@wildo-ai/saas-backend-lib 1.1.2 → 1.1.4

package/dist/esm/users/services/user-read-retained.custom-impl.backend.service.js

@@ -0,0 +1,159 @@
+/**
+ * `users | read_retained` — the operator surface for the audited see-through read (#490).
+ *
+ * # What this replaced: a capability nothing could reach
+ *
+ * `SystemAccessBackendService.readRetainedAsSystem` is the sanctioned way to reveal a RETAINED
+ * (erased-and-impersonalized) user row. It has been complete and correct since retention landed —
+ * it asserts the `seeRetained` policy verb, demands a privileged role, refuses a blank attribution,
+ * sets the see-through flag for that read only, and emits a human-attributed `RETAINED_DATA_ACCESS`
+ * audit row.
+ *
+ * And it had **no caller**. Measured: the only references were the factory that derives its grant
+ * and the schema prose describing it as LIVE. So the capability existed, was audited by
+ * construction, and the only route an operator actually had to a retained record was a database
+ * console — which is precisely the unaudited path the primitive was built to replace.
+ *
+ * # Why an authenticated resource operation, and not an admin controller
+ *
+ * The engine already has an operator-facing admin controller pattern (`data-seeding-admin`), and it
+ * is the wrong shape here: it authenticates with a shared `X-Admin-Secret`, which yields no user id
+ * and no roles. The primitive requires BOTH — it fail-closes on a blank `accessingUserId`, and the
+ * audit row's entire purpose is to say WHO looked. A shared secret answers "someone who holds the
+ * secret", which is the question the record exists to improve on.
+ *
+ * A resource operation runs inside the application's own authentication and authorization, so the
+ * caller's identity and roles arrive already established and cannot be self-asserted.
+ *
+ * # Application tier, deliberately — not platform tier
+ *
+ * A retention policy is an application's decision about its own data, the role gate the primitive
+ * enforces (`APP_ADMIN_SUPER_ADMIN`) is an application role, and the system context the primitive
+ * builds is APPLICATION-scoped. A platform-tier version would cross tenants, and would therefore
+ * come under the declared cross-tenant admission rules and the `PLATFORM_ACCESS_GRANTS` requirement
+ * rather than an ordinary role check. That is a bigger, different door; it is not this one, and it
+ * should not be added by widening this one.
+ */
+import { CoreResourceType, ErrorCustomMessageReference, ErrorType, ResourceOperationVariantType, Users_Operations, } from '@wildo-ai/saas-models';
+import { createResourceCustomServiceImplementation, } from '../../base-classes/services/services/resource-operation-custom-implementation.factory.backend.js';
+import { describeUnaddressableShape, resolveSingleSubjectId, } from '../../base-classes/utils/single-subject-addressing.backend.utils.js';
+import { SAAS_SERVICE_TYPES } from '../../inject/models/service-types.js';
+/**
+ * Resolve and validate the whole request, or throw.
+ *
+ * PURE and idempotent, so the PREFIX phase can run it to refuse before anything happens and the
+ * REPLACE phase can re-derive the same values without state threaded between them — the shape the
+ * sibling `force_password_reset` implementation records.
+ */
+function resolveValidatedRetainedReadRequest(id, input, executionContext, utils) {
+    // Exactly one subject. A population-addressed reveal would disclose every retained row matching a
+    // filter on one operator's single stated reason, and the audit row would record that reason
+    // against a disclosure nobody sized.
+    const subjectUserId = resolveSingleSubjectId(id);
+    if (subjectUserId === undefined) {
+        throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {
+            customMessageReference: ErrorCustomMessageReference.SERVICE_RESOURCE_VALIDATION_FAILED,
+            context: {
+                reason: 'read_retained requires a single addressed user id',
+                receivedAddressing: describeUnaddressableShape(id),
+            },
+        });
+    }
+    /*
+     * A HUMAN, and only a human.
+     *
+     * The sibling `force_password_reset` accepts a machine credential as attribution, and that is
+     * right there: a forced reset is an administrative ACT whose provenance is the strongest
+     * attribution available for a machine caller. This is different. The record being written says a
+     * named person chose to look at data an erasure removed, for a reason they wrote down — and an
+     * API key can supply neither half. `machineCredential` would answer "which credential", never
+     * "who", and the audit row is the whole reason this read is permitted at all.
+     */
+    const accessingUserId = executionContext.initiatorIds?.userId;
+    if (!accessingUserId) {
+        throw utils.errorBuilder.buildError(ErrorType.AUTHORIZATION, executionContext, {
+            context: {
+                reason: 'read_retained_requires_human_principal',
+                message: 'Revealing a retained (erased) record requires an authenticated human principal. A machine '
+                    + 'credential cannot supply the attribution this reveal is audited on.',
+            },
+        });
+    }
+    /*
+     * Roles from the ESTABLISHED session, never from the request body.
+     *
+     * The primitive re-asserts the privileged role itself, and it can only assert what it is handed —
+     * so handing it a request-supplied list would let a caller name their own authorization. The
+     * execution context's roles were established by authentication and cannot be written by the
+     * caller. Flattened across scopes because the primitive tests for one member, not for a scope.
+     */
+    const accessingUserRoles = (executionContext.initiatorRoles ?? []).flatMap((roleInfo) => [...roleInfo.roles]);
+    const reason = typeof input?.reason === 'string'
+        ? (input.reason).trim()
+        : '';
+    if (!reason) {
+        // Also enforced by the request DTO and again inside the primitive. Three sites, because the
+        // audit store persists `eventData` unparsed: a blank reason that reached the row would produce a
+        // reveal recorded with no justification, which is indistinguishable from an unaudited one.
+        throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {
+            customMessageReference: ErrorCustomMessageReference.SERVICE_RESOURCE_VALIDATION_FAILED,
+            context: {
+                reason: 'read_retained requires a non-empty justification',
+                message: 'Provide `reason`: why this retained record is being revealed (legal hold, dispute, investigation).',
+            },
+        });
+    }
+    return { subjectUserId, accessingUserId, accessingUserRoles, reason };
+}
+export function createUserReadRetainedFactories() {
+    const factory = (_resourcesRegistryService, container) => createResourceCustomServiceImplementation({
+        operationPath: {
+            resourceIdentifier: CoreResourceType.USERS,
+            operationIdentifier: Users_Operations.READ_RETAINED,
+            variantType: ResourceOperationVariantType.API_CALL,
+            isOperationDefault: true,
+        },
+        debugLabel: 'users.read_retained.see-through-reveal',
+        handlers: {
+            // Every refusal lives in PREFIX, the only phase that runs before the core write — so a
+            // rejected request cannot have touched the row on its way to being rejected.
+            prefixCoreOperations: async (id, input, executionContext, _operationPath, utils) => {
+                resolveValidatedRetainedReadRequest(id, input, executionContext, utils);
+                return input;
+            },
+            /*
+             * REPLACE, because the operation is UPDATE-like and must WRITE NOTHING.
+             *
+             * `resourceOperationLike: UPDATE` is how the operation gets a PUT with a body — the request
+             * carries a free-text justification, and a GET would put it in the URL and therefore in
+             * every access log between the operator and the server. Left to the generic core path, that
+             * declaration would make this a real update: a retained row is frozen, so it would fail, and
+             * on a resource that did not freeze it, it would silently write. Replacing the core
+             * operation is what makes an UPDATE-shaped route a read.
+             */
+            replaceCoreOperations: async (id, input, executionContext, _operationPath, utils) => {
+                const { subjectUserId, accessingUserId, accessingUserRoles, reason } = resolveValidatedRetainedReadRequest(id, input, executionContext, utils);
+                const systemAccess = container.get(SAAS_SERVICE_TYPES.SystemAccessService);
+                /*
+                 * Through the PRIMITIVE, never through the repository.
+                 *
+                 * This is the line the whole issue turns on. The same row is reachable by building a
+                 * super-admin context and reading it directly — and that path asserts no `seeRetained`
+                 * grant, sets no see-through flag, and writes no audit row. Reaching the repository here
+                 * would reveal exactly the same personal data with no record of it, which is the outcome
+                 * the audited pair exists to prevent.
+                 */
+                return await systemAccess.readRetainedAsSystem(CoreResourceType.USERS, subjectUserId, { accessingUserId, accessingUserRoles, reason }, {
+                    // Scoped to the organization the caller is acting in, when there is one. The primitive
+                    // suppresses the RETENTION predicate only — never the scope filter — so this cannot
+                    // widen the read beyond what the caller could otherwise address.
+                    scopeContext: executionContext.initiatorIds?.organizationId
+                        ? { organizationId: executionContext.initiatorIds.organizationId }
+                        : undefined,
+                });
+            },
+        },
+    });
+    return [factory];
+}
+//# sourceMappingURL=user-read-retained.custom-impl.backend.service.js.map

package/dist/esm/users/services/user-read-retained.custom-impl.backend.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-read-retained.custom-impl.backend.service.js","sourceRoot":"","sources":["../../../../src/users/services/user-read-retained.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EACL,gBAAgB,EAChB,2BAA2B,EAC3B,SAAS,EACT,4BAA4B,EAC5B,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,yCAAyC,GAE1C,MAAM,4GAA4G,CAAC;AACpH,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,+EAA+E,CAAC;AAEvF,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAsBpF;;;;;;GAMG;AACH,SAAS,mCAAmC,CAC1C,EAAW,EACX,KAAc,EACd,gBAAuC,EACvC,KAAyB;IAEzB,kGAAkG;IAClG,4FAA4F;IAC5F,qCAAqC;IACrC,MAAM,aAAa,GAAG,sBAAsB,CAAC,EAAW,CAAC,CAAC;IAC1D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;YAC1E,sBAAsB,EAAE,2BAA2B,CAAC,kCAAkC;YACtF,OAAO,EAAE;gBACP,MAAM,EAAE,mDAAmD;gBAC3D,kBAAkB,EAAE,0BAA0B,CAAC,EAAW,CAAC;aAC5D;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACH,MAAM,eAAe,GAAG,gBAAgB,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9D,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,gBAAgB,EAAE;YAC7E,OAAO,EAAE;gBACP,MAAM,EAAE,wCAAwC;gBAChD,OAAO,EACL,4FAA4F;sBAC1F,qEAAqE;aAC1E;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,kBAAkB,GAAG,CAAC,gBAAgB,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAE9G,MAAM,MAAM,GAAG,OAAQ,KAA8B,EAAE,MAAM,KAAK,QAAQ;QACxE,CAAC,CAAC,CAAE,KAA4B,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE;QAC/C,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,4FAA4F;QAC5F,iGAAiG;QACjG,2FAA2F;QAC3F,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;YAC1E,sBAAsB,EAAE,2BAA2B,CAAC,kCAAkC;YACtF,OAAO,EAAE;gBACP,MAAM,EAAE,kDAAkD;gBAC1D,OAAO,EAAE,oGAAoG;aAC9G;SACF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,EAAE,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,+BAA+B;IAC7C,MAAM,OAAO,GAAG,CAAC,yBAA0D,EAAE,SAAoB,EAAE,EAAE,CACnG,yCAAyC,CAAC;QACxC,aAAa,EAAE;YACb,kBAAkB,EAAE,gBAAgB,CAAC,KAAK;YAC1C,mBAAmB,EAAE,gBAAgB,CAAC,aAAa;YACnD,WAAW,EAAE,4BAA4B,CAAC,QAAQ;YAClD,kBAAkB,EAAE,IAAI;SACzB;QACD,UAAU,EAAE,wCAAwC;QACpD,QAAQ,EAAE;YACR,uFAAuF;YACvF,6EAA6E;YAC7E,oBAAoB,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;gBACjF,mCAAmC,CAAC,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;gBACxE,OAAO,KAAK,CAAC;YACf,CAAC;YACD;;;;;;;;;eASG;YACH,qBAAqB,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;gBAClF,MAAM,EAAE,aAAa,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,EAAE,GAClE,mCAAmC,CAAC,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;gBAE1E,MAAM,YAAY,GAAG,SAAS,CAAC,GAAG,CAA6B,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;gBAEvG;;;;;;;;mBAQG;gBACH,OAAO,MAAM,YAAY,CAAC,oBAAoB,CAC5C,gBAAgB,CAAC,KAAK,EACtB,aAAa,EACb,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,EAAE,EAC/C;oBACE,uFAAuF;oBACvF,oFAAoF;oBACpF,iEAAiE;oBACjE,YAAY,EAAE,gBAAgB,CAAC,YAAY,EAAE,cAAc;wBACzD,CAAC,CAAC,EAAE,cAAc,EAAE,gBAAgB,CAAC,YAAY,CAAC,cAAc,EAAE;wBAClE,CAAC,CAAC,SAAS;iBACd,CACF,CAAC;YACJ,CAAC;SACF;KACF,CAAC,CAAC;IAEL,OAAO,CAAC,OAAO,CAAC,CAAC;AACnB,CAAC","sourcesContent":["/**\n * `users | read_retained` — the operator surface for the audited see-through read (#490).\n *\n * # What this replaced: a capability nothing could reach\n *\n * `SystemAccessBackendService.readRetainedAsSystem` is the sanctioned way to reveal a RETAINED\n * (erased-and-impersonalized) user row. It has been complete and correct since retention landed —\n * it asserts the `seeRetained` policy verb, demands a privileged role, refuses a blank attribution,\n * sets the see-through flag for that read only, and emits a human-attributed `RETAINED_DATA_ACCESS`\n * audit row.\n *\n * And it had **no caller**. Measured: the only references were the factory that derives its grant\n * and the schema prose describing it as LIVE. So the capability existed, was audited by\n * construction, and the only route an operator actually had to a retained record was a database\n * console — which is precisely the unaudited path the primitive was built to replace.\n *\n * # Why an authenticated resource operation, and not an admin controller\n *\n * The engine already has an operator-facing admin controller pattern (`data-seeding-admin`), and it\n * is the wrong shape here: it authenticates with a shared `X-Admin-Secret`, which yields no user id\n * and no roles. The primitive requires BOTH — it fail-closes on a blank `accessingUserId`, and the\n * audit row's entire purpose is to say WHO looked. A shared secret answers \"someone who holds the\n * secret\", which is the question the record exists to improve on.\n *\n * A resource operation runs inside the application's own authentication and authorization, so the\n * caller's identity and roles arrive already established and cannot be self-asserted.\n *\n * # Application tier, deliberately — not platform tier\n *\n * A retention policy is an application's decision about its own data, the role gate the primitive\n * enforces (`APP_ADMIN_SUPER_ADMIN`) is an application role, and the system context the primitive\n * builds is APPLICATION-scoped. A platform-tier version would cross tenants, and would therefore\n * come under the declared cross-tenant admission rules and the `PLATFORM_ACCESS_GRANTS` requirement\n * rather than an ordinary role check. That is a bigger, different door; it is not this one, and it\n * should not be added by widening this one.\n */\n\nimport {\n  CoreResourceType,\n  ErrorCustomMessageReference,\n  ErrorType,\n  ResourceOperationVariantType,\n  Users_Operations,\n} from '@wildo-ai/saas-models';\nimport type { Container } from 'inversify';\n\nimport {\n  createResourceCustomServiceImplementation,\n  type ResourceCustomServiceImplementationFactory,\n} from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation.factory.backend';\nimport {\n  describeUnaddressableShape,\n  resolveSingleSubjectId,\n} from '~wildo-backend-lib/base-classes/utils/single-subject-addressing.backend.utils';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\n\ninterface ErrorBuildingUtils {\n  errorBuilder: {\n    buildError: (\n      type: ErrorType,\n      executionContext?: unknown,\n      options?: { customMessageReference?: ErrorCustomMessageReference; context?: Record<string, unknown> },\n    ) => unknown;\n  };\n}\n\n/** Everything the reveal needs, resolved from the request and the established session. */\ninterface ValidatedRetainedReadRequest {\n  subjectUserId: string;\n  accessingUserId: string;\n  accessingUserRoles: string[];\n  reason: string;\n}\n\n/**\n * Resolve and validate the whole request, or throw.\n *\n * PURE and idempotent, so the PREFIX phase can run it to refuse before anything happens and the\n * REPLACE phase can re-derive the same values without state threaded between them — the shape the\n * sibling `force_password_reset` implementation records.\n */\nfunction resolveValidatedRetainedReadRequest(\n  id: unknown,\n  input: unknown,\n  executionContext: ExecutionContext<any>,\n  utils: ErrorBuildingUtils,\n): ValidatedRetainedReadRequest {\n  // Exactly one subject. A population-addressed reveal would disclose every retained row matching a\n  // filter on one operator's single stated reason, and the audit row would record that reason\n  // against a disclosure nobody sized.\n  const subjectUserId = resolveSingleSubjectId(id as never);\n  if (subjectUserId === undefined) {\n    throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n      customMessageReference: ErrorCustomMessageReference.SERVICE_RESOURCE_VALIDATION_FAILED,\n      context: {\n        reason: 'read_retained requires a single addressed user id',\n        receivedAddressing: describeUnaddressableShape(id as never),\n      },\n    });\n  }\n\n  /*\n   * A HUMAN, and only a human.\n   *\n   * The sibling `force_password_reset` accepts a machine credential as attribution, and that is\n   * right there: a forced reset is an administrative ACT whose provenance is the strongest\n   * attribution available for a machine caller. This is different. The record being written says a\n   * named person chose to look at data an erasure removed, for a reason they wrote down — and an\n   * API key can supply neither half. `machineCredential` would answer \"which credential\", never\n   * \"who\", and the audit row is the whole reason this read is permitted at all.\n   */\n  const accessingUserId = executionContext.initiatorIds?.userId;\n  if (!accessingUserId) {\n    throw utils.errorBuilder.buildError(ErrorType.AUTHORIZATION, executionContext, {\n      context: {\n        reason: 'read_retained_requires_human_principal',\n        message:\n          'Revealing a retained (erased) record requires an authenticated human principal. A machine '\n          + 'credential cannot supply the attribution this reveal is audited on.',\n      },\n    });\n  }\n\n  /*\n   * Roles from the ESTABLISHED session, never from the request body.\n   *\n   * The primitive re-asserts the privileged role itself, and it can only assert what it is handed —\n   * so handing it a request-supplied list would let a caller name their own authorization. The\n   * execution context's roles were established by authentication and cannot be written by the\n   * caller. Flattened across scopes because the primitive tests for one member, not for a scope.\n   */\n  const accessingUserRoles = (executionContext.initiatorRoles ?? []).flatMap((roleInfo) => [...roleInfo.roles]);\n\n  const reason = typeof (input as { reason?: unknown })?.reason === 'string'\n    ? ((input as { reason: string }).reason).trim()\n    : '';\n  if (!reason) {\n    // Also enforced by the request DTO and again inside the primitive. Three sites, because the\n    // audit store persists `eventData` unparsed: a blank reason that reached the row would produce a\n    // reveal recorded with no justification, which is indistinguishable from an unaudited one.\n    throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n      customMessageReference: ErrorCustomMessageReference.SERVICE_RESOURCE_VALIDATION_FAILED,\n      context: {\n        reason: 'read_retained requires a non-empty justification',\n        message: 'Provide `reason`: why this retained record is being revealed (legal hold, dispute, investigation).',\n      },\n    });\n  }\n\n  return { subjectUserId, accessingUserId, accessingUserRoles, reason };\n}\n\nexport function createUserReadRetainedFactories(): ResourceCustomServiceImplementationFactory[] {\n  const factory = (_resourcesRegistryService: ResourcesRegistryBackendService, container: Container) =>\n    createResourceCustomServiceImplementation({\n      operationPath: {\n        resourceIdentifier: CoreResourceType.USERS,\n        operationIdentifier: Users_Operations.READ_RETAINED,\n        variantType: ResourceOperationVariantType.API_CALL,\n        isOperationDefault: true,\n      },\n      debugLabel: 'users.read_retained.see-through-reveal',\n      handlers: {\n        // Every refusal lives in PREFIX, the only phase that runs before the core write — so a\n        // rejected request cannot have touched the row on its way to being rejected.\n        prefixCoreOperations: async (id, input, executionContext, _operationPath, utils) => {\n          resolveValidatedRetainedReadRequest(id, input, executionContext, utils);\n          return input;\n        },\n        /*\n         * REPLACE, because the operation is UPDATE-like and must WRITE NOTHING.\n         *\n         * `resourceOperationLike: UPDATE` is how the operation gets a PUT with a body — the request\n         * carries a free-text justification, and a GET would put it in the URL and therefore in\n         * every access log between the operator and the server. Left to the generic core path, that\n         * declaration would make this a real update: a retained row is frozen, so it would fail, and\n         * on a resource that did not freeze it, it would silently write. Replacing the core\n         * operation is what makes an UPDATE-shaped route a read.\n         */\n        replaceCoreOperations: async (id, input, executionContext, _operationPath, utils) => {\n          const { subjectUserId, accessingUserId, accessingUserRoles, reason } =\n            resolveValidatedRetainedReadRequest(id, input, executionContext, utils);\n\n          const systemAccess = container.get<SystemAccessBackendService>(SAAS_SERVICE_TYPES.SystemAccessService);\n\n          /*\n           * Through the PRIMITIVE, never through the repository.\n           *\n           * This is the line the whole issue turns on. The same row is reachable by building a\n           * super-admin context and reading it directly — and that path asserts no `seeRetained`\n           * grant, sets no see-through flag, and writes no audit row. Reaching the repository here\n           * would reveal exactly the same personal data with no record of it, which is the outcome\n           * the audited pair exists to prevent.\n           */\n          return await systemAccess.readRetainedAsSystem(\n            CoreResourceType.USERS,\n            subjectUserId,\n            { accessingUserId, accessingUserRoles, reason },\n            {\n              // Scoped to the organization the caller is acting in, when there is one. The primitive\n              // suppresses the RETENTION predicate only — never the scope filter — so this cannot\n              // widen the read beyond what the caller could otherwise address.\n              scopeContext: executionContext.initiatorIds?.organizationId\n                ? { organizationId: executionContext.initiatorIds.organizationId }\n                : undefined,\n            },\n          );\n        },\n      },\n    });\n\n  return [factory];\n}\n"]}

package/dist/esm/users/services/user-role-administration.custom-impl.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-role-administration.custom-impl.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/users/services/user-role-administration.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAaH,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AAsYpH,uCAAuC;AACvC,wBAAgB,mCAAmC,IAAI,0CAA0C,EAAE,CAKlG;AAiJD,mDAAmD;AACnD,wBAAgB,kCAAkC,IAAI,0CAA0C,EAAE,CAKjG"}
+{"version":3,"file":"user-role-administration.custom-impl.backend.service.d.ts","sourceRoot":"","sources":["../../../../src/users/services/user-role-administration.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAaH,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AAsYpH,uCAAuC;AACvC,wBAAgB,mCAAmC,IAAI,0CAA0C,EAAE,CAKlG;AAiJD,mDAAmD;AACnD,wBAAgB,kCAAkC,IAAI,0CAA0C,EAAE,CAKjG"}

package/dist/esm/users/services/user-self-custom-implementations.backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-self-custom-implementations.backend.d.ts","sourceRoot":"","sources":["../../../../../src/users/services/user-self-custom-implementations.backend.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAaH,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AA0IpH,eAAO,MAAM,6BAA6B,EAAE,0CAA0C,EAGrF,CAAC"}
+{"version":3,"file":"user-self-custom-implementations.backend.d.ts","sourceRoot":"","sources":["../../../../src/users/services/user-self-custom-implementations.backend.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAaH,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AA0IpH,eAAO,MAAM,6BAA6B,EAAE,0CAA0C,EAGrF,CAAC"}

package/dist/esm/users/services/user-super-admin-floor.custom-impl.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-super-admin-floor.custom-impl.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/users/services/user-super-admin-floor.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAUH,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AA8CpH;;GAEG;AACH,wBAAgB,sCAAsC,IAAI,0CAA0C,CAiEnG;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,sCAAsC,IAAI,0CAA0C,CA+DnG;AAED,yDAAyD;AACzD,wBAAgB,kCAAkC,IAAI,0CAA0C,EAAE,CAEjG"}
+{"version":3,"file":"user-super-admin-floor.custom-impl.backend.service.d.ts","sourceRoot":"","sources":["../../../../src/users/services/user-super-admin-floor.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAUH,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AA8CpH;;GAEG;AACH,wBAAgB,sCAAsC,IAAI,0CAA0C,CAiEnG;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,sCAAsC,IAAI,0CAA0C,CA+DnG;AAED,yDAAyD;AACzD,wBAAgB,kCAAkC,IAAI,0CAA0C,EAAE,CAEjG"}