@wildo-ai/saas-backend-lib 1.1.2 → 1.1.4

package/dist/esm/security/authorizations/access-grant-decision.factory.backend.js

@@ -0,0 +1,111 @@
+/**
+ * The decision verbs of an access grant — `approve` / `deny` / `revoke` / `expire` — for BOTH grant
+ * resources.
+ *
+ * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — a grant's status may only move through a verb
+ * that checks the transition and records it.
+ *
+ * ## What is shared and what is not
+ *
+ * Shared: refuse unless the current status permits the transition, write exactly the fields that
+ * transition owns, and record it after commit. That is identical for a tenant elevation and an
+ * application-wide one, because it is a property of the LIFECYCLE, and the two lifecycles are the
+ * same lifecycle.
+ *
+ * NOT shared, and passed in: `additionalPrecondition`. The application-wide `approve` refuses a
+ * SELF-approval — the two-person rule — and nothing equivalent exists on the tenant resource, where
+ * the requester is a platform operator and the approver is a tenant administrator, so they cannot be
+ * the same person by construction.
+ *
+ * ## Why the guard is here at all when `enabledCondition` already exists
+ *
+ * `enabledCondition` on the operation config is evaluated against the row the framework fetched and
+ * is a UI-and-dispatch concern. This is the fail-closed half: a custom implementation is addressed by
+ * an exact operation path and inherits nothing, so a future variant authored without an
+ * `enabledCondition` would otherwise transition a terminal grant — or approve a self-request —
+ * silently. Neither guard alone is the control; both are, and each has its own pin.
+ */
+import { ErrorCustomMessageReference, ErrorType, ResourceOperationVariantType, } from '@wildo-ai/saas-models';
+import { recordAccessGrantTransition } from '../../security/authorizations/access-grant-lifecycle-audit.backend.js';
+import { createResourceCustomServiceImplementation } from '../../base-classes/services/services/resource-operation-custom-implementation.factory.backend.js';
+export function createAccessGrantDecisionFactory(resourceIdentifier, grantScope, 
+// The operation identifier as a string: `ResourceConfiguration_OperationPath` does not accept a
+// union of enum members, and the two resources declare two enums whose members share their values.
+operationIdentifier, options) {
+    return (_resourcesRegistryService, container) => {
+        const containerRef = container;
+        return createResourceCustomServiceImplementation({
+            operationPath: {
+                resourceIdentifier,
+                operationIdentifier: operationIdentifier,
+                variantType: options.variantType ?? ResourceOperationVariantType.API_CALL,
+                isOperationDefault: true,
+            },
+            debugLabel: options.debugLabel,
+            authoritativeFields: options.stampsApprover
+                ? ['status', 'approvedByUserId', 'approvedAt', 'decisionReason']
+                : ['status', 'decisionReason'],
+            transactionalCore: true,
+            // No additional participants: a decision writes only the grant row itself, which the operation
+            // resource contributes automatically. Declaring the set explicitly (even as empty) is the
+            // authoring contract — startup proves adapter compatibility for what is declared, and it cannot
+            // detect an omitted participant.
+            transactionParticipants: {},
+            handlers: {
+                prefixCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {
+                    const currentObject = utils.currentObject;
+                    const currentStatus = currentObject?.status;
+                    if (!currentStatus || !options.permittedFrom.includes(currentStatus)) {
+                        throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {
+                            customMessageReference: ErrorCustomMessageReference.CONFLICT,
+                            context: {
+                                reason: options.transitionRefusalReason,
+                                currentStatus: currentStatus ?? null,
+                                permittedFrom: [...options.permittedFrom],
+                                operationIdentifier,
+                            },
+                        });
+                    }
+                    const deciderUserId = executionContext.initiatorIds?.userId;
+                    const additionalRefusal = options.additionalPrecondition?.({ currentObject, deciderUserId });
+                    if (additionalRefusal) {
+                        throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {
+                            customMessageReference: ErrorCustomMessageReference.CONFLICT,
+                            context: {
+                                reason: additionalRefusal,
+                                operationIdentifier,
+                            },
+                        });
+                    }
+                    const decisionReason = input?.decisionReason;
+                    const now = new Date();
+                    return {
+                        status: options.nextStatus,
+                        ...(decisionReason ? { decisionReason } : {}),
+                        // Only an APPROVAL names a human approver. A revocation or a denial is a decision too,
+                        // but recording either in `approvedByUserId` would corrupt the one field an audit reads
+                        // to answer "did somebody say yes?".
+                        ...(options.stampsApprover
+                            ? { approvedByUserId: deciderUserId, approvedAt: now }
+                            : {}),
+                    };
+                },
+                postfixCoreOperations: async (_id, updatedGrant, executionContext, _operationPath, utils) => {
+                    recordAccessGrantTransition({
+                        container: containerRef,
+                        utils,
+                        grantScope,
+                        transition: options.auditTransition,
+                        grant: (updatedGrant ?? {}),
+                        // The administrator who acted — distinct from the grant's `operatorUserId`, which stays
+                        // the operator who asked. Conflating them would make an audit unable to answer who said
+                        // yes, which on the application-wide resource is the entire point of the second signature.
+                        decidedByUserId: executionContext.initiatorIds?.userId,
+                    });
+                    return updatedGrant;
+                },
+            },
+        });
+    };
+}
+//# sourceMappingURL=access-grant-decision.factory.backend.js.map

package/dist/esm/security/authorizations/access-grant-decision.factory.backend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-grant-decision.factory.backend.js","sourceRoot":"","sources":["../../../../src/security/authorizations/access-grant-decision.factory.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,EAEL,2BAA2B,EAC3B,SAAS,EAIT,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,2BAA2B,EAAE,MAAM,iFAAiF,CAAC;AAC9H,OAAO,EAAE,yCAAyC,EAAE,MAAM,4GAA4G,CAAC;AAgBvK,MAAM,UAAU,gCAAgC,CAC9C,kBAAoC,EACpC,UAAoC;AACpC,gGAAgG;AAChG,mGAAmG;AACnG,mBAA2B,EAC3B,OAiBC;IAED,OAAO,CAAC,yBAA0D,EAAE,SAAoB,EAAE,EAAE;QAC1F,MAAM,YAAY,GAAG,SAAS,CAAC;QAC/B,OAAO,yCAAyC,CAAC;YAC/C,aAAa,EAAE;gBACb,kBAAkB;gBAClB,mBAAmB,EAAE,mBAA4B;gBACjD,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,4BAA4B,CAAC,QAAQ;gBACzE,kBAAkB,EAAE,IAAI;aACzB;YACD,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,mBAAmB,EAAE,OAAO,CAAC,cAAc;gBACzC,CAAC,CAAC,CAAC,QAAQ,EAAE,kBAAkB,EAAE,YAAY,EAAE,gBAAgB,CAAC;gBAChE,CAAC,CAAC,CAAC,QAAQ,EAAE,gBAAgB,CAAC;YAChC,iBAAiB,EAAE,IAAI;YACvB,+FAA+F;YAC/F,0FAA0F;YAC1F,gGAAgG;YAChG,iCAAiC;YACjC,uBAAuB,EAAE,EAAE;YAC3B,QAAQ,EAAE;gBACR,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;oBAClF,MAAM,aAAa,GAAG,KAAK,CAAC,aAAoD,CAAC;oBACjF,MAAM,aAAa,GAAG,aAAa,EAAE,MAA+C,CAAC;oBAErF,IAAI,CAAC,aAAa,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;wBACrE,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;4BACxE,sBAAsB,EAAE,2BAA2B,CAAC,QAAQ;4BAC5D,OAAO,EAAE;gCACP,MAAM,EAAE,OAAO,CAAC,uBAAuB;gCACvC,aAAa,EAAE,aAAa,IAAI,IAAI;gCACpC,aAAa,EAAE,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC;gCACzC,mBAAmB;6BACpB;yBACF,CAAC,CAAC;oBACL,CAAC;oBAED,MAAM,aAAa,GAAG,gBAAgB,CAAC,YAAY,EAAE,MAAM,CAAC;oBAC5D,MAAM,iBAAiB,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC,CAAC;oBAC7F,IAAI,iBAAiB,EAAE,CAAC;wBACtB,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;4BACxE,sBAAsB,EAAE,2BAA2B,CAAC,QAAQ;4BAC5D,OAAO,EAAE;gCACP,MAAM,EAAE,iBAAiB;gCACzB,mBAAmB;6BACpB;yBACF,CAAC,CAAC;oBACL,CAAC;oBAED,MAAM,cAAc,GAAI,KAAqC,EAAE,cAAc,CAAC;oBAC9E,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;oBAEvB,OAAO;wBACL,MAAM,EAAE,OAAO,CAAC,UAAU;wBAC1B,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC7C,uFAAuF;wBACvF,wFAAwF;wBACxF,qCAAqC;wBACrC,GAAG,CAAC,OAAO,CAAC,cAAc;4BACxB,CAAC,CAAC,EAAE,gBAAgB,EAAE,aAAa,EAAE,UAAU,EAAE,GAAG,EAAE;4BACtD,CAAC,CAAC,EAAE,CAAC;qBACR,CAAC;gBACJ,CAAC;gBACD,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,YAAY,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;oBAC1F,2BAA2B,CAAC;wBAC1B,SAAS,EAAE,YAAa;wBACxB,KAAK;wBACL,UAAU;wBACV,UAAU,EAAE,OAAO,CAAC,eAAe;wBACnC,KAAK,EAAE,CAAC,YAAY,IAAI,EAAE,CAA4B;wBACtD,wFAAwF;wBACxF,wFAAwF;wBACxF,2FAA2F;wBAC3F,eAAe,EAAE,gBAAgB,CAAC,YAAY,EAAE,MAAM;qBACvD,CAAC,CAAC;oBACH,OAAO,YAAY,CAAC;gBACtB,CAAC;aACF;SACF,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC","sourcesContent":["/**\n * The decision verbs of an access grant — `approve` / `deny` / `revoke` / `expire` — for BOTH grant\n * resources.\n *\n * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — a grant's status may only move through a verb\n * that checks the transition and records it.\n *\n * ## What is shared and what is not\n *\n * Shared: refuse unless the current status permits the transition, write exactly the fields that\n * transition owns, and record it after commit. That is identical for a tenant elevation and an\n * application-wide one, because it is a property of the LIFECYCLE, and the two lifecycles are the\n * same lifecycle.\n *\n * NOT shared, and passed in: `additionalPrecondition`. The application-wide `approve` refuses a\n * SELF-approval — the two-person rule — and nothing equivalent exists on the tenant resource, where\n * the requester is a platform operator and the approver is a tenant administrator, so they cannot be\n * the same person by construction.\n *\n * ## Why the guard is here at all when `enabledCondition` already exists\n *\n * `enabledCondition` on the operation config is evaluated against the row the framework fetched and\n * is a UI-and-dispatch concern. This is the fail-closed half: a custom implementation is addressed by\n * an exact operation path and inherits nothing, so a future variant authored without an\n * `enabledCondition` would otherwise transition a terminal grant — or approve a self-request —\n * silently. Neither guard alone is the control; both are, and each has its own pin.\n */\n\nimport type { Container } from 'inversify';\nimport {\n  CoreResourceType,\n  ErrorCustomMessageReference,\n  ErrorType,\n  PlatformAccessGrantLifecycleTransition,\n  PlatformAccessGrantScope,\n  PlatformAccessGrantStatus,\n  ResourceOperationVariantType,\n} from '@wildo-ai/saas-models';\n\nimport { recordAccessGrantTransition } from '~wildo-backend-lib/security/authorizations/access-grant-lifecycle-audit.backend';\nimport { createResourceCustomServiceImplementation } from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation.factory.backend';\nimport type { ResourceCustomServiceImplementationFactory } from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation.factory.backend';\nimport type { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\n\n/**\n * A refusal a specific verb owns, evaluated after the status precondition and before the write.\n *\n * Returns the `reason` token to refuse with, or `undefined` to permit. A token rather than a boolean\n * because the refusal reaches a client as a `CONFLICT` context and a reviewer as a log line, and\n * `false` cannot say which rule fired.\n */\nexport type AccessGrantDecisionPrecondition = (params: {\n  readonly currentObject: Record<string, unknown> | undefined;\n  readonly deciderUserId: string | undefined;\n}) => string | undefined;\n\nexport function createAccessGrantDecisionFactory(\n  resourceIdentifier: CoreResourceType,\n  grantScope: PlatformAccessGrantScope,\n  // The operation identifier as a string: `ResourceConfiguration_OperationPath` does not accept a\n  // union of enum members, and the two resources declare two enums whose members share their values.\n  operationIdentifier: string,\n  options: {\n    debugLabel: string;\n    nextStatus: PlatformAccessGrantStatus;\n    permittedFrom: readonly PlatformAccessGrantStatus[];\n    stampsApprover: boolean;\n    auditTransition: PlatformAccessGrantLifecycleTransition;\n    /** The token a status-precondition failure refuses with — each resource names its own. */\n    transitionRefusalReason: string;\n    /** The verb-specific refusal, when the verb has one. See {@link AccessGrantDecisionPrecondition}. */\n    additionalPrecondition?: AccessGrantDecisionPrecondition;\n    /**\n     * Defaults to API_CALL — every operator-facing decision. EXPIRE is INTERNAL_CALL, and the lookup\n     * key is built from the RUNNING operation's variant type, so a mismatch here does not fail\n     * loudly: the implementation is simply never found and the core UPDATE runs with no transition\n     * guard and no audit row.\n     */\n    variantType?: ResourceOperationVariantType;\n  },\n): ResourceCustomServiceImplementationFactory {\n  return (_resourcesRegistryService: ResourcesRegistryBackendService, container: Container) => {\n    const containerRef = container;\n    return createResourceCustomServiceImplementation({\n      operationPath: {\n        resourceIdentifier,\n        operationIdentifier: operationIdentifier as never,\n        variantType: options.variantType ?? ResourceOperationVariantType.API_CALL,\n        isOperationDefault: true,\n      },\n      debugLabel: options.debugLabel,\n      authoritativeFields: options.stampsApprover\n        ? ['status', 'approvedByUserId', 'approvedAt', 'decisionReason']\n        : ['status', 'decisionReason'],\n      transactionalCore: true,\n      // No additional participants: a decision writes only the grant row itself, which the operation\n      // resource contributes automatically. Declaring the set explicitly (even as empty) is the\n      // authoring contract — startup proves adapter compatibility for what is declared, and it cannot\n      // detect an omitted participant.\n      transactionParticipants: {},\n      handlers: {\n        prefixCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {\n          const currentObject = utils.currentObject as Record<string, unknown> | undefined;\n          const currentStatus = currentObject?.status as PlatformAccessGrantStatus | undefined;\n\n          if (!currentStatus || !options.permittedFrom.includes(currentStatus)) {\n            throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n              customMessageReference: ErrorCustomMessageReference.CONFLICT,\n              context: {\n                reason: options.transitionRefusalReason,\n                currentStatus: currentStatus ?? null,\n                permittedFrom: [...options.permittedFrom],\n                operationIdentifier,\n              },\n            });\n          }\n\n          const deciderUserId = executionContext.initiatorIds?.userId;\n          const additionalRefusal = options.additionalPrecondition?.({ currentObject, deciderUserId });\n          if (additionalRefusal) {\n            throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n              customMessageReference: ErrorCustomMessageReference.CONFLICT,\n              context: {\n                reason: additionalRefusal,\n                operationIdentifier,\n              },\n            });\n          }\n\n          const decisionReason = (input as { decisionReason?: string })?.decisionReason;\n          const now = new Date();\n\n          return {\n            status: options.nextStatus,\n            ...(decisionReason ? { decisionReason } : {}),\n            // Only an APPROVAL names a human approver. A revocation or a denial is a decision too,\n            // but recording either in `approvedByUserId` would corrupt the one field an audit reads\n            // to answer \"did somebody say yes?\".\n            ...(options.stampsApprover\n              ? { approvedByUserId: deciderUserId, approvedAt: now }\n              : {}),\n          };\n        },\n        postfixCoreOperations: async (_id, updatedGrant, executionContext, _operationPath, utils) => {\n          recordAccessGrantTransition({\n            container: containerRef!,\n            utils,\n            grantScope,\n            transition: options.auditTransition,\n            grant: (updatedGrant ?? {}) as Record<string, unknown>,\n            // The administrator who acted — distinct from the grant's `operatorUserId`, which stays\n            // the operator who asked. Conflating them would make an audit unable to answer who said\n            // yes, which on the application-wide resource is the entire point of the second signature.\n            decidedByUserId: executionContext.initiatorIds?.userId,\n          });\n          return updatedGrant;\n        },\n      },\n    });\n  };\n}\n"]}

package/dist/esm/security/authorizations/access-grant-lifecycle-audit.backend.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Recording one access-grant transition — the emitter BOTH grant resources use.
+ *
+ * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — every elevation transition, tenant-scoped or
+ * application-wide, leaves one durable record.
+ *
+ * ## Why it is one function and not one per resource
+ *
+ * The tenant grant (`platformAccessGrants`) and the application-wide grant (`applicationAccessGrants`)
+ * are two resources with one lifecycle. This emitter carries the whole of the shared behaviour — the
+ * post-commit deferral, the feature detection, the loss accounting — so the two can never drift on
+ * the part that is identical, and the ONE thing that differs is a parameter: `grantScope`.
+ *
+ * The alternative was a second near-copy. `.claude/rules/invariant-call-site-enumeration.md` is a
+ * catalogue of what happens next: the deferral gets fixed on one side, the loss counter is widened on
+ * one side, and the trail's completeness becomes a property of which file somebody opened.
+ *
+ * ## Deferred to COMMIT, not emitted from the hook
+ *
+ * A postfix hook runs INSIDE the declared transaction, so an audit row written there survives a
+ * rollback — the trail would then claim an elevation that does not exist, which is worse than no
+ * trail at all.
+ *
+ * ## Best-effort, and the loss is COUNTED
+ *
+ * Feature-detected against the audit service (adding a `log*` method breaks partially-mocked doubles,
+ * and the absent property throws synchronously before any `.catch()` can help) and never allowed to
+ * fail the transition it observes. Every exit — unbound service, absent method, thrown emission —
+ * lands on `audit_observation_dropped_total` through `recordAuditObservationLoss`, because a grant
+ * trail with no transitions in it otherwise reads identically whether no elevation was requested or
+ * the audit service had been unbound since boot. For THESE resources that is the whole evidentiary
+ * claim: an elevation with no recorded request and approval is a standing privilege wearing a
+ * lifecycle's clothes.
+ */
+import type { Container } from 'inversify';
+import { PlatformAccessGrantLifecycleTransition, PlatformAccessGrantScope } from '@wildo-ai/saas-models';
+export declare function recordAccessGrantTransition(params: {
+    container: Container;
+    utils: {
+        serviceOptions?: {
+            transaction?: unknown;
+        };
+        logger?: {
+            error?: (message: string, meta: unknown) => void;
+        };
+    };
+    transition: PlatformAccessGrantLifecycleTransition;
+    /**
+     * WHICH elevation this is. Passed rather than inferred from the row's shape: an application-wide
+     * grant carries no `organizationId`, and reading absence as scope would make a scrubbed or missing
+     * tenant id report the wider, more alarming elevation.
+     */
+    grantScope: PlatformAccessGrantScope;
+    grant: Record<string, unknown>;
+    decidedByUserId?: string;
+}): void;
+//# sourceMappingURL=access-grant-lifecycle-audit.backend.d.ts.map

package/dist/esm/security/authorizations/access-grant-lifecycle-audit.backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-grant-lifecycle-audit.backend.d.ts","sourceRoot":"","sources":["../../../../src/security/authorizations/access-grant-lifecycle-audit.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAEL,sCAAsC,EACtC,wBAAwB,EAEzB,MAAM,uBAAuB,CAAC;AAa/B,wBAAgB,2BAA2B,CAAC,MAAM,EAAE;IAClD,SAAS,EAAE,SAAS,CAAC;IACrB,KAAK,EAAE;QAAE,cAAc,CAAC,EAAE;YAAE,WAAW,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;QAAC,MAAM,CAAC,EAAE;YAAE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,KAAK,IAAI,CAAA;SAAE,CAAA;KAAE,CAAC;IACrH,UAAU,EAAE,sCAAsC,CAAC;IACnD;;;;OAIG;IACH,UAAU,EAAE,wBAAwB,CAAC;IACrC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,GAAG,IAAI,CA8FP"}

package/dist/esm/security/authorizations/access-grant-lifecycle-audit.backend.js

@@ -0,0 +1,133 @@
+/**
+ * Recording one access-grant transition — the emitter BOTH grant resources use.
+ *
+ * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — every elevation transition, tenant-scoped or
+ * application-wide, leaves one durable record.
+ *
+ * ## Why it is one function and not one per resource
+ *
+ * The tenant grant (`platformAccessGrants`) and the application-wide grant (`applicationAccessGrants`)
+ * are two resources with one lifecycle. This emitter carries the whole of the shared behaviour — the
+ * post-commit deferral, the feature detection, the loss accounting — so the two can never drift on
+ * the part that is identical, and the ONE thing that differs is a parameter: `grantScope`.
+ *
+ * The alternative was a second near-copy. `.claude/rules/invariant-call-site-enumeration.md` is a
+ * catalogue of what happens next: the deferral gets fixed on one side, the loss counter is widened on
+ * one side, and the trail's completeness becomes a property of which file somebody opened.
+ *
+ * ## Deferred to COMMIT, not emitted from the hook
+ *
+ * A postfix hook runs INSIDE the declared transaction, so an audit row written there survives a
+ * rollback — the trail would then claim an elevation that does not exist, which is worse than no
+ * trail at all.
+ *
+ * ## Best-effort, and the loss is COUNTED
+ *
+ * Feature-detected against the audit service (adding a `log*` method breaks partially-mocked doubles,
+ * and the absent property throws synchronously before any `.catch()` can help) and never allowed to
+ * fail the transition it observes. Every exit — unbound service, absent method, thrown emission —
+ * lands on `audit_observation_dropped_total` through `recordAuditObservationLoss`, because a grant
+ * trail with no transitions in it otherwise reads identically whether no elevation was requested or
+ * the audit service had been unbound since boot. For THESE resources that is the whole evidentiary
+ * claim: an elevation with no recorded request and approval is a standing privilege wearing a
+ * lifecycle's clothes.
+ */
+import { SAAS_SERVICE_TYPES } from '../../inject/models/service-types.js';
+import { registerTransactionPostCommitEffect } from '../../databases/models/transaction.shared.schemas.js';
+import { describeCaughtError } from '../../errors/utils/error-log-level-classification.backend.utils.js';
+import { AuditObservationKind, AuditObservationLossReason, recordAuditObservationLoss, } from '../../monitoring/observability/audit-observation-emission.backend.js';
+export function recordAccessGrantTransition(params) {
+    /**
+     * The metrics recorder behind the loss counter, or `undefined` when nothing is bound.
+     *
+     * Wrapped: this runs on the observation path, so a container that throws while resolving must not
+     * be able to fail the transition. Losing the metric channel degrades the signal to its log line,
+     * which is the correct direction — an observability gap is never a reason to refuse.
+     */
+    const resolveMetricsService = () => {
+        try {
+            if (!params.container.isBound?.(SAAS_SERVICE_TYPES.MetricsService))
+                return undefined;
+            return params.container.get(SAAS_SERVICE_TYPES.MetricsService);
+        }
+        catch {
+            return undefined;
+        }
+    };
+    const reportLoss = (reason, error) => recordAuditObservationLoss({
+        observation: AuditObservationKind.PLATFORM_ACCESS_GRANT_LIFECYCLE,
+        reason,
+        metricsService: resolveMetricsService(),
+        logger: params.utils.logger,
+        error,
+        // Names WHICH transition on WHICH grant went unrecorded, so the gap can be reconstructed from
+        // the grant row rather than being known only as "a transition, somewhere". The SCOPE is in the
+        // context too: a lost application-wide transition and a lost tenant one are not equally serious.
+        context: {
+            observedTransition: params.transition,
+            observedGrantScope: params.grantScope,
+            observedGrantId: String(params.grant._id ?? ''),
+            observedTargetOrganizationId: String(params.grant.organizationId ?? ''),
+        },
+    });
+    const emit = async () => {
+        try {
+            // One report for both halves of "the audit service cannot take this": an unbound service and a
+            // bound service missing the method are the same loss to a reviewer, and splitting them would
+            // add a metric label nobody could act on differently.
+            if (!params.container.isBound?.(SAAS_SERVICE_TYPES.AuditLogsService)) {
+                reportLoss(AuditObservationLossReason.SERVICE_UNAVAILABLE);
+                return;
+            }
+            const auditLogsService = params.container.get(SAAS_SERVICE_TYPES.AuditLogsService);
+            if (typeof auditLogsService?.logPlatformAccessGrantLifecycle !== 'function') {
+                reportLoss(AuditObservationLossReason.SERVICE_UNAVAILABLE);
+                return;
+            }
+            const grant = params.grant;
+            const targetOrganizationId = String(grant.organizationId ?? '');
+            await auditLogsService.logPlatformAccessGrantLifecycle({
+                transition: params.transition,
+                grantScope: params.grantScope,
+                grantId: String(grant._id ?? ''),
+                // Omitted rather than empty for an application-wide grant: `''` would be written into the
+                // event's tenant field and read back as a tenant nobody can resolve.
+                targetOrganizationId: targetOrganizationId || undefined,
+                operatorUserId: String(grant.operatorUserId ?? ''),
+                justification: grant.justification,
+                resultingStatus: grant.status,
+                expiresAt: grant.expiresAt,
+                autoApprovalReason: grant.autoApprovalReason,
+                decidedByUserId: params.decidedByUserId,
+                decisionReason: grant.decisionReason,
+            });
+        }
+        catch (error) {
+            params.utils.logger?.error?.('Failed to record an access-grant lifecycle event', {
+                reason: 'platform_access_grant_lifecycle_audit_emission_failed',
+                transition: params.transition,
+                grantScope: params.grantScope,
+                error: describeCaughtError(error),
+            });
+            // The line above names ONE lost transition; this names the RATE, on the same counter every
+            // other dropped security observation lands on. `EMISSION_THREW`: this path `await`s, so a
+            // rejection and a synchronous throw arrive at the same `catch` and cannot be told apart —
+            // claiming the more specific member would be a distinction the code cannot make.
+            reportLoss(AuditObservationLossReason.EMISSION_THREW, error);
+        }
+    };
+    const transaction = params.utils.serviceOptions?.transaction;
+    if (transaction) {
+        registerTransactionPostCommitEffect(transaction, {
+            // The SCOPE is in the key. Both resources use the same transition names, so without it two
+            // grants decided in one transaction — possible for a cascade — would collide on one effect key
+            // and the second would be dropped.
+            key: `access-grant:${params.grantScope}:${params.transition}:${String(params.grant._id ?? '')}`,
+            execute: emit,
+        });
+    }
+    else {
+        void emit();
+    }
+}
+//# sourceMappingURL=access-grant-lifecycle-audit.backend.js.map

package/dist/esm/security/authorizations/access-grant-lifecycle-audit.backend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-grant-lifecycle-audit.backend.js","sourceRoot":"","sources":["../../../../src/security/authorizations/access-grant-lifecycle-audit.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAUH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,mCAAmC,EAAE,MAAM,gEAAgE,CAAC;AACrH,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AACnH,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,0BAA0B,GAE3B,MAAM,gFAAgF,CAAC;AAGxF,MAAM,UAAU,2BAA2B,CAAC,MAY3C;IACC;;;;;;OAMG;IACH,MAAM,qBAAqB,GAAG,GAAoD,EAAE;QAClF,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,kBAAkB,CAAC,cAAc,CAAC;gBAAE,OAAO,SAAS,CAAC;YACrF,OAAO,MAAM,CAAC,SAAS,CAAC,GAAG,CAAsC,kBAAkB,CAAC,cAAc,CAAC,CAAC;QACtG,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,CAAC,MAAkC,EAAE,KAAe,EAAQ,EAAE,CAC/E,0BAA0B,CAAC;QACzB,WAAW,EAAE,oBAAoB,CAAC,+BAA+B;QACjE,MAAM;QACN,cAAc,EAAE,qBAAqB,EAAE;QACvC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;QAC3B,KAAK;QACL,8FAA8F;QAC9F,+FAA+F;QAC/F,iGAAiG;QACjG,OAAO,EAAE;YACP,kBAAkB,EAAE,MAAM,CAAC,UAAU;YACrC,kBAAkB,EAAE,MAAM,CAAC,UAAU;YACrC,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC;YAC/C,4BAA4B,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC;SACxE;KACF,CAAC,CAAC;IAEL,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;QACrC,IAAI,CAAC;YACH,+FAA+F;YAC/F,6FAA6F;YAC7F,sDAAsD;YACtD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACrE,UAAU,CAAC,0BAA0B,CAAC,mBAAmB,CAAC,CAAC;gBAC3D,OAAO;YACT,CAAC;YACD,MAAM,gBAAgB,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAA0B,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;YAC5G,IAAI,OAAO,gBAAgB,EAAE,+BAA+B,KAAK,UAAU,EAAE,CAAC;gBAC5E,UAAU,CAAC,0BAA0B,CAAC,mBAAmB,CAAC,CAAC;gBAC3D,OAAO;YACT,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAC3B,MAAM,oBAAoB,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;YAChE,MAAM,gBAAgB,CAAC,+BAA+B,CAAC;gBACrD,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC;gBAChC,0FAA0F;gBAC1F,qEAAqE;gBACrE,oBAAoB,EAAE,oBAAoB,IAAI,SAAS;gBACvD,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC;gBAClD,aAAa,EAAE,KAAK,CAAC,aAAmC;gBACxD,eAAe,EAAE,KAAK,CAAC,MAAmC;gBAC1D,SAAS,EAAE,KAAK,CAAC,SAA6B;gBAC9C,kBAAkB,EAAE,KAAK,CAAC,kBAAuE;gBACjG,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,cAAc,EAAE,KAAK,CAAC,cAAoC;aAC3D,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,kDAAkD,EAAE;gBAC/E,MAAM,EAAE,uDAAuD;gBAC/D,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aAClC,CAAC,CAAC;YACH,2FAA2F;YAC3F,0FAA0F;YAC1F,0FAA0F;YAC1F,iFAAiF;YACjF,UAAU,CAAC,0BAA0B,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,WAAW,CAAC;IAC7D,IAAI,WAAW,EAAE,CAAC;QAChB,mCAAmC,CAAC,WAAoB,EAAE;YACxD,2FAA2F;YAC3F,+FAA+F;YAC/F,mCAAmC;YACnC,GAAG,EAAE,gBAAgB,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE;YAC/F,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,KAAK,IAAI,EAAE,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["/**\n * Recording one access-grant transition — the emitter BOTH grant resources use.\n *\n * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — every elevation transition, tenant-scoped or\n * application-wide, leaves one durable record.\n *\n * ## Why it is one function and not one per resource\n *\n * The tenant grant (`platformAccessGrants`) and the application-wide grant (`applicationAccessGrants`)\n * are two resources with one lifecycle. This emitter carries the whole of the shared behaviour — the\n * post-commit deferral, the feature detection, the loss accounting — so the two can never drift on\n * the part that is identical, and the ONE thing that differs is a parameter: `grantScope`.\n *\n * The alternative was a second near-copy. `.claude/rules/invariant-call-site-enumeration.md` is a\n * catalogue of what happens next: the deferral gets fixed on one side, the loss counter is widened on\n * one side, and the trail's completeness becomes a property of which file somebody opened.\n *\n * ## Deferred to COMMIT, not emitted from the hook\n *\n * A postfix hook runs INSIDE the declared transaction, so an audit row written there survives a\n * rollback — the trail would then claim an elevation that does not exist, which is worse than no\n * trail at all.\n *\n * ## Best-effort, and the loss is COUNTED\n *\n * Feature-detected against the audit service (adding a `log*` method breaks partially-mocked doubles,\n * and the absent property throws synchronously before any `.catch()` can help) and never allowed to\n * fail the transition it observes. Every exit — unbound service, absent method, thrown emission —\n * lands on `audit_observation_dropped_total` through `recordAuditObservationLoss`, because a grant\n * trail with no transitions in it otherwise reads identically whether no elevation was requested or\n * the audit service had been unbound since boot. For THESE resources that is the whole evidentiary\n * claim: an elevation with no recorded request and approval is a standing privilege wearing a\n * lifecycle's clothes.\n */\n\nimport type { Container } from 'inversify';\nimport {\n  PlatformAccessGrantAutoApprovalReason,\n  PlatformAccessGrantLifecycleTransition,\n  PlatformAccessGrantScope,\n  PlatformAccessGrantStatus,\n} from '@wildo-ai/saas-models';\n\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { registerTransactionPostCommitEffect } from '~wildo-backend-lib/databases/models/transaction.shared.schemas';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport {\n  AuditObservationKind,\n  AuditObservationLossReason,\n  recordAuditObservationLoss,\n  type AuditObservationLossMetricsRecorder,\n} from '~wildo-backend-lib/monitoring/observability/audit-observation-emission.backend';\nimport type { AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\n\nexport function recordAccessGrantTransition(params: {\n  container: Container;\n  utils: { serviceOptions?: { transaction?: unknown }; logger?: { error?: (message: string, meta: unknown) => void } };\n  transition: PlatformAccessGrantLifecycleTransition;\n  /**\n   * WHICH elevation this is. Passed rather than inferred from the row's shape: an application-wide\n   * grant carries no `organizationId`, and reading absence as scope would make a scrubbed or missing\n   * tenant id report the wider, more alarming elevation.\n   */\n  grantScope: PlatformAccessGrantScope;\n  grant: Record<string, unknown>;\n  decidedByUserId?: string;\n}): void {\n  /**\n   * The metrics recorder behind the loss counter, or `undefined` when nothing is bound.\n   *\n   * Wrapped: this runs on the observation path, so a container that throws while resolving must not\n   * be able to fail the transition. Losing the metric channel degrades the signal to its log line,\n   * which is the correct direction — an observability gap is never a reason to refuse.\n   */\n  const resolveMetricsService = (): AuditObservationLossMetricsRecorder | undefined => {\n    try {\n      if (!params.container.isBound?.(SAAS_SERVICE_TYPES.MetricsService)) return undefined;\n      return params.container.get<AuditObservationLossMetricsRecorder>(SAAS_SERVICE_TYPES.MetricsService);\n    } catch {\n      return undefined;\n    }\n  };\n\n  const reportLoss = (reason: AuditObservationLossReason, error?: unknown): void =>\n    recordAuditObservationLoss({\n      observation: AuditObservationKind.PLATFORM_ACCESS_GRANT_LIFECYCLE,\n      reason,\n      metricsService: resolveMetricsService(),\n      logger: params.utils.logger,\n      error,\n      // Names WHICH transition on WHICH grant went unrecorded, so the gap can be reconstructed from\n      // the grant row rather than being known only as \"a transition, somewhere\". The SCOPE is in the\n      // context too: a lost application-wide transition and a lost tenant one are not equally serious.\n      context: {\n        observedTransition: params.transition,\n        observedGrantScope: params.grantScope,\n        observedGrantId: String(params.grant._id ?? ''),\n        observedTargetOrganizationId: String(params.grant.organizationId ?? ''),\n      },\n    });\n\n  const emit = async (): Promise<void> => {\n    try {\n      // One report for both halves of \"the audit service cannot take this\": an unbound service and a\n      // bound service missing the method are the same loss to a reviewer, and splitting them would\n      // add a metric label nobody could act on differently.\n      if (!params.container.isBound?.(SAAS_SERVICE_TYPES.AuditLogsService)) {\n        reportLoss(AuditObservationLossReason.SERVICE_UNAVAILABLE);\n        return;\n      }\n      const auditLogsService = params.container.get<AuditLogsBackendService>(SAAS_SERVICE_TYPES.AuditLogsService);\n      if (typeof auditLogsService?.logPlatformAccessGrantLifecycle !== 'function') {\n        reportLoss(AuditObservationLossReason.SERVICE_UNAVAILABLE);\n        return;\n      }\n\n      const grant = params.grant;\n      const targetOrganizationId = String(grant.organizationId ?? '');\n      await auditLogsService.logPlatformAccessGrantLifecycle({\n        transition: params.transition,\n        grantScope: params.grantScope,\n        grantId: String(grant._id ?? ''),\n        // Omitted rather than empty for an application-wide grant: `''` would be written into the\n        // event's tenant field and read back as a tenant nobody can resolve.\n        targetOrganizationId: targetOrganizationId || undefined,\n        operatorUserId: String(grant.operatorUserId ?? ''),\n        justification: grant.justification as string | undefined,\n        resultingStatus: grant.status as PlatformAccessGrantStatus,\n        expiresAt: grant.expiresAt as Date | undefined,\n        autoApprovalReason: grant.autoApprovalReason as PlatformAccessGrantAutoApprovalReason | undefined,\n        decidedByUserId: params.decidedByUserId,\n        decisionReason: grant.decisionReason as string | undefined,\n      });\n    } catch (error) {\n      params.utils.logger?.error?.('Failed to record an access-grant lifecycle event', {\n        reason: 'platform_access_grant_lifecycle_audit_emission_failed',\n        transition: params.transition,\n        grantScope: params.grantScope,\n        error: describeCaughtError(error),\n      });\n      // The line above names ONE lost transition; this names the RATE, on the same counter every\n      // other dropped security observation lands on. `EMISSION_THREW`: this path `await`s, so a\n      // rejection and a synchronous throw arrive at the same `catch` and cannot be told apart —\n      // claiming the more specific member would be a distinction the code cannot make.\n      reportLoss(AuditObservationLossReason.EMISSION_THREW, error);\n    }\n  };\n\n  const transaction = params.utils.serviceOptions?.transaction;\n  if (transaction) {\n    registerTransactionPostCommitEffect(transaction as never, {\n      // The SCOPE is in the key. Both resources use the same transition names, so without it two\n      // grants decided in one transaction — possible for a cascade — would collide on one effect key\n      // and the second would be dropped.\n      key: `access-grant:${params.grantScope}:${params.transition}:${String(params.grant._id ?? '')}`,\n      execute: emit,\n    });\n  } else {\n    void emit();\n  }\n}\n"]}

package/dist/esm/security/authorizations/application-access-grant-custom-implementation.backend.service.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Application access grants — the five lifecycle transitions.
+ *
+ * assurance-control: WILDO.ACCESS.SEGREGATION_OF_DUTIES — the widest operator elevation is approved
+ * by a SECOND, distinct platform administrator.
+ * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE
+ *
+ * Everything structural here is the tenant resource's, reached through
+ * `access-grant-decision.factory.backend.ts` and `access-grant-lifecycle-audit.backend.ts`: the same
+ * server-authored fields, the same transition preconditions, the same post-commit audit. What is NEW
+ * is two things, and they are the whole of the unit:
+ *
+ *  1. **`requestAccess` never auto-approves.** The tenant grant auto-approves when the tenant has not
+ *     opted into approval, or cannot approve — both statements about a NAMED tenant. This grant names
+ *     none, so there is no posture to read and no circularity to break. Every row starts PENDING.
+ *  2. **`approve` refuses the requester.** {@link applicationAccessGrantApproverIsDistinct} is the
+ *     two-person rule, and it is enforced here as well as on the operation's `enabledCondition`. Two
+ *     guarantees, not one belt-and-braces: the config makes the affordance disappear, this makes the
+ *     transition impossible. Removing either alone must not admit a self-approval, and each has its
+ *     own pin.
+ */
+import type { ResourceCustomServiceImplementationFactory } from '../../base-classes/services/services/resource-operation-custom-implementation.factory.backend';
+/** The refusal token a self-approval produces. Named once so a pin can match it exactly. */
+export declare const APPLICATION_ACCESS_GRANT_SELF_APPROVAL_REFUSAL = "application_access_grant_requires_a_second_administrator";
+/**
+ * The two-person rule as a decision precondition.
+ *
+ * Exported so its pin can exercise it directly rather than through the whole operation pipeline, and
+ * so nothing can silently substitute a laxer comparison at the call site.
+ *
+ * Note the direction of the fail: `applicationAccessGrantApproverIsDistinct` returns `false` when
+ * EITHER id is missing, so an approval reaching here with no decider — a system context, a broken
+ * session — is REFUSED rather than admitted. That is deliberate; the inline `a !== b` form would
+ * admit it, because `undefined !== 'operator'` is `true`.
+ */
+export declare const refuseApplicationAccessGrantSelfApproval: (params: {
+    readonly currentObject: Record<string, unknown> | undefined;
+    readonly deciderUserId: string | undefined;
+}) => string | undefined;
+export declare function createApplicationAccessGrantFactories(): ResourceCustomServiceImplementationFactory[];
+//# sourceMappingURL=application-access-grant-custom-implementation.backend.service.d.ts.map

package/dist/esm/security/authorizations/application-access-grant-custom-implementation.backend.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"application-access-grant-custom-implementation.backend.service.d.ts","sourceRoot":"","sources":["../../../../src/security/authorizations/application-access-grant-custom-implementation.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAoBH,OAAO,KAAK,EAAE,0CAA0C,EAAE,MAAM,4GAA4G,CAAC;AAG7K,4FAA4F;AAC5F,eAAO,MAAM,8CAA8C,6DAA6D,CAAC;AAEzH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wCAAwC,GAAI,QAAQ;IAC/D,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IAC5D,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5C,KAAG,MAAM,GAAG,SAOZ,CAAC;AAEF,wBAAgB,qCAAqC,IAAI,0CAA0C,EAAE,CA8HpG"}

package/dist/esm/security/authorizations/application-access-grant-custom-implementation.backend.service.js

@@ -0,0 +1,157 @@
+/**
+ * Application access grants — the five lifecycle transitions.
+ *
+ * assurance-control: WILDO.ACCESS.SEGREGATION_OF_DUTIES — the widest operator elevation is approved
+ * by a SECOND, distinct platform administrator.
+ * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE
+ *
+ * Everything structural here is the tenant resource's, reached through
+ * `access-grant-decision.factory.backend.ts` and `access-grant-lifecycle-audit.backend.ts`: the same
+ * server-authored fields, the same transition preconditions, the same post-commit audit. What is NEW
+ * is two things, and they are the whole of the unit:
+ *
+ *  1. **`requestAccess` never auto-approves.** The tenant grant auto-approves when the tenant has not
+ *     opted into approval, or cannot approve — both statements about a NAMED tenant. This grant names
+ *     none, so there is no posture to read and no circularity to break. Every row starts PENDING.
+ *  2. **`approve` refuses the requester.** {@link applicationAccessGrantApproverIsDistinct} is the
+ *     two-person rule, and it is enforced here as well as on the operation's `enabledCondition`. Two
+ *     guarantees, not one belt-and-braces: the config makes the affordance disappear, this makes the
+ *     transition impossible. Removing either alone must not admit a self-approval, and each has its
+ *     own pin.
+ */
+import { ApplicationAccessGrants_Operations, CoreResourceType, ErrorCustomMessageReference, ErrorType, PLATFORM_ACCESS_GRANT_REVOCABLE_STATUSES, PlatformAccessGrantLifecycleTransition, PlatformAccessGrantScope, PlatformAccessGrantStatus, ResourceOperationVariantType, applicationAccessGrantApproverIsDistinct, resolveApplicationAccessGrantExpiry, } from '@wildo-ai/saas-models';
+import { recordAccessGrantTransition } from '../../security/authorizations/access-grant-lifecycle-audit.backend.js';
+import { createAccessGrantDecisionFactory } from '../../security/authorizations/access-grant-decision.factory.backend.js';
+import { createResourceCustomServiceImplementation } from '../../base-classes/services/services/resource-operation-custom-implementation.factory.backend.js';
+/** The refusal token a self-approval produces. Named once so a pin can match it exactly. */
+export const APPLICATION_ACCESS_GRANT_SELF_APPROVAL_REFUSAL = 'application_access_grant_requires_a_second_administrator';
+/**
+ * The two-person rule as a decision precondition.
+ *
+ * Exported so its pin can exercise it directly rather than through the whole operation pipeline, and
+ * so nothing can silently substitute a laxer comparison at the call site.
+ *
+ * Note the direction of the fail: `applicationAccessGrantApproverIsDistinct` returns `false` when
+ * EITHER id is missing, so an approval reaching here with no decider — a system context, a broken
+ * session — is REFUSED rather than admitted. That is deliberate; the inline `a !== b` form would
+ * admit it, because `undefined !== 'operator'` is `true`.
+ */
+export const refuseApplicationAccessGrantSelfApproval = (params) => (applicationAccessGrantApproverIsDistinct({
+    operatorUserId: params.currentObject?.operatorUserId,
+    approverUserId: params.deciderUserId,
+})
+    ? undefined
+    : APPLICATION_ACCESS_GRANT_SELF_APPROVAL_REFUSAL);
+export function createApplicationAccessGrantFactories() {
+    /**
+     * REQUEST — the bootstrap verb, and the only one reachable without an existing grant.
+     *
+     * The admission gate exempts this whole resource, because an operator would otherwise need an
+     * application-wide grant in order to ask for one. What keeps the exemption safe is the tenant
+     * resource's own argument: requesting is not accessing. This writes one PENDING row and reads
+     * nothing; the blast radius of an abused request is an entry in a queue somebody else must sign.
+     */
+    const requestAccessFactory = (_resourcesRegistryService, container) => createResourceCustomServiceImplementation({
+        operationPath: {
+            resourceIdentifier: CoreResourceType.APPLICATION_ACCESS_GRANTS,
+            operationIdentifier: ApplicationAccessGrants_Operations.REQUEST_ACCESS,
+            variantType: ResourceOperationVariantType.API_CALL,
+            isOperationDefault: true,
+        },
+        debugLabel: 'application-access-grants.request-access.api',
+        // Every one of these is `.excludeFromCreate()`, so the strict request DTO drops whatever a caller
+        // sent and the prefix's value is authoritative. Declaring them makes that explicit rather than
+        // inferred — the inference has a hole for callers that reach the service tier with the key already
+        // present (MCP `callTool` forwards arguments unparsed), and here a caller choosing their own
+        // `status` would mint an ACTIVE application-wide elevation with no second signature at all.
+        authoritativeFields: ['operatorUserId', 'status', 'expiresAt', 'approvedByUserId', 'approvedAt'],
+        transactionalCore: true,
+        // A request writes only the grant row, which the operation resource contributes automatically.
+        // Declared explicitly (even as empty) because startup proves adapter compatibility for what is
+        // declared and cannot detect an omission.
+        transactionParticipants: {},
+        handlers: {
+            prefixCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {
+                const payload = input;
+                const operatorUserId = executionContext.initiatorIds?.userId;
+                if (!operatorUserId) {
+                    throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {
+                        customMessageReference: ErrorCustomMessageReference.VALIDATION,
+                        context: { reason: 'application_access_grant_requires_an_operator' },
+                    });
+                }
+                return {
+                    // Server-authored from the session, never the body — the field that says WHOSE elevation
+                    // this is, and therefore whom the approver may not be.
+                    operatorUserId,
+                    applicationId: executionContext.initiatorIds?.applicationId,
+                    justification: payload.justification,
+                    // PENDING, always. There is no auto-approval member here and no branch that could reach
+                    // ACTIVE: the only writer of ACTIVE is `approve`, and `approve` refuses this same user.
+                    status: PlatformAccessGrantStatus.PENDING_APPROVAL,
+                    expiresAt: resolveApplicationAccessGrantExpiry(payload.requestedDurationMinutes, new Date()),
+                };
+            },
+            postfixCoreOperations: async (_id, createdGrant, _executionContext, _operationPath, utils) => {
+                recordAccessGrantTransition({
+                    container,
+                    utils,
+                    grantScope: PlatformAccessGrantScope.APPLICATION_WIDE,
+                    transition: PlatformAccessGrantLifecycleTransition.REQUESTED,
+                    grant: (createdGrant ?? {}),
+                });
+                return createdGrant;
+            },
+        },
+    });
+    const makeDecisionFactory = (operationIdentifier, options) => createAccessGrantDecisionFactory(CoreResourceType.APPLICATION_ACCESS_GRANTS, PlatformAccessGrantScope.APPLICATION_WIDE, operationIdentifier, options);
+    return [
+        requestAccessFactory,
+        makeDecisionFactory(ApplicationAccessGrants_Operations.APPROVE, {
+            debugLabel: 'application-access-grants.approve.api',
+            auditTransition: PlatformAccessGrantLifecycleTransition.APPROVED,
+            nextStatus: PlatformAccessGrantStatus.ACTIVE,
+            permittedFrom: [PlatformAccessGrantStatus.PENDING_APPROVAL],
+            stampsApprover: true,
+            transitionRefusalReason: 'application_access_grant_transition_not_permitted_from_current_status',
+            // THE two-person rule. Everything else in this file exists on the tenant resource too.
+            additionalPrecondition: refuseApplicationAccessGrantSelfApproval,
+        }),
+        makeDecisionFactory(ApplicationAccessGrants_Operations.DENY, {
+            debugLabel: 'application-access-grants.deny.api',
+            auditTransition: PlatformAccessGrantLifecycleTransition.DENIED,
+            nextStatus: PlatformAccessGrantStatus.DENIED,
+            permittedFrom: [PlatformAccessGrantStatus.PENDING_APPROVAL],
+            stampsApprover: false,
+            transitionRefusalReason: 'application_access_grant_transition_not_permitted_from_current_status',
+            // No same-person refusal, deliberately. An operator thinking better of their own request should
+            // be able to withdraw it; the two-person rule constrains what an operator can GRANT themselves,
+            // never what they can refuse themselves.
+        }),
+        makeDecisionFactory(ApplicationAccessGrants_Operations.REVOKE, {
+            debugLabel: 'application-access-grants.revoke.api',
+            auditTransition: PlatformAccessGrantLifecycleTransition.REVOKED,
+            nextStatus: PlatformAccessGrantStatus.REVOKED,
+            // Both a pending request and a live elevation can be withdrawn; a terminal one cannot be
+            // re-terminated, which would rewrite the decision history.
+            permittedFrom: PLATFORM_ACCESS_GRANT_REVOCABLE_STATUSES,
+            stampsApprover: false,
+            transitionRefusalReason: 'application_access_grant_transition_not_permitted_from_current_status',
+        }),
+        /**
+         * The one transition with no human actor. Permitted from ACTIVE alone: a grant that was DENIED or
+         * REVOKED is terminal and must keep saying which, because relabelling it EXPIRED would rewrite the
+         * decision history an audit reads.
+         */
+        makeDecisionFactory(ApplicationAccessGrants_Operations.EXPIRE, {
+            debugLabel: 'application-access-grants.expire.internal',
+            auditTransition: PlatformAccessGrantLifecycleTransition.EXPIRED,
+            nextStatus: PlatformAccessGrantStatus.EXPIRED,
+            permittedFrom: [PlatformAccessGrantStatus.ACTIVE],
+            stampsApprover: false,
+            transitionRefusalReason: 'application_access_grant_transition_not_permitted_from_current_status',
+            variantType: ResourceOperationVariantType.INTERNAL_CALL,
+        }),
+    ];
+}
+//# sourceMappingURL=application-access-grant-custom-implementation.backend.service.js.map

package/dist/esm/security/authorizations/application-access-grant-custom-implementation.backend.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"application-access-grant-custom-implementation.backend.service.js","sourceRoot":"","sources":["../../../../src/security/authorizations/application-access-grant-custom-implementation.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,EACL,kCAAkC,EAClC,gBAAgB,EAChB,2BAA2B,EAC3B,SAAS,EACT,wCAAwC,EACxC,sCAAsC,EACtC,wBAAwB,EACxB,yBAAyB,EACzB,4BAA4B,EAC5B,wCAAwC,EACxC,mCAAmC,GACpC,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,2BAA2B,EAAE,MAAM,iFAAiF,CAAC;AAC9H,OAAO,EAAE,gCAAgC,EAAE,MAAM,kFAAkF,CAAC;AACpI,OAAO,EAAE,yCAAyC,EAAE,MAAM,4GAA4G,CAAC;AAIvK,4FAA4F;AAC5F,MAAM,CAAC,MAAM,8CAA8C,GAAG,0DAA0D,CAAC;AAEzH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,MAGxD,EAAsB,EAAE,CAAC,CACxB,wCAAwC,CAAC;IACvC,cAAc,EAAE,MAAM,CAAC,aAAa,EAAE,cAAoC;IAC1E,cAAc,EAAE,MAAM,CAAC,aAAa;CACrC,CAAC;IACA,CAAC,CAAC,SAAS;IACX,CAAC,CAAC,8CAA8C,CACnD,CAAC;AAEF,MAAM,UAAU,qCAAqC;IACnD;;;;;;;OAOG;IACH,MAAM,oBAAoB,GAAG,CAC3B,yBAA0D,EAC1D,SAAoB,EACpB,EAAE,CAAC,yCAAyC,CAAC;QAC7C,aAAa,EAAE;YACb,kBAAkB,EAAE,gBAAgB,CAAC,yBAAyB;YAC9D,mBAAmB,EAAE,kCAAkC,CAAC,cAAc;YACtE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;YAClD,kBAAkB,EAAE,IAAI;SACzB;QACD,UAAU,EAAE,8CAA8C;QAC1D,kGAAkG;QAClG,+FAA+F;QAC/F,mGAAmG;QACnG,6FAA6F;QAC7F,4FAA4F;QAC5F,mBAAmB,EAAE,CAAC,gBAAgB,EAAE,QAAQ,EAAE,WAAW,EAAE,kBAAkB,EAAE,YAAY,CAAC;QAChG,iBAAiB,EAAE,IAAI;QACvB,+FAA+F;QAC/F,+FAA+F;QAC/F,0CAA0C;QAC1C,uBAAuB,EAAE,EAAE;QAC3B,QAAQ,EAAE;YACR,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;gBAClF,MAAM,OAAO,GAAG,KAAsE,CAAC;gBACvF,MAAM,cAAc,GAAG,gBAAgB,CAAC,YAAY,EAAE,MAAM,CAAC;gBAE7D,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;wBAC1E,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;wBAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,+CAA+C,EAAE;qBACrE,CAAC,CAAC;gBACL,CAAC;gBAED,OAAO;oBACL,yFAAyF;oBACzF,uDAAuD;oBACvD,cAAc;oBACd,aAAa,EAAE,gBAAgB,CAAC,YAAY,EAAE,aAAa;oBAC3D,aAAa,EAAE,OAAO,CAAC,aAAa;oBACpC,wFAAwF;oBACxF,wFAAwF;oBACxF,MAAM,EAAE,yBAAyB,CAAC,gBAAgB;oBAClD,SAAS,EAAE,mCAAmC,CAAC,OAAO,CAAC,wBAAwB,EAAE,IAAI,IAAI,EAAE,CAAC;iBAC7F,CAAC;YACJ,CAAC;YACD,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;gBAC3F,2BAA2B,CAAC;oBAC1B,SAAS;oBACT,KAAK;oBACL,UAAU,EAAE,wBAAwB,CAAC,gBAAgB;oBACrD,UAAU,EAAE,sCAAsC,CAAC,SAAS;oBAC5D,KAAK,EAAE,CAAC,YAAY,IAAI,EAAE,CAA4B;iBACvD,CAAC,CAAC;gBACH,OAAO,YAAY,CAAC;YACtB,CAAC;SACF;KACF,CAAC,CAAC;IAEH,MAAM,mBAAmB,GAAG,CAC1B,mBAAuD,EACvD,OAA+D,EACnB,EAAE,CAAC,gCAAgC,CAC/E,gBAAgB,CAAC,yBAAyB,EAC1C,wBAAwB,CAAC,gBAAgB,EACzC,mBAAmB,EACnB,OAAO,CACR,CAAC;IAEF,OAAO;QACL,oBAAoB;QACpB,mBAAmB,CAAC,kCAAkC,CAAC,OAAO,EAAE;YAC9D,UAAU,EAAE,uCAAuC;YACnD,eAAe,EAAE,sCAAsC,CAAC,QAAQ;YAChE,UAAU,EAAE,yBAAyB,CAAC,MAAM;YAC5C,aAAa,EAAE,CAAC,yBAAyB,CAAC,gBAAgB,CAAC;YAC3D,cAAc,EAAE,IAAI;YACpB,uBAAuB,EAAE,uEAAuE;YAChG,uFAAuF;YACvF,sBAAsB,EAAE,wCAAwC;SACjE,CAAC;QACF,mBAAmB,CAAC,kCAAkC,CAAC,IAAI,EAAE;YAC3D,UAAU,EAAE,oCAAoC;YAChD,eAAe,EAAE,sCAAsC,CAAC,MAAM;YAC9D,UAAU,EAAE,yBAAyB,CAAC,MAAM;YAC5C,aAAa,EAAE,CAAC,yBAAyB,CAAC,gBAAgB,CAAC;YAC3D,cAAc,EAAE,KAAK;YACrB,uBAAuB,EAAE,uEAAuE;YAChG,gGAAgG;YAChG,gGAAgG;YAChG,yCAAyC;SAC1C,CAAC;QACF,mBAAmB,CAAC,kCAAkC,CAAC,MAAM,EAAE;YAC7D,UAAU,EAAE,sCAAsC;YAClD,eAAe,EAAE,sCAAsC,CAAC,OAAO;YAC/D,UAAU,EAAE,yBAAyB,CAAC,OAAO;YAC7C,yFAAyF;YACzF,2DAA2D;YAC3D,aAAa,EAAE,wCAAwC;YACvD,cAAc,EAAE,KAAK;YACrB,uBAAuB,EAAE,uEAAuE;SACjG,CAAC;QACF;;;;WAIG;QACH,mBAAmB,CAAC,kCAAkC,CAAC,MAAM,EAAE;YAC7D,UAAU,EAAE,2CAA2C;YACvD,eAAe,EAAE,sCAAsC,CAAC,OAAO;YAC/D,UAAU,EAAE,yBAAyB,CAAC,OAAO;YAC7C,aAAa,EAAE,CAAC,yBAAyB,CAAC,MAAM,CAAC;YACjD,cAAc,EAAE,KAAK;YACrB,uBAAuB,EAAE,uEAAuE;YAChG,WAAW,EAAE,4BAA4B,CAAC,aAAa;SACxD,CAAC;KACH,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Application access grants — the five lifecycle transitions.\n *\n * assurance-control: WILDO.ACCESS.SEGREGATION_OF_DUTIES — the widest operator elevation is approved\n * by a SECOND, distinct platform administrator.\n * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n *\n * Everything structural here is the tenant resource's, reached through\n * `access-grant-decision.factory.backend.ts` and `access-grant-lifecycle-audit.backend.ts`: the same\n * server-authored fields, the same transition preconditions, the same post-commit audit. What is NEW\n * is two things, and they are the whole of the unit:\n *\n *  1. **`requestAccess` never auto-approves.** The tenant grant auto-approves when the tenant has not\n *     opted into approval, or cannot approve — both statements about a NAMED tenant. This grant names\n *     none, so there is no posture to read and no circularity to break. Every row starts PENDING.\n *  2. **`approve` refuses the requester.** {@link applicationAccessGrantApproverIsDistinct} is the\n *     two-person rule, and it is enforced here as well as on the operation's `enabledCondition`. Two\n *     guarantees, not one belt-and-braces: the config makes the affordance disappear, this makes the\n *     transition impossible. Removing either alone must not admit a self-approval, and each has its\n *     own pin.\n */\n\nimport type { Container } from 'inversify';\nimport {\n  ApplicationAccessGrants_Operations,\n  CoreResourceType,\n  ErrorCustomMessageReference,\n  ErrorType,\n  PLATFORM_ACCESS_GRANT_REVOCABLE_STATUSES,\n  PlatformAccessGrantLifecycleTransition,\n  PlatformAccessGrantScope,\n  PlatformAccessGrantStatus,\n  ResourceOperationVariantType,\n  applicationAccessGrantApproverIsDistinct,\n  resolveApplicationAccessGrantExpiry,\n} from '@wildo-ai/saas-models';\n\nimport { recordAccessGrantTransition } from '~wildo-backend-lib/security/authorizations/access-grant-lifecycle-audit.backend';\nimport { createAccessGrantDecisionFactory } from '~wildo-backend-lib/security/authorizations/access-grant-decision.factory.backend';\nimport { createResourceCustomServiceImplementation } from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation.factory.backend';\nimport type { ResourceCustomServiceImplementationFactory } from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation.factory.backend';\nimport type { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\n\n/** The refusal token a self-approval produces. Named once so a pin can match it exactly. */\nexport const APPLICATION_ACCESS_GRANT_SELF_APPROVAL_REFUSAL = 'application_access_grant_requires_a_second_administrator';\n\n/**\n * The two-person rule as a decision precondition.\n *\n * Exported so its pin can exercise it directly rather than through the whole operation pipeline, and\n * so nothing can silently substitute a laxer comparison at the call site.\n *\n * Note the direction of the fail: `applicationAccessGrantApproverIsDistinct` returns `false` when\n * EITHER id is missing, so an approval reaching here with no decider — a system context, a broken\n * session — is REFUSED rather than admitted. That is deliberate; the inline `a !== b` form would\n * admit it, because `undefined !== 'operator'` is `true`.\n */\nexport const refuseApplicationAccessGrantSelfApproval = (params: {\n  readonly currentObject: Record<string, unknown> | undefined;\n  readonly deciderUserId: string | undefined;\n}): string | undefined => (\n  applicationAccessGrantApproverIsDistinct({\n    operatorUserId: params.currentObject?.operatorUserId as string | undefined,\n    approverUserId: params.deciderUserId,\n  })\n    ? undefined\n    : APPLICATION_ACCESS_GRANT_SELF_APPROVAL_REFUSAL\n);\n\nexport function createApplicationAccessGrantFactories(): ResourceCustomServiceImplementationFactory[] {\n  /**\n   * REQUEST — the bootstrap verb, and the only one reachable without an existing grant.\n   *\n   * The admission gate exempts this whole resource, because an operator would otherwise need an\n   * application-wide grant in order to ask for one. What keeps the exemption safe is the tenant\n   * resource's own argument: requesting is not accessing. This writes one PENDING row and reads\n   * nothing; the blast radius of an abused request is an entry in a queue somebody else must sign.\n   */\n  const requestAccessFactory = (\n    _resourcesRegistryService: ResourcesRegistryBackendService,\n    container: Container,\n  ) => createResourceCustomServiceImplementation({\n    operationPath: {\n      resourceIdentifier: CoreResourceType.APPLICATION_ACCESS_GRANTS,\n      operationIdentifier: ApplicationAccessGrants_Operations.REQUEST_ACCESS,\n      variantType: ResourceOperationVariantType.API_CALL,\n      isOperationDefault: true,\n    },\n    debugLabel: 'application-access-grants.request-access.api',\n    // Every one of these is `.excludeFromCreate()`, so the strict request DTO drops whatever a caller\n    // sent and the prefix's value is authoritative. Declaring them makes that explicit rather than\n    // inferred — the inference has a hole for callers that reach the service tier with the key already\n    // present (MCP `callTool` forwards arguments unparsed), and here a caller choosing their own\n    // `status` would mint an ACTIVE application-wide elevation with no second signature at all.\n    authoritativeFields: ['operatorUserId', 'status', 'expiresAt', 'approvedByUserId', 'approvedAt'],\n    transactionalCore: true,\n    // A request writes only the grant row, which the operation resource contributes automatically.\n    // Declared explicitly (even as empty) because startup proves adapter compatibility for what is\n    // declared and cannot detect an omission.\n    transactionParticipants: {},\n    handlers: {\n      prefixCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {\n        const payload = input as { justification?: string; requestedDurationMinutes?: number };\n        const operatorUserId = executionContext.initiatorIds?.userId;\n\n        if (!operatorUserId) {\n          throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n            customMessageReference: ErrorCustomMessageReference.VALIDATION,\n            context: { reason: 'application_access_grant_requires_an_operator' },\n          });\n        }\n\n        return {\n          // Server-authored from the session, never the body — the field that says WHOSE elevation\n          // this is, and therefore whom the approver may not be.\n          operatorUserId,\n          applicationId: executionContext.initiatorIds?.applicationId,\n          justification: payload.justification,\n          // PENDING, always. There is no auto-approval member here and no branch that could reach\n          // ACTIVE: the only writer of ACTIVE is `approve`, and `approve` refuses this same user.\n          status: PlatformAccessGrantStatus.PENDING_APPROVAL,\n          expiresAt: resolveApplicationAccessGrantExpiry(payload.requestedDurationMinutes, new Date()),\n        };\n      },\n      postfixCoreOperations: async (_id, createdGrant, _executionContext, _operationPath, utils) => {\n        recordAccessGrantTransition({\n          container,\n          utils,\n          grantScope: PlatformAccessGrantScope.APPLICATION_WIDE,\n          transition: PlatformAccessGrantLifecycleTransition.REQUESTED,\n          grant: (createdGrant ?? {}) as Record<string, unknown>,\n        });\n        return createdGrant;\n      },\n    },\n  });\n\n  const makeDecisionFactory = (\n    operationIdentifier: ApplicationAccessGrants_Operations,\n    options: Parameters<typeof createAccessGrantDecisionFactory>[3],\n  ): ResourceCustomServiceImplementationFactory => createAccessGrantDecisionFactory(\n    CoreResourceType.APPLICATION_ACCESS_GRANTS,\n    PlatformAccessGrantScope.APPLICATION_WIDE,\n    operationIdentifier,\n    options,\n  );\n\n  return [\n    requestAccessFactory,\n    makeDecisionFactory(ApplicationAccessGrants_Operations.APPROVE, {\n      debugLabel: 'application-access-grants.approve.api',\n      auditTransition: PlatformAccessGrantLifecycleTransition.APPROVED,\n      nextStatus: PlatformAccessGrantStatus.ACTIVE,\n      permittedFrom: [PlatformAccessGrantStatus.PENDING_APPROVAL],\n      stampsApprover: true,\n      transitionRefusalReason: 'application_access_grant_transition_not_permitted_from_current_status',\n      // THE two-person rule. Everything else in this file exists on the tenant resource too.\n      additionalPrecondition: refuseApplicationAccessGrantSelfApproval,\n    }),\n    makeDecisionFactory(ApplicationAccessGrants_Operations.DENY, {\n      debugLabel: 'application-access-grants.deny.api',\n      auditTransition: PlatformAccessGrantLifecycleTransition.DENIED,\n      nextStatus: PlatformAccessGrantStatus.DENIED,\n      permittedFrom: [PlatformAccessGrantStatus.PENDING_APPROVAL],\n      stampsApprover: false,\n      transitionRefusalReason: 'application_access_grant_transition_not_permitted_from_current_status',\n      // No same-person refusal, deliberately. An operator thinking better of their own request should\n      // be able to withdraw it; the two-person rule constrains what an operator can GRANT themselves,\n      // never what they can refuse themselves.\n    }),\n    makeDecisionFactory(ApplicationAccessGrants_Operations.REVOKE, {\n      debugLabel: 'application-access-grants.revoke.api',\n      auditTransition: PlatformAccessGrantLifecycleTransition.REVOKED,\n      nextStatus: PlatformAccessGrantStatus.REVOKED,\n      // Both a pending request and a live elevation can be withdrawn; a terminal one cannot be\n      // re-terminated, which would rewrite the decision history.\n      permittedFrom: PLATFORM_ACCESS_GRANT_REVOCABLE_STATUSES,\n      stampsApprover: false,\n      transitionRefusalReason: 'application_access_grant_transition_not_permitted_from_current_status',\n    }),\n    /**\n     * The one transition with no human actor. Permitted from ACTIVE alone: a grant that was DENIED or\n     * REVOKED is terminal and must keep saying which, because relabelling it EXPIRED would rewrite the\n     * decision history an audit reads.\n     */\n    makeDecisionFactory(ApplicationAccessGrants_Operations.EXPIRE, {\n      debugLabel: 'application-access-grants.expire.internal',\n      auditTransition: PlatformAccessGrantLifecycleTransition.EXPIRED,\n      nextStatus: PlatformAccessGrantStatus.EXPIRED,\n      permittedFrom: [PlatformAccessGrantStatus.ACTIVE],\n      stampsApprover: false,\n      transitionRefusalReason: 'application_access_grant_transition_not_permitted_from_current_status',\n      variantType: ResourceOperationVariantType.INTERNAL_CALL,\n    }),\n  ];\n}\n"]}