n * dispatch a seed against.\n *\n * Phase 7 / Item 47 (cron scheduler) — Slice 4. Designed to be reusable by\n * Item 51 (multi-tenant UPGRADE/SYNC for the synchronous Level-A path), so\n * lives under `shared/` rather than under `services/engines/`.\n *\n * --------------------------------------------------------------------------\n * Why iterators, not realized arrays\n * --------------------------------------------------------------------------\n * Cron seeds will be scheduled across potentially-large core-resource tables\n * (every `applications`, every `users`, every `organizations`). Buffering an\n * entire tenant table into memory before dispatching the first seed run\n * would (a) blow heap on large fleets, (b) push first-run latency to the end\n * of the page-walk, (c) lose the natural per-row failure-isolation boundary\n * the cron batch needs (Slice 5, N6 / Q5=E2 — one row's failure must NOT\n * stop the next row).\n *\n * `AsyncIterable<{ relatedId }>` matches the `for await (const item of …)`\n * loop the cron's `doHandle` body wants and lets the underlying paginator\n * fetch one page at a time on demand.\n *\n * --------------------------------------------------------------------------\n * Discriminated `kind` — why it travels with each item\n * --------------------------------------------------------------------------\n * The cron batch needs to know which scope-kind the iterator produced so it\n * can build the correct {@link DataSeedScopeArg} for `runManual` (different\n * `kind`s carry different anchor fields downstream). Putting the\n * discriminator on each yielded item — instead of returning a tuple of\n * `(kind, AsyncIterable<{ relatedId }>)` — keeps the cron's per-row branch\n * collapsed into a single `switch (item.kind)` and means the iterator can,\n * in a future slice, mix kinds (e.g. a custom resolver that yields both\n * org-anchored and user-anchored rows) without breaking the contract.\n *\n * --------------------------------------------------------------------------\n * Pagination cap\n * --------------------------------------------------------------------------\n * Each per-resource walker (`iterateAllOfResource`) runs a defensive\n * `MAX_PAGES` ceiling — same defence-in-depth pattern as\n * `dormancy-detection.batch.backend.service.ts`'s `MAX_PAGES = 50`, but\n * raised to {@link DEFAULT_DATA_SEED_SCOPE_ITERATION_MAX_PAGES} (1000) here\n * because cron iteration is read-only (no in-walk state mutation removes\n * rows) and large fleets can legitimately reach 100k+ rows. Hitting the cap\n * triggers a `logger.warn` and ends the iteration cleanly — never a throw,\n * because Slice 5's per-iteration error containment expects the iterator to\n * always close.\n *\n * --------------------------------------------------------------------------\n * Why `parentCtx` is `ExecutionContext<any>`\n * --------------------------------------------------------------------------\n * The cron batch builds the parent context via\n * `ExecutionContextCreatorBackendService.createForInternalSystemOperation`\n * (super-admin authority, `INTERNALLY_INITIATED_REQUEST` initiator). The\n * helpers don't narrow further because:\n *  - `repo.list(executionContext, …)` accepts `ExecutionContext<any>`;\n *  - `DataSeedScopeResolver` was deliberately typed against the same\n *    `ExecutionContext<any>` (Slice 3) so resolvers can do arbitrary\n *    repository reads.\n * Narrowing to a custom `DataSeedingCronExecutionContext` brand here would\n * force every test to construct that brand without buying any safety the\n * Slice-3 design didn't already cover.\n */\n\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport type { RepositoriesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/repositories/repositories-registry-handler.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport type { DataSeedScopeResolverRegistryBackendService } from '~wildo-backend-lib/data-seeding/services/data-seed-scope-resolver-registry.backend.service';\nimport { CoreResourceType } from '@wildo-ai/saas-models';\nimport { DataSeedScopeIterationStrategy } from '~wildo-backend-lib/data-seeding/models/data-seed.shared.schemas';\n\n// --------------------------------------------------------------------------\n// Defaults\n// --------------------------------------------------------------------------\n\n/**\n * Page size for resource-table walks. Matches the schema cap on\n * `Resouces_PaginationRequestSchema.limit` (`max(100)`), which is the largest\n * value `repo.list({ paginated: true })` will accept. Going larger would be\n * silently rejected by the pagination Zod parse.\n */\nexport const DEFAULT_DATA_SEED_SCOPE_ITERATION_BATCH_SIZE = 100;\n\n/**\n * Defence-in-depth ceiling for `iterateAllOfResource`. Sized to allow 100k\n * rows at the default batch size while still bounding a runaway iterator\n * (e.g. a misbehaving paginator that always returns `data.length === limit`\n * regardless of progress). Hitting the cap is a warning, not an error — the\n * iterator simply ends and the cron emits a partial-iteration report.\n */\nexport const DEFAULT_DATA_SEED_SCOPE_ITERATION_MAX_PAGES = 1000;\n\n// --------------------------------------------------------------------------\n// Yielded shape\n// --------------------------------------------------------------------------\n\n/**\n * One emitted iteration item. Discriminated by `kind` so the cron batch's\n * per-row dispatch loop can `switch (item.kind)` without re-correlating\n * against the originating strategy.\n *\n * `GLOBAL` carries no `relatedId` — the seed dispatches once with\n * `scope: { kind: GLOBAL }` and there is no per-row anchor to attach.\n * Modeling this as a separate union variant (vs `relatedId: null`) means\n * downstream consumers cannot accidentally treat the global tick as a\n * row-anchored dispatch — TypeScript's exhaustiveness check forces them to\n * branch.\n */\nexport type DataSeedScopeIterationItem =\n  | { readonly kind: DataSeedScopeIterationStrategy.GLOBAL }\n  | {\n      readonly kind: DataSeedScopeIterationStrategy.ALL_APPLICATIONS;\n      readonly relatedId: string;\n    }\n  | {\n      readonly kind: DataSeedScopeIterationStrategy.ALL_ORGANIZATIONS;\n      readonly relatedId: string;\n    }\n  | {\n      readonly kind: DataSeedScopeIterationStrategy.ALL_USERS;\n      readonly relatedId: string;\n    }\n  | {\n      readonly kind: DataSeedScopeIterationStrategy.CUSTOM_RESOLVER;\n      readonly relatedId: string;\n    };\n\n// --------------------------------------------------------------------------\n// Dependency bundles\n// --------------------------------------------------------------------------\n\n/**\n * Dependencies the resource-walker iterators need. Bundled into a single\n * object so test harnesses construct one fixture and reuse it across all\n * three `ALL_*` strategies, and so future additions (e.g. a metrics emitter)\n * don't ripple through every per-strategy call site.\n */\nexport interface DataSeedScopeResourceIterationDeps {\n  readonly repositoriesRegistry: RepositoriesRegistryHandlerBackendService;\n  readonly logger: LoggerService;\n}\n\n/**\n * Dependencies the {@link iterateScope} dispatcher needs. Superset of\n * {@link DataSeedScopeResourceIterationDeps} — adds the resolver registry\n * for the `CUSTOM_RESOLVER` branch. The dispatcher accepts the broader\n * shape so callers (e.g. the Slice-5 batch) build one deps object regardless\n * of which strategy a given seed declares.\n */\nexport interface DataSeedScopeIterationDeps extends DataSeedScopeResourceIterationDeps {\n  readonly scopeResolverRegistry: DataSeedScopeResolverRegistryBackendService;\n}\n\n/**\n * Per-call options shared by the `ALL_*` resource walkers.\n *\n * `batchSize` and `maxPages` default to the module-level constants; tests\n * override them to keep fixtures small without losing the production\n * default-path coverage.\n */\nexport interface DataSeedScopeIterationOptions {\n  readonly batchSize?: number;\n  readonly maxPages?: number;\n}\n\n// --------------------------------------------------------------------------\n// Per-strategy iterators\n// --------------------------------------------------------------------------\n\n/**\n * Yield the single `GLOBAL` sentinel.\n *\n * Modeled as an async iterator (not a `[item]` literal) so the cron batch\n * can `for await (const item of iterateScope(...))` for every strategy\n * uniformly — strategy-specific branching at the call site would defeat the\n * dispatcher's purpose.\n */\nexport async function* iterateGlobal(): AsyncGenerator<DataSeedScopeIterationItem> {\n  yield { kind: DataSeedScopeIterationStrategy.GLOBAL };\n}\n\n/**\n * Generic page-walker over a single core resource. Used by the three\n * `ALL_*` strategy iterators below.\n *\n * Yields `{ relatedId }` (no `kind`) — the caller wraps each item with the\n * appropriate `kind` discriminator. This separation means the walker stays\n * reusable for Item 51's tenant-aware UPGRADE/SYNC path, which doesn't fit\n * the `DataSeedScopeIterationItem` union and instead consumes the bare\n * `{ relatedId }` form directly.\n *\n * Pagination is page-based (matches the `Resouces_PaginationRequestSchema`\n * `{ page, limit }` shape) — NOT skip-based. A page slip caused by\n * concurrent inserts/deletes is acceptable for cron seeding (the next tick\n * picks up the missed row); cursor-based stable pagination would add\n * complexity for a cost the cron use-case doesn't pay.\n *\n * Defensive `MAX_PAGES` ceiling guards against a misbehaving paginator that\n * never empties — see module header. Hitting the cap is a `logger.warn`,\n * not a throw, so the cron's per-seed iteration always closes cleanly.\n */\nexport async function* iterateAllOfResource(\n  resourceType: string,\n  parentCtx: ExecutionContext<any>,\n  deps: DataSeedScopeResourceIterationDeps,\n  options: DataSeedScopeIterationOptions = {},\n): AsyncGenerator<{ readonly relatedId: string }> {\n  const batchSize = options.batchSize ?? DEFAULT_DATA_SEED_SCOPE_ITERATION_BATCH_SIZE;\n  const maxPages = options.maxPages ?? DEFAULT_DATA_SEED_SCOPE_ITERATION_MAX_PAGES;\n\n  const repo = deps.repositoriesRegistry.getRepositoryOrThrow(resourceType);\n\n  let page = 1;\n  let hasMore = true;\n\n  while (hasMore && page <= maxPages) {\n    const result = await repo.list<{ _id: string }>(\n      parentCtx,\n      {},\n      { paginated: true as const, listOptions: { page, limit: batchSize } },\n    );\n\n    for (const row of result.data) {\n      yield { relatedId: row._id };\n    }\n\n    // Audit L3-2 (post-Phase-7 close-out): defence-in-depth `hasMore`\n    // computation. The primary signal is the historical\n    // `data.length === batchSize` heuristic (works when the paginator\n    // returns short pages reliably). Where a `pagination.totalPages`\n    // value is also reported, we cross-check it: if the current page\n    // index is at-or-past `totalPages`, we trust the paginator and\n    // stop, even if the last page happened to be exactly `batchSize`\n    // long. This catches the \"buggy paginator that always returns\n    // length === limit\" failure mode the SKILL/docs claim is enforced\n    // here, and it short-circuits the MAX_PAGES walk on small\n    // resource tables.\n    const reportedTotalPages = (result as unknown as { pagination?: { totalPages?: number } })?.pagination?.totalPages;\n    if (typeof reportedTotalPages === 'number' && reportedTotalPages > 0 && page >= reportedTotalPages) {\n      hasMore = false;\n    } else {\n      hasMore = result.data.length === batchSize;\n    }\n    page++;\n  }\n\n  if (hasMore && page > maxPages) {\n    deps.logger.warn(\n      `iterateAllOfResource: hit MAX_PAGES (${maxPages}) cap on '${resourceType}' — iteration ended early.`,\n      { resourceType, maxPages, batchSize },\n    );\n  }\n}\n\n/**\n * Walk every `applications` row, yielding one item per `_id`. Thin wrapper\n * over {@link iterateAllOfResource} that attaches the\n * `ALL_APPLICATIONS` discriminator.\n */\nexport async function* iterateAllApplications(\n  parentCtx: ExecutionContext<any>,\n  deps: DataSeedScopeResourceIterationDeps,\n  options: DataSeedScopeIterationOptions = {},\n): AsyncGenerator<DataSeedScopeIterationItem> {\n  for await (const item of iterateAllOfResource(CoreResourceType.APPLICATION as string, parentCtx, deps, options)) {\n    yield {\n      kind: DataSeedScopeIterationStrategy.ALL_APPLICATIONS,\n      relatedId: item.relatedId,\n    };\n  }\n}\n\n/**\n * Walk every `organizations` row, yielding one item per `_id`. Thin\n * wrapper over {@link iterateAllOfResource} that attaches the\n * `ALL_ORGANIZATIONS` discriminator.\n */\nexport async function* iterateAllOrganizations(\n  parentCtx: ExecutionContext<any>,\n  deps: DataSeedScopeResourceIterationDeps,\n  options: DataSeedScopeIterationOptions = {},\n): AsyncGenerator<DataSeedScopeIterationItem> {\n  for await (const item of iterateAllOfResource(CoreResourceType.ORGANIZATIONS as string, parentCtx, deps, options)) {\n    yield {\n      kind: DataSeedScopeIterationStrategy.ALL_ORGANIZATIONS,\n      relatedId: item.relatedId,\n    };\n  }\n}\n\n/**\n * Walk every `users` row, yielding one item per `_id`. Thin wrapper over\n * {@link iterateAllOfResource} that attaches the `ALL_USERS`\n * discriminator.\n */\nexport async function* iterateAllUsers(\n  parentCtx: ExecutionContext<any>,\n  deps: DataSeedScopeResourceIterationDeps,\n  options: DataSeedScopeIterationOptions = {},\n): AsyncGenerator<DataSeedScopeIterationItem> {\n  for await (const item of iterateAllOfResource(CoreResourceType.USERS as string, parentCtx, deps, options)) {\n    yield {\n      kind: DataSeedScopeIterationStrategy.ALL_USERS,\n      relatedId: item.relatedId,\n    };\n  }\n}\n\n/**\n * Resolve the registered scope resolver for `customResolverKey` and yield\n * each `{ relatedId }` row it produces, tagged with the\n * `CUSTOM_RESOLVER` discriminator.\n *\n * The resolver lookup goes through\n * {@link DataSeedScopeResolverRegistryBackendService.resolve} — a missing\n * key throws `ErrorType.CONFIGURATION` from the registry (Slice 3\n * contract); a resolver-internal throw bubbles up unchanged. Slice 5's\n * per-iteration `try/catch` is the containment layer (N6 / Q5=E2) — the\n * iterator deliberately does NOT catch, so the cron can record the failing\n * `seedKey` in `report.failedSeedKeys` and continue with the next seed.\n */\nexport async function* iterateCustomResolver(\n  customResolverKey: string,\n  parentCtx: ExecutionContext<any>,\n  deps: Pick<DataSeedScopeIterationDeps, 'scopeResolverRegistry'>,\n): AsyncGenerator<DataSeedScopeIterationItem> {\n  const rows = await deps.scopeResolverRegistry.resolve(customResolverKey, parentCtx);\n  for (const row of rows) {\n    yield {\n      kind: DataSeedScopeIterationStrategy.CUSTOM_RESOLVER,\n      relatedId: row.relatedId,\n    };\n  }\n}\n\n// --------------------------------------------------------------------------\n// Dispatcher\n// --------------------------------------------------------------------------\n\n/**\n * Single entry-point the cron batch (Slice 5) calls per `(seed, tick)` pair.\n * Routes to the appropriate per-strategy iterator and yields a uniform\n * {@link DataSeedScopeIterationItem} stream regardless of `strategy`.\n *\n * Contract:\n *  - `strategy === GLOBAL` — yields exactly one item; `customResolverKey`\n *    MUST be `undefined` (the schema layer enforces this; we re-check\n *    defensively at the dispatcher to fail loudly if a malformed seed\n *    bypasses validation).\n *  - `strategy === ALL_*` — pages the corresponding core resource;\n *    `customResolverKey` MUST be `undefined`.\n *  - `strategy === CUSTOM_RESOLVER` — `customResolverKey` is REQUIRED;\n *    delegates to the resolver registry.\n *\n * The defensive `customResolverKey` re-checks throw `Error` (not a\n * structured `WildoBackendError`) because reaching them means a Zod-layer\n * invariant has already been violated upstream — we want the loudest\n * possible failure mode (with a stack trace pointing into the dispatcher),\n * not a soft framework-error path that operators might mistake for a\n * recoverable misconfiguration.\n *\n * Returns `AsyncGenerator` (concrete type, not `AsyncIterable`) so the\n * cron batch can also call `.return()` for early termination if a future\n * slice adds a per-tick deadline — `AsyncIterable` doesn't expose that\n * affordance.\n */\nexport function iterateScope(input: {\n  readonly strategy: DataSeedScopeIterationStrategy;\n  readonly customResolverKey?: string;\n  readonly parentCtx: ExecutionContext<any>;\n  readonly deps: DataSeedScopeIterationDeps;\n  readonly options?: DataSeedScopeIterationOptions;\n}): AsyncGenerator<DataSeedScopeIterationItem> {\n  const { strategy, customResolverKey, parentCtx, deps, options } = input;\n\n  switch (strategy) {\n    case DataSeedScopeIterationStrategy.GLOBAL:\n      if (customResolverKey !== undefined) {\n        throw new Error(\n          `iterateScope: strategy=GLOBAL must not carry customResolverKey (got '${customResolverKey}'). The schema layer should reject this — reaching here means a malformed DataSeedDefinition bypassed validation.`,\n        );\n      }\n      return iterateGlobal();\n\n    case DataSeedScopeIterationStrategy.ALL_APPLICATIONS:\n      if (customResolverKey !== undefined) {\n        throw new Error(\n          `iterateScope: strategy=ALL_APPLICATIONS must not carry customResolverKey (got '${customResolverKey}').`,\n        );\n      }\n      return iterateAllApplications(parentCtx, deps, options);\n\n    case DataSeedScopeIterationStrategy.ALL_ORGANIZATIONS:\n      if (customResolverKey !== undefined) {\n        throw new Error(\n          `iterateScope: strategy=ALL_ORGANIZATIONS must not carry customResolverKey (got '${customResolverKey}').`,\n        );\n      }\n      return iterateAllOrganizations(parentCtx, deps, options);\n\n    case DataSeedScopeIterationStrategy.ALL_USERS:\n      if (customResolverKey !== undefined) {\n        throw new Error(\n          `iterateScope: strategy=ALL_USERS must not carry customResolverKey (got '${customResolverKey}').`,\n        );\n      }\n      return iterateAllUsers(parentCtx, deps, options);\n\n    case DataSeedScopeIterationStrategy.CUSTOM_RESOLVER:\n      if (customResolverKey === undefined || customResolverKey.length === 0) {\n        throw new Error(\n          `iterateScope: strategy=CUSTOM_RESOLVER requires a non-empty customResolverKey. The schema layer should reject this — reaching here means a malformed DataSeedDefinition bypassed validation.`,\n        );\n      }\n      return iterateCustomResolver(customResolverKey, parentCtx, deps);\n  }\n}\n"]}
+{"version":3,"file":"data-seed-scope-iteration.shared.utils.js","sourceRoot":"","sources":["../../../../../../src/data-seeding/services/shared/data-seed-scope-iteration.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AAMH,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,8BAA8B,EAAE,MAAM,iEAAiE,CAAC;AAEjH,6EAA6E;AAC7E,WAAW;AACX,6EAA6E;AAE7E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4CAA4C,GAAG,GAAG,CAAC;AAEhE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAG,IAAI,CAAC;AA2EhE,6EAA6E;AAC7E,yBAAyB;AACzB,6EAA6E;AAE7E;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,aAAa;IAClC,MAAM,EAAE,IAAI,EAAE,8BAA8B,CAAC,MAAM,EAAE,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,oBAAoB,CACzC,YAAoB,EACpB,SAAgC,EAChC,IAAwC,EACxC,UAAyC,EAAE;IAE3C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,4CAA4C,CAAC;IACpF,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,2CAA2C,CAAC;IAEjF,MAAM,IAAI,GAAG,IAAI,CAAC,oBAAoB,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAE1E,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,OAAO,GAAG,IAAI,CAAC;IAEnB,OAAO,OAAO,IAAI,IAAI,IAAI,QAAQ,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAC5B,SAAS,EACT,EAAE,EACF,EAAE,SAAS,EAAE,IAAa,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CACtE,CAAC;QAEF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;QAC/B,CAAC;QAED,kEAAkE;QAClE,oDAAoD;QACpD,kEAAkE;QAClE,iEAAiE;QACjE,iEAAiE;QACjE,+DAA+D;QAC/D,iEAAiE;QACjE,8DAA8D;QAC9D,kEAAkE;QAClE,0DAA0D;QAC1D,mBAAmB;QACnB,MAAM,kBAAkB,GAAI,MAA8D,EAAE,UAAU,EAAE,UAAU,CAAC;QACnH,IAAI,OAAO,kBAAkB,KAAK,QAAQ,IAAI,kBAAkB,GAAG,CAAC,IAAI,IAAI,IAAI,kBAAkB,EAAE,CAAC;YACnG,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC;QAC7C,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC;IAED,IAAI,OAAO,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,wCAAwC,QAAQ,aAAa,YAAY,4BAA4B,EACrG,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,CACtC,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,sBAAsB,CAC3C,SAAgC,EAChC,IAAwC,EACxC,UAAyC,EAAE;IAE3C,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,oBAAoB,CAAC,gBAAgB,CAAC,WAAqB,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;QAChH,MAAM;YACJ,IAAI,EAAE,8BAA8B,CAAC,gBAAgB;YACrD,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,uBAAuB,CAC5C,SAAgC,EAChC,IAAwC,EACxC,UAAyC,EAAE;IAE3C,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,oBAAoB,CAAC,gBAAgB,CAAC,aAAuB,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;QAClH,MAAM;YACJ,IAAI,EAAE,8BAA8B,CAAC,iBAAiB;YACtD,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,eAAe,CACpC,SAAgC,EAChC,IAAwC,EACxC,UAAyC,EAAE;IAE3C,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,oBAAoB,CAAC,gBAAgB,CAAC,KAAe,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;QAC1G,MAAM;YACJ,IAAI,EAAE,8BAA8B,CAAC,SAAS;YAC9C,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,qBAAqB,CAC1C,iBAAyB,EACzB,SAAgC,EAChC,IAA+D;IAE/D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;IACpF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM;YACJ,IAAI,EAAE,8BAA8B,CAAC,eAAe;YACpD,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,aAAa;AACb,6EAA6E;AAE7E;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,YAAY,CAAC,KAM5B;IACC,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAExE,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,8BAA8B,CAAC,MAAM;YACxC,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CACb,wEAAwE,iBAAiB,mHAAmH,CAC7M,CAAC;YACJ,CAAC;YACD,OAAO,aAAa,EAAE,CAAC;QAEzB,KAAK,8BAA8B,CAAC,gBAAgB;YAClD,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CACb,kFAAkF,iBAAiB,KAAK,CACzG,CAAC;YACJ,CAAC;YACD,OAAO,sBAAsB,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAE1D,KAAK,8BAA8B,CAAC,iBAAiB;YACnD,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CACb,mFAAmF,iBAAiB,KAAK,CAC1G,CAAC;YACJ,CAAC;YACD,OAAO,uBAAuB,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAE3D,KAAK,8BAA8B,CAAC,SAAS;YAC3C,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CACb,2EAA2E,iBAAiB,KAAK,CAClG,CAAC;YACJ,CAAC;YACD,OAAO,eAAe,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAEnD,KAAK,8BAA8B,CAAC,eAAe;YACjD,IAAI,iBAAiB,KAAK,SAAS,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtE,MAAM,IAAI,KAAK,CACb,8LAA8L,CAC/L,CAAC;YACJ,CAAC;YACD,OAAO,qBAAqB,CAAC,iBAAiB,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACrE,CAAC;AACH,CAAC","sourcesContent":["/**\n * `data-seed-scope-iteration` — pure async-iterator helpers that translate a\n * {@link DataSeedScopeIterationStrategy} into a stream of `relatedId`s to\n * dispatch a seed against.\n *\n * Phase 7 / Item 47 (cron scheduler) — Slice 4. Designed to be reusable by\n * Item 51 (multi-tenant UPGRADE/SYNC for the synchronous Level-A path), so\n * lives under `shared/` rather than under `services/engines/`.\n *\n * --------------------------------------------------------------------------\n * Why iterators, not realized arrays\n * --------------------------------------------------------------------------\n * Cron seeds will be scheduled across potentially-large core-resource tables\n * (every `applications`, every `users`, every `organizations`). Buffering an\n * entire tenant table into memory before dispatching the first seed run\n * would (a) blow heap on large fleets, (b) push first-run latency to the end\n * of the page-walk, (c) lose the natural per-row failure-isolation boundary\n * the cron batch needs (Slice 5, N6 / Q5=E2 — one row's failure must NOT\n * stop the next row).\n *\n * `AsyncIterable<{ relatedId }>` matches the `for await (const item of …)`\n * loop the cron's `doHandle` body wants and lets the underlying paginator\n * fetch one page at a time on demand.\n *\n * --------------------------------------------------------------------------\n * Discriminated `kind` — why it travels with each item\n * --------------------------------------------------------------------------\n * The cron batch needs to know which scope-kind the iterator produced so it\n * can build the correct {@link DataSeedScopeArg} for `runManual` (different\n * `kind`s carry different anchor fields downstream). Putting the\n * discriminator on each yielded item — instead of returning a tuple of\n * `(kind, AsyncIterable<{ relatedId }>)` — keeps the cron's per-row branch\n * collapsed into a single `switch (item.kind)` and means the iterator can,\n * in a future slice, mix kinds (e.g. a custom resolver that yields both\n * org-anchored and user-anchored rows) without breaking the contract.\n *\n * --------------------------------------------------------------------------\n * Pagination cap\n * --------------------------------------------------------------------------\n * Each per-resource walker (`iterateAllOfResource`) runs a defensive\n * `MAX_PAGES` ceiling — same defence-in-depth pattern as\n * `dormancy-detection.batch.backend.service.ts`'s `MAX_PAGES = 50`, but\n * raised to {@link DEFAULT_DATA_SEED_SCOPE_ITERATION_MAX_PAGES} (1000) here\n * because cron iteration is read-only (no in-walk state mutation removes\n * rows) and large fleets can legitimately reach 100k+ rows. Hitting the cap\n * triggers a `logger.warn` and ends the iteration cleanly — never a throw,\n * because Slice 5's per-iteration error containment expects the iterator to\n * always close.\n *\n * --------------------------------------------------------------------------\n * Why `parentCtx` is `ExecutionContext<any>`\n * --------------------------------------------------------------------------\n * The cron batch builds the parent context via\n * `ExecutionContextCreatorBackendService.createForInternalSystemOperation`\n * (super-admin authority, `INTERNALLY_INITIATED_REQUEST` initiator). The\n * helpers don't narrow further because:\n *  - `repo.list(executionContext, …)` accepts `ExecutionContext<any>`;\n *  - `DataSeedScopeResolver` was deliberately typed against the same\n *    `ExecutionContext<any>` (Slice 3) so resolvers can do arbitrary\n *    repository reads.\n * Narrowing to a custom `DataSeedingCronExecutionContext` brand here would\n * force every test to construct that brand without buying any safety the\n * Slice-3 design didn't already cover.\n */\n\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport type { RepositoriesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/repositories/repositories-registry-handler.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport type { DataSeedScopeResolverRegistryBackendService } from '~wildo-backend-lib/data-seeding/services/data-seed-scope-resolver-registry.backend.service';\nimport { CoreResourceType } from '@wildo-ai/saas-models';\nimport { DataSeedScopeIterationStrategy } from '~wildo-backend-lib/data-seeding/models/data-seed.shared.schemas';\n\n// --------------------------------------------------------------------------\n// Defaults\n// --------------------------------------------------------------------------\n\n/**\n * Page size for resource-table walks. Matches the schema cap on\n * `Resources_PaginationRequestSchema.limit` (`max(100)`), which is the largest\n * value `repo.list({ paginated: true })` will accept. Going larger would be\n * silently rejected by the pagination Zod parse.\n */\nexport const DEFAULT_DATA_SEED_SCOPE_ITERATION_BATCH_SIZE = 100;\n\n/**\n * Defence-in-depth ceiling for `iterateAllOfResource`. Sized to allow 100k\n * rows at the default batch size while still bounding a runaway iterator\n * (e.g. a misbehaving paginator that always returns `data.length === limit`\n * regardless of progress). Hitting the cap is a warning, not an error — the\n * iterator simply ends and the cron emits a partial-iteration report.\n */\nexport const DEFAULT_DATA_SEED_SCOPE_ITERATION_MAX_PAGES = 1000;\n\n// --------------------------------------------------------------------------\n// Yielded shape\n// --------------------------------------------------------------------------\n\n/**\n * One emitted iteration item. Discriminated by `kind` so the cron batch's\n * per-row dispatch loop can `switch (item.kind)` without re-correlating\n * against the originating strategy.\n *\n * `GLOBAL` carries no `relatedId` — the seed dispatches once with\n * `scope: { kind: GLOBAL }` and there is no per-row anchor to attach.\n * Modeling this as a separate union variant (vs `relatedId: null`) means\n * downstream consumers cannot accidentally treat the global tick as a\n * row-anchored dispatch — TypeScript's exhaustiveness check forces them to\n * branch.\n */\nexport type DataSeedScopeIterationItem =\n  | { readonly kind: DataSeedScopeIterationStrategy.GLOBAL }\n  | {\n      readonly kind: DataSeedScopeIterationStrategy.ALL_APPLICATIONS;\n      readonly relatedId: string;\n    }\n  | {\n      readonly kind: DataSeedScopeIterationStrategy.ALL_ORGANIZATIONS;\n      readonly relatedId: string;\n    }\n  | {\n      readonly kind: DataSeedScopeIterationStrategy.ALL_USERS;\n      readonly relatedId: string;\n    }\n  | {\n      readonly kind: DataSeedScopeIterationStrategy.CUSTOM_RESOLVER;\n      readonly relatedId: string;\n    };\n\n// --------------------------------------------------------------------------\n// Dependency bundles\n// --------------------------------------------------------------------------\n\n/**\n * Dependencies the resource-walker iterators need. Bundled into a single\n * object so test harnesses construct one fixture and reuse it across all\n * three `ALL_*` strategies, and so future additions (e.g. a metrics emitter)\n * don't ripple through every per-strategy call site.\n */\nexport interface DataSeedScopeResourceIterationDeps {\n  readonly repositoriesRegistry: RepositoriesRegistryHandlerBackendService;\n  readonly logger: LoggerService;\n}\n\n/**\n * Dependencies the {@link iterateScope} dispatcher needs. Superset of\n * {@link DataSeedScopeResourceIterationDeps} — adds the resolver registry\n * for the `CUSTOM_RESOLVER` branch. The dispatcher accepts the broader\n * shape so callers (e.g. the Slice-5 batch) build one deps object regardless\n * of which strategy a given seed declares.\n */\nexport interface DataSeedScopeIterationDeps extends DataSeedScopeResourceIterationDeps {\n  readonly scopeResolverRegistry: DataSeedScopeResolverRegistryBackendService;\n}\n\n/**\n * Per-call options shared by the `ALL_*` resource walkers.\n *\n * `batchSize` and `maxPages` default to the module-level constants; tests\n * override them to keep fixtures small without losing the production\n * default-path coverage.\n */\nexport interface DataSeedScopeIterationOptions {\n  readonly batchSize?: number;\n  readonly maxPages?: number;\n}\n\n// --------------------------------------------------------------------------\n// Per-strategy iterators\n// --------------------------------------------------------------------------\n\n/**\n * Yield the single `GLOBAL` sentinel.\n *\n * Modeled as an async iterator (not a `[item]` literal) so the cron batch\n * can `for await (const item of iterateScope(...))` for every strategy\n * uniformly — strategy-specific branching at the call site would defeat the\n * dispatcher's purpose.\n */\nexport async function* iterateGlobal(): AsyncGenerator<DataSeedScopeIterationItem> {\n  yield { kind: DataSeedScopeIterationStrategy.GLOBAL };\n}\n\n/**\n * Generic page-walker over a single core resource. Used by the three\n * `ALL_*` strategy iterators below.\n *\n * Yields `{ relatedId }` (no `kind`) — the caller wraps each item with the\n * appropriate `kind` discriminator. This separation means the walker stays\n * reusable for Item 51's tenant-aware UPGRADE/SYNC path, which doesn't fit\n * the `DataSeedScopeIterationItem` union and instead consumes the bare\n * `{ relatedId }` form directly.\n *\n * Pagination is page-based (matches the `Resources_PaginationRequestSchema`\n * `{ page, limit }` shape) — NOT skip-based. A page slip caused by\n * concurrent inserts/deletes is acceptable for cron seeding (the next tick\n * picks up the missed row); cursor-based stable pagination would add\n * complexity for a cost the cron use-case doesn't pay.\n *\n * Defensive `MAX_PAGES` ceiling guards against a misbehaving paginator that\n * never empties — see module header. Hitting the cap is a `logger.warn`,\n * not a throw, so the cron's per-seed iteration always closes cleanly.\n */\nexport async function* iterateAllOfResource(\n  resourceType: string,\n  parentCtx: ExecutionContext<any>,\n  deps: DataSeedScopeResourceIterationDeps,\n  options: DataSeedScopeIterationOptions = {},\n): AsyncGenerator<{ readonly relatedId: string }> {\n  const batchSize = options.batchSize ?? DEFAULT_DATA_SEED_SCOPE_ITERATION_BATCH_SIZE;\n  const maxPages = options.maxPages ?? DEFAULT_DATA_SEED_SCOPE_ITERATION_MAX_PAGES;\n\n  const repo = deps.repositoriesRegistry.getRepositoryOrThrow(resourceType);\n\n  let page = 1;\n  let hasMore = true;\n\n  while (hasMore && page <= maxPages) {\n    const result = await repo.list<{ _id: string }>(\n      parentCtx,\n      {},\n      { paginated: true as const, listOptions: { page, limit: batchSize } },\n    );\n\n    for (const row of result.data) {\n      yield { relatedId: row._id };\n    }\n\n    // Audit L3-2 (post-Phase-7 close-out): defence-in-depth `hasMore`\n    // computation. The primary signal is the historical\n    // `data.length === batchSize` heuristic (works when the paginator\n    // returns short pages reliably). Where a `pagination.totalPages`\n    // value is also reported, we cross-check it: if the current page\n    // index is at-or-past `totalPages`, we trust the paginator and\n    // stop, even if the last page happened to be exactly `batchSize`\n    // long. This catches the \"buggy paginator that always returns\n    // length === limit\" failure mode the SKILL/docs claim is enforced\n    // here, and it short-circuits the MAX_PAGES walk on small\n    // resource tables.\n    const reportedTotalPages = (result as unknown as { pagination?: { totalPages?: number } })?.pagination?.totalPages;\n    if (typeof reportedTotalPages === 'number' && reportedTotalPages > 0 && page >= reportedTotalPages) {\n      hasMore = false;\n    } else {\n      hasMore = result.data.length === batchSize;\n    }\n    page++;\n  }\n\n  if (hasMore && page > maxPages) {\n    deps.logger.warn(\n      `iterateAllOfResource: hit MAX_PAGES (${maxPages}) cap on '${resourceType}' — iteration ended early.`,\n      { resourceType, maxPages, batchSize },\n    );\n  }\n}\n\n/**\n * Walk every `applications` row, yielding one item per `_id`. Thin wrapper\n * over {@link iterateAllOfResource} that attaches the\n * `ALL_APPLICATIONS` discriminator.\n */\nexport async function* iterateAllApplications(\n  parentCtx: ExecutionContext<any>,\n  deps: DataSeedScopeResourceIterationDeps,\n  options: DataSeedScopeIterationOptions = {},\n): AsyncGenerator<DataSeedScopeIterationItem> {\n  for await (const item of iterateAllOfResource(CoreResourceType.APPLICATION as string, parentCtx, deps, options)) {\n    yield {\n      kind: DataSeedScopeIterationStrategy.ALL_APPLICATIONS,\n      relatedId: item.relatedId,\n    };\n  }\n}\n\n/**\n * Walk every `organizations` row, yielding one item per `_id`. Thin\n * wrapper over {@link iterateAllOfResource} that attaches the\n * `ALL_ORGANIZATIONS` discriminator.\n */\nexport async function* iterateAllOrganizations(\n  parentCtx: ExecutionContext<any>,\n  deps: DataSeedScopeResourceIterationDeps,\n  options: DataSeedScopeIterationOptions = {},\n): AsyncGenerator<DataSeedScopeIterationItem> {\n  for await (const item of iterateAllOfResource(CoreResourceType.ORGANIZATIONS as string, parentCtx, deps, options)) {\n    yield {\n      kind: DataSeedScopeIterationStrategy.ALL_ORGANIZATIONS,\n      relatedId: item.relatedId,\n    };\n  }\n}\n\n/**\n * Walk every `users` row, yielding one item per `_id`. Thin wrapper over\n * {@link iterateAllOfResource} that attaches the `ALL_USERS`\n * discriminator.\n */\nexport async function* iterateAllUsers(\n  parentCtx: ExecutionContext<any>,\n  deps: DataSeedScopeResourceIterationDeps,\n  options: DataSeedScopeIterationOptions = {},\n): AsyncGenerator<DataSeedScopeIterationItem> {\n  for await (const item of iterateAllOfResource(CoreResourceType.USERS as string, parentCtx, deps, options)) {\n    yield {\n      kind: DataSeedScopeIterationStrategy.ALL_USERS,\n      relatedId: item.relatedId,\n    };\n  }\n}\n\n/**\n * Resolve the registered scope resolver for `customResolverKey` and yield\n * each `{ relatedId }` row it produces, tagged with the\n * `CUSTOM_RESOLVER` discriminator.\n *\n * The resolver lookup goes through\n * {@link DataSeedScopeResolverRegistryBackendService.resolve} — a missing\n * key throws `ErrorType.CONFIGURATION` from the registry (Slice 3\n * contract); a resolver-internal throw bubbles up unchanged. Slice 5's\n * per-iteration `try/catch` is the containment layer (N6 / Q5=E2) — the\n * iterator deliberately does NOT catch, so the cron can record the failing\n * `seedKey` in `report.failedSeedKeys` and continue with the next seed.\n */\nexport async function* iterateCustomResolver(\n  customResolverKey: string,\n  parentCtx: ExecutionContext<any>,\n  deps: Pick<DataSeedScopeIterationDeps, 'scopeResolverRegistry'>,\n): AsyncGenerator<DataSeedScopeIterationItem> {\n  const rows = await deps.scopeResolverRegistry.resolve(customResolverKey, parentCtx);\n  for (const row of rows) {\n    yield {\n      kind: DataSeedScopeIterationStrategy.CUSTOM_RESOLVER,\n      relatedId: row.relatedId,\n    };\n  }\n}\n\n// --------------------------------------------------------------------------\n// Dispatcher\n// --------------------------------------------------------------------------\n\n/**\n * Single entry-point the cron batch (Slice 5) calls per `(seed, tick)` pair.\n * Routes to the appropriate per-strategy iterator and yields a uniform\n * {@link DataSeedScopeIterationItem} stream regardless of `strategy`.\n *\n * Contract:\n *  - `strategy === GLOBAL` — yields exactly one item; `customResolverKey`\n *    MUST be `undefined` (the schema layer enforces this; we re-check\n *    defensively at the dispatcher to fail loudly if a malformed seed\n *    bypasses validation).\n *  - `strategy === ALL_*` — pages the corresponding core resource;\n *    `customResolverKey` MUST be `undefined`.\n *  - `strategy === CUSTOM_RESOLVER` — `customResolverKey` is REQUIRED;\n *    delegates to the resolver registry.\n *\n * The defensive `customResolverKey` re-checks throw `Error` (not a\n * structured `WildoBackendError`) because reaching them means a Zod-layer\n * invariant has already been violated upstream — we want the loudest\n * possible failure mode (with a stack trace pointing into the dispatcher),\n * not a soft framework-error path that operators might mistake for a\n * recoverable misconfiguration.\n *\n * Returns `AsyncGenerator` (concrete type, not `AsyncIterable`) so the\n * cron batch can also call `.return()` for early termination if a future\n * slice adds a per-tick deadline — `AsyncIterable` doesn't expose that\n * affordance.\n */\nexport function iterateScope(input: {\n  readonly strategy: DataSeedScopeIterationStrategy;\n  readonly customResolverKey?: string;\n  readonly parentCtx: ExecutionContext<any>;\n  readonly deps: DataSeedScopeIterationDeps;\n  readonly options?: DataSeedScopeIterationOptions;\n}): AsyncGenerator<DataSeedScopeIterationItem> {\n  const { strategy, customResolverKey, parentCtx, deps, options } = input;\n\n  switch (strategy) {\n    case DataSeedScopeIterationStrategy.GLOBAL:\n      if (customResolverKey !== undefined) {\n        throw new Error(\n          `iterateScope: strategy=GLOBAL must not carry customResolverKey (got '${customResolverKey}'). The schema layer should reject this — reaching here means a malformed DataSeedDefinition bypassed validation.`,\n        );\n      }\n      return iterateGlobal();\n\n    case DataSeedScopeIterationStrategy.ALL_APPLICATIONS:\n      if (customResolverKey !== undefined) {\n        throw new Error(\n          `iterateScope: strategy=ALL_APPLICATIONS must not carry customResolverKey (got '${customResolverKey}').`,\n        );\n      }\n      return iterateAllApplications(parentCtx, deps, options);\n\n    case DataSeedScopeIterationStrategy.ALL_ORGANIZATIONS:\n      if (customResolverKey !== undefined) {\n        throw new Error(\n          `iterateScope: strategy=ALL_ORGANIZATIONS must not carry customResolverKey (got '${customResolverKey}').`,\n        );\n      }\n      return iterateAllOrganizations(parentCtx, deps, options);\n\n    case DataSeedScopeIterationStrategy.ALL_USERS:\n      if (customResolverKey !== undefined) {\n        throw new Error(\n          `iterateScope: strategy=ALL_USERS must not carry customResolverKey (got '${customResolverKey}').`,\n        );\n      }\n      return iterateAllUsers(parentCtx, deps, options);\n\n    case DataSeedScopeIterationStrategy.CUSTOM_RESOLVER:\n      if (customResolverKey === undefined || customResolverKey.length === 0) {\n        throw new Error(\n          `iterateScope: strategy=CUSTOM_RESOLVER requires a non-empty customResolverKey. The schema layer should reject this — reaching here means a malformed DataSeedDefinition bypassed validation.`,\n        );\n      }\n      return iterateCustomResolver(customResolverKey, parentCtx, deps);\n  }\n}\n"]}

package/dist/esm/databases/models/filter.backend.schemas.js

@@ -29,14 +29,14 @@ export const MONGODB_ONLY_OPERATORS = [
 // ============================================================================
 /**
  * The sub-keys of the canonical date-range filter vocabulary
- * (`Resouces_Filter_DateRangeSchema` in `@wildo-ai/saas-models` → `{ startDate?, endDate? }`).
+ * (`Resources_Filter_DateRangeSchema` in `@wildo-ai/saas-models` → `{ startDate?, endDate? }`).
  */
 const DATE_RANGE_SUBKEYS = ['startDate', 'endDate'];
 /**
  * A date-range filter VALUE is a PLAIN object whose keys are a non-empty subset of
  * `{ startDate, endDate }`. This is the shape the collection-query controller reconstructs for a
  * `z.date()` filter field (the resources-config factory auto-converts such a field to
- * `Resouces_Filter_DateRangeSchema`). A scalar, an operator object (`$`-prefixed keys), a `Date`,
+ * `Resources_Filter_DateRangeSchema`). A scalar, an operator object (`$`-prefixed keys), a `Date`,
  * an ObjectId, or any class instance is deliberately NOT a range — only a plain `{}` literal carries
  * the vocabulary, so this cannot misfire on an operator condition or a persisted value.
  */

package/dist/esm/databases/models/filter.backend.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"filter.backend.schemas.js","sourceRoot":"","sources":["../../../../../src/databases/models/filter.backend.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAiEH;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;IACzD,MAAM,EAAE,KAAK,EAAE,MAAM;IACrB,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW;IACjD,SAAS;IACT,MAAM,EAAE,6CAA6C;CAC7C,CAAC;AAEX;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO;IAC/D,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,gBAAgB;IACjE,aAAa,EAAE,eAAe,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc;CACnE,CAAC;AAYX,+EAA+E;AAC/E,mDAAmD;AACnD,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,kBAAkB,GAAsB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;AAEvE;;;;;;;GAOG;AACH,SAAS,sBAAsB,CAAC,KAAc;IAC5C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,KAAK,KAAK,MAAM,CAAC,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC,CAAC,uCAAuC;IACvG,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;IAC1C,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,yBAAyB,CAAI,MAAS;IACpD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IACzD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAiB,CAAC;IAC1G,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,KAAK,KAAK,MAAM,CAAC,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,CAAC,+CAA+C;IAChH,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,EAAE,CAAC;QAC7E,IAAI,CAAC,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChF,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC;QAChE,CAAC;aAAM,IAAI,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC;YACzC,MAAM,KAAK,GAA4B,EAAE,CAAC;YAC1C,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;gBAAE,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC;YAChE,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;gBAAE,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC;YAC5D,6FAA6F;YAC7F,kDAAkD;YAClD,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACtD,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,GAAQ,CAAC;AAClB,CAAC","sourcesContent":["/**\n * Database-agnostic Filter Types\n * \n * Provides abstract filter types and operator definitions for cross-database\n * query filtering (MongoDB, PostgreSQL).\n * \n * @see PostgreSQLFilterBackendService for the conversion implementation\n */\n\n// ============================================================================\n// Filter Types (Database-Agnostic)\n// ============================================================================\n\n/**\n * Database-agnostic filter type.\n * \n * Uses MongoDB FilterQuery-style syntax at the interface level.\n * SQL repository converts internally using a FilterQuery → SQL predicate builder.\n * \n * ## Supported Filter Operators (Cross-Database)\n * \n * The following operators are guaranteed to work with both MongoDB and PostgreSQL:\n * \n * **Comparison Operators:**\n * - `$eq` - Equal to (also implicit: `{ field: value }`)\n * - `$ne` - Not equal to\n * - `$gt` - Greater than\n * - `$gte` - Greater than or equal\n * - `$lt` - Less than\n * - `$lte` - Less than or equal\n * - `$in` - In array of values\n * - `$nin` - Not in array of values\n * \n * **Logical Operators:**\n * - `$and` - Logical AND (array of conditions)\n * - `$or` - Logical OR (array of conditions)\n * - `$not` - Logical NOT (single condition)\n * \n * **String Operators:**\n * - `$regex` - Regular expression match (with `$options: 'i'` for case-insensitive)\n * - `$startsWith` - Starts with (custom, converted to `LIKE 'value%'` in SQL)\n * - `$endsWith` - Ends with (custom, converted to `LIKE '%value'` in SQL)\n * - `$contains` - Contains substring (custom, converted to `LIKE '%value%'` in SQL)\n * \n * **Null Operators:**\n * - `$exists` - Field exists (true) or is null (false)\n * \n * ## Unsupported Operators (MongoDB-only)\n * \n * The following operators are NOT supported cross-database and will throw errors\n * if used with PostgreSQL resources:\n * \n * - `$where` - JavaScript expression evaluation\n * - `$expr` - Aggregation expression\n * - `$jsonSchema` - JSON schema validation\n * - `$elemMatch` - Complex array element matching (simple cases may work)\n * - `$all` - Array contains all\n * - `$size` - Array size\n * - `$type` - BSON type check\n * - `$mod` - Modulo\n * - `$text` - Text search (use full-text search instead)\n * - Geospatial operators (`$near`, `$geoWithin`, etc.)\n * \n * ## Escape Hatch\n * \n * For database-specific queries, use `$raw`:\n * ```typescript\n * { $raw: { sql: 'jsonb_path_exists(metadata, $1)', params: ['$.\\\"nested\\\"'] } }\n * ```\n */\nexport type ResourceFilter = Record<string, unknown>;\n\n/**\n * Supported comparison operators for cross-database filters\n */\nexport const SUPPORTED_FILTER_OPERATORS = [\n  '$eq', '$ne', '$gt', '$gte', '$lt', '$lte', '$in', '$nin',\n  '$and', '$or', '$not',\n  '$regex', '$startsWith', '$endsWith', '$contains',\n  '$exists',\n  '$raw', // Escape hatch for database-specific queries\n] as const;\n\n/**\n * Operators that are MongoDB-only and will throw errors with PostgreSQL\n */\nexport const MONGODB_ONLY_OPERATORS = [\n  '$where', '$expr', '$jsonSchema', '$elemMatch', '$all', '$size',\n  '$type', '$mod', '$text', '$near', '$geoWithin', '$geoIntersects',\n  '$nearSphere', '$centerSphere', '$geometry', '$minDistance', '$maxDistance',\n] as const;\n\n/**\n * Type for supported filter operator keys\n */\nexport type SupportedFilterOperator = typeof SUPPORTED_FILTER_OPERATORS[number];\n\n/**\n * Type for MongoDB-only operator keys\n */\nexport type MongoDBOnlyOperator = typeof MONGODB_ONLY_OPERATORS[number];\n\n// ============================================================================\n// Date-range filter normalization (cross-database)\n// ============================================================================\n\n/**\n * The sub-keys of the canonical date-range filter vocabulary\n * (`Resouces_Filter_DateRangeSchema` in `@wildo-ai/saas-models` → `{ startDate?, endDate? }`).\n */\nconst DATE_RANGE_SUBKEYS: readonly string[] = ['startDate', 'endDate'];\n\n/**\n * A date-range filter VALUE is a PLAIN object whose keys are a non-empty subset of\n * `{ startDate, endDate }`. This is the shape the collection-query controller reconstructs for a\n * `z.date()` filter field (the resources-config factory auto-converts such a field to\n * `Resouces_Filter_DateRangeSchema`). A scalar, an operator object (`$`-prefixed keys), a `Date`,\n * an ObjectId, or any class instance is deliberately NOT a range — only a plain `{}` literal carries\n * the vocabulary, so this cannot misfire on an operator condition or a persisted value.\n */\nfunction isDateRangeFilterValue(value: unknown): value is { startDate?: unknown; endDate?: unknown } {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) return false;\n  const proto = Object.getPrototypeOf(value);\n  if (proto !== Object.prototype && proto !== null) return false; // reject Date/ObjectId/class instances\n  const keys = Object.keys(value as object);\n  return keys.length > 0 && keys.every((k) => DATE_RANGE_SUBKEYS.includes(k));\n}\n\n/**\n * Translate the canonical date-range filter vocabulary (`{ startDate?, endDate? }`) into the\n * cross-database comparison-operator form (`{ $gte?, $lte? }`), which mongoose consumes natively and\n * `PostgreSQLFilterBackendService.buildWhereExpression` already compiles. WITHOUT this, a\n * `createdAt: { startDate, endDate }` filter reaches mongoose and fails with a `CastError` (the whole\n * object is cast to a Date), and PG treats it as a nested-path equality — i.e. the date-range filter\n * that the OpenAPI/controller layers reconstruct is silently unusable on every generic resource\n * (only the audit-logs custom-impl translated it by hand).\n *\n * Both bounds are optional (open-ended ranges), so an absent bound is omitted. Recurses through\n * `$and`/`$or`/`$nor` so a SEARCH filter wrapped in a logical operator is covered. Returns a NEW\n * object (no mutation of the caller's filter); non-range values pass through untouched, so it is a\n * safe no-op on read/update/delete filters that carry no range vocabulary.\n */\nexport function normalizeDateRangeFilters<T>(filter: T): T {\n  if (!filter || typeof filter !== 'object') return filter;\n  if (Array.isArray(filter)) return filter.map((entry) => normalizeDateRangeFilters(entry)) as unknown as T;\n  const proto = Object.getPrototypeOf(filter);\n  if (proto !== Object.prototype && proto !== null) return filter; // never rewrite a Date/ObjectId/class instance\n  const out: Record<string, unknown> = {};\n  for (const [key, value] of Object.entries(filter as Record<string, unknown>)) {\n    if ((key === '$and' || key === '$or' || key === '$nor') && Array.isArray(value)) {\n      out[key] = value.map((sub) => normalizeDateRangeFilters(sub));\n    } else if (isDateRangeFilterValue(value)) {\n      const range: Record<string, unknown> = {};\n      if (value.startDate !== undefined) range.$gte = value.startDate;\n      if (value.endDate !== undefined) range.$lte = value.endDate;\n      // An all-undefined range object carries no bound → drop the key rather than emit `{}` (which\n      // would be a match-nothing/degenerate condition).\n      if (Object.keys(range).length > 0) out[key] = range;\n    } else {\n      out[key] = value;\n    }\n  }\n  return out as T;\n}\n"]}
+{"version":3,"file":"filter.backend.schemas.js","sourceRoot":"","sources":["../../../../../src/databases/models/filter.backend.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAiEH;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;IACzD,MAAM,EAAE,KAAK,EAAE,MAAM;IACrB,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW;IACjD,SAAS;IACT,MAAM,EAAE,6CAA6C;CAC7C,CAAC;AAEX;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO;IAC/D,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,gBAAgB;IACjE,aAAa,EAAE,eAAe,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc;CACnE,CAAC;AAYX,+EAA+E;AAC/E,mDAAmD;AACnD,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,kBAAkB,GAAsB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;AAEvE;;;;;;;GAOG;AACH,SAAS,sBAAsB,CAAC,KAAc;IAC5C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,KAAK,KAAK,MAAM,CAAC,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC,CAAC,uCAAuC;IACvG,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;IAC1C,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,yBAAyB,CAAI,MAAS;IACpD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IACzD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAiB,CAAC;IAC1G,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,KAAK,KAAK,MAAM,CAAC,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,CAAC,+CAA+C;IAChH,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,EAAE,CAAC;QAC7E,IAAI,CAAC,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChF,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC;QAChE,CAAC;aAAM,IAAI,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC;YACzC,MAAM,KAAK,GAA4B,EAAE,CAAC;YAC1C,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;gBAAE,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC;YAChE,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;gBAAE,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC;YAC5D,6FAA6F;YAC7F,kDAAkD;YAClD,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACtD,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,GAAQ,CAAC;AAClB,CAAC","sourcesContent":["/**\n * Database-agnostic Filter Types\n * \n * Provides abstract filter types and operator definitions for cross-database\n * query filtering (MongoDB, PostgreSQL).\n * \n * @see PostgreSQLFilterBackendService for the conversion implementation\n */\n\n// ============================================================================\n// Filter Types (Database-Agnostic)\n// ============================================================================\n\n/**\n * Database-agnostic filter type.\n * \n * Uses MongoDB FilterQuery-style syntax at the interface level.\n * SQL repository converts internally using a FilterQuery → SQL predicate builder.\n * \n * ## Supported Filter Operators (Cross-Database)\n * \n * The following operators are guaranteed to work with both MongoDB and PostgreSQL:\n * \n * **Comparison Operators:**\n * - `$eq` - Equal to (also implicit: `{ field: value }`)\n * - `$ne` - Not equal to\n * - `$gt` - Greater than\n * - `$gte` - Greater than or equal\n * - `$lt` - Less than\n * - `$lte` - Less than or equal\n * - `$in` - In array of values\n * - `$nin` - Not in array of values\n * \n * **Logical Operators:**\n * - `$and` - Logical AND (array of conditions)\n * - `$or` - Logical OR (array of conditions)\n * - `$not` - Logical NOT (single condition)\n * \n * **String Operators:**\n * - `$regex` - Regular expression match (with `$options: 'i'` for case-insensitive)\n * - `$startsWith` - Starts with (custom, converted to `LIKE 'value%'` in SQL)\n * - `$endsWith` - Ends with (custom, converted to `LIKE '%value'` in SQL)\n * - `$contains` - Contains substring (custom, converted to `LIKE '%value%'` in SQL)\n * \n * **Null Operators:**\n * - `$exists` - Field exists (true) or is null (false)\n * \n * ## Unsupported Operators (MongoDB-only)\n * \n * The following operators are NOT supported cross-database and will throw errors\n * if used with PostgreSQL resources:\n * \n * - `$where` - JavaScript expression evaluation\n * - `$expr` - Aggregation expression\n * - `$jsonSchema` - JSON schema validation\n * - `$elemMatch` - Complex array element matching (simple cases may work)\n * - `$all` - Array contains all\n * - `$size` - Array size\n * - `$type` - BSON type check\n * - `$mod` - Modulo\n * - `$text` - Text search (use full-text search instead)\n * - Geospatial operators (`$near`, `$geoWithin`, etc.)\n * \n * ## Escape Hatch\n * \n * For database-specific queries, use `$raw`:\n * ```typescript\n * { $raw: { sql: 'jsonb_path_exists(metadata, $1)', params: ['$.\\\"nested\\\"'] } }\n * ```\n */\nexport type ResourceFilter = Record<string, unknown>;\n\n/**\n * Supported comparison operators for cross-database filters\n */\nexport const SUPPORTED_FILTER_OPERATORS = [\n  '$eq', '$ne', '$gt', '$gte', '$lt', '$lte', '$in', '$nin',\n  '$and', '$or', '$not',\n  '$regex', '$startsWith', '$endsWith', '$contains',\n  '$exists',\n  '$raw', // Escape hatch for database-specific queries\n] as const;\n\n/**\n * Operators that are MongoDB-only and will throw errors with PostgreSQL\n */\nexport const MONGODB_ONLY_OPERATORS = [\n  '$where', '$expr', '$jsonSchema', '$elemMatch', '$all', '$size',\n  '$type', '$mod', '$text', '$near', '$geoWithin', '$geoIntersects',\n  '$nearSphere', '$centerSphere', '$geometry', '$minDistance', '$maxDistance',\n] as const;\n\n/**\n * Type for supported filter operator keys\n */\nexport type SupportedFilterOperator = typeof SUPPORTED_FILTER_OPERATORS[number];\n\n/**\n * Type for MongoDB-only operator keys\n */\nexport type MongoDBOnlyOperator = typeof MONGODB_ONLY_OPERATORS[number];\n\n// ============================================================================\n// Date-range filter normalization (cross-database)\n// ============================================================================\n\n/**\n * The sub-keys of the canonical date-range filter vocabulary\n * (`Resources_Filter_DateRangeSchema` in `@wildo-ai/saas-models` → `{ startDate?, endDate? }`).\n */\nconst DATE_RANGE_SUBKEYS: readonly string[] = ['startDate', 'endDate'];\n\n/**\n * A date-range filter VALUE is a PLAIN object whose keys are a non-empty subset of\n * `{ startDate, endDate }`. This is the shape the collection-query controller reconstructs for a\n * `z.date()` filter field (the resources-config factory auto-converts such a field to\n * `Resources_Filter_DateRangeSchema`). A scalar, an operator object (`$`-prefixed keys), a `Date`,\n * an ObjectId, or any class instance is deliberately NOT a range — only a plain `{}` literal carries\n * the vocabulary, so this cannot misfire on an operator condition or a persisted value.\n */\nfunction isDateRangeFilterValue(value: unknown): value is { startDate?: unknown; endDate?: unknown } {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) return false;\n  const proto = Object.getPrototypeOf(value);\n  if (proto !== Object.prototype && proto !== null) return false; // reject Date/ObjectId/class instances\n  const keys = Object.keys(value as object);\n  return keys.length > 0 && keys.every((k) => DATE_RANGE_SUBKEYS.includes(k));\n}\n\n/**\n * Translate the canonical date-range filter vocabulary (`{ startDate?, endDate? }`) into the\n * cross-database comparison-operator form (`{ $gte?, $lte? }`), which mongoose consumes natively and\n * `PostgreSQLFilterBackendService.buildWhereExpression` already compiles. WITHOUT this, a\n * `createdAt: { startDate, endDate }` filter reaches mongoose and fails with a `CastError` (the whole\n * object is cast to a Date), and PG treats it as a nested-path equality — i.e. the date-range filter\n * that the OpenAPI/controller layers reconstruct is silently unusable on every generic resource\n * (only the audit-logs custom-impl translated it by hand).\n *\n * Both bounds are optional (open-ended ranges), so an absent bound is omitted. Recurses through\n * `$and`/`$or`/`$nor` so a SEARCH filter wrapped in a logical operator is covered. Returns a NEW\n * object (no mutation of the caller's filter); non-range values pass through untouched, so it is a\n * safe no-op on read/update/delete filters that carry no range vocabulary.\n */\nexport function normalizeDateRangeFilters<T>(filter: T): T {\n  if (!filter || typeof filter !== 'object') return filter;\n  if (Array.isArray(filter)) return filter.map((entry) => normalizeDateRangeFilters(entry)) as unknown as T;\n  const proto = Object.getPrototypeOf(filter);\n  if (proto !== Object.prototype && proto !== null) return filter; // never rewrite a Date/ObjectId/class instance\n  const out: Record<string, unknown> = {};\n  for (const [key, value] of Object.entries(filter as Record<string, unknown>)) {\n    if ((key === '$and' || key === '$or' || key === '$nor') && Array.isArray(value)) {\n      out[key] = value.map((sub) => normalizeDateRangeFilters(sub));\n    } else if (isDateRangeFilterValue(value)) {\n      const range: Record<string, unknown> = {};\n      if (value.startDate !== undefined) range.$gte = value.startDate;\n      if (value.endDate !== undefined) range.$lte = value.endDate;\n      // An all-undefined range object carries no bound → drop the key rather than emit `{}` (which\n      // would be a match-nothing/degenerate condition).\n      if (Object.keys(range).length > 0) out[key] = range;\n    } else {\n      out[key] = value;\n    }\n  }\n  return out as T;\n}\n"]}

package/dist/esm/databases/services/aggregation/aggregation-authorization.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"aggregation-authorization.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/databases/services/aggregation/aggregation-authorization.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;oEAaoE;AAKpE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AACnH,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAChI,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,oFAAoF,CAAC;AACvI,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAW5G,OAAO,EAIL,KAAK,yBAAyB,EAC/B,MAAM,wEAAwE,CAAC;AAEhF,OAAO,KAAK,EAAE,gBAAgB,EAAiB,MAAM,uBAAuB,CAAC;AAC7E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4DAA4D,CAAC;AAYjG,kDAAkD;AAClD,MAAM,WAAW,6BAA6B;IAC5C,KAAK,EAAE,gBAAgB,CAAC;IACxB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,iEAAiE;IACjE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,8DAA8D;IAC9D,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC1C;AAED,qFAAqF;AACrF,MAAM,WAAW,8BAA8B;IAC7C,yEAAyE;IACzE,cAAc,EAAE,cAAc,CAAC;CAChC;AAOD,qBACa,sCAAsC;IAEZ,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IACzB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACnC,OAAO,CAAC,QAAQ,CAAC,qBAAqB;gBAHpC,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EACpC,gBAAgB,EAAE,+BAA+B,EACnD,qBAAqB,EAAE,4BAA4B;IAGxH;;;;;;OAMG;IACH,SAAS,CAAC,KAAK,EAAE,6BAA6B,GAAG,8BAA8B;IAwC/E;;;;;;;;;;;;;;;;;;;OAmBG;IACI,qCAAqC,CAC1C,qBAAqB,EAAE,yBAAyB,GAAG,SAAS,EAC5D,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,gBAAgB,CAAC,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACvC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAe1B,OAAO,CAAC,eAAe;IA0EvB,OAAO,CAAC,kBAAkB;IAiE1B,OAAO,CAAC,qBAAqB;IAmE7B,OAAO,CAAC,yBAAyB;IA2BjC;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAuCzB,OAAO,CAAC,iBAAiB;IAWzB;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;IAiB7B,OAAO,CAAC,+BAA+B;IAgBvC;;;;;;;;;OASG;IACH,OAAO,CAAC,wBAAwB;IAiDhC,OAAO,CAAC,2CAA2C;CA8CpD"}
+{"version":3,"file":"aggregation-authorization.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/databases/services/aggregation/aggregation-authorization.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;oEAaoE;AAKpE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AACnH,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAChI,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,oFAAoF,CAAC;AACvI,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAY5G,OAAO,EAIL,KAAK,yBAAyB,EAC/B,MAAM,wEAAwE,CAAC;AAEhF,OAAO,KAAK,EAAE,gBAAgB,EAAiB,MAAM,uBAAuB,CAAC;AAC7E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4DAA4D,CAAC;AAYjG,kDAAkD;AAClD,MAAM,WAAW,6BAA6B;IAC5C,KAAK,EAAE,gBAAgB,CAAC;IACxB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,iEAAiE;IACjE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,8DAA8D;IAC9D,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC1C;AAED,qFAAqF;AACrF,MAAM,WAAW,8BAA8B;IAC7C,yEAAyE;IACzE,cAAc,EAAE,cAAc,CAAC;CAChC;AAOD,qBACa,sCAAsC;IAEZ,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IACzB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACnC,OAAO,CAAC,QAAQ,CAAC,qBAAqB;gBAHpC,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EACpC,gBAAgB,EAAE,+BAA+B,EACnD,qBAAqB,EAAE,4BAA4B;IAGxH;;;;;;OAMG;IACH,SAAS,CAAC,KAAK,EAAE,6BAA6B,GAAG,8BAA8B;IAwC/E;;;;;;;;;;;;;;;;;;;OAmBG;IACI,qCAAqC,CAC1C,qBAAqB,EAAE,yBAAyB,GAAG,SAAS,EAC5D,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,gBAAgB,CAAC,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACvC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAe1B,OAAO,CAAC,eAAe;IA8FvB,OAAO,CAAC,kBAAkB;IAiE1B,OAAO,CAAC,qBAAqB;IAmE7B,OAAO,CAAC,yBAAyB;IA2BjC;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAuCzB,OAAO,CAAC,iBAAiB;IAWzB;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;IAiB7B,OAAO,CAAC,+BAA+B;IAgBvC;;;;;;;;;OASG;IACH,OAAO,CAAC,wBAAwB;IAiDhC,OAAO,CAAC,2CAA2C;CA8CpD"}

package/dist/esm/databases/services/aggregation/aggregation-authorization.backend.service.js

@@ -26,7 +26,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 };
 import { injectable, inject } from 'inversify';
 import { SAAS_SERVICE_TYPES } from '../../../inject/models/service-types.js';
-import { ErrorType, ErrorCustomMessageReference, CoreResourceOperation, ResourcePrimaryScope, ComparisonOperator, ContextFilterSource, isOrganizationWideRoleInfo, } from '@wildo-ai/saas-models';
+import { ErrorType, ErrorCustomMessageReference, CoreResourceOperation, ResourcePrimaryScope, ComparisonOperator, ContextFilterSource, isOrganizationWideRoleInfo, requiredRolesDeclarePublicAccess, } from '@wildo-ai/saas-models';
 import { isRetentionGovernedResource, isRetentionHideSuppressedForReadOnlyPipeline, withRetentionHideApplied, } from '../../../compliance/privacy/retention-hide-predicate.backend.js';
 import { getZodObjectShape, unwrapSchema, getZodType } from '@wildo-ai/zod-decorators';
 /** Map ComparisonOperator to MongoDB filter operators */
@@ -130,6 +130,25 @@ let AggregationAuthorizationBackendService = class AggregationAuthorizationBacke
                 customMessageReference: ErrorCustomMessageReference.AGGREGATION_ACCESS_DENIED,
             });
         }
+        /*
+         * The THIRD role gate that must honour `APP_PUBLIC`, and the one furthest from the authorizer.
+         *
+         * A chart over a resource whose LIST declares `APP_PUBLIC` asks the same question
+         * `validateOperationRoles` asks, by a different mechanism — so before this line it produced the
+         * same wrong answer: the LIST itself answered 200 to an authenticated caller (once the
+         * authorizer's gate was fixed) while a chart built on that very LIST kept refusing them.
+         *
+         * Read from `effectiveRoles`, not `listRoles`, so a chart that narrows deliberately still
+         * narrows: a public LIST with `chartRoles: [ORG_ADMIN]` intersects to `[ORG_ADMIN]`, carries no
+         * public sentinel, and is gated exactly as its author declared. Only a required set that STILL
+         * declares public access after the narrowing admits everyone.
+         *
+         * The scope-filter injection below is untouched — this relaxes who may ASK, never which rows the
+         * aggregation reads.
+         */
+        if (requiredRolesDeclarePublicAccess(effectiveRoles)) {
+            return;
+        }
         // Check if the user satisfies at least one effective role — honouring the
         // ROLE HIERARCHY, exactly like the canonical `validateOperationRoles`. A raw
         // `includes` check (the previous behaviour) wrongly denied an ORG_ADMIN a chart

package/dist/esm/databases/services/aggregation/aggregation-authorization.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"aggregation-authorization.backend.service.js","sourceRoot":"","sources":["../../../../../../src/databases/services/aggregation/aggregation-authorization.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;oEAaoE;;;;;;;;;;;;;AAEpE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAMpF,OAAO,EACL,SAAS,EACT,2BAA2B,EAC3B,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,2BAA2B,EAC3B,4CAA4C,EAC5C,wBAAwB,GAEzB,MAAM,wEAAwE,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAIvF,yDAAyD;AACzD,MAAM,iBAAiB,GAA2B;IAChD,CAAC,kBAAkB,CAAC,EAAE,CAAC,EAAE,KAAK;IAC9B,CAAC,kBAAkB,CAAC,EAAE,CAAC,EAAE,KAAK;IAC9B,CAAC,kBAAkB,CAAC,EAAE,CAAC,EAAE,KAAK;IAC9B,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,MAAM;IAChC,CAAC,kBAAkB,CAAC,EAAE,CAAC,EAAE,KAAK;IAC9B,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,MAAM;CACjC,CAAC;AA0BK,IAAM,sCAAsC,GAA5C,MAAM,sCAAsC;IAEK;IACa;IACI;IACF;IAJrE,YACsD,MAAqB,EACR,YAAwC,EACpC,gBAAiD,EACnD,qBAAmD;QAHlE,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QACpC,qBAAgB,GAAhB,gBAAgB,CAAiC;QACnD,0BAAqB,GAArB,qBAAqB,CAA8B;IACrH,CAAC;IAEJ;;;;;;OAMG;IACH,SAAS,CAAC,KAAoC;QAC5C,MAAM,EAAE,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC;QAEjF,MAAM,cAAc,GAAG,IAAI,CAAC,+BAA+B,CAAC,KAAK,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;QAEtG,8CAA8C;QAC9C,MAAM,MAAM,GAA4B,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QAErE,+EAA+E;QAC/E,6EAA6E;QAC7E,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,oBAA4C,EAAE,KAAK,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;QAE1J,oEAAoE;QACpE,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,gBAAgB,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC;QAE3F,6BAA6B;QAC7B,IAAI,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5D,IAAI,CAAC,qBAAqB,CACxB,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,gBAAgB,EACtB,gBAAgB,EAChB,SAAS,IAAI,EAAE,EACf,cAAc,IAAI,EAAE,EACpB,MAAM,EACN,UAAU,CACX,CAAC;QACJ,CAAC;QAED,+FAA+F;QAC/F,iGAAiG;QACjG,yEAAyE;QACzE,OAAO;YACL,cAAc,EAAE,IAAI,CAAC,qCAAqC,CACxD,cAAc,EACd,MAAM,EACN,gBAAgB,CACC;SACpB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACI,qCAAqC,CAC1C,qBAA4D,EAC5D,MAA+B,EAC/B,gBAAwC;QAExC,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,EAAE,CAAC;YACxD,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,4CAA4C,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACnE,+FAA+F;YAC/F,gGAAgG;YAChG,oGAAoG;YACpG,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,8DAA8D;IAEtD,eAAe,CACrB,YAAoB,EACpB,MAAW,EACX,gBAAuC,EACvC,UAAqB;QAErB,kCAAkC;QAClC,MAAM,SAAS,GAAG,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,sCAAsC;YACtC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oDAAoD,YAAY,GAAG,CAAC,CAAC;YACtF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,yBAAyB;gBAC7E,OAAO,EAAE,EAAE,YAAY,EAAE;aAC1B,CACF,CAAC;QACJ,CAAC;QAED,2DAA2D;QAC3D,MAAM,cAAc,GAAG,UAAU;YAC/B,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC/C,CAAC,CAAC,SAAS,CAAC;QAEd,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,yBAAyB;aAC9E,CACF,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,6EAA6E;QAC7E,gFAAgF;QAChF,wEAAwE;QACxE,8EAA8E;QAC9E,8EAA8E;QAC9E,8EAA8E;QAC9E,MAAM,aAAa,GAAG,MAAM,CAAC,oBAA4C,CAAC;QAC1E,MAAM,aAAa,GAAG,IAAI,CAAC,wBAAwB,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;QACrF,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEzD,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;QACzC,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,aAAa,EAAE,CAAC;YAC5C,6EAA6E;YAC7E,2EAA2E;YAC3E,kCAAkC;YAClC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACzB,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,IAAa,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC1F,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QACD,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAExE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wDAAwD,YAAY,mBAAmB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC3K,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,yBAAyB;gBAC7E,OAAO,EAAE,EAAE,YAAY,EAAE;aAC1B,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,8DAA8D;IAEtD,kBAAkB,CACxB,KAA2B,EAC3B,YAAoB,EACpB,gBAAuC,EACvC,MAA+B;QAE/B,QAAQ,KAAK,EAAE,CAAC;YACd,KAAK,oBAAoB,CAAC,aAAa,CAAC,CAAC,CAAC;gBACxC,MAAM,KAAK,GAAG,gBAAgB,CAAC,cAAc,CAAC;gBAC9C,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;wBACE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;wBAChF,OAAO,EAAE;4BACP,wBAAwB;4BACxB,YAAY;yBACb;qBACF,CACF,CAAC;gBACJ,CAAC;gBACD,2EAA2E;gBAC3E,MAAM,CAAC,gBAAgB,CAAC,GAAG,KAAK,CAAC;gBACjC,OAAO,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YACrD,CAAC;YACD,KAAK,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC;gBACpC,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC;gBACvC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;wBACE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;wBAChF,OAAO,EAAE;4BACP,wBAAwB;4BACxB,YAAY;yBACb;qBACF,CACF,CAAC;gBACJ,CAAC;gBACD,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC;gBAC1B,OAAO,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAC9C,CAAC;YACD,KAAK,oBAAoB,CAAC,WAAW;gBACnC,uCAAuC;gBACvC,OAAO,EAAE,CAAC;YACZ;gBACE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;oBAChF,OAAO,EAAE;wBACP,wBAAwB;wBACxB,YAAY;wBACZ,KAAK;qBACN;iBACF,CACF,CAAC;QACN,CAAC;IACH,CAAC;IAED,8DAA8D;IAEtD,qBAAqB,CAC3B,cAA+B,EAC/B,YAAoB,EACpB,gBAAuC,EACvC,SAAiC,EACjC,cAAuC,EACvC,MAA+B,EAC/B,UAAiC;QAEjC,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;QAEpD,KAAK,MAAM,EAAE,IAAI,cAAc,EAAE,CAAC;YAChC,MAAM,aAAa,GAAG,IAAI,CAAC,yBAAyB,CAAC,EAAE,EAAE,gBAAgB,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;YACtG,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC1D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;oBAChF,OAAO,EAAE;wBACP,wBAAwB;wBACxB,YAAY;wBACZ,KAAK,EAAE,EAAE,CAAC,KAAK;wBACf,MAAM,EAAE,EAAE,CAAC,MAAM;wBACjB,WAAW,EAAE,EAAE,CAAC,WAAW;qBAC5B;iBACF,CACF,CAAC;YACJ,CAAC;YAED,0CAA0C;YAC1C,MAAM,YAAY,GAAG,MAAM;gBACzB,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,aAAa,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;gBACzD,CAAC,CAAC,aAAa,CAAC;YAElB,gCAAgC;YAChC,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,IAAI,kBAAkB,CAAC,EAAE,CAAC;YAEtD,IAAI,CAAC,2CAA2C,CAAC;gBAC/C,YAAY;gBACZ,gBAAgB;gBAChB,KAAK,EAAE,EAAE,CAAC,KAAK;gBACf,QAAQ;gBACR,YAAY;gBACZ,MAAM;gBACN,UAAU;aACX,CAAC,CAAC;YAEH,IAAI,QAAQ,KAAK,kBAAkB,CAAC,EAAE,EAAE,CAAC;gBACvC,sCAAsC;gBACtC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,YAAY,CAAC;YAClC,CAAC;iBAAM,CAAC;gBACN,mDAAmD;gBACnD,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;gBAC5C,IAAI,OAAO,EAAE,CAAC;oBACZ,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;oBAClC,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;wBACzE,sFAAsF;wBACrF,QAAoC,CAAC,OAAO,CAAC,GAAG,YAAY,CAAC;oBAChE,CAAC;yBAAM,CAAC;wBACN,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC;oBACjD,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAEO,yBAAyB,CAC/B,EAAiB,EACjB,gBAAuC,EACvC,SAAiC,EACjC,cAAuC;QAEvC,QAAQ,EAAE,CAAC,MAAM,EAAE,CAAC;YAClB,KAAK,mBAAmB,CAAC,YAAY;gBACnC,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC,CAAE,gBAAgB,CAAC,YAAoB,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC;YAE7G,KAAK,mBAAmB,CAAC,oBAAoB;gBAC3C,OAAO,gBAAgB,CAAC,cAAc,CAAC;YAEzC,KAAK,mBAAmB,CAAC,SAAS;gBAChC,OAAO,SAAS,CAAC,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC;YAE/C,KAAK,mBAAmB,CAAC,eAAe;gBACtC,OAAO,cAAc,CAAC,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC;YAEpD;gBACE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4DAA4D,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;gBAC3F,OAAO,SAAS,CAAC;QACrB,CAAC;IACH,CAAC;IAED,8DAA8D;IAE9D;;;OAGG;IACK,iBAAiB,CAAC,KAAc,EAAE,SAAiB,EAAE,MAAoB;QAC/E,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAE5D,MAAM,WAAW,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,CAAC,WAAW;YAAE,OAAO,KAAK,CAAC;QAE/B,iDAAiD;QACjD,MAAM,QAAQ,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAEtC,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAE5C,QAAQ,QAAQ,EAAE,CAAC;YACjB,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC7B,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;oBAC1B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iDAAiD,KAAK,gBAAgB,SAAS,GAAG,CAAC,CAAC;oBACrG,OAAO,KAAK,CAAC,CAAC,8CAA8C;gBAC9D,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC1B,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;oBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mDAAmD,KAAK,gBAAgB,SAAS,GAAG,CAAC,CAAC;oBACvG,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,OAAO,GAAG,CAAC;YACb,CAAC;YACD,KAAK,SAAS;gBACZ,OAAO,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,GAAG,CAAC;YAC3C;gBACE,OAAO,KAAK,CAAC;QACjB,CAAC;IACH,CAAC;IAED,8DAA8D;IAEtD,iBAAiB,CAAC,YAAoB;QAC5C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;YAC5E,OAAO,MAAM,CAAC,UAA0B,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,8DAA8D;IAE9D;;;;;;;;OAQG;IACK,qBAAqB,CAAC,MAAW;QACvC,4EAA4E;QAC5E,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;YAAE,OAAO,SAAS,CAAC;QAE9E,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CACnC,CAAC,EAAO,EAAE,EAAE,CAAC,EAAE,CAAC,mBAAmB,KAAK,qBAAqB,CAAC,IAAI,IAAI,EAAE,CAAC,kBAAkB,KAAK,IAAI,CACrG,CAAC;QACF,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAE9B,4CAA4C;QAC5C,IAAI,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7E,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,+BAA+B,CAAC,YAAoB,EAAE,gBAAuC;QACnG,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;QACtE,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,YAAY,yBAAyB,CAAC,CAAC;YAC/F,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,SAAS,EACnB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,SAAS;gBAC7D,OAAO,EAAE,EAAE,YAAY,EAAE;aAC1B,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACK,wBAAwB,CAC9B,aAAmC,EACnC,gBAAuC;QAEvC,MAAM,SAAS,GAAG,gBAAgB,CAAC,cAAc,CAAC;QAClD,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,CAAC;QAEvD,MAAM,oBAAoB,GAAG,gBAAgB,CAAC,cAAc,CAAC;QAC7D,MAAM,YAAY,GAAG,gBAAgB,CAAC,MAAM,CAAC;QAC7C,MAAM,QAAQ,GAAyD,EAAE,CAAC;QAE1E,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1C,SAAS;YACX,CAAC;YAED,2FAA2F;YAC3F,2FAA2F;YAC3F,4FAA4F;YAC5F,iFAAiF;YACjF,IAAI,CAAC,0BAA0B,CAAC,EAAE,CAAC,EAAE,CAAC;gBACpC,SAAS;YACX,CAAC;YAED,MAAM,UAAU,GACd,EAAE,CAAC,mBAAmB,KAAK,oBAAoB,CAAC,WAAW;mBACxD,CACD,aAAa,KAAK,oBAAoB,CAAC,aAAa;uBACjD,EAAE,CAAC,mBAAmB,KAAK,oBAAoB,CAAC,aAAa;uBAC7D,EAAE,CAAC,iBAAiB,KAAK,oBAAoB,CACjD;mBACE,CACD,aAAa,KAAK,oBAAoB,CAAC,SAAS;uBAC7C,EAAE,CAAC,mBAAmB,KAAK,oBAAoB,CAAC,SAAS;uBACzD,EAAE,CAAC,iBAAiB,KAAK,YAAY,CACzC,CAAC;YAEJ,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,SAAS;YACX,CAAC;YAED,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;gBAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,mBAAmB,EAAE,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,2CAA2C,CAAC,MAQnD;QACC,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC;QAChF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO;QACT,CAAC;QAED,IAAI,MAAM,CAAC,QAAQ,KAAK,kBAAkB,CAAC,EAAE,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC;YACzF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,MAAM,CAAC,gBAAgB,EACvB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;gBAC9E,OAAO,EAAE;oBACP,wBAAwB;oBACxB,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,KAAK,EAAE,MAAM,CAAC,KAAK;iBACpB;aACF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,aAAa,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC;YACtC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,MAAM,CAAC,gBAAgB,EACvB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;gBAC9E,OAAO,EAAE;oBACP,wBAAwB;oBACxB,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,KAAK,EAAE,MAAM,CAAC,KAAK;iBACpB;aACF,CACF,CAAC;QACJ,CAAC;IACH,CAAC;CAEF,CAAA;AAhhBY,sCAAsC;IADlD,UAAU,EAAE;IAGR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;IAClD,WAAA,MAAM,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAA;;GALxC,sCAAsC,CAghBlD","sourcesContent":["/** ──────────────────────────────────────────────────────────────\n * AggregationAuthorizationBackendService\n *\n * Handles authorization for aggregation queries:\n *   1. LIST role check — user must have LIST permission on main resource\n *   2. Scope filter injection — ORGANIZATIONS, USER_SELF, APPLICATION\n *   3. Context filter resolution — parentResource, urlParam, currentUser, currentOrganization\n *   4. Optional chart-level role narrowing\n *\n * Ref: Authorization model → L996-1024\n * Ref: Scope-based injection → L1004-1007\n * Ref: Context filter examples → L1053-1074\n * Ref: Type coercion → L1074\n * ────────────────────────────────────────────────────────────── */\n\nimport { injectable, inject } from 'inversify';\nimport type { z } from 'zod';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport type { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport type { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\nimport type { AuthorizationsBackendService } from '~wildo-backend-lib/security/authorizations/services/authorizations.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport {\n  ErrorType,\n  ErrorCustomMessageReference,\n  CoreResourceOperation,\n  ResourcePrimaryScope,\n  ComparisonOperator,\n  ContextFilterSource,\n  isOrganizationWideRoleInfo,\n} from '@wildo-ai/saas-models';\nimport type { Roles, ResourceType } from '@wildo-ai/saas-models';\nimport {\n  isRetentionGovernedResource,\n  isRetentionHideSuppressedForReadOnlyPipeline,\n  withRetentionHideApplied,\n  type RetentionGovernanceSignal,\n} from '~wildo-backend-lib/compliance/privacy/retention-hide-predicate.backend';\nimport { getZodObjectShape, unwrapSchema, getZodType } from '@wildo-ai/zod-decorators';\nimport type { AggregationQuery, ContextFilter } from '@wildo-ai/saas-models';\nimport type { ResourceFilter } from '~wildo-backend-lib/databases/models/filter.backend.schemas';\n\n/** Map ComparisonOperator to MongoDB filter operators */\nconst OPERATOR_TO_MONGO: Record<string, string> = {\n  [ComparisonOperator.EQ]: '$eq',\n  [ComparisonOperator.NE]: '$ne',\n  [ComparisonOperator.GT]: '$gt',\n  [ComparisonOperator.GTE]: '$gte',\n  [ComparisonOperator.LT]: '$lt',\n  [ComparisonOperator.LTE]: '$lte',\n};\n\n/** Input required by the authorization service */\nexport interface AggregationAuthorizationInput {\n  query: AggregationQuery;\n  executionContext: ExecutionContext<any>;\n  /** Optional chart-level role restriction (narrows LIST roles) */\n  chartRoles?: string[];\n  /** URL param values (for context filter resolution) */\n  urlParams?: Record<string, string>;\n  /** Parent resource context (for context filter resolution) */\n  parentResource?: Record<string, unknown>;\n}\n\n/** Output from authorization — the augmented filter to merge into the aggregation */\nexport interface AggregationAuthorizationResult {\n  /** Combined filter (static filters + scope filters + context filters) */\n  resolvedFilter: ResourceFilter;\n}\n\ninterface ScopeLockDescriptor {\n  field: 'organizationId' | 'userId';\n  value: string;\n}\n\n@injectable()\nexport class AggregationAuthorizationBackendService {\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.ResourceRegistryService) private readonly resourceRegistry: ResourcesRegistryBackendService,\n    @inject(SAAS_SERVICE_TYPES.AuthorizationsService) private readonly authorizationsService: AuthorizationsBackendService,\n  ) {}\n\n  /**\n   * Authorize an aggregation query:\n   *   1. Check user has LIST role on mainResourceType\n   *   2. Inject scope filters based on ResourcePrimaryScope\n   *   3. Resolve context filters\n   *   4. Merge everything into a single filter object\n   */\n  authorize(input: AggregationAuthorizationInput): AggregationAuthorizationResult {\n    const { query, executionContext, chartRoles, urlParams, parentResource } = input;\n\n    const resourceConfig = this.getResourceConfigurationOrThrow(query.mainResourceType, executionContext);\n\n    // 1. Start with static filters from the query\n    const filter: Record<string, unknown> = { ...(query.filters || {}) };\n\n    // 2. Inject scope-based filters before the role check so missing/unknown scope\n    // fails with the real authorization reason instead of a generic role denial.\n    const scopeLocks = this.injectScopeFilters(resourceConfig.resourcePrimaryScope as ResourcePrimaryScope, query.mainResourceType, executionContext, filter);\n\n    // 3. LIST role check against the active application/org/user scope.\n    this.checkListAccess(query.mainResourceType, resourceConfig, executionContext, chartRoles);\n\n    // 4. Resolve context filters\n    if (query.contextFilters && query.contextFilters.length > 0) {\n      this.resolveContextFilters(\n        query.contextFilters,\n        query.mainResourceType,\n        executionContext,\n        urlParams || {},\n        parentResource || {},\n        filter,\n        scopeLocks,\n      );\n    }\n\n    // 5. Retention hide (gate G-AGG). Applied LAST so it cannot be overwritten by a static/context\n    //    filter resolved above, and inside `authorize` so it covers BOTH the main resource and every\n    //    joined resource (each join is authorized through this same method).\n    return {\n      resolvedFilter: this.applyRetentionHideToAggregationFilter(\n        resourceConfig,\n        filter,\n        executionContext,\n      ) as ResourceFilter,\n    };\n  }\n\n  /**\n   * Hide impersonalized-and-retained rows from an aggregation (gate **G-AGG**).\n   *\n   * The charts/analytics path builds its own `$match` from the authorization result and NEVER passes\n   * through `buildContextualFilter`, so without this a RETAINED row still contributes to every chart,\n   * KPI tile and export — leaking, in aggregate form, records that are individually unreadable. A\n   * count or a sum over a hidden row is still disclosure.\n   *\n   * THE single authority for the aggregation side, deliberately public: the query service reuses it\n   * for the `skipAuthorization` bypass branch, so skipping AUTHORIZATION can never mean skipping\n   * RETENTION (mirrors the repository chokepoint, where the hide is applied before the\n   * `excludeContextualFilter` early-return for exactly this reason).\n   *\n   * FAIL-CLOSED: assigned at the TOP LEVEL, overwriting any caller-supplied `retentionStatus` — a\n   * chart's static `filters` are author-controlled and must not be able to re-select retained rows.\n   *\n   * Suppressed ONLY by the audited see-through EC flag (M5b). No read-op scoping is needed here, and\n   * its absence is structural rather than incidental: an aggregation compiles to a read-only pipeline\n   * and has no write path, so a see-through EC reaching this code can never mutate a retained row.\n   */\n  public applyRetentionHideToAggregationFilter(\n    resourceConfiguration: RetentionGovernanceSignal | undefined,\n    filter: Record<string, unknown>,\n    executionContext?: ExecutionContext<any>,\n  ): Record<string, unknown> {\n    if (!isRetentionGovernedResource(resourceConfiguration)) {\n      return filter;\n    }\n    if (isRetentionHideSuppressedForReadOnlyPipeline(executionContext)) {\n      // Audited compliance reveal — the caller has already passed the `seeRetained` fail-closed gate\n      // and supplied a human + reason, so retained rows are legitimately in scope for this aggregate.\n      // Returning the filter UNTOUCHED is what lets an auditor's own `retentionStatus` predicate survive.\n      return filter;\n    }\n    return withRetentionHideApplied(filter);\n  }\n\n  // ── LIST Role Check ────────────────────────────────────────\n\n  private checkListAccess(\n    resourceType: string,\n    config: any,\n    executionContext: ExecutionContext<any>,\n    chartRoles?: string[],\n  ): void {\n    // Find the LIST operation's roles\n    const listRoles = this.getListOperationRoles(config);\n    if (!listRoles) {\n      // No LIST operation configured → deny\n      this.logger.warn(`AggregationAuthorization: no LIST operation for '${resourceType}'`);\n      throw this.errorBuilder.buildError(\n        ErrorType.AUTHORIZATION,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.AGGREGATION_ACCESS_DENIED,\n          context: { resourceType },\n        },\n      );\n    }\n\n    // If chart restricts roles further, narrow the allowed set\n    const effectiveRoles = chartRoles\n      ? listRoles.filter(r => chartRoles.includes(r))\n      : listRoles;\n\n    if (effectiveRoles.length === 0) {\n      throw this.errorBuilder.buildError(\n        ErrorType.AUTHORIZATION,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.AGGREGATION_ACCESS_DENIED,\n        },\n      );\n    }\n\n    // Check if the user satisfies at least one effective role — honouring the\n    // ROLE HIERARCHY, exactly like the canonical `validateOperationRoles`. A raw\n    // `includes` check (the previous behaviour) wrongly denied an ORG_ADMIN a chart\n    // gated on ORG_MEMBER, because admin's *inherited* membership was never\n    // expanded. We keep the scope-filtering (only the active org's / user's roles\n    // count — a deliberate aggregation tightening) and expand each scope-filtered\n    // role through ITS scope's hierarchy via the live (custom-aware) role config.\n    const resourceScope = config.resourcePrimaryScope as ResourcePrimaryScope;\n    const relevantRoles = this.collectRelevantUserRoles(resourceScope, executionContext);\n    const userRoles = relevantRoles.map(entry => entry.role);\n\n    const satisfiedRoles = new Set<string>();\n    for (const { role, scope } of relevantRoles) {\n      // Always include the role itself (preserves the prior direct-match behaviour\n      // even for a required role that is absent from the hierarchy config), then\n      // add every ancestor it inherits.\n      satisfiedRoles.add(role);\n      for (const inherited of this.authorizationsService.getRoleHierarchy(role as Roles, scope)) {\n        satisfiedRoles.add(inherited);\n      }\n    }\n    const hasAccess = effectiveRoles.some(role => satisfiedRoles.has(role));\n\n    if (!hasAccess) {\n      this.logger.warn(`AggregationAuthorization: user lacks LIST access on '${resourceType}'. User roles: [${userRoles.join(', ')}], required: [${effectiveRoles.join(', ')}]`);\n      throw this.errorBuilder.buildError(\n        ErrorType.AUTHORIZATION,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.AGGREGATION_ACCESS_DENIED,\n          context: { resourceType },\n        },\n      );\n    }\n  }\n\n  // ── Scope Filter Injection ─────────────────────────────────\n\n  private injectScopeFilters(\n    scope: ResourcePrimaryScope,\n    resourceType: string,\n    executionContext: ExecutionContext<any>,\n    filter: Record<string, unknown>,\n  ): ScopeLockDescriptor[] {\n    switch (scope) {\n      case ResourcePrimaryScope.ORGANIZATIONS: {\n        const orgId = executionContext.organizationId;\n        if (!orgId) {\n          throw this.errorBuilder.buildError(\n            ErrorType.AUTHORIZATION,\n            executionContext,\n            {\n              customMessageReference: ErrorCustomMessageReference.AGGREGATION_SCOPE_UNRESOLVED,\n              context: {\n                // diagnostic (log-only)\n                resourceType,\n              },\n            },\n          );\n        }\n        // Always enforce scope — override any pre-existing value to prevent bypass\n        filter['organizationId'] = orgId;\n        return [{ field: 'organizationId', value: orgId }];\n      }\n      case ResourcePrimaryScope.USER_SELF: {\n        const userId = executionContext.userId;\n        if (!userId) {\n          throw this.errorBuilder.buildError(\n            ErrorType.AUTHORIZATION,\n            executionContext,\n            {\n              customMessageReference: ErrorCustomMessageReference.AGGREGATION_SCOPE_UNRESOLVED,\n              context: {\n                // diagnostic (log-only)\n                resourceType,\n              },\n            },\n          );\n        }\n        filter['userId'] = userId;\n        return [{ field: 'userId', value: userId }];\n      }\n      case ResourcePrimaryScope.APPLICATION:\n        // No scope filter needed — admin-level\n        return [];\n      default:\n        throw this.errorBuilder.buildError(\n          ErrorType.AUTHORIZATION,\n          executionContext,\n          {\n            customMessageReference: ErrorCustomMessageReference.AGGREGATION_SCOPE_UNRESOLVED,\n            context: {\n              // diagnostic (log-only)\n              resourceType,\n              scope,\n            },\n          },\n        );\n    }\n  }\n\n  // ── Context Filter Resolution ──────────────────────────────\n\n  private resolveContextFilters(\n    contextFilters: ContextFilter[],\n    resourceType: string,\n    executionContext: ExecutionContext<any>,\n    urlParams: Record<string, string>,\n    parentResource: Record<string, unknown>,\n    filter: Record<string, unknown>,\n    scopeLocks: ScopeLockDescriptor[],\n  ): void {\n    const schema = this.resolveMainSchema(resourceType);\n\n    for (const cf of contextFilters) {\n      const resolvedValue = this.resolveContextFilterValue(cf, executionContext, urlParams, parentResource);\n      if (resolvedValue === undefined || resolvedValue === null) {\n        throw this.errorBuilder.buildError(\n          ErrorType.AUTHORIZATION,\n          executionContext,\n          {\n            customMessageReference: ErrorCustomMessageReference.AGGREGATION_SCOPE_UNRESOLVED,\n            context: {\n              // diagnostic (log-only)\n              resourceType,\n              field: cf.field,\n              source: cf.source,\n              sourceField: cf.sourceField,\n            },\n          },\n        );\n      }\n\n      // Coerce value to the target field's type\n      const coercedValue = schema\n        ? this.coerceToFieldType(resolvedValue, cf.field, schema)\n        : resolvedValue;\n\n      // Apply to filter with operator\n      const operator = cf.operator || ComparisonOperator.EQ;\n\n      this.assertContextFilterDoesNotOverrideScopeLock({\n        resourceType,\n        executionContext,\n        field: cf.field,\n        operator,\n        coercedValue,\n        filter,\n        scopeLocks,\n      });\n\n      if (operator === ComparisonOperator.EQ) {\n        // Simple equality — direct assignment\n        filter[cf.field] = coercedValue;\n      } else {\n        // Operator-based — use MongoDB-style nested object\n        const mongoOp = OPERATOR_TO_MONGO[operator];\n        if (mongoOp) {\n          const existing = filter[cf.field];\n          if (existing && typeof existing === 'object' && !Array.isArray(existing)) {\n            // Merge with existing operator filters on same field (e.g., gte + lte for date range)\n            (existing as Record<string, unknown>)[mongoOp] = coercedValue;\n          } else {\n            filter[cf.field] = { [mongoOp]: coercedValue };\n          }\n        }\n      }\n    }\n  }\n\n  private resolveContextFilterValue(\n    cf: ContextFilter,\n    executionContext: ExecutionContext<any>,\n    urlParams: Record<string, string>,\n    parentResource: Record<string, unknown>,\n  ): unknown {\n    switch (cf.source) {\n      case ContextFilterSource.CURRENT_USER:\n        return cf.sourceField ? (executionContext.initiatorIds as any)?.[cf.sourceField] : executionContext.userId;\n\n      case ContextFilterSource.CURRENT_ORGANIZATION:\n        return executionContext.organizationId;\n\n      case ContextFilterSource.URL_PARAM:\n        return urlParams[cf.sourceField ?? cf.field];\n\n      case ContextFilterSource.PARENT_RESOURCE:\n        return parentResource[cf.sourceField ?? cf.field];\n\n      default:\n        this.logger.warn(`AggregationAuthorization: unknown context filter source '${cf.source}'`);\n        return undefined;\n    }\n  }\n\n  // ── Type coercion ──────────────────────────────────────────\n\n  /**\n   * Coerce a resolved value (typically a string from URL params) to the\n   * target field's Zod type: string → as-is, date → Date, number → Number.\n   */\n  private coerceToFieldType(value: unknown, fieldName: string, schema: z.ZodTypeAny): unknown {\n    const shape = getZodObjectShape(schema);\n    if (!shape || Object.keys(shape).length === 0) return value;\n\n    const fieldSchema = shape[fieldName];\n    if (!fieldSchema) return value;\n\n    // Unwrap optional/nullable to find the core type\n    const coreType = unwrapSchema(fieldSchema);\n    const typeName = getZodType(coreType);\n\n    if (typeof value !== 'string') return value;\n\n    switch (typeName) {\n      case 'date': {\n        const date = new Date(value);\n        if (isNaN(date.getTime())) {\n          this.logger.warn(`AggregationAuthorization: invalid date value '${value}' for field '${fieldName}'`);\n          return value; // Fall back to string — let MongoDB handle it\n        }\n        return date;\n      }\n      case 'number': {\n        const num = Number(value);\n        if (isNaN(num)) {\n          this.logger.warn(`AggregationAuthorization: invalid number value '${value}' for field '${fieldName}'`);\n          return value;\n        }\n        return num;\n      }\n      case 'boolean':\n        return value === 'true' || value === '1';\n      default:\n        return value;\n    }\n  }\n\n  // ── Schema Resolution ──────────────────────────────────────\n\n  private resolveMainSchema(resourceType: string): z.ZodTypeAny | undefined {\n    try {\n      const config = this.resourceRegistry.getResourceConfiguration(resourceType);\n      return config.mainSchema as z.ZodTypeAny;\n    } catch {\n      return undefined;\n    }\n  }\n\n  // ── Helpers ────────────────────────────────────────────────\n\n  /**\n   * Extract the allowed role strings from the default LIST operation on a resource config.\n   *\n   * Resource configs expose `operations` as an array of\n   * `{ operationIdentifier: string; isOperationDefault: boolean; roles?: (string|object)[] }`.\n   * We use `any` here because the resource-registry returns a dynamic config object\n   * whose internal shape depends on the app's resource definitions.  The function\n   * is defensive: it gracefully returns `undefined` if the structure doesn't match.\n   */\n  private getListOperationRoles(config: any): string[] | undefined {\n    // operations is an array — use .find() to locate the LIST default operation\n    if (!config.operations || !Array.isArray(config.operations)) return undefined;\n\n    const listOp = config.operations.find(\n      (op: any) => op.operationIdentifier === CoreResourceOperation.LIST && op.isOperationDefault === true,\n    );\n    if (!listOp) return undefined;\n\n    // roles is directly on the operation object\n    if (listOp.roles && Array.isArray(listOp.roles)) {\n      return listOp.roles.map((r: any) => typeof r === 'string' ? r : String(r));\n    }\n\n    return undefined;\n  }\n\n  private getResourceConfigurationOrThrow(resourceType: string, executionContext: ExecutionContext<any>): any {\n    try {\n      return this.resourceRegistry.getResourceConfiguration(resourceType);\n    } catch {\n      this.logger.warn(`AggregationAuthorization: resource '${resourceType}' not found in registry`);\n      throw this.errorBuilder.buildError(\n        ErrorType.NOT_FOUND,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.NOT_FOUND,\n          context: { resourceType },\n        },\n      );\n    }\n  }\n\n  /**\n   * Collect the user's roles RELEVANT to a chart over a resource of `resourceScope`,\n   * each paired with the scope it was granted in so the caller can expand it through\n   * the correct (app vs org) role hierarchy.\n   *\n   * Relevance (the deliberate aggregation tightening): application-scope roles always\n   * count; organization-scope roles count only for the ACTIVE organization; user-self\n   * roles count only for the active user. A role granted in some OTHER org must never\n   * authorize a chart scoped to the active org.\n   */\n  private collectRelevantUserRoles(\n    resourceScope: ResourcePrimaryScope,\n    executionContext: ExecutionContext<any>,\n  ): Array<{ role: string; scope: ResourcePrimaryScope }> {\n    const roleInfos = executionContext.initiatorRoles;\n    if (!roleInfos || !Array.isArray(roleInfos)) return [];\n\n    const activeOrganizationId = executionContext.organizationId;\n    const activeUserId = executionContext.userId;\n    const relevant: Array<{ role: string; scope: ResourcePrimaryScope }> = [];\n\n    for (const ri of roleInfos) {\n      if (!ri.roles || !Array.isArray(ri.roles)) {\n        continue;\n      }\n\n      // ORGANIZATION-WIDE GRANTS ONLY. Aggregation asks a scope-level question (\"may this caller\n      // aggregate over this resource?\"), and a unit-scoped role answers a strictly narrower one.\n      // Admitting it here would let a single unit's grant authorize a tenant-wide rollup — and an\n      // aggregate leaks the rows it summarises, so this is a read-boundary escalation.\n      if (!isOrganizationWideRoleInfo(ri)) {\n        continue;\n      }\n\n      const isRelevant =\n        ri.relatedPrimaryScope === ResourcePrimaryScope.APPLICATION\n        || (\n          resourceScope === ResourcePrimaryScope.ORGANIZATIONS\n          && ri.relatedPrimaryScope === ResourcePrimaryScope.ORGANIZATIONS\n          && ri.relatedResourceId === activeOrganizationId\n        )\n        || (\n          resourceScope === ResourcePrimaryScope.USER_SELF\n          && ri.relatedPrimaryScope === ResourcePrimaryScope.USER_SELF\n          && ri.relatedResourceId === activeUserId\n        );\n\n      if (!isRelevant) {\n        continue;\n      }\n\n      for (const role of ri.roles) {\n        relevant.push({ role, scope: ri.relatedPrimaryScope });\n      }\n    }\n\n    return relevant;\n  }\n\n  private assertContextFilterDoesNotOverrideScopeLock(params: {\n    resourceType: string;\n    executionContext: ExecutionContext<any>;\n    field: string;\n    operator: ComparisonOperator;\n    coercedValue: unknown;\n    filter: Record<string, unknown>;\n    scopeLocks: ScopeLockDescriptor[];\n  }): void {\n    const scopeLock = params.scopeLocks.find((lock) => lock.field === params.field);\n    if (!scopeLock) {\n      return;\n    }\n\n    if (params.operator !== ComparisonOperator.EQ || params.coercedValue !== scopeLock.value) {\n      throw this.errorBuilder.buildError(\n        ErrorType.AUTHORIZATION,\n        params.executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.AGGREGATION_SCOPE_CONFLICT,\n          context: {\n            // diagnostic (log-only)\n            resourceType: params.resourceType,\n            field: params.field,\n          },\n        },\n      );\n    }\n\n    const existingValue = params.filter[params.field];\n    if (existingValue !== scopeLock.value) {\n      throw this.errorBuilder.buildError(\n        ErrorType.AUTHORIZATION,\n        params.executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.AGGREGATION_SCOPE_CONFLICT,\n          context: {\n            // diagnostic (log-only)\n            resourceType: params.resourceType,\n            field: params.field,\n          },\n        },\n      );\n    }\n  }\n\n}\n"]}
+{"version":3,"file":"aggregation-authorization.backend.service.js","sourceRoot":"","sources":["../../../../../../src/databases/services/aggregation/aggregation-authorization.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;oEAaoE;;;;;;;;;;;;;AAEpE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAMpF,OAAO,EACL,SAAS,EACT,2BAA2B,EAC3B,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,0BAA0B,EAC1B,gCAAgC,GACjC,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,2BAA2B,EAC3B,4CAA4C,EAC5C,wBAAwB,GAEzB,MAAM,wEAAwE,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAIvF,yDAAyD;AACzD,MAAM,iBAAiB,GAA2B;IAChD,CAAC,kBAAkB,CAAC,EAAE,CAAC,EAAE,KAAK;IAC9B,CAAC,kBAAkB,CAAC,EAAE,CAAC,EAAE,KAAK;IAC9B,CAAC,kBAAkB,CAAC,EAAE,CAAC,EAAE,KAAK;IAC9B,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,MAAM;IAChC,CAAC,kBAAkB,CAAC,EAAE,CAAC,EAAE,KAAK;IAC9B,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,MAAM;CACjC,CAAC;AA0BK,IAAM,sCAAsC,GAA5C,MAAM,sCAAsC;IAEK;IACa;IACI;IACF;IAJrE,YACsD,MAAqB,EACR,YAAwC,EACpC,gBAAiD,EACnD,qBAAmD;QAHlE,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QACpC,qBAAgB,GAAhB,gBAAgB,CAAiC;QACnD,0BAAqB,GAArB,qBAAqB,CAA8B;IACrH,CAAC;IAEJ;;;;;;OAMG;IACH,SAAS,CAAC,KAAoC;QAC5C,MAAM,EAAE,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC;QAEjF,MAAM,cAAc,GAAG,IAAI,CAAC,+BAA+B,CAAC,KAAK,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;QAEtG,8CAA8C;QAC9C,MAAM,MAAM,GAA4B,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QAErE,+EAA+E;QAC/E,6EAA6E;QAC7E,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,oBAA4C,EAAE,KAAK,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;QAE1J,oEAAoE;QACpE,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,gBAAgB,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC;QAE3F,6BAA6B;QAC7B,IAAI,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5D,IAAI,CAAC,qBAAqB,CACxB,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,gBAAgB,EACtB,gBAAgB,EAChB,SAAS,IAAI,EAAE,EACf,cAAc,IAAI,EAAE,EACpB,MAAM,EACN,UAAU,CACX,CAAC;QACJ,CAAC;QAED,+FAA+F;QAC/F,iGAAiG;QACjG,yEAAyE;QACzE,OAAO;YACL,cAAc,EAAE,IAAI,CAAC,qCAAqC,CACxD,cAAc,EACd,MAAM,EACN,gBAAgB,CACC;SACpB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACI,qCAAqC,CAC1C,qBAA4D,EAC5D,MAA+B,EAC/B,gBAAwC;QAExC,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,EAAE,CAAC;YACxD,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,4CAA4C,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACnE,+FAA+F;YAC/F,gGAAgG;YAChG,oGAAoG;YACpG,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,8DAA8D;IAEtD,eAAe,CACrB,YAAoB,EACpB,MAAW,EACX,gBAAuC,EACvC,UAAqB;QAErB,kCAAkC;QAClC,MAAM,SAAS,GAAG,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,sCAAsC;YACtC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oDAAoD,YAAY,GAAG,CAAC,CAAC;YACtF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,yBAAyB;gBAC7E,OAAO,EAAE,EAAE,YAAY,EAAE;aAC1B,CACF,CAAC;QACJ,CAAC;QAED,2DAA2D;QAC3D,MAAM,cAAc,GAAG,UAAU;YAC/B,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC/C,CAAC,CAAC,SAAS,CAAC;QAEd,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,yBAAyB;aAC9E,CACF,CAAC;QACJ,CAAC;QAED;;;;;;;;;;;;;;;WAeG;QACH,IAAI,gCAAgC,CAAC,cAAc,CAAC,EAAE,CAAC;YACrD,OAAO;QACT,CAAC;QAED,0EAA0E;QAC1E,6EAA6E;QAC7E,gFAAgF;QAChF,wEAAwE;QACxE,8EAA8E;QAC9E,8EAA8E;QAC9E,8EAA8E;QAC9E,MAAM,aAAa,GAAG,MAAM,CAAC,oBAA4C,CAAC;QAC1E,MAAM,aAAa,GAAG,IAAI,CAAC,wBAAwB,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;QACrF,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEzD,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;QACzC,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,aAAa,EAAE,CAAC;YAC5C,6EAA6E;YAC7E,2EAA2E;YAC3E,kCAAkC;YAClC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACzB,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,IAAa,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC1F,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QACD,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAExE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wDAAwD,YAAY,mBAAmB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC3K,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,yBAAyB;gBAC7E,OAAO,EAAE,EAAE,YAAY,EAAE;aAC1B,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,8DAA8D;IAEtD,kBAAkB,CACxB,KAA2B,EAC3B,YAAoB,EACpB,gBAAuC,EACvC,MAA+B;QAE/B,QAAQ,KAAK,EAAE,CAAC;YACd,KAAK,oBAAoB,CAAC,aAAa,CAAC,CAAC,CAAC;gBACxC,MAAM,KAAK,GAAG,gBAAgB,CAAC,cAAc,CAAC;gBAC9C,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;wBACE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;wBAChF,OAAO,EAAE;4BACP,wBAAwB;4BACxB,YAAY;yBACb;qBACF,CACF,CAAC;gBACJ,CAAC;gBACD,2EAA2E;gBAC3E,MAAM,CAAC,gBAAgB,CAAC,GAAG,KAAK,CAAC;gBACjC,OAAO,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YACrD,CAAC;YACD,KAAK,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC;gBACpC,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC;gBACvC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;wBACE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;wBAChF,OAAO,EAAE;4BACP,wBAAwB;4BACxB,YAAY;yBACb;qBACF,CACF,CAAC;gBACJ,CAAC;gBACD,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC;gBAC1B,OAAO,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAC9C,CAAC;YACD,KAAK,oBAAoB,CAAC,WAAW;gBACnC,uCAAuC;gBACvC,OAAO,EAAE,CAAC;YACZ;gBACE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;oBAChF,OAAO,EAAE;wBACP,wBAAwB;wBACxB,YAAY;wBACZ,KAAK;qBACN;iBACF,CACF,CAAC;QACN,CAAC;IACH,CAAC;IAED,8DAA8D;IAEtD,qBAAqB,CAC3B,cAA+B,EAC/B,YAAoB,EACpB,gBAAuC,EACvC,SAAiC,EACjC,cAAuC,EACvC,MAA+B,EAC/B,UAAiC;QAEjC,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;QAEpD,KAAK,MAAM,EAAE,IAAI,cAAc,EAAE,CAAC;YAChC,MAAM,aAAa,GAAG,IAAI,CAAC,yBAAyB,CAAC,EAAE,EAAE,gBAAgB,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;YACtG,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC1D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;oBAChF,OAAO,EAAE;wBACP,wBAAwB;wBACxB,YAAY;wBACZ,KAAK,EAAE,EAAE,CAAC,KAAK;wBACf,MAAM,EAAE,EAAE,CAAC,MAAM;wBACjB,WAAW,EAAE,EAAE,CAAC,WAAW;qBAC5B;iBACF,CACF,CAAC;YACJ,CAAC;YAED,0CAA0C;YAC1C,MAAM,YAAY,GAAG,MAAM;gBACzB,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,aAAa,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;gBACzD,CAAC,CAAC,aAAa,CAAC;YAElB,gCAAgC;YAChC,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,IAAI,kBAAkB,CAAC,EAAE,CAAC;YAEtD,IAAI,CAAC,2CAA2C,CAAC;gBAC/C,YAAY;gBACZ,gBAAgB;gBAChB,KAAK,EAAE,EAAE,CAAC,KAAK;gBACf,QAAQ;gBACR,YAAY;gBACZ,MAAM;gBACN,UAAU;aACX,CAAC,CAAC;YAEH,IAAI,QAAQ,KAAK,kBAAkB,CAAC,EAAE,EAAE,CAAC;gBACvC,sCAAsC;gBACtC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,YAAY,CAAC;YAClC,CAAC;iBAAM,CAAC;gBACN,mDAAmD;gBACnD,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;gBAC5C,IAAI,OAAO,EAAE,CAAC;oBACZ,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;oBAClC,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;wBACzE,sFAAsF;wBACrF,QAAoC,CAAC,OAAO,CAAC,GAAG,YAAY,CAAC;oBAChE,CAAC;yBAAM,CAAC;wBACN,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC;oBACjD,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAEO,yBAAyB,CAC/B,EAAiB,EACjB,gBAAuC,EACvC,SAAiC,EACjC,cAAuC;QAEvC,QAAQ,EAAE,CAAC,MAAM,EAAE,CAAC;YAClB,KAAK,mBAAmB,CAAC,YAAY;gBACnC,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC,CAAE,gBAAgB,CAAC,YAAoB,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC;YAE7G,KAAK,mBAAmB,CAAC,oBAAoB;gBAC3C,OAAO,gBAAgB,CAAC,cAAc,CAAC;YAEzC,KAAK,mBAAmB,CAAC,SAAS;gBAChC,OAAO,SAAS,CAAC,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC;YAE/C,KAAK,mBAAmB,CAAC,eAAe;gBACtC,OAAO,cAAc,CAAC,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC;YAEpD;gBACE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4DAA4D,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;gBAC3F,OAAO,SAAS,CAAC;QACrB,CAAC;IACH,CAAC;IAED,8DAA8D;IAE9D;;;OAGG;IACK,iBAAiB,CAAC,KAAc,EAAE,SAAiB,EAAE,MAAoB;QAC/E,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAE5D,MAAM,WAAW,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,CAAC,WAAW;YAAE,OAAO,KAAK,CAAC;QAE/B,iDAAiD;QACjD,MAAM,QAAQ,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAEtC,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAE5C,QAAQ,QAAQ,EAAE,CAAC;YACjB,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC7B,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;oBAC1B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iDAAiD,KAAK,gBAAgB,SAAS,GAAG,CAAC,CAAC;oBACrG,OAAO,KAAK,CAAC,CAAC,8CAA8C;gBAC9D,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC1B,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;oBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mDAAmD,KAAK,gBAAgB,SAAS,GAAG,CAAC,CAAC;oBACvG,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,OAAO,GAAG,CAAC;YACb,CAAC;YACD,KAAK,SAAS;gBACZ,OAAO,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,GAAG,CAAC;YAC3C;gBACE,OAAO,KAAK,CAAC;QACjB,CAAC;IACH,CAAC;IAED,8DAA8D;IAEtD,iBAAiB,CAAC,YAAoB;QAC5C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;YAC5E,OAAO,MAAM,CAAC,UAA0B,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,8DAA8D;IAE9D;;;;;;;;OAQG;IACK,qBAAqB,CAAC,MAAW;QACvC,4EAA4E;QAC5E,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;YAAE,OAAO,SAAS,CAAC;QAE9E,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CACnC,CAAC,EAAO,EAAE,EAAE,CAAC,EAAE,CAAC,mBAAmB,KAAK,qBAAqB,CAAC,IAAI,IAAI,EAAE,CAAC,kBAAkB,KAAK,IAAI,CACrG,CAAC;QACF,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAE9B,4CAA4C;QAC5C,IAAI,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7E,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,+BAA+B,CAAC,YAAoB,EAAE,gBAAuC;QACnG,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;QACtE,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,YAAY,yBAAyB,CAAC,CAAC;YAC/F,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,SAAS,EACnB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,SAAS;gBAC7D,OAAO,EAAE,EAAE,YAAY,EAAE;aAC1B,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACK,wBAAwB,CAC9B,aAAmC,EACnC,gBAAuC;QAEvC,MAAM,SAAS,GAAG,gBAAgB,CAAC,cAAc,CAAC;QAClD,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,CAAC;QAEvD,MAAM,oBAAoB,GAAG,gBAAgB,CAAC,cAAc,CAAC;QAC7D,MAAM,YAAY,GAAG,gBAAgB,CAAC,MAAM,CAAC;QAC7C,MAAM,QAAQ,GAAyD,EAAE,CAAC;QAE1E,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1C,SAAS;YACX,CAAC;YAED,2FAA2F;YAC3F,2FAA2F;YAC3F,4FAA4F;YAC5F,iFAAiF;YACjF,IAAI,CAAC,0BAA0B,CAAC,EAAE,CAAC,EAAE,CAAC;gBACpC,SAAS;YACX,CAAC;YAED,MAAM,UAAU,GACd,EAAE,CAAC,mBAAmB,KAAK,oBAAoB,CAAC,WAAW;mBACxD,CACD,aAAa,KAAK,oBAAoB,CAAC,aAAa;uBACjD,EAAE,CAAC,mBAAmB,KAAK,oBAAoB,CAAC,aAAa;uBAC7D,EAAE,CAAC,iBAAiB,KAAK,oBAAoB,CACjD;mBACE,CACD,aAAa,KAAK,oBAAoB,CAAC,SAAS;uBAC7C,EAAE,CAAC,mBAAmB,KAAK,oBAAoB,CAAC,SAAS;uBACzD,EAAE,CAAC,iBAAiB,KAAK,YAAY,CACzC,CAAC;YAEJ,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,SAAS;YACX,CAAC;YAED,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;gBAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,mBAAmB,EAAE,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,2CAA2C,CAAC,MAQnD;QACC,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC;QAChF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO;QACT,CAAC;QAED,IAAI,MAAM,CAAC,QAAQ,KAAK,kBAAkB,CAAC,EAAE,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC;YACzF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,MAAM,CAAC,gBAAgB,EACvB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;gBAC9E,OAAO,EAAE;oBACP,wBAAwB;oBACxB,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,KAAK,EAAE,MAAM,CAAC,KAAK;iBACpB;aACF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,aAAa,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC;YACtC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,MAAM,CAAC,gBAAgB,EACvB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;gBAC9E,OAAO,EAAE;oBACP,wBAAwB;oBACxB,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,KAAK,EAAE,MAAM,CAAC,KAAK;iBACpB;aACF,CACF,CAAC;QACJ,CAAC;IACH,CAAC;CAEF,CAAA;AApiBY,sCAAsC;IADlD,UAAU,EAAE;IAGR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;IAClD,WAAA,MAAM,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAA;;GALxC,sCAAsC,CAoiBlD","sourcesContent":["/** ──────────────────────────────────────────────────────────────\n * AggregationAuthorizationBackendService\n *\n * Handles authorization for aggregation queries:\n *   1. LIST role check — user must have LIST permission on main resource\n *   2. Scope filter injection — ORGANIZATIONS, USER_SELF, APPLICATION\n *   3. Context filter resolution — parentResource, urlParam, currentUser, currentOrganization\n *   4. Optional chart-level role narrowing\n *\n * Ref: Authorization model → L996-1024\n * Ref: Scope-based injection → L1004-1007\n * Ref: Context filter examples → L1053-1074\n * Ref: Type coercion → L1074\n * ────────────────────────────────────────────────────────────── */\n\nimport { injectable, inject } from 'inversify';\nimport type { z } from 'zod';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport type { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport type { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\nimport type { AuthorizationsBackendService } from '~wildo-backend-lib/security/authorizations/services/authorizations.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport {\n  ErrorType,\n  ErrorCustomMessageReference,\n  CoreResourceOperation,\n  ResourcePrimaryScope,\n  ComparisonOperator,\n  ContextFilterSource,\n  isOrganizationWideRoleInfo,\n  requiredRolesDeclarePublicAccess,\n} from '@wildo-ai/saas-models';\nimport type { Roles, ResourceType } from '@wildo-ai/saas-models';\nimport {\n  isRetentionGovernedResource,\n  isRetentionHideSuppressedForReadOnlyPipeline,\n  withRetentionHideApplied,\n  type RetentionGovernanceSignal,\n} from '~wildo-backend-lib/compliance/privacy/retention-hide-predicate.backend';\nimport { getZodObjectShape, unwrapSchema, getZodType } from '@wildo-ai/zod-decorators';\nimport type { AggregationQuery, ContextFilter } from '@wildo-ai/saas-models';\nimport type { ResourceFilter } from '~wildo-backend-lib/databases/models/filter.backend.schemas';\n\n/** Map ComparisonOperator to MongoDB filter operators */\nconst OPERATOR_TO_MONGO: Record<string, string> = {\n  [ComparisonOperator.EQ]: '$eq',\n  [ComparisonOperator.NE]: '$ne',\n  [ComparisonOperator.GT]: '$gt',\n  [ComparisonOperator.GTE]: '$gte',\n  [ComparisonOperator.LT]: '$lt',\n  [ComparisonOperator.LTE]: '$lte',\n};\n\n/** Input required by the authorization service */\nexport interface AggregationAuthorizationInput {\n  query: AggregationQuery;\n  executionContext: ExecutionContext<any>;\n  /** Optional chart-level role restriction (narrows LIST roles) */\n  chartRoles?: string[];\n  /** URL param values (for context filter resolution) */\n  urlParams?: Record<string, string>;\n  /** Parent resource context (for context filter resolution) */\n  parentResource?: Record<string, unknown>;\n}\n\n/** Output from authorization — the augmented filter to merge into the aggregation */\nexport interface AggregationAuthorizationResult {\n  /** Combined filter (static filters + scope filters + context filters) */\n  resolvedFilter: ResourceFilter;\n}\n\ninterface ScopeLockDescriptor {\n  field: 'organizationId' | 'userId';\n  value: string;\n}\n\n@injectable()\nexport class AggregationAuthorizationBackendService {\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.ResourceRegistryService) private readonly resourceRegistry: ResourcesRegistryBackendService,\n    @inject(SAAS_SERVICE_TYPES.AuthorizationsService) private readonly authorizationsService: AuthorizationsBackendService,\n  ) {}\n\n  /**\n   * Authorize an aggregation query:\n   *   1. Check user has LIST role on mainResourceType\n   *   2. Inject scope filters based on ResourcePrimaryScope\n   *   3. Resolve context filters\n   *   4. Merge everything into a single filter object\n   */\n  authorize(input: AggregationAuthorizationInput): AggregationAuthorizationResult {\n    const { query, executionContext, chartRoles, urlParams, parentResource } = input;\n\n    const resourceConfig = this.getResourceConfigurationOrThrow(query.mainResourceType, executionContext);\n\n    // 1. Start with static filters from the query\n    const filter: Record<string, unknown> = { ...(query.filters || {}) };\n\n    // 2. Inject scope-based filters before the role check so missing/unknown scope\n    // fails with the real authorization reason instead of a generic role denial.\n    const scopeLocks = this.injectScopeFilters(resourceConfig.resourcePrimaryScope as ResourcePrimaryScope, query.mainResourceType, executionContext, filter);\n\n    // 3. LIST role check against the active application/org/user scope.\n    this.checkListAccess(query.mainResourceType, resourceConfig, executionContext, chartRoles);\n\n    // 4. Resolve context filters\n    if (query.contextFilters && query.contextFilters.length > 0) {\n      this.resolveContextFilters(\n        query.contextFilters,\n        query.mainResourceType,\n        executionContext,\n        urlParams || {},\n        parentResource || {},\n        filter,\n        scopeLocks,\n      );\n    }\n\n    // 5. Retention hide (gate G-AGG). Applied LAST so it cannot be overwritten by a static/context\n    //    filter resolved above, and inside `authorize` so it covers BOTH the main resource and every\n    //    joined resource (each join is authorized through this same method).\n    return {\n      resolvedFilter: this.applyRetentionHideToAggregationFilter(\n        resourceConfig,\n        filter,\n        executionContext,\n      ) as ResourceFilter,\n    };\n  }\n\n  /**\n   * Hide impersonalized-and-retained rows from an aggregation (gate **G-AGG**).\n   *\n   * The charts/analytics path builds its own `$match` from the authorization result and NEVER passes\n   * through `buildContextualFilter`, so without this a RETAINED row still contributes to every chart,\n   * KPI tile and export — leaking, in aggregate form, records that are individually unreadable. A\n   * count or a sum over a hidden row is still disclosure.\n   *\n   * THE single authority for the aggregation side, deliberately public: the query service reuses it\n   * for the `skipAuthorization` bypass branch, so skipping AUTHORIZATION can never mean skipping\n   * RETENTION (mirrors the repository chokepoint, where the hide is applied before the\n   * `excludeContextualFilter` early-return for exactly this reason).\n   *\n   * FAIL-CLOSED: assigned at the TOP LEVEL, overwriting any caller-supplied `retentionStatus` — a\n   * chart's static `filters` are author-controlled and must not be able to re-select retained rows.\n   *\n   * Suppressed ONLY by the audited see-through EC flag (M5b). No read-op scoping is needed here, and\n   * its absence is structural rather than incidental: an aggregation compiles to a read-only pipeline\n   * and has no write path, so a see-through EC reaching this code can never mutate a retained row.\n   */\n  public applyRetentionHideToAggregationFilter(\n    resourceConfiguration: RetentionGovernanceSignal | undefined,\n    filter: Record<string, unknown>,\n    executionContext?: ExecutionContext<any>,\n  ): Record<string, unknown> {\n    if (!isRetentionGovernedResource(resourceConfiguration)) {\n      return filter;\n    }\n    if (isRetentionHideSuppressedForReadOnlyPipeline(executionContext)) {\n      // Audited compliance reveal — the caller has already passed the `seeRetained` fail-closed gate\n      // and supplied a human + reason, so retained rows are legitimately in scope for this aggregate.\n      // Returning the filter UNTOUCHED is what lets an auditor's own `retentionStatus` predicate survive.\n      return filter;\n    }\n    return withRetentionHideApplied(filter);\n  }\n\n  // ── LIST Role Check ────────────────────────────────────────\n\n  private checkListAccess(\n    resourceType: string,\n    config: any,\n    executionContext: ExecutionContext<any>,\n    chartRoles?: string[],\n  ): void {\n    // Find the LIST operation's roles\n    const listRoles = this.getListOperationRoles(config);\n    if (!listRoles) {\n      // No LIST operation configured → deny\n      this.logger.warn(`AggregationAuthorization: no LIST operation for '${resourceType}'`);\n      throw this.errorBuilder.buildError(\n        ErrorType.AUTHORIZATION,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.AGGREGATION_ACCESS_DENIED,\n          context: { resourceType },\n        },\n      );\n    }\n\n    // If chart restricts roles further, narrow the allowed set\n    const effectiveRoles = chartRoles\n      ? listRoles.filter(r => chartRoles.includes(r))\n      : listRoles;\n\n    if (effectiveRoles.length === 0) {\n      throw this.errorBuilder.buildError(\n        ErrorType.AUTHORIZATION,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.AGGREGATION_ACCESS_DENIED,\n        },\n      );\n    }\n\n    /*\n     * The THIRD role gate that must honour `APP_PUBLIC`, and the one furthest from the authorizer.\n     *\n     * A chart over a resource whose LIST declares `APP_PUBLIC` asks the same question\n     * `validateOperationRoles` asks, by a different mechanism — so before this line it produced the\n     * same wrong answer: the LIST itself answered 200 to an authenticated caller (once the\n     * authorizer's gate was fixed) while a chart built on that very LIST kept refusing them.\n     *\n     * Read from `effectiveRoles`, not `listRoles`, so a chart that narrows deliberately still\n     * narrows: a public LIST with `chartRoles: [ORG_ADMIN]` intersects to `[ORG_ADMIN]`, carries no\n     * public sentinel, and is gated exactly as its author declared. Only a required set that STILL\n     * declares public access after the narrowing admits everyone.\n     *\n     * The scope-filter injection below is untouched — this relaxes who may ASK, never which rows the\n     * aggregation reads.\n     */\n    if (requiredRolesDeclarePublicAccess(effectiveRoles)) {\n      return;\n    }\n\n    // Check if the user satisfies at least one effective role — honouring the\n    // ROLE HIERARCHY, exactly like the canonical `validateOperationRoles`. A raw\n    // `includes` check (the previous behaviour) wrongly denied an ORG_ADMIN a chart\n    // gated on ORG_MEMBER, because admin's *inherited* membership was never\n    // expanded. We keep the scope-filtering (only the active org's / user's roles\n    // count — a deliberate aggregation tightening) and expand each scope-filtered\n    // role through ITS scope's hierarchy via the live (custom-aware) role config.\n    const resourceScope = config.resourcePrimaryScope as ResourcePrimaryScope;\n    const relevantRoles = this.collectRelevantUserRoles(resourceScope, executionContext);\n    const userRoles = relevantRoles.map(entry => entry.role);\n\n    const satisfiedRoles = new Set<string>();\n    for (const { role, scope } of relevantRoles) {\n      // Always include the role itself (preserves the prior direct-match behaviour\n      // even for a required role that is absent from the hierarchy config), then\n      // add every ancestor it inherits.\n      satisfiedRoles.add(role);\n      for (const inherited of this.authorizationsService.getRoleHierarchy(role as Roles, scope)) {\n        satisfiedRoles.add(inherited);\n      }\n    }\n    const hasAccess = effectiveRoles.some(role => satisfiedRoles.has(role));\n\n    if (!hasAccess) {\n      this.logger.warn(`AggregationAuthorization: user lacks LIST access on '${resourceType}'. User roles: [${userRoles.join(', ')}], required: [${effectiveRoles.join(', ')}]`);\n      throw this.errorBuilder.buildError(\n        ErrorType.AUTHORIZATION,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.AGGREGATION_ACCESS_DENIED,\n          context: { resourceType },\n        },\n      );\n    }\n  }\n\n  // ── Scope Filter Injection ─────────────────────────────────\n\n  private injectScopeFilters(\n    scope: ResourcePrimaryScope,\n    resourceType: string,\n    executionContext: ExecutionContext<any>,\n    filter: Record<string, unknown>,\n  ): ScopeLockDescriptor[] {\n    switch (scope) {\n      case ResourcePrimaryScope.ORGANIZATIONS: {\n        const orgId = executionContext.organizationId;\n        if (!orgId) {\n          throw this.errorBuilder.buildError(\n            ErrorType.AUTHORIZATION,\n            executionContext,\n            {\n              customMessageReference: ErrorCustomMessageReference.AGGREGATION_SCOPE_UNRESOLVED,\n              context: {\n                // diagnostic (log-only)\n                resourceType,\n              },\n            },\n          );\n        }\n        // Always enforce scope — override any pre-existing value to prevent bypass\n        filter['organizationId'] = orgId;\n        return [{ field: 'organizationId', value: orgId }];\n      }\n      case ResourcePrimaryScope.USER_SELF: {\n        const userId = executionContext.userId;\n        if (!userId) {\n          throw this.errorBuilder.buildError(\n            ErrorType.AUTHORIZATION,\n            executionContext,\n            {\n              customMessageReference: ErrorCustomMessageReference.AGGREGATION_SCOPE_UNRESOLVED,\n              context: {\n                // diagnostic (log-only)\n                resourceType,\n              },\n            },\n          );\n        }\n        filter['userId'] = userId;\n        return [{ field: 'userId', value: userId }];\n      }\n      case ResourcePrimaryScope.APPLICATION:\n        // No scope filter needed — admin-level\n        return [];\n      default:\n        throw this.errorBuilder.buildError(\n          ErrorType.AUTHORIZATION,\n          executionContext,\n          {\n            customMessageReference: ErrorCustomMessageReference.AGGREGATION_SCOPE_UNRESOLVED,\n            context: {\n              // diagnostic (log-only)\n              resourceType,\n              scope,\n            },\n          },\n        );\n    }\n  }\n\n  // ── Context Filter Resolution ──────────────────────────────\n\n  private resolveContextFilters(\n    contextFilters: ContextFilter[],\n    resourceType: string,\n    executionContext: ExecutionContext<any>,\n    urlParams: Record<string, string>,\n    parentResource: Record<string, unknown>,\n    filter: Record<string, unknown>,\n    scopeLocks: ScopeLockDescriptor[],\n  ): void {\n    const schema = this.resolveMainSchema(resourceType);\n\n    for (const cf of contextFilters) {\n      const resolvedValue = this.resolveContextFilterValue(cf, executionContext, urlParams, parentResource);\n      if (resolvedValue === undefined || resolvedValue === null) {\n        throw this.errorBuilder.buildError(\n          ErrorType.AUTHORIZATION,\n          executionContext,\n          {\n            customMessageReference: ErrorCustomMessageReference.AGGREGATION_SCOPE_UNRESOLVED,\n            context: {\n              // diagnostic (log-only)\n              resourceType,\n              field: cf.field,\n              source: cf.source,\n              sourceField: cf.sourceField,\n            },\n          },\n        );\n      }\n\n      // Coerce value to the target field's type\n      const coercedValue = schema\n        ? this.coerceToFieldType(resolvedValue, cf.field, schema)\n        : resolvedValue;\n\n      // Apply to filter with operator\n      const operator = cf.operator || ComparisonOperator.EQ;\n\n      this.assertContextFilterDoesNotOverrideScopeLock({\n        resourceType,\n        executionContext,\n        field: cf.field,\n        operator,\n        coercedValue,\n        filter,\n        scopeLocks,\n      });\n\n      if (operator === ComparisonOperator.EQ) {\n        // Simple equality — direct assignment\n        filter[cf.field] = coercedValue;\n      } else {\n        // Operator-based — use MongoDB-style nested object\n        const mongoOp = OPERATOR_TO_MONGO[operator];\n        if (mongoOp) {\n          const existing = filter[cf.field];\n          if (existing && typeof existing === 'object' && !Array.isArray(existing)) {\n            // Merge with existing operator filters on same field (e.g., gte + lte for date range)\n            (existing as Record<string, unknown>)[mongoOp] = coercedValue;\n          } else {\n            filter[cf.field] = { [mongoOp]: coercedValue };\n          }\n        }\n      }\n    }\n  }\n\n  private resolveContextFilterValue(\n    cf: ContextFilter,\n    executionContext: ExecutionContext<any>,\n    urlParams: Record<string, string>,\n    parentResource: Record<string, unknown>,\n  ): unknown {\n    switch (cf.source) {\n      case ContextFilterSource.CURRENT_USER:\n        return cf.sourceField ? (executionContext.initiatorIds as any)?.[cf.sourceField] : executionContext.userId;\n\n      case ContextFilterSource.CURRENT_ORGANIZATION:\n        return executionContext.organizationId;\n\n      case ContextFilterSource.URL_PARAM:\n        return urlParams[cf.sourceField ?? cf.field];\n\n      case ContextFilterSource.PARENT_RESOURCE:\n        return parentResource[cf.sourceField ?? cf.field];\n\n      default:\n        this.logger.warn(`AggregationAuthorization: unknown context filter source '${cf.source}'`);\n        return undefined;\n    }\n  }\n\n  // ── Type coercion ──────────────────────────────────────────\n\n  /**\n   * Coerce a resolved value (typically a string from URL params) to the\n   * target field's Zod type: string → as-is, date → Date, number → Number.\n   */\n  private coerceToFieldType(value: unknown, fieldName: string, schema: z.ZodTypeAny): unknown {\n    const shape = getZodObjectShape(schema);\n    if (!shape || Object.keys(shape).length === 0) return value;\n\n    const fieldSchema = shape[fieldName];\n    if (!fieldSchema) return value;\n\n    // Unwrap optional/nullable to find the core type\n    const coreType = unwrapSchema(fieldSchema);\n    const typeName = getZodType(coreType);\n\n    if (typeof value !== 'string') return value;\n\n    switch (typeName) {\n      case 'date': {\n        const date = new Date(value);\n        if (isNaN(date.getTime())) {\n          this.logger.warn(`AggregationAuthorization: invalid date value '${value}' for field '${fieldName}'`);\n          return value; // Fall back to string — let MongoDB handle it\n        }\n        return date;\n      }\n      case 'number': {\n        const num = Number(value);\n        if (isNaN(num)) {\n          this.logger.warn(`AggregationAuthorization: invalid number value '${value}' for field '${fieldName}'`);\n          return value;\n        }\n        return num;\n      }\n      case 'boolean':\n        return value === 'true' || value === '1';\n      default:\n        return value;\n    }\n  }\n\n  // ── Schema Resolution ──────────────────────────────────────\n\n  private resolveMainSchema(resourceType: string): z.ZodTypeAny | undefined {\n    try {\n      const config = this.resourceRegistry.getResourceConfiguration(resourceType);\n      return config.mainSchema as z.ZodTypeAny;\n    } catch {\n      return undefined;\n    }\n  }\n\n  // ── Helpers ────────────────────────────────────────────────\n\n  /**\n   * Extract the allowed role strings from the default LIST operation on a resource config.\n   *\n   * Resource configs expose `operations` as an array of\n   * `{ operationIdentifier: string; isOperationDefault: boolean; roles?: (string|object)[] }`.\n   * We use `any` here because the resource-registry returns a dynamic config object\n   * whose internal shape depends on the app's resource definitions.  The function\n   * is defensive: it gracefully returns `undefined` if the structure doesn't match.\n   */\n  private getListOperationRoles(config: any): string[] | undefined {\n    // operations is an array — use .find() to locate the LIST default operation\n    if (!config.operations || !Array.isArray(config.operations)) return undefined;\n\n    const listOp = config.operations.find(\n      (op: any) => op.operationIdentifier === CoreResourceOperation.LIST && op.isOperationDefault === true,\n    );\n    if (!listOp) return undefined;\n\n    // roles is directly on the operation object\n    if (listOp.roles && Array.isArray(listOp.roles)) {\n      return listOp.roles.map((r: any) => typeof r === 'string' ? r : String(r));\n    }\n\n    return undefined;\n  }\n\n  private getResourceConfigurationOrThrow(resourceType: string, executionContext: ExecutionContext<any>): any {\n    try {\n      return this.resourceRegistry.getResourceConfiguration(resourceType);\n    } catch {\n      this.logger.warn(`AggregationAuthorization: resource '${resourceType}' not found in registry`);\n      throw this.errorBuilder.buildError(\n        ErrorType.NOT_FOUND,\n        executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.NOT_FOUND,\n          context: { resourceType },\n        },\n      );\n    }\n  }\n\n  /**\n   * Collect the user's roles RELEVANT to a chart over a resource of `resourceScope`,\n   * each paired with the scope it was granted in so the caller can expand it through\n   * the correct (app vs org) role hierarchy.\n   *\n   * Relevance (the deliberate aggregation tightening): application-scope roles always\n   * count; organization-scope roles count only for the ACTIVE organization; user-self\n   * roles count only for the active user. A role granted in some OTHER org must never\n   * authorize a chart scoped to the active org.\n   */\n  private collectRelevantUserRoles(\n    resourceScope: ResourcePrimaryScope,\n    executionContext: ExecutionContext<any>,\n  ): Array<{ role: string; scope: ResourcePrimaryScope }> {\n    const roleInfos = executionContext.initiatorRoles;\n    if (!roleInfos || !Array.isArray(roleInfos)) return [];\n\n    const activeOrganizationId = executionContext.organizationId;\n    const activeUserId = executionContext.userId;\n    const relevant: Array<{ role: string; scope: ResourcePrimaryScope }> = [];\n\n    for (const ri of roleInfos) {\n      if (!ri.roles || !Array.isArray(ri.roles)) {\n        continue;\n      }\n\n      // ORGANIZATION-WIDE GRANTS ONLY. Aggregation asks a scope-level question (\"may this caller\n      // aggregate over this resource?\"), and a unit-scoped role answers a strictly narrower one.\n      // Admitting it here would let a single unit's grant authorize a tenant-wide rollup — and an\n      // aggregate leaks the rows it summarises, so this is a read-boundary escalation.\n      if (!isOrganizationWideRoleInfo(ri)) {\n        continue;\n      }\n\n      const isRelevant =\n        ri.relatedPrimaryScope === ResourcePrimaryScope.APPLICATION\n        || (\n          resourceScope === ResourcePrimaryScope.ORGANIZATIONS\n          && ri.relatedPrimaryScope === ResourcePrimaryScope.ORGANIZATIONS\n          && ri.relatedResourceId === activeOrganizationId\n        )\n        || (\n          resourceScope === ResourcePrimaryScope.USER_SELF\n          && ri.relatedPrimaryScope === ResourcePrimaryScope.USER_SELF\n          && ri.relatedResourceId === activeUserId\n        );\n\n      if (!isRelevant) {\n        continue;\n      }\n\n      for (const role of ri.roles) {\n        relevant.push({ role, scope: ri.relatedPrimaryScope });\n      }\n    }\n\n    return relevant;\n  }\n\n  private assertContextFilterDoesNotOverrideScopeLock(params: {\n    resourceType: string;\n    executionContext: ExecutionContext<any>;\n    field: string;\n    operator: ComparisonOperator;\n    coercedValue: unknown;\n    filter: Record<string, unknown>;\n    scopeLocks: ScopeLockDescriptor[];\n  }): void {\n    const scopeLock = params.scopeLocks.find((lock) => lock.field === params.field);\n    if (!scopeLock) {\n      return;\n    }\n\n    if (params.operator !== ComparisonOperator.EQ || params.coercedValue !== scopeLock.value) {\n      throw this.errorBuilder.buildError(\n        ErrorType.AUTHORIZATION,\n        params.executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.AGGREGATION_SCOPE_CONFLICT,\n          context: {\n            // diagnostic (log-only)\n            resourceType: params.resourceType,\n            field: params.field,\n          },\n        },\n      );\n    }\n\n    const existingValue = params.filter[params.field];\n    if (existingValue !== scopeLock.value) {\n      throw this.errorBuilder.buildError(\n        ErrorType.AUTHORIZATION,\n        params.executionContext,\n        {\n          customMessageReference: ErrorCustomMessageReference.AGGREGATION_SCOPE_CONFLICT,\n          context: {\n            // diagnostic (log-only)\n            resourceType: params.resourceType,\n            field: params.field,\n          },\n        },\n      );\n    }\n  }\n\n}\n"]}

package/dist/esm/databases/services/postgresql-schema-plan-diff.backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"postgresql-schema-plan-diff.backend.d.ts","sourceRoot":"","sources":["../../../../../src/databases/services/postgresql-schema-plan-diff.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAA6C,MAAM,+EAA+E,CAAC;AAEnK;;;;GAIG;AACH,oBAAY,oBAAoB;IAC9B,SAAS,cAAc;IACvB,8FAA8F;IAC9F,UAAU,eAAe;IACzB,UAAU,eAAe;IACzB,qGAAqG;IACrG,WAAW,gBAAgB;IAC3B;;;OAGG;IACH,kBAAkB,uBAAuB;IACzC;;;;OAIG;IACH,kBAAkB,uBAAuB;IACzC;;;;;;;;;;;;;;;;OAgBG;IACH,eAAe,oBAAoB;IACnC;;;OAGG;IACH,+BAA+B,oCAAoC;IACnE,8EAA8E;IAC9E,iCAAiC,sCAAsC;IACvE,wGAAwG;IACxG,gBAAgB,qBAAqB;IACrC,iBAAiB,sBAAsB;IACvC,SAAS,cAAc;IACvB,UAAU,eAAe;IACzB;;;;;;;;OAQG;IACH,qBAAqB,0BAA0B;IAC/C,+FAA+F;IAC/F,cAAc,mBAAmB;IACjC,eAAe,oBAAoB;IACnC,iBAAiB,sBAAsB;CACxC;AAED;;;;;;;;;;;GAWG;AACH,oBAAY,oBAAoB;IAC9B,IAAI,SAAS;IACb,WAAW,gBAAgB;IAC3B,uBAAuB,4BAA4B;CACpD;AACD;;;;;;;;;GASG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,oBAAoB,CAAC;IACjC,IAAI,EAAE,oBAAoB,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,wFAAwF;IACxF,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAC;CAChB;AA8MD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,kBAAkB,EAAE,IAAI,EAAE,kBAAkB,GAAG,gBAAgB,EAAE,CA+BlH"}
+{"version":3,"file":"postgresql-schema-plan-diff.backend.d.ts","sourceRoot":"","sources":["../../../../../src/databases/services/postgresql-schema-plan-diff.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAA6C,MAAM,+EAA+E,CAAC;AAEnK;;;;GAIG;AACH,oBAAY,oBAAoB;IAC9B,SAAS,cAAc;IACvB,8FAA8F;IAC9F,UAAU,eAAe;IACzB,UAAU,eAAe;IACzB,qGAAqG;IACrG,WAAW,gBAAgB;IAC3B;;;OAGG;IACH,kBAAkB,uBAAuB;IACzC;;;;OAIG;IACH,kBAAkB,uBAAuB;IACzC;;;;;;;;;;;;;;;;OAgBG;IACH,eAAe,oBAAoB;IACnC;;;OAGG;IACH,+BAA+B,oCAAoC;IACnE,8EAA8E;IAC9E,iCAAiC,sCAAsC;IACvE,wGAAwG;IACxG,gBAAgB,qBAAqB;IACrC,iBAAiB,sBAAsB;IACvC,SAAS,cAAc;IACvB,UAAU,eAAe;IACzB;;;;;;;;OAQG;IACH,qBAAqB,0BAA0B;IAC/C,+FAA+F;IAC/F,cAAc,mBAAmB;IACjC,eAAe,oBAAoB;IACnC,iBAAiB,sBAAsB;CACxC;AAED;;;;;;;;;;;GAWG;AACH,oBAAY,oBAAoB;IAC9B,IAAI,SAAS;IACb,WAAW,gBAAgB;IAC3B,uBAAuB,4BAA4B;CACpD;AACD;;;;;;;;;GASG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,oBAAoB,CAAC;IACjC,IAAI,EAAE,oBAAoB,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,wFAAwF;IACxF,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAC;CAChB;AA8PD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,kBAAkB,EAAE,IAAI,EAAE,kBAAkB,GAAG,gBAAgB,EAAE,CA+BlH"}

package/dist/esm/databases/services/postgresql-schema-plan-diff.backend.js

@@ -215,6 +215,54 @@ function diffTable(tableName, previous, next) {
                     detail: `new column "${name}" ${after.sqlType}.`,
                 });
             }
+            /*
+             * A column ARRIVES with the properties it was declared with (#505).
+             *
+             * Everything below this point compares `before` against `after`, so it is reachable only for a
+             * column that already existed — and a NEW column `continue`s past all of it. That silently made
+             * `.isDBIndexed()` a no-op on any field added to an EXISTING table: the differ emitted
+             * `ADD_COLUMN` alone, so the database permanently lacked an index the schema declared.
+             *
+             * The initial-schema path was never affected, which is why this survived: `CREATE TABLE`
+             * renders every declared index, so the planner plainly knows how. What it did not do was carry
+             * the declaration through the DELTA path.
+             *
+             * Worse than the missing index was the silence around it. `db diff --check` compares the plan
+             * to the lockfile, and BOTH record `hasIndex: true` — the lockfile is written from the same
+             * plan — so the check was wrong in the same direction as the thing it checks and reported IN
+             * SYNC over a database missing the index. Measured 2026-09-08 on two `oauthClients` tables: the
+             * application generator emitted 4 statements, the platform generator 8, from one schema.
+             *
+             * The primary-key case is included on the same reasoning rather than on symmetry: a new column
+             * declared `isPrimaryKey` on a table that has none is additive and renderable, and skipping it
+             * left exactly the same gap one property over.
+             */
+            if (after.hasIndex === true) {
+                changes.push({
+                    changeType: SchemaPlanChangeType.ADD_INDEX,
+                    risk: SchemaPlanChangeRisk.SAFE,
+                    tableName,
+                    subject: name,
+                    detail: `plain index on the new column "${name}".`,
+                });
+            }
+            if (after.isPrimaryKey === true) {
+                changes.push(previousHadPrimaryKey
+                    ? {
+                        changeType: SchemaPlanChangeType.CHANGE_PRIMARY_KEY,
+                        risk: SchemaPlanChangeRisk.REQUIRES_DATA_MIGRATION,
+                        tableName,
+                        subject: name,
+                        detail: `the new column "${name}" is declared the primary key of a table that already has one — a constraint rebuild that touches every reference to this table; hand-author the plan.`,
+                    }
+                    : {
+                        changeType: SchemaPlanChangeType.ADD_PRIMARY_KEY,
+                        risk: SchemaPlanChangeRisk.SAFE,
+                        tableName,
+                        subject: name,
+                        detail: `the new column "${name}" becomes the primary key of a table that had none. Additive, so nothing references the constraint being built — but it WILL fail on any existing row, since a column that has just arrived holds NULL in every one of them.`,
+                    });
+            }
             continue;
         }
         if (!before || !after)