@wildo-ai/saas-backend-lib 1.1.2 → 1.1.4

package/dist/esm/security/authorizations/services/authorizations.backend.service.js

@@ -19,7 +19,10 @@ import { describeCaughtError, projectCaughtErrorLogFields } from "../../../error
 import { RepositoriesRegistryHandlerBackendService } from "../../../base-classes/services/repositories/repositories-registry-handler.backend.service.js";
 import { CoreResourceType, IntrospectionTenancyStance, PersistenceAdapter, coreResourceShared_FieldIdentifier, PlatformAccessGrantStatus, PlatformAccessGrants_Operations, ResourcePrimaryScope, isPlatformAccessGrantUsable, PRIMARY_SCOPE_TO_CORE_RESOURCE_TYPE, ErrorType, ErrorCustomMessageReference, DEFAULT_APP_ROLE_CONFIGURATION, DEFAULT_ORGANIZATION_ROLES, CoreResourceOperation, ResourceOperationDenialReason, ResourceOperationRiskLevel } from "@wildo-ai/saas-models";
 import { classifyAuthorizationDenial, resolveDenialAuditEmissionDecision } from "../../../security/authorizations/authorization-denial-audit.backend.utils.js";
+import { AuditObservationKind, AuditObservationLossReason, emitAuditObservation, recordAuditObservationLoss, } from "../../../monitoring/observability/audit-observation-emission.backend.js";
 import { isOwnScopeRootResource } from "../../../security/authorizations/scope-root-collection-confinement.backend.js";
+import { readRequiresApplicationWideGrant } from "../../../security/authorizations/application-wide-read-admission.backend.js";
+import { roleConfersAuthority } from "../../../security/authorizations/role-conferral.backend.utils.js";
 let AuthorizationsBackendService = class AuthorizationsBackendService {
     logger;
     errorBuilder;
@@ -84,14 +87,25 @@ let AuthorizationsBackendService = class AuthorizationsBackendService {
                         orgRolesAdded++;
                         this.logDebug('Custom org role added', { roleKey, role: typedRoleDefinition.role, inheritFrom: typedRoleDefinition.inheritFrom, isSystemRole: typedRoleDefinition.isSystemRole });
                         break;
+                    /*
+                     * Skipped, not refused — and the author is told somewhere they will actually read (#425).
+                     *
+                     * Refusing here would turn a silently-inert role into a BOOT FAILURE for any application
+                     * that already ships one, which is why this is a warning. But a warning on a startup path
+                     * is read once and never again, so the role stayed inert with no surviving signal. The
+                     * durable one is `wildo local doctor` → "custom role scopes", which reads
+                     * `shared-lib/src/engine/roles.ts` and names every role this switch would drop, before
+                     * the application is shipped rather than after.
+                     *
+                     * Keep the two log lines: they are what a runtime investigation reads, and they are the
+                     * only evidence for a role table this process received some other way.
+                     */
                     case ResourcePrimaryScope.USER_SELF:
-                        // This scope doesn't have dedicated role configurations
-                        // Log a warning but don't add them
-                        this.logger.warn('Custom role with unsupported scope ignored', { roleKey, scope: typedRoleDefinition.relatedPrimaryScope, message: 'USER_SELF scope does not support custom roles' });
+                        this.logger.warn('Custom role with unsupported scope ignored — the role is INERT', { roleKey, scope: typedRoleDefinition.relatedPrimaryScope, message: 'USER_SELF scope does not support custom roles; `wildo local doctor` reports this before the application ships' });
                         invalidRoles.push(roleKey);
                         break;
                     default:
-                        this.logger.warn('Custom role with unknown scope ignored', { roleKey, scope: typedRoleDefinition.relatedPrimaryScope });
+                        this.logger.warn('Custom role with unknown scope ignored — the role is INERT', { roleKey, scope: typedRoleDefinition.relatedPrimaryScope, message: '`wildo local doctor` reports this before the application ships' });
                         invalidRoles.push(roleKey);
                         break;
                 }
@@ -142,6 +156,33 @@ let AuthorizationsBackendService = class AuthorizationsBackendService {
     hasOrgRole(roleKey) {
         return roleKey in this.orgRoles;
     }
+    /**
+     * Does holding `heldRoleKey` in `scope` satisfy a gate that requires `requiredRoleKey`?
+     *
+     * Delegates to {@link roleConfersAuthority}, which is the ONE derivation this repository has of
+     * that question — the same atom the authority floors measure their protected populations with.
+     *
+     * Sharing it is not tidiness. The atom is where the SCOPE PARTITION is consulted, and the partition
+     * is the entire reason an application-scope role string written into an organisation-scoped
+     * membership row confers nothing: the key is unknown in the passed table, so its chain is EMPTY.
+     * That safety comes from RESOLUTION rather than from the field's type, and every separate copy of
+     * these two lines is another place the argument can quietly stop holding. It was written out four
+     * times — twice in this class's own admission paths, once in the platform-authority check, and once
+     * inside the floors' shared derivation — which is the defect shape
+     * `.claude/rules/invariant-call-site-enumeration.md` exists for.
+     *
+     * The floors' derivation and these gates still ask DIFFERENT questions and keep different shapes:
+     * a floor quantifies over the declared role TABLE and returns a set, a gate quantifies over the
+     * roles a CALLER holds and returns a boolean. Only the atom is shared.
+     */
+    roleConfersAuthority(heldRoleKey, requiredRoleKey, scope) {
+        return roleConfersAuthority({
+            heldRoleKey,
+            requiredRoleKey,
+            scope,
+            roleHierarchyResolver: (roleKey, resolvedScope) => this.getRoleHierarchy(roleKey, resolvedScope),
+        });
+    }
     getRoleHierarchy(roleKey, scope) {
         const rolesConfig = scope === ResourcePrimaryScope.APPLICATION ? this.appRoles : this.orgRoles;
         const roleHierarchy = [];
@@ -669,8 +710,124 @@ let AuthorizationsBackendService = class AuthorizationsBackendService {
         // authorization pre-fetch, not merely the role gate below. See the comment there.)
         // Check that user has required roles to perform the operation
         await this.runAuthorizationPhase(() => this.validateOperationRoles(operationRoles, executionContext, operation.resourceIdentifier), (error) => classifyAuthorizationDenial(error, ResourceOperationDenialReason.INSUFFICIENT_ROLES), operation, executionContext, idsArray);
+        // SITE 1 of 2 — the id-addressed half. It matters because the cross-tenant read observation
+        // covers a per-instance READ too: reading ONE tenant's row from an application-scoped
+        // cross-tenant door is exactly the access the trail exists to show, so gating only the collection
+        // verbs would leave the cheapest crossing — fetch by id — elevated by nothing.
+        await this.enforceApplicationWideReadAdmission(operation, executionContext);
         this.logDebug('Authorization check completed successfully');
     }
+    /**
+     * The core operation this call actually EXECUTES.
+     *
+     * `resourceOperationLike ?? operationIdentifier` — the derivation the controller tier, the batch
+     * dispatcher and the response serializer all already use. A custom verb declares which core
+     * operation it borrows persistence from (`approve` is UPDATE-like, `requestAccess` is CREATE-like),
+     * and without that indirection a custom READ-like verb would be invisible to every core-operation
+     * predicate in the system.
+     */
+    resolveExecutedCoreOperation(operation) {
+        const effective = operation.resourceOperationLike
+            ?? operation.operationIdentifier;
+        const value = String(effective ?? '');
+        return Object.values(CoreResourceOperation).includes(value)
+            ? value
+            : undefined;
+    }
+    /**
+     * Refuse an APPLICATION-WIDE read unless the caller holds a usable, second-signed elevation.
+     *
+     * assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — the widest read is admitted only
+     * under an elevation, on the same terms the narrowest one already was.
+     * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE
+     *
+     * ## Why it runs LAST
+     *
+     * After the role gate, deliberately. A caller who does not hold the administrator role must be
+     * refused with `INSUFFICIENT_ROLES` and learn nothing about the elevation mechanism; only a caller
+     * who WOULD have been admitted before this change reaches the new refusal. That also keeps the two
+     * reasons countable: `APPLICATION_WIDE_ELEVATION_MISSING` measures exactly the standing privilege
+     * this removes, and nothing else.
+     *
+     * ## Why it is stamped on the CONTEXT
+     *
+     * The observation seams run in the service registry, AFTER the rows are in hand, and they emit the
+     * evidence. Stashing the authorizing grant id here is what lets that evidence NAME the elevation —
+     * the same mechanism `admitsCrossTenantPlatformAdministration` already uses for the per-row
+     * crossing. On the CONTEXT and never on the service: the authorizer is a singleton, and a field
+     * here would leak one request's grant onto another's audit row under concurrency.
+     */
+    async enforceApplicationWideReadAdmission(operation, executionContext) {
+        const resourceConfiguration = this.resourcesRegistry?.getResourceConfiguration?.(operation.resourceIdentifier);
+        // No configuration ⇒ nothing this authority can decide. It cannot fail closed here without
+        // refusing every read on a resource the registry has not finished binding, which on this path
+        // would include the startup reads that BUILD the registry.
+        if (!resourceConfiguration)
+            return;
+        if (!readRequiresApplicationWideGrant({
+            executionContext: executionContext,
+            operation: operation,
+            resourceConfiguration: resourceConfiguration,
+            executedCoreOperation: this.resolveExecutedCoreOperation(operation),
+        }))
+            return;
+        const usableGrant = await this.hasUsableApplicationAccessGrant(executionContext);
+        if (usableGrant) {
+            executionContext.authorizingApplicationAccessGrantId =
+                typeof usableGrant === 'string' ? usableGrant : undefined;
+            return;
+        }
+        await this.emitAuthorizationDenialAudit(ResourceOperationDenialReason.APPLICATION_WIDE_ELEVATION_MISSING, operation, executionContext);
+        throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, executionContext, {
+            customMessageReference: ErrorCustomMessageReference.AUTHORIZATIONS_ACCESS_DENIED,
+            context: { reason: 'application_wide_read_requires_a_usable_application_access_grant' },
+        });
+    }
+    /**
+     * Is there a live application-wide elevation for this operator?
+     *
+     * The sibling of {@link hasUsablePlatformAccessGrant}, and deliberately NOT a parameterisation of
+     * it: that one keys on `(operator, TENANT)` and answers `false` on an empty tenant, which is
+     * exactly the structural fact that made this resource necessary. A shared helper taking an optional
+     * tenant would make "no tenant supplied" mean two opposite things depending on which resource was
+     * being read — the kind of overload that fails open the first time a caller forgets an argument.
+     *
+     * Read on a SYSTEM context: the grants are APPLICATION-scoped and the caller's own contextual
+     * filter is not what decides whether their elevation exists. **Fails CLOSED** — a read error, an
+     * unbound repository, a missing resource all answer "no elevation", because the alternative would
+     * let an operator restore standing access by breaking the grant store.
+     *
+     * Returns the GRANT ID so the evidence can name the elevation; `true` remains possible only for a
+     * grant with no `_id`, which the repository does not produce.
+     */
+    async hasUsableApplicationAccessGrant(executionContext) {
+        const operatorUserId = executionContext.initiatorIds?.userId;
+        if (!operatorUserId)
+            return false;
+        try {
+            const repository = this.repositoriesRegistry?.getRepository?.(CoreResourceType.APPLICATION_ACCESS_GRANTS);
+            if (!repository?.list)
+                return false;
+            const systemExecutionContext = await this.resolveSystemReadExecutionContext();
+            if (!systemExecutionContext)
+                return false;
+            const grants = await repository.list(systemExecutionContext, {
+                operatorUserId,
+                status: PlatformAccessGrantStatus.ACTIVE,
+            });
+            // `isPlatformAccessGrantUsable` re-checks `expiresAt` rather than trusting the ACTIVE filter.
+            // The status is bookkeeping a sweeper maintains; the WINDOW is the control, and a grant whose
+            // window elapsed must stop working whether or not anything has relabelled it yet. Shared with
+            // the tenant grant on purpose — one predicate, so the two elevations can never disagree about
+            // what "usable" means.
+            const now = new Date();
+            const usable = (grants ?? []).find((grant) => isPlatformAccessGrantUsable(grant, now));
+            return usable ? String(usable._id ?? '') || true : false;
+        }
+        catch {
+            return false;
+        }
+    }
     /**
      * Resolve the effective scope at runtime.
      * For isAnonymizable resources (primaryScope: USER_SELF), the effective scope
@@ -721,7 +878,7 @@ let AuthorizationsBackendService = class AuthorizationsBackendService {
      * `USERS` is a self-anchor scope root, so its `resourcePrimaryScope` IS `USER_SELF` and every
      * USERS operation lands here. Without an admission this check made the whole administrative
      * surface self-only: `assign_roles`, `revoke_roles`, `suspend_user`, `unsuspend_user`,
-     * `force_password_reset`, the admin READ and the core UPDATE/DELETE all refused against another
+     * `reactivate_user`, `force_password_reset`, the admin READ and the core UPDATE/DELETE all refused against another
      * user, contradicting both the resource specification and the admin UI that surfaces them as
      * per-row actions.
      *
@@ -832,8 +989,7 @@ let AuthorizationsBackendService = class AuthorizationsBackendService {
         const holdsPlatformAuthority = (executionContext.initiatorRoles ?? [])
             .filter(isOrganizationWideRoleInfo)
             .filter(roleInfo => roleInfo.relatedPrimaryScope === ResourcePrimaryScope.APPLICATION)
-            .some(roleInfo => roleInfo.roles.some(heldRole => this.getRoleHierarchy(heldRole, ResourcePrimaryScope.APPLICATION)
-            .includes(CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN)));
+            .some(roleInfo => roleInfo.roles.some(heldRole => this.roleConfersAuthority(heldRole, CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN, ResourcePrimaryScope.APPLICATION)));
         if (!holdsPlatformAuthority)
             return false;
         // ── The bootstrap exemption ────────────────────────────────────────────────────────────────
@@ -971,9 +1127,30 @@ let AuthorizationsBackendService = class AuthorizationsBackendService {
      *
      * Fire-and-forget by construction: no `await`, and the promise's rejection is swallowed. An
      * operator's request must not fail because the audit sink is down, and a fail-closed variant would
-     * hand anyone a way to disable operator support by breaking the sink.
+     * hand anyone a way to disable operator support by breaking the sink. That contract is unchanged
+     * and must stay unchanged.
+     *
+     * ## The loss is COUNTED — added 2026-09-09
+     *
+     * Fire-and-forget was the right trade and it was shipped without the other half: nothing recorded
+     * the drops, so an empty operator-crossing trail read identically whether no operator crossed a
+     * boundary or the audit service had been unbound since boot. That is the property that makes the
+     * evidence worthless, and it is the shape
+     * `.claude/rules/negative-results-require-a-positive-probe.md` names — an empty result is evidence
+     * about the pipeline, never about the world.
+     *
+     * Every emission now goes through {@link emitAuditObservation}, which counts an unavailable
+     * service, a synchronous throw and a rejected promise into `audit_observation_dropped_total` and
+     * logs one throttled `error` line per loss shape. It never throws and never awaits, so the
+     * contract above is preserved exactly — read that seam's header before changing anything here.
+     *
+     * **Do not restore the "`audit_store_failure_total` covers this" reading.** It does not, and that
+     * claim was carried at three sites in this package: that counter lives INSIDE
+     * `AuditLogsBackendService._createAuditLog`, so it only ever sees an emission that reached the
+     * audit service. The three shapes counted here never get that far.
      *
      * assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION
+     * assurance-control: WILDO.AUDIT.SECURITY_EVENT — the loss of this evidence is itself detectable.
      */
     recordCrossTenantAdministrativeAccess(resourceObject, resourceIdentifier, executionContext) {
         const operation = executionContext.operation;
@@ -991,10 +1168,12 @@ let AuthorizationsBackendService = class AuthorizationsBackendService {
         // absent, so the CALL throws a TypeError synchronously — before any `.catch()` can make it
         // fire-and-forget. It is not a test-only concern either; a host binding an older audit service
         // takes the same throw. An observer must never be able to fail the request it observes.
-        if (typeof auditLogsService?.logCrossTenantAdministrativeAccess !== 'function')
-            return;
-        try {
-            void auditLogsService.logCrossTenantAdministrativeAccess({
+        //
+        // The detection now decides an ARGUMENT rather than an early return: handing the seam
+        // `undefined` is how this site reports `SERVICE_UNAVAILABLE`, which is precisely the loss shape
+        // that used to leave nothing behind at all. Returning early here would restore the silence.
+        const emit = typeof auditLogsService?.logCrossTenantAdministrativeAccess === 'function'
+            ? () => auditLogsService.logCrossTenantAdministrativeAccess({
                 operatorUserId: executionContext.initiatorIds?.userId,
                 targetOrganizationId: rowOrganizationId,
                 resourceType: resourceIdentifier,
@@ -1006,11 +1185,23 @@ let AuthorizationsBackendService = class AuthorizationsBackendService {
                 admissionDeclared: operation.admitsCrossTenantPlatformAdministration === true,
                 initiatorRoles: initiatorRoles.flatMap(roleInfo => roleInfo.roles ?? []),
                 executionType: executionContext.executionType,
-            })?.catch?.(() => undefined);
-        }
-        catch {
-            // Deliberately swallowed — see the feature-detection note above.
-        }
+            })
+            : undefined;
+        emitAuditObservation({
+            observation: AuditObservationKind.CROSS_TENANT_ADMINISTRATIVE_ACCESS,
+            emit,
+            metricsService: this.resolveMetricsService(),
+            logger: this.logger,
+            // Enough to name WHICH crossing went unrecorded, so a reviewer can reconstruct it from the
+            // application log rather than knowing only that "a crossing, somewhere" was lost. The operator
+            // and the tenant are the two identities the audit row itself would have carried.
+            context: {
+                observedResourceType: resourceIdentifier,
+                observedOperationIdentifier: String(operation.operationIdentifier ?? ''),
+                observedTargetOrganizationId: rowOrganizationId,
+                observedOperatorUserId: executionContext.initiatorIds?.userId,
+            },
+        });
     }
     /**
      * Refuse a per-instance tenant-boundary denial in a way that is INDISTINGUISHABLE from a row that
@@ -1218,6 +1409,29 @@ let AuthorizationsBackendService = class AuthorizationsBackendService {
                 throw error;
             }
         }
+        /*
+         * An APPLICATION-scoped read can still cross a TENANT boundary, and until now nothing said so.
+         *
+         * `CROSS_TENANT_ADMINISTRATIVE_ACCESS` is emitted from `authorizeOrganizations`, so a row
+         * carrying an `organizationId` that is reached through an APPLICATION-scoped resource — by a
+         * caller holding no organization-wide entry for that tenant — was an unaudited crossing. The
+         * application-scoped audit door (#317) is the case that forced this: its whole purpose is to
+         * return rows from every tenant, and the audit trail is the worst possible surface on which to
+         * make an operator read invisible. `administrative-continuity-floors.md` requires every crossing
+         * to be NAMED in the trail.
+         *
+         * Placed at the SCOPE boundary rather than on that one resource on purpose. The invariant is
+         * "a tenant-attributed row reached by a non-member is a crossing", which is a property of the
+         * ROW and the CALLER, not of one resource — wiring it per-resource is the shape
+         * `invariant-call-site-enumeration.md` exists to prevent, and the next application-scoped
+         * resource carrying an `organizationId` would silently miss it.
+         *
+         * Cheap and non-invasive by construction: the emitter returns immediately when the row carries
+         * no organization (the common case — an application-scoped row is not a crossing), and again
+         * when the caller does hold an organization-wide entry for it. It is fire-and-forget and
+         * feature-detected, so it can neither fail nor slow the request it observes.
+         */
+        this.recordCrossTenantAdministrativeAccess(resourceObject, resourceIdentifier, executionContext);
     }
     /**
      * Authorize ANONYMOUS scope — ownership check via anonymousUserId.
@@ -1288,10 +1502,7 @@ let AuthorizationsBackendService = class AuthorizationsBackendService {
                 if (!roleInfo)
                     return false;
                 const scope = roleInfo.relatedPrimaryScope;
-                // Get the full hierarchy of the user's role
-                const hierarchy = this.getRoleHierarchy(userRole, scope);
-                // Check if the required role is in the hierarchy
-                return hierarchy.includes(requiredRole);
+                return this.roleConfersAuthority(userRole, requiredRole, scope);
             });
         });
         // WS-C ADDITIVE admission (D-C3b): no organization-wide grant satisfies the operation, but the
@@ -1319,6 +1530,30 @@ let AuthorizationsBackendService = class AuthorizationsBackendService {
             return undefined;
         return this.container.get(SAAS_SERVICE_TYPES.AuditLogsService);
     }
+    /**
+     * Lazy getter for the metrics recorder behind {@link emitAuditObservation}'s loss counter.
+     *
+     * Resolved from the container rather than constructor-injected for the SAME reason the audit
+     * service is (see the `container` param's JSDoc) — but a weaker one: `MetricsService` has a
+     * zero-argument constructor and closes no dependency cycle. What the lazy form actually buys is
+     * that every partial-container test and every positional construction keeps working unchanged,
+     * which is the property this class's whole optional-dependency tail is built around.
+     *
+     * Wrapped, because this runs on the observation path: a container that throws while resolving a
+     * binding must not be able to fail the request the observation is about. Returning `undefined`
+     * degrades the loss signal to its log channel, which is the correct direction — an observability
+     * gap is never a reason to refuse.
+     */
+    resolveMetricsService() {
+        try {
+            if (!this.container?.isBound(SAAS_SERVICE_TYPES.MetricsService))
+                return undefined;
+            return this.container.get(SAAS_SERVICE_TYPES.MetricsService);
+        }
+        catch {
+            return undefined;
+        }
+    }
     /**
      * Record a refusal as a `RESOURCE_OPERATION_DENIED` audit event.
      *
@@ -1348,15 +1583,32 @@ let AuthorizationsBackendService = class AuthorizationsBackendService {
      * ## Never affects the outcome
      *
      * Every path here is swallowed. The caller has already been correctly refused; an audit-store
-     * problem must not convert that clean refusal into a 500. Detection of a lost row is the audit
-     * pipeline's own control (`audit_store_failure_total`), not this gate's.
+     * problem must not convert that clean refusal into a 500. That stays true.
+     *
+     * ## But the swallow is now COUNTED — corrected 2026-09-09
+     *
+     * This paragraph used to end "detection of a lost row is the audit pipeline's own control
+     * (`audit_store_failure_total`), not this gate's", and that was **false for the shape this method
+     * loses most often**. That counter lives inside `AuditLogsBackendService._createAuditLog`, so it
+     * only ever sees an emission that reached the audit service. When the service is unbound — a
+     * partial DI binding, a host binding an older audit service — this method returned in silence and
+     * NOTHING anywhere recorded that every refusal in the deployment was going unaudited.
+     *
+     * Both exits now report into `audit_observation_dropped_total` via `recordAuditObservationLoss`.
+     * Three paths deliberately do NOT: an absent `operation` (nothing was owed), the `AUDIT_LOGS`
+     * recursion guard, and a dedup decision of `shouldEmit: false`. Each is a suppression the design
+     * asked for, and a loss counter that fires on correct behaviour is one operators learn to ignore.
      *
      * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — the negative access decision is
      * recorded, attributable, and carries the authority context needed to review it.
+     * assurance-control: WILDO.AUDIT.SECURITY_EVENT — and its LOSS is detectable rather than silent.
      */
     async emitAuthorizationDenialAudit(denialReason, operation, executionContext, attemptedResourceIds) {
-        const auditLogsService = this.resolveAuditLogsService();
-        if (!auditLogsService || !operation)
+        // `!operation` is NOT a loss — there is nothing to record, so counting it would fire the loss
+        // signal on a correct path and train a reader to skim past the lines that mean something. The
+        // same reasoning excludes the recursion guard and the dedup decision below: both are DELIBERATE
+        // suppressions of an emission that was never owed, not evidence that went missing.
+        if (!operation)
             return;
         // Defence-in-depth against an emission loop. Structurally unreachable today — the audit write
         // runs as a REPOSITORY_ONLY super-admin context and repository writes do not route through this
@@ -1364,8 +1616,33 @@ let AuthorizationsBackendService = class AuthorizationsBackendService {
         // subsystem already carries a documented recursion hazard of exactly that shape (a per-org SIEM
         // dispatch's own config load is a system read that re-enters the audit path). Stateless and
         // concurrency-safe, unlike an in-flight instance flag.
+        //
+        // ORDER: this sits ABOVE the service resolution deliberately, and a first cut had it below —
+        // caught by its own calibration pin. A refusal on the audit resource is owed NO emission, so
+        // reaching the service resolution first would report a `SERVICE_UNAVAILABLE` loss for evidence
+        // that was never going to be written. A loss counter that fires on correct behaviour is one
+        // operators learn to ignore, which would defeat the counter's entire purpose.
         if (operation.resourceIdentifier === CoreResourceType.AUDIT_LOGS)
             return;
+        const auditLogsService = this.resolveAuditLogsService();
+        // Feature-detected for the same reason its cross-tenant sibling is (adding a `log*` method
+        // breaks partially-mocked doubles), and reported for the same reason: an unbound service is the
+        // loss shape that used to leave nothing behind — `_createAuditLog` is never reached, so
+        // `audit_store_failure_total` never fires either.
+        if (typeof auditLogsService?.logResourceOperationDenied !== 'function') {
+            recordAuditObservationLoss({
+                observation: AuditObservationKind.AUTHORIZATION_DENIAL,
+                reason: AuditObservationLossReason.SERVICE_UNAVAILABLE,
+                metricsService: this.resolveMetricsService(),
+                logger: this.logger,
+                context: {
+                    observedResourceType: String(operation.resourceIdentifier),
+                    observedOperationIdentifier: String(operation.operationIdentifier),
+                    observedDenialReason: denialReason,
+                },
+            });
+            return;
+        }
         try {
             const principalUserId = executionContext.initiatorIds?.userId;
             const decision = await resolveDenialAuditEmissionDecision({ redisService: this.redisService, logger: this.logger }, {
@@ -1415,6 +1692,26 @@ let AuthorizationsBackendService = class AuthorizationsBackendService {
                 denialReason,
                 ...projectCaughtErrorLogFields(error),
             });
+            // The warn line above names the ONE refusal whose evidence was lost; this names the RATE. A
+            // per-occurrence line cannot answer "has this been happening all afternoon?" and is exactly
+            // what an operator filters out once it repeats — which is how a swallowed emission stays
+            // swallowed while looking observed.
+            //
+            // `EMISSION_THREW` rather than `EMISSION_REJECTED`: this path `await`s, so a rejected promise
+            // and a synchronous throw arrive at the same `catch` and cannot be told apart here. Claiming
+            // the more specific one would be a distinction the code cannot actually make.
+            recordAuditObservationLoss({
+                observation: AuditObservationKind.AUTHORIZATION_DENIAL,
+                reason: AuditObservationLossReason.EMISSION_THREW,
+                metricsService: this.resolveMetricsService(),
+                logger: this.logger,
+                error,
+                context: {
+                    observedResourceType: String(operation.resourceIdentifier),
+                    observedOperationIdentifier: String(operation.operationIdentifier),
+                    observedDenialReason: denialReason,
+                },
+            });
         }
     }
     /**
@@ -1648,6 +1945,11 @@ let AuthorizationsBackendService = class AuthorizationsBackendService {
         if (effectiveScope !== ResourcePrimaryScope.ORGANIZATIONS && !isJunctionScopedSearch) {
             await this.runAuthorizationPhase(() => this.validateOperationRoles(operationRoles, executionContext, operation.resourceIdentifier), (error) => classifyAuthorizationDenial(error, ResourceOperationDenialReason.INSUFFICIENT_ROLES), operation, executionContext);
         }
+        // SITE 2 of 2 — the collection half, and the one the finding names: LIST / SEARCH / COUNT over a
+        // scope-root directory or an application-scoped cross-tenant door. Placed here rather than in
+        // `authorizeInController` because BOTH public entries converge on this method — the controller
+        // tier and `authorizeInProgrammaticSurface` (RAG) — so one call covers both without a third.
+        await this.enforceApplicationWideReadAdmission(operation, executionContext);
         this.logDebug('Collection operation authorization completed successfully');
     }
     /**
@@ -1988,10 +2290,7 @@ let AuthorizationsBackendService = class AuthorizationsBackendService {
     validateRolesForScope(requiredRoles, userRoles, scope) {
         if (requiredRolesDeclarePublicAccess(requiredRoles))
             return true;
-        return requiredRoles.some(requiredRole => userRoles.some(userRole => {
-            const hierarchy = this.getRoleHierarchy(userRole, scope);
-            return hierarchy.includes(requiredRole);
-        }));
+        return requiredRoles.some(requiredRole => userRoles.some(userRole => this.roleConfersAuthority(userRole, requiredRole, scope)));
     }
 };
 AuthorizationsBackendService = __decorate([