@wildo-ai/saas-backend-lib 1.1.3 → 1.1.4

package/dist/esm/security/authorizations/access-grant-lifecycle-audit.backend.js

@@ -0,0 +1,133 @@
+/**
+ * Recording one access-grant transition — the emitter BOTH grant resources use.
+ *
+ * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — every elevation transition, tenant-scoped or
+ * application-wide, leaves one durable record.
+ *
+ * ## Why it is one function and not one per resource
+ *
+ * The tenant grant (`platformAccessGrants`) and the application-wide grant (`applicationAccessGrants`)
+ * are two resources with one lifecycle. This emitter carries the whole of the shared behaviour — the
+ * post-commit deferral, the feature detection, the loss accounting — so the two can never drift on
+ * the part that is identical, and the ONE thing that differs is a parameter: `grantScope`.
+ *
+ * The alternative was a second near-copy. `.claude/rules/invariant-call-site-enumeration.md` is a
+ * catalogue of what happens next: the deferral gets fixed on one side, the loss counter is widened on
+ * one side, and the trail's completeness becomes a property of which file somebody opened.
+ *
+ * ## Deferred to COMMIT, not emitted from the hook
+ *
+ * A postfix hook runs INSIDE the declared transaction, so an audit row written there survives a
+ * rollback — the trail would then claim an elevation that does not exist, which is worse than no
+ * trail at all.
+ *
+ * ## Best-effort, and the loss is COUNTED
+ *
+ * Feature-detected against the audit service (adding a `log*` method breaks partially-mocked doubles,
+ * and the absent property throws synchronously before any `.catch()` can help) and never allowed to
+ * fail the transition it observes. Every exit — unbound service, absent method, thrown emission —
+ * lands on `audit_observation_dropped_total` through `recordAuditObservationLoss`, because a grant
+ * trail with no transitions in it otherwise reads identically whether no elevation was requested or
+ * the audit service had been unbound since boot. For THESE resources that is the whole evidentiary
+ * claim: an elevation with no recorded request and approval is a standing privilege wearing a
+ * lifecycle's clothes.
+ */
+import { SAAS_SERVICE_TYPES } from '../../inject/models/service-types.js';
+import { registerTransactionPostCommitEffect } from '../../databases/models/transaction.shared.schemas.js';
+import { describeCaughtError } from '../../errors/utils/error-log-level-classification.backend.utils.js';
+import { AuditObservationKind, AuditObservationLossReason, recordAuditObservationLoss, } from '../../monitoring/observability/audit-observation-emission.backend.js';
+export function recordAccessGrantTransition(params) {
+    /**
+     * The metrics recorder behind the loss counter, or `undefined` when nothing is bound.
+     *
+     * Wrapped: this runs on the observation path, so a container that throws while resolving must not
+     * be able to fail the transition. Losing the metric channel degrades the signal to its log line,
+     * which is the correct direction — an observability gap is never a reason to refuse.
+     */
+    const resolveMetricsService = () => {
+        try {
+            if (!params.container.isBound?.(SAAS_SERVICE_TYPES.MetricsService))
+                return undefined;
+            return params.container.get(SAAS_SERVICE_TYPES.MetricsService);
+        }
+        catch {
+            return undefined;
+        }
+    };
+    const reportLoss = (reason, error) => recordAuditObservationLoss({
+        observation: AuditObservationKind.PLATFORM_ACCESS_GRANT_LIFECYCLE,
+        reason,
+        metricsService: resolveMetricsService(),
+        logger: params.utils.logger,
+        error,
+        // Names WHICH transition on WHICH grant went unrecorded, so the gap can be reconstructed from
+        // the grant row rather than being known only as "a transition, somewhere". The SCOPE is in the
+        // context too: a lost application-wide transition and a lost tenant one are not equally serious.
+        context: {
+            observedTransition: params.transition,
+            observedGrantScope: params.grantScope,
+            observedGrantId: String(params.grant._id ?? ''),
+            observedTargetOrganizationId: String(params.grant.organizationId ?? ''),
+        },
+    });
+    const emit = async () => {
+        try {
+            // One report for both halves of "the audit service cannot take this": an unbound service and a
+            // bound service missing the method are the same loss to a reviewer, and splitting them would
+            // add a metric label nobody could act on differently.
+            if (!params.container.isBound?.(SAAS_SERVICE_TYPES.AuditLogsService)) {
+                reportLoss(AuditObservationLossReason.SERVICE_UNAVAILABLE);
+                return;
+            }
+            const auditLogsService = params.container.get(SAAS_SERVICE_TYPES.AuditLogsService);
+            if (typeof auditLogsService?.logPlatformAccessGrantLifecycle !== 'function') {
+                reportLoss(AuditObservationLossReason.SERVICE_UNAVAILABLE);
+                return;
+            }
+            const grant = params.grant;
+            const targetOrganizationId = String(grant.organizationId ?? '');
+            await auditLogsService.logPlatformAccessGrantLifecycle({
+                transition: params.transition,
+                grantScope: params.grantScope,
+                grantId: String(grant._id ?? ''),
+                // Omitted rather than empty for an application-wide grant: `''` would be written into the
+                // event's tenant field and read back as a tenant nobody can resolve.
+                targetOrganizationId: targetOrganizationId || undefined,
+                operatorUserId: String(grant.operatorUserId ?? ''),
+                justification: grant.justification,
+                resultingStatus: grant.status,
+                expiresAt: grant.expiresAt,
+                autoApprovalReason: grant.autoApprovalReason,
+                decidedByUserId: params.decidedByUserId,
+                decisionReason: grant.decisionReason,
+            });
+        }
+        catch (error) {
+            params.utils.logger?.error?.('Failed to record an access-grant lifecycle event', {
+                reason: 'platform_access_grant_lifecycle_audit_emission_failed',
+                transition: params.transition,
+                grantScope: params.grantScope,
+                error: describeCaughtError(error),
+            });
+            // The line above names ONE lost transition; this names the RATE, on the same counter every
+            // other dropped security observation lands on. `EMISSION_THREW`: this path `await`s, so a
+            // rejection and a synchronous throw arrive at the same `catch` and cannot be told apart —
+            // claiming the more specific member would be a distinction the code cannot make.
+            reportLoss(AuditObservationLossReason.EMISSION_THREW, error);
+        }
+    };
+    const transaction = params.utils.serviceOptions?.transaction;
+    if (transaction) {
+        registerTransactionPostCommitEffect(transaction, {
+            // The SCOPE is in the key. Both resources use the same transition names, so without it two
+            // grants decided in one transaction — possible for a cascade — would collide on one effect key
+            // and the second would be dropped.
+            key: `access-grant:${params.grantScope}:${params.transition}:${String(params.grant._id ?? '')}`,
+            execute: emit,
+        });
+    }
+    else {
+        void emit();
+    }
+}
+//# sourceMappingURL=access-grant-lifecycle-audit.backend.js.map

package/dist/esm/security/authorizations/access-grant-lifecycle-audit.backend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-grant-lifecycle-audit.backend.js","sourceRoot":"","sources":["../../../../src/security/authorizations/access-grant-lifecycle-audit.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAUH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,mCAAmC,EAAE,MAAM,gEAAgE,CAAC;AACrH,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AACnH,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,0BAA0B,GAE3B,MAAM,gFAAgF,CAAC;AAGxF,MAAM,UAAU,2BAA2B,CAAC,MAY3C;IACC;;;;;;OAMG;IACH,MAAM,qBAAqB,GAAG,GAAoD,EAAE;QAClF,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,kBAAkB,CAAC,cAAc,CAAC;gBAAE,OAAO,SAAS,CAAC;YACrF,OAAO,MAAM,CAAC,SAAS,CAAC,GAAG,CAAsC,kBAAkB,CAAC,cAAc,CAAC,CAAC;QACtG,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,CAAC,MAAkC,EAAE,KAAe,EAAQ,EAAE,CAC/E,0BAA0B,CAAC;QACzB,WAAW,EAAE,oBAAoB,CAAC,+BAA+B;QACjE,MAAM;QACN,cAAc,EAAE,qBAAqB,EAAE;QACvC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;QAC3B,KAAK;QACL,8FAA8F;QAC9F,+FAA+F;QAC/F,iGAAiG;QACjG,OAAO,EAAE;YACP,kBAAkB,EAAE,MAAM,CAAC,UAAU;YACrC,kBAAkB,EAAE,MAAM,CAAC,UAAU;YACrC,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC;YAC/C,4BAA4B,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC;SACxE;KACF,CAAC,CAAC;IAEL,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;QACrC,IAAI,CAAC;YACH,+FAA+F;YAC/F,6FAA6F;YAC7F,sDAAsD;YACtD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACrE,UAAU,CAAC,0BAA0B,CAAC,mBAAmB,CAAC,CAAC;gBAC3D,OAAO;YACT,CAAC;YACD,MAAM,gBAAgB,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAA0B,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;YAC5G,IAAI,OAAO,gBAAgB,EAAE,+BAA+B,KAAK,UAAU,EAAE,CAAC;gBAC5E,UAAU,CAAC,0BAA0B,CAAC,mBAAmB,CAAC,CAAC;gBAC3D,OAAO;YACT,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAC3B,MAAM,oBAAoB,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;YAChE,MAAM,gBAAgB,CAAC,+BAA+B,CAAC;gBACrD,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC;gBAChC,0FAA0F;gBAC1F,qEAAqE;gBACrE,oBAAoB,EAAE,oBAAoB,IAAI,SAAS;gBACvD,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC;gBAClD,aAAa,EAAE,KAAK,CAAC,aAAmC;gBACxD,eAAe,EAAE,KAAK,CAAC,MAAmC;gBAC1D,SAAS,EAAE,KAAK,CAAC,SAA6B;gBAC9C,kBAAkB,EAAE,KAAK,CAAC,kBAAuE;gBACjG,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,cAAc,EAAE,KAAK,CAAC,cAAoC;aAC3D,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,kDAAkD,EAAE;gBAC/E,MAAM,EAAE,uDAAuD;gBAC/D,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aAClC,CAAC,CAAC;YACH,2FAA2F;YAC3F,0FAA0F;YAC1F,0FAA0F;YAC1F,iFAAiF;YACjF,UAAU,CAAC,0BAA0B,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,WAAW,CAAC;IAC7D,IAAI,WAAW,EAAE,CAAC;QAChB,mCAAmC,CAAC,WAAoB,EAAE;YACxD,2FAA2F;YAC3F,+FAA+F;YAC/F,mCAAmC;YACnC,GAAG,EAAE,gBAAgB,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE;YAC/F,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,KAAK,IAAI,EAAE,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["/**\n * Recording one access-grant transition — the emitter BOTH grant resources use.\n *\n * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — every elevation transition, tenant-scoped or\n * application-wide, leaves one durable record.\n *\n * ## Why it is one function and not one per resource\n *\n * The tenant grant (`platformAccessGrants`) and the application-wide grant (`applicationAccessGrants`)\n * are two resources with one lifecycle. This emitter carries the whole of the shared behaviour — the\n * post-commit deferral, the feature detection, the loss accounting — so the two can never drift on\n * the part that is identical, and the ONE thing that differs is a parameter: `grantScope`.\n *\n * The alternative was a second near-copy. `.claude/rules/invariant-call-site-enumeration.md` is a\n * catalogue of what happens next: the deferral gets fixed on one side, the loss counter is widened on\n * one side, and the trail's completeness becomes a property of which file somebody opened.\n *\n * ## Deferred to COMMIT, not emitted from the hook\n *\n * A postfix hook runs INSIDE the declared transaction, so an audit row written there survives a\n * rollback — the trail would then claim an elevation that does not exist, which is worse than no\n * trail at all.\n *\n * ## Best-effort, and the loss is COUNTED\n *\n * Feature-detected against the audit service (adding a `log*` method breaks partially-mocked doubles,\n * and the absent property throws synchronously before any `.catch()` can help) and never allowed to\n * fail the transition it observes. Every exit — unbound service, absent method, thrown emission —\n * lands on `audit_observation_dropped_total` through `recordAuditObservationLoss`, because a grant\n * trail with no transitions in it otherwise reads identically whether no elevation was requested or\n * the audit service had been unbound since boot. For THESE resources that is the whole evidentiary\n * claim: an elevation with no recorded request and approval is a standing privilege wearing a\n * lifecycle's clothes.\n */\n\nimport type { Container } from 'inversify';\nimport {\n  PlatformAccessGrantAutoApprovalReason,\n  PlatformAccessGrantLifecycleTransition,\n  PlatformAccessGrantScope,\n  PlatformAccessGrantStatus,\n} from '@wildo-ai/saas-models';\n\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { registerTransactionPostCommitEffect } from '~wildo-backend-lib/databases/models/transaction.shared.schemas';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport {\n  AuditObservationKind,\n  AuditObservationLossReason,\n  recordAuditObservationLoss,\n  type AuditObservationLossMetricsRecorder,\n} from '~wildo-backend-lib/monitoring/observability/audit-observation-emission.backend';\nimport type { AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\n\nexport function recordAccessGrantTransition(params: {\n  container: Container;\n  utils: { serviceOptions?: { transaction?: unknown }; logger?: { error?: (message: string, meta: unknown) => void } };\n  transition: PlatformAccessGrantLifecycleTransition;\n  /**\n   * WHICH elevation this is. Passed rather than inferred from the row's shape: an application-wide\n   * grant carries no `organizationId`, and reading absence as scope would make a scrubbed or missing\n   * tenant id report the wider, more alarming elevation.\n   */\n  grantScope: PlatformAccessGrantScope;\n  grant: Record<string, unknown>;\n  decidedByUserId?: string;\n}): void {\n  /**\n   * The metrics recorder behind the loss counter, or `undefined` when nothing is bound.\n   *\n   * Wrapped: this runs on the observation path, so a container that throws while resolving must not\n   * be able to fail the transition. Losing the metric channel degrades the signal to its log line,\n   * which is the correct direction — an observability gap is never a reason to refuse.\n   */\n  const resolveMetricsService = (): AuditObservationLossMetricsRecorder | undefined => {\n    try {\n      if (!params.container.isBound?.(SAAS_SERVICE_TYPES.MetricsService)) return undefined;\n      return params.container.get<AuditObservationLossMetricsRecorder>(SAAS_SERVICE_TYPES.MetricsService);\n    } catch {\n      return undefined;\n    }\n  };\n\n  const reportLoss = (reason: AuditObservationLossReason, error?: unknown): void =>\n    recordAuditObservationLoss({\n      observation: AuditObservationKind.PLATFORM_ACCESS_GRANT_LIFECYCLE,\n      reason,\n      metricsService: resolveMetricsService(),\n      logger: params.utils.logger,\n      error,\n      // Names WHICH transition on WHICH grant went unrecorded, so the gap can be reconstructed from\n      // the grant row rather than being known only as \"a transition, somewhere\". The SCOPE is in the\n      // context too: a lost application-wide transition and a lost tenant one are not equally serious.\n      context: {\n        observedTransition: params.transition,\n        observedGrantScope: params.grantScope,\n        observedGrantId: String(params.grant._id ?? ''),\n        observedTargetOrganizationId: String(params.grant.organizationId ?? ''),\n      },\n    });\n\n  const emit = async (): Promise<void> => {\n    try {\n      // One report for both halves of \"the audit service cannot take this\": an unbound service and a\n      // bound service missing the method are the same loss to a reviewer, and splitting them would\n      // add a metric label nobody could act on differently.\n      if (!params.container.isBound?.(SAAS_SERVICE_TYPES.AuditLogsService)) {\n        reportLoss(AuditObservationLossReason.SERVICE_UNAVAILABLE);\n        return;\n      }\n      const auditLogsService = params.container.get<AuditLogsBackendService>(SAAS_SERVICE_TYPES.AuditLogsService);\n      if (typeof auditLogsService?.logPlatformAccessGrantLifecycle !== 'function') {\n        reportLoss(AuditObservationLossReason.SERVICE_UNAVAILABLE);\n        return;\n      }\n\n      const grant = params.grant;\n      const targetOrganizationId = String(grant.organizationId ?? '');\n      await auditLogsService.logPlatformAccessGrantLifecycle({\n        transition: params.transition,\n        grantScope: params.grantScope,\n        grantId: String(grant._id ?? ''),\n        // Omitted rather than empty for an application-wide grant: `''` would be written into the\n        // event's tenant field and read back as a tenant nobody can resolve.\n        targetOrganizationId: targetOrganizationId || undefined,\n        operatorUserId: String(grant.operatorUserId ?? ''),\n        justification: grant.justification as string | undefined,\n        resultingStatus: grant.status as PlatformAccessGrantStatus,\n        expiresAt: grant.expiresAt as Date | undefined,\n        autoApprovalReason: grant.autoApprovalReason as PlatformAccessGrantAutoApprovalReason | undefined,\n        decidedByUserId: params.decidedByUserId,\n        decisionReason: grant.decisionReason as string | undefined,\n      });\n    } catch (error) {\n      params.utils.logger?.error?.('Failed to record an access-grant lifecycle event', {\n        reason: 'platform_access_grant_lifecycle_audit_emission_failed',\n        transition: params.transition,\n        grantScope: params.grantScope,\n        error: describeCaughtError(error),\n      });\n      // The line above names ONE lost transition; this names the RATE, on the same counter every\n      // other dropped security observation lands on. `EMISSION_THREW`: this path `await`s, so a\n      // rejection and a synchronous throw arrive at the same `catch` and cannot be told apart —\n      // claiming the more specific member would be a distinction the code cannot make.\n      reportLoss(AuditObservationLossReason.EMISSION_THREW, error);\n    }\n  };\n\n  const transaction = params.utils.serviceOptions?.transaction;\n  if (transaction) {\n    registerTransactionPostCommitEffect(transaction as never, {\n      // The SCOPE is in the key. Both resources use the same transition names, so without it two\n      // grants decided in one transaction — possible for a cascade — would collide on one effect key\n      // and the second would be dropped.\n      key: `access-grant:${params.grantScope}:${params.transition}:${String(params.grant._id ?? '')}`,\n      execute: emit,\n    });\n  } else {\n    void emit();\n  }\n}\n"]}

package/dist/esm/security/authorizations/application-access-grant-custom-implementation.backend.service.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Application access grants — the five lifecycle transitions.
+ *
+ * assurance-control: WILDO.ACCESS.SEGREGATION_OF_DUTIES — the widest operator elevation is approved
+ * by a SECOND, distinct platform administrator.
+ * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE
+ *
+ * Everything structural here is the tenant resource's, reached through
+ * `access-grant-decision.factory.backend.ts` and `access-grant-lifecycle-audit.backend.ts`: the same
+ * server-authored fields, the same transition preconditions, the same post-commit audit. What is NEW
+ * is two things, and they are the whole of the unit:
+ *
+ *  1. **`requestAccess` never auto-approves.** The tenant grant auto-approves when the tenant has not
+ *     opted into approval, or cannot approve — both statements about a NAMED tenant. This grant names
+ *     none, so there is no posture to read and no circularity to break. Every row starts PENDING.
+ *  2. **`approve` refuses the requester.** {@link applicationAccessGrantApproverIsDistinct} is the
+ *     two-person rule, and it is enforced here as well as on the operation's `enabledCondition`. Two
+ *     guarantees, not one belt-and-braces: the config makes the affordance disappear, this makes the
+ *     transition impossible. Removing either alone must not admit a self-approval, and each has its
+ *     own pin.
+ */
+import type { ResourceCustomServiceImplementationFactory } from '../../base-classes/services/services/resource-operation-custom-implementation.factory.backend';
+/** The refusal token a self-approval produces. Named once so a pin can match it exactly. */
+export declare const APPLICATION_ACCESS_GRANT_SELF_APPROVAL_REFUSAL = "application_access_grant_requires_a_second_administrator";
+/**
+ * The two-person rule as a decision precondition.
+ *
+ * Exported so its pin can exercise it directly rather than through the whole operation pipeline, and
+ * so nothing can silently substitute a laxer comparison at the call site.
+ *
+ * Note the direction of the fail: `applicationAccessGrantApproverIsDistinct` returns `false` when
+ * EITHER id is missing, so an approval reaching here with no decider — a system context, a broken
+ * session — is REFUSED rather than admitted. That is deliberate; the inline `a !== b` form would
+ * admit it, because `undefined !== 'operator'` is `true`.
+ */
+export declare const refuseApplicationAccessGrantSelfApproval: (params: {
+    readonly currentObject: Record<string, unknown> | undefined;
+    readonly deciderUserId: string | undefined;
+}) => string | undefined;
+export declare function createApplicationAccessGrantFactories(): ResourceCustomServiceImplementationFactory[];
+//# sourceMappingURL=application-access-grant-custom-implementation.backend.service.d.ts.map

package/dist/esm/security/authorizations/application-access-grant-custom-implementation.backend.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"application-access-grant-custom-implementation.backend.service.d.ts","sourceRoot":"","sources":["../../../../src/security/authorizations/application-access-grant-custom-implementation.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAoBH,OAAO,KAAK,EAAE,0CAA0C,EAAE,MAAM,4GAA4G,CAAC;AAG7K,4FAA4F;AAC5F,eAAO,MAAM,8CAA8C,6DAA6D,CAAC;AAEzH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wCAAwC,GAAI,QAAQ;IAC/D,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IAC5D,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5C,KAAG,MAAM,GAAG,SAOZ,CAAC;AAEF,wBAAgB,qCAAqC,IAAI,0CAA0C,EAAE,CA8HpG"}

package/dist/esm/security/authorizations/application-access-grant-custom-implementation.backend.service.js

@@ -0,0 +1,157 @@
+/**
+ * Application access grants — the five lifecycle transitions.
+ *
+ * assurance-control: WILDO.ACCESS.SEGREGATION_OF_DUTIES — the widest operator elevation is approved
+ * by a SECOND, distinct platform administrator.
+ * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE
+ *
+ * Everything structural here is the tenant resource's, reached through
+ * `access-grant-decision.factory.backend.ts` and `access-grant-lifecycle-audit.backend.ts`: the same
+ * server-authored fields, the same transition preconditions, the same post-commit audit. What is NEW
+ * is two things, and they are the whole of the unit:
+ *
+ *  1. **`requestAccess` never auto-approves.** The tenant grant auto-approves when the tenant has not
+ *     opted into approval, or cannot approve — both statements about a NAMED tenant. This grant names
+ *     none, so there is no posture to read and no circularity to break. Every row starts PENDING.
+ *  2. **`approve` refuses the requester.** {@link applicationAccessGrantApproverIsDistinct} is the
+ *     two-person rule, and it is enforced here as well as on the operation's `enabledCondition`. Two
+ *     guarantees, not one belt-and-braces: the config makes the affordance disappear, this makes the
+ *     transition impossible. Removing either alone must not admit a self-approval, and each has its
+ *     own pin.
+ */
+import { ApplicationAccessGrants_Operations, CoreResourceType, ErrorCustomMessageReference, ErrorType, PLATFORM_ACCESS_GRANT_REVOCABLE_STATUSES, PlatformAccessGrantLifecycleTransition, PlatformAccessGrantScope, PlatformAccessGrantStatus, ResourceOperationVariantType, applicationAccessGrantApproverIsDistinct, resolveApplicationAccessGrantExpiry, } from '@wildo-ai/saas-models';
+import { recordAccessGrantTransition } from '../../security/authorizations/access-grant-lifecycle-audit.backend.js';
+import { createAccessGrantDecisionFactory } from '../../security/authorizations/access-grant-decision.factory.backend.js';
+import { createResourceCustomServiceImplementation } from '../../base-classes/services/services/resource-operation-custom-implementation.factory.backend.js';
+/** The refusal token a self-approval produces. Named once so a pin can match it exactly. */
+export const APPLICATION_ACCESS_GRANT_SELF_APPROVAL_REFUSAL = 'application_access_grant_requires_a_second_administrator';
+/**
+ * The two-person rule as a decision precondition.
+ *
+ * Exported so its pin can exercise it directly rather than through the whole operation pipeline, and
+ * so nothing can silently substitute a laxer comparison at the call site.
+ *
+ * Note the direction of the fail: `applicationAccessGrantApproverIsDistinct` returns `false` when
+ * EITHER id is missing, so an approval reaching here with no decider — a system context, a broken
+ * session — is REFUSED rather than admitted. That is deliberate; the inline `a !== b` form would
+ * admit it, because `undefined !== 'operator'` is `true`.
+ */
+export const refuseApplicationAccessGrantSelfApproval = (params) => (applicationAccessGrantApproverIsDistinct({
+    operatorUserId: params.currentObject?.operatorUserId,
+    approverUserId: params.deciderUserId,
+})
+    ? undefined
+    : APPLICATION_ACCESS_GRANT_SELF_APPROVAL_REFUSAL);
+export function createApplicationAccessGrantFactories() {
+    /**
+     * REQUEST — the bootstrap verb, and the only one reachable without an existing grant.
+     *
+     * The admission gate exempts this whole resource, because an operator would otherwise need an
+     * application-wide grant in order to ask for one. What keeps the exemption safe is the tenant
+     * resource's own argument: requesting is not accessing. This writes one PENDING row and reads
+     * nothing; the blast radius of an abused request is an entry in a queue somebody else must sign.
+     */
+    const requestAccessFactory = (_resourcesRegistryService, container) => createResourceCustomServiceImplementation({
+        operationPath: {
+            resourceIdentifier: CoreResourceType.APPLICATION_ACCESS_GRANTS,
+            operationIdentifier: ApplicationAccessGrants_Operations.REQUEST_ACCESS,
+            variantType: ResourceOperationVariantType.API_CALL,
+            isOperationDefault: true,
+        },
+        debugLabel: 'application-access-grants.request-access.api',
+        // Every one of these is `.excludeFromCreate()`, so the strict request DTO drops whatever a caller
+        // sent and the prefix's value is authoritative. Declaring them makes that explicit rather than
+        // inferred — the inference has a hole for callers that reach the service tier with the key already
+        // present (MCP `callTool` forwards arguments unparsed), and here a caller choosing their own
+        // `status` would mint an ACTIVE application-wide elevation with no second signature at all.
+        authoritativeFields: ['operatorUserId', 'status', 'expiresAt', 'approvedByUserId', 'approvedAt'],
+        transactionalCore: true,
+        // A request writes only the grant row, which the operation resource contributes automatically.
+        // Declared explicitly (even as empty) because startup proves adapter compatibility for what is
+        // declared and cannot detect an omission.
+        transactionParticipants: {},
+        handlers: {
+            prefixCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {
+                const payload = input;
+                const operatorUserId = executionContext.initiatorIds?.userId;
+                if (!operatorUserId) {
+                    throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {
+                        customMessageReference: ErrorCustomMessageReference.VALIDATION,
+                        context: { reason: 'application_access_grant_requires_an_operator' },
+                    });
+                }
+                return {
+                    // Server-authored from the session, never the body — the field that says WHOSE elevation
+                    // this is, and therefore whom the approver may not be.
+                    operatorUserId,
+                    applicationId: executionContext.initiatorIds?.applicationId,
+                    justification: payload.justification,
+                    // PENDING, always. There is no auto-approval member here and no branch that could reach
+                    // ACTIVE: the only writer of ACTIVE is `approve`, and `approve` refuses this same user.
+                    status: PlatformAccessGrantStatus.PENDING_APPROVAL,
+                    expiresAt: resolveApplicationAccessGrantExpiry(payload.requestedDurationMinutes, new Date()),
+                };
+            },
+            postfixCoreOperations: async (_id, createdGrant, _executionContext, _operationPath, utils) => {
+                recordAccessGrantTransition({
+                    container,
+                    utils,
+                    grantScope: PlatformAccessGrantScope.APPLICATION_WIDE,
+                    transition: PlatformAccessGrantLifecycleTransition.REQUESTED,
+                    grant: (createdGrant ?? {}),
+                });
+                return createdGrant;
+            },
+        },
+    });
+    const makeDecisionFactory = (operationIdentifier, options) => createAccessGrantDecisionFactory(CoreResourceType.APPLICATION_ACCESS_GRANTS, PlatformAccessGrantScope.APPLICATION_WIDE, operationIdentifier, options);
+    return [
+        requestAccessFactory,
+        makeDecisionFactory(ApplicationAccessGrants_Operations.APPROVE, {
+            debugLabel: 'application-access-grants.approve.api',
+            auditTransition: PlatformAccessGrantLifecycleTransition.APPROVED,
+            nextStatus: PlatformAccessGrantStatus.ACTIVE,
+            permittedFrom: [PlatformAccessGrantStatus.PENDING_APPROVAL],
+            stampsApprover: true,
+            transitionRefusalReason: 'application_access_grant_transition_not_permitted_from_current_status',
+            // THE two-person rule. Everything else in this file exists on the tenant resource too.
+            additionalPrecondition: refuseApplicationAccessGrantSelfApproval,
+        }),
+        makeDecisionFactory(ApplicationAccessGrants_Operations.DENY, {
+            debugLabel: 'application-access-grants.deny.api',
+            auditTransition: PlatformAccessGrantLifecycleTransition.DENIED,
+            nextStatus: PlatformAccessGrantStatus.DENIED,
+            permittedFrom: [PlatformAccessGrantStatus.PENDING_APPROVAL],
+            stampsApprover: false,
+            transitionRefusalReason: 'application_access_grant_transition_not_permitted_from_current_status',
+            // No same-person refusal, deliberately. An operator thinking better of their own request should
+            // be able to withdraw it; the two-person rule constrains what an operator can GRANT themselves,
+            // never what they can refuse themselves.
+        }),
+        makeDecisionFactory(ApplicationAccessGrants_Operations.REVOKE, {
+            debugLabel: 'application-access-grants.revoke.api',
+            auditTransition: PlatformAccessGrantLifecycleTransition.REVOKED,
+            nextStatus: PlatformAccessGrantStatus.REVOKED,
+            // Both a pending request and a live elevation can be withdrawn; a terminal one cannot be
+            // re-terminated, which would rewrite the decision history.
+            permittedFrom: PLATFORM_ACCESS_GRANT_REVOCABLE_STATUSES,
+            stampsApprover: false,
+            transitionRefusalReason: 'application_access_grant_transition_not_permitted_from_current_status',
+        }),
+        /**
+         * The one transition with no human actor. Permitted from ACTIVE alone: a grant that was DENIED or
+         * REVOKED is terminal and must keep saying which, because relabelling it EXPIRED would rewrite the
+         * decision history an audit reads.
+         */
+        makeDecisionFactory(ApplicationAccessGrants_Operations.EXPIRE, {
+            debugLabel: 'application-access-grants.expire.internal',
+            auditTransition: PlatformAccessGrantLifecycleTransition.EXPIRED,
+            nextStatus: PlatformAccessGrantStatus.EXPIRED,
+            permittedFrom: [PlatformAccessGrantStatus.ACTIVE],
+            stampsApprover: false,
+            transitionRefusalReason: 'application_access_grant_transition_not_permitted_from_current_status',
+            variantType: ResourceOperationVariantType.INTERNAL_CALL,
+        }),
+    ];
+}
+//# sourceMappingURL=application-access-grant-custom-implementation.backend.service.js.map

package/dist/esm/security/authorizations/application-access-grant-custom-implementation.backend.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"application-access-grant-custom-implementation.backend.service.js","sourceRoot":"","sources":["../../../../src/security/authorizations/application-access-grant-custom-implementation.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,EACL,kCAAkC,EAClC,gBAAgB,EAChB,2BAA2B,EAC3B,SAAS,EACT,wCAAwC,EACxC,sCAAsC,EACtC,wBAAwB,EACxB,yBAAyB,EACzB,4BAA4B,EAC5B,wCAAwC,EACxC,mCAAmC,GACpC,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,2BAA2B,EAAE,MAAM,iFAAiF,CAAC;AAC9H,OAAO,EAAE,gCAAgC,EAAE,MAAM,kFAAkF,CAAC;AACpI,OAAO,EAAE,yCAAyC,EAAE,MAAM,4GAA4G,CAAC;AAIvK,4FAA4F;AAC5F,MAAM,CAAC,MAAM,8CAA8C,GAAG,0DAA0D,CAAC;AAEzH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,MAGxD,EAAsB,EAAE,CAAC,CACxB,wCAAwC,CAAC;IACvC,cAAc,EAAE,MAAM,CAAC,aAAa,EAAE,cAAoC;IAC1E,cAAc,EAAE,MAAM,CAAC,aAAa;CACrC,CAAC;IACA,CAAC,CAAC,SAAS;IACX,CAAC,CAAC,8CAA8C,CACnD,CAAC;AAEF,MAAM,UAAU,qCAAqC;IACnD;;;;;;;OAOG;IACH,MAAM,oBAAoB,GAAG,CAC3B,yBAA0D,EAC1D,SAAoB,EACpB,EAAE,CAAC,yCAAyC,CAAC;QAC7C,aAAa,EAAE;YACb,kBAAkB,EAAE,gBAAgB,CAAC,yBAAyB;YAC9D,mBAAmB,EAAE,kCAAkC,CAAC,cAAc;YACtE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;YAClD,kBAAkB,EAAE,IAAI;SACzB;QACD,UAAU,EAAE,8CAA8C;QAC1D,kGAAkG;QAClG,+FAA+F;QAC/F,mGAAmG;QACnG,6FAA6F;QAC7F,4FAA4F;QAC5F,mBAAmB,EAAE,CAAC,gBAAgB,EAAE,QAAQ,EAAE,WAAW,EAAE,kBAAkB,EAAE,YAAY,CAAC;QAChG,iBAAiB,EAAE,IAAI;QACvB,+FAA+F;QAC/F,+FAA+F;QAC/F,0CAA0C;QAC1C,uBAAuB,EAAE,EAAE;QAC3B,QAAQ,EAAE;YACR,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;gBAClF,MAAM,OAAO,GAAG,KAAsE,CAAC;gBACvF,MAAM,cAAc,GAAG,gBAAgB,CAAC,YAAY,EAAE,MAAM,CAAC;gBAE7D,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;wBAC1E,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;wBAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,+CAA+C,EAAE;qBACrE,CAAC,CAAC;gBACL,CAAC;gBAED,OAAO;oBACL,yFAAyF;oBACzF,uDAAuD;oBACvD,cAAc;oBACd,aAAa,EAAE,gBAAgB,CAAC,YAAY,EAAE,aAAa;oBAC3D,aAAa,EAAE,OAAO,CAAC,aAAa;oBACpC,wFAAwF;oBACxF,wFAAwF;oBACxF,MAAM,EAAE,yBAAyB,CAAC,gBAAgB;oBAClD,SAAS,EAAE,mCAAmC,CAAC,OAAO,CAAC,wBAAwB,EAAE,IAAI,IAAI,EAAE,CAAC;iBAC7F,CAAC;YACJ,CAAC;YACD,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;gBAC3F,2BAA2B,CAAC;oBAC1B,SAAS;oBACT,KAAK;oBACL,UAAU,EAAE,wBAAwB,CAAC,gBAAgB;oBACrD,UAAU,EAAE,sCAAsC,CAAC,SAAS;oBAC5D,KAAK,EAAE,CAAC,YAAY,IAAI,EAAE,CAA4B;iBACvD,CAAC,CAAC;gBACH,OAAO,YAAY,CAAC;YACtB,CAAC;SACF;KACF,CAAC,CAAC;IAEH,MAAM,mBAAmB,GAAG,CAC1B,mBAAuD,EACvD,OAA+D,EACnB,EAAE,CAAC,gCAAgC,CAC/E,gBAAgB,CAAC,yBAAyB,EAC1C,wBAAwB,CAAC,gBAAgB,EACzC,mBAAmB,EACnB,OAAO,CACR,CAAC;IAEF,OAAO;QACL,oBAAoB;QACpB,mBAAmB,CAAC,kCAAkC,CAAC,OAAO,EAAE;YAC9D,UAAU,EAAE,uCAAuC;YACnD,eAAe,EAAE,sCAAsC,CAAC,QAAQ;YAChE,UAAU,EAAE,yBAAyB,CAAC,MAAM;YAC5C,aAAa,EAAE,CAAC,yBAAyB,CAAC,gBAAgB,CAAC;YAC3D,cAAc,EAAE,IAAI;YACpB,uBAAuB,EAAE,uEAAuE;YAChG,uFAAuF;YACvF,sBAAsB,EAAE,wCAAwC;SACjE,CAAC;QACF,mBAAmB,CAAC,kCAAkC,CAAC,IAAI,EAAE;YAC3D,UAAU,EAAE,oCAAoC;YAChD,eAAe,EAAE,sCAAsC,CAAC,MAAM;YAC9D,UAAU,EAAE,yBAAyB,CAAC,MAAM;YAC5C,aAAa,EAAE,CAAC,yBAAyB,CAAC,gBAAgB,CAAC;YAC3D,cAAc,EAAE,KAAK;YACrB,uBAAuB,EAAE,uEAAuE;YAChG,gGAAgG;YAChG,gGAAgG;YAChG,yCAAyC;SAC1C,CAAC;QACF,mBAAmB,CAAC,kCAAkC,CAAC,MAAM,EAAE;YAC7D,UAAU,EAAE,sCAAsC;YAClD,eAAe,EAAE,sCAAsC,CAAC,OAAO;YAC/D,UAAU,EAAE,yBAAyB,CAAC,OAAO;YAC7C,yFAAyF;YACzF,2DAA2D;YAC3D,aAAa,EAAE,wCAAwC;YACvD,cAAc,EAAE,KAAK;YACrB,uBAAuB,EAAE,uEAAuE;SACjG,CAAC;QACF;;;;WAIG;QACH,mBAAmB,CAAC,kCAAkC,CAAC,MAAM,EAAE;YAC7D,UAAU,EAAE,2CAA2C;YACvD,eAAe,EAAE,sCAAsC,CAAC,OAAO;YAC/D,UAAU,EAAE,yBAAyB,CAAC,OAAO;YAC7C,aAAa,EAAE,CAAC,yBAAyB,CAAC,MAAM,CAAC;YACjD,cAAc,EAAE,KAAK;YACrB,uBAAuB,EAAE,uEAAuE;YAChG,WAAW,EAAE,4BAA4B,CAAC,aAAa;SACxD,CAAC;KACH,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Application access grants — the five lifecycle transitions.\n *\n * assurance-control: WILDO.ACCESS.SEGREGATION_OF_DUTIES — the widest operator elevation is approved\n * by a SECOND, distinct platform administrator.\n * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n *\n * Everything structural here is the tenant resource's, reached through\n * `access-grant-decision.factory.backend.ts` and `access-grant-lifecycle-audit.backend.ts`: the same\n * server-authored fields, the same transition preconditions, the same post-commit audit. What is NEW\n * is two things, and they are the whole of the unit:\n *\n *  1. **`requestAccess` never auto-approves.** The tenant grant auto-approves when the tenant has not\n *     opted into approval, or cannot approve — both statements about a NAMED tenant. This grant names\n *     none, so there is no posture to read and no circularity to break. Every row starts PENDING.\n *  2. **`approve` refuses the requester.** {@link applicationAccessGrantApproverIsDistinct} is the\n *     two-person rule, and it is enforced here as well as on the operation's `enabledCondition`. Two\n *     guarantees, not one belt-and-braces: the config makes the affordance disappear, this makes the\n *     transition impossible. Removing either alone must not admit a self-approval, and each has its\n *     own pin.\n */\n\nimport type { Container } from 'inversify';\nimport {\n  ApplicationAccessGrants_Operations,\n  CoreResourceType,\n  ErrorCustomMessageReference,\n  ErrorType,\n  PLATFORM_ACCESS_GRANT_REVOCABLE_STATUSES,\n  PlatformAccessGrantLifecycleTransition,\n  PlatformAccessGrantScope,\n  PlatformAccessGrantStatus,\n  ResourceOperationVariantType,\n  applicationAccessGrantApproverIsDistinct,\n  resolveApplicationAccessGrantExpiry,\n} from '@wildo-ai/saas-models';\n\nimport { recordAccessGrantTransition } from '~wildo-backend-lib/security/authorizations/access-grant-lifecycle-audit.backend';\nimport { createAccessGrantDecisionFactory } from '~wildo-backend-lib/security/authorizations/access-grant-decision.factory.backend';\nimport { createResourceCustomServiceImplementation } from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation.factory.backend';\nimport type { ResourceCustomServiceImplementationFactory } from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation.factory.backend';\nimport type { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\n\n/** The refusal token a self-approval produces. Named once so a pin can match it exactly. */\nexport const APPLICATION_ACCESS_GRANT_SELF_APPROVAL_REFUSAL = 'application_access_grant_requires_a_second_administrator';\n\n/**\n * The two-person rule as a decision precondition.\n *\n * Exported so its pin can exercise it directly rather than through the whole operation pipeline, and\n * so nothing can silently substitute a laxer comparison at the call site.\n *\n * Note the direction of the fail: `applicationAccessGrantApproverIsDistinct` returns `false` when\n * EITHER id is missing, so an approval reaching here with no decider — a system context, a broken\n * session — is REFUSED rather than admitted. That is deliberate; the inline `a !== b` form would\n * admit it, because `undefined !== 'operator'` is `true`.\n */\nexport const refuseApplicationAccessGrantSelfApproval = (params: {\n  readonly currentObject: Record<string, unknown> | undefined;\n  readonly deciderUserId: string | undefined;\n}): string | undefined => (\n  applicationAccessGrantApproverIsDistinct({\n    operatorUserId: params.currentObject?.operatorUserId as string | undefined,\n    approverUserId: params.deciderUserId,\n  })\n    ? undefined\n    : APPLICATION_ACCESS_GRANT_SELF_APPROVAL_REFUSAL\n);\n\nexport function createApplicationAccessGrantFactories(): ResourceCustomServiceImplementationFactory[] {\n  /**\n   * REQUEST — the bootstrap verb, and the only one reachable without an existing grant.\n   *\n   * The admission gate exempts this whole resource, because an operator would otherwise need an\n   * application-wide grant in order to ask for one. What keeps the exemption safe is the tenant\n   * resource's own argument: requesting is not accessing. This writes one PENDING row and reads\n   * nothing; the blast radius of an abused request is an entry in a queue somebody else must sign.\n   */\n  const requestAccessFactory = (\n    _resourcesRegistryService: ResourcesRegistryBackendService,\n    container: Container,\n  ) => createResourceCustomServiceImplementation({\n    operationPath: {\n      resourceIdentifier: CoreResourceType.APPLICATION_ACCESS_GRANTS,\n      operationIdentifier: ApplicationAccessGrants_Operations.REQUEST_ACCESS,\n      variantType: ResourceOperationVariantType.API_CALL,\n      isOperationDefault: true,\n    },\n    debugLabel: 'application-access-grants.request-access.api',\n    // Every one of these is `.excludeFromCreate()`, so the strict request DTO drops whatever a caller\n    // sent and the prefix's value is authoritative. Declaring them makes that explicit rather than\n    // inferred — the inference has a hole for callers that reach the service tier with the key already\n    // present (MCP `callTool` forwards arguments unparsed), and here a caller choosing their own\n    // `status` would mint an ACTIVE application-wide elevation with no second signature at all.\n    authoritativeFields: ['operatorUserId', 'status', 'expiresAt', 'approvedByUserId', 'approvedAt'],\n    transactionalCore: true,\n    // A request writes only the grant row, which the operation resource contributes automatically.\n    // Declared explicitly (even as empty) because startup proves adapter compatibility for what is\n    // declared and cannot detect an omission.\n    transactionParticipants: {},\n    handlers: {\n      prefixCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {\n        const payload = input as { justification?: string; requestedDurationMinutes?: number };\n        const operatorUserId = executionContext.initiatorIds?.userId;\n\n        if (!operatorUserId) {\n          throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n            customMessageReference: ErrorCustomMessageReference.VALIDATION,\n            context: { reason: 'application_access_grant_requires_an_operator' },\n          });\n        }\n\n        return {\n          // Server-authored from the session, never the body — the field that says WHOSE elevation\n          // this is, and therefore whom the approver may not be.\n          operatorUserId,\n          applicationId: executionContext.initiatorIds?.applicationId,\n          justification: payload.justification,\n          // PENDING, always. There is no auto-approval member here and no branch that could reach\n          // ACTIVE: the only writer of ACTIVE is `approve`, and `approve` refuses this same user.\n          status: PlatformAccessGrantStatus.PENDING_APPROVAL,\n          expiresAt: resolveApplicationAccessGrantExpiry(payload.requestedDurationMinutes, new Date()),\n        };\n      },\n      postfixCoreOperations: async (_id, createdGrant, _executionContext, _operationPath, utils) => {\n        recordAccessGrantTransition({\n          container,\n          utils,\n          grantScope: PlatformAccessGrantScope.APPLICATION_WIDE,\n          transition: PlatformAccessGrantLifecycleTransition.REQUESTED,\n          grant: (createdGrant ?? {}) as Record<string, unknown>,\n        });\n        return createdGrant;\n      },\n    },\n  });\n\n  const makeDecisionFactory = (\n    operationIdentifier: ApplicationAccessGrants_Operations,\n    options: Parameters<typeof createAccessGrantDecisionFactory>[3],\n  ): ResourceCustomServiceImplementationFactory => createAccessGrantDecisionFactory(\n    CoreResourceType.APPLICATION_ACCESS_GRANTS,\n    PlatformAccessGrantScope.APPLICATION_WIDE,\n    operationIdentifier,\n    options,\n  );\n\n  return [\n    requestAccessFactory,\n    makeDecisionFactory(ApplicationAccessGrants_Operations.APPROVE, {\n      debugLabel: 'application-access-grants.approve.api',\n      auditTransition: PlatformAccessGrantLifecycleTransition.APPROVED,\n      nextStatus: PlatformAccessGrantStatus.ACTIVE,\n      permittedFrom: [PlatformAccessGrantStatus.PENDING_APPROVAL],\n      stampsApprover: true,\n      transitionRefusalReason: 'application_access_grant_transition_not_permitted_from_current_status',\n      // THE two-person rule. Everything else in this file exists on the tenant resource too.\n      additionalPrecondition: refuseApplicationAccessGrantSelfApproval,\n    }),\n    makeDecisionFactory(ApplicationAccessGrants_Operations.DENY, {\n      debugLabel: 'application-access-grants.deny.api',\n      auditTransition: PlatformAccessGrantLifecycleTransition.DENIED,\n      nextStatus: PlatformAccessGrantStatus.DENIED,\n      permittedFrom: [PlatformAccessGrantStatus.PENDING_APPROVAL],\n      stampsApprover: false,\n      transitionRefusalReason: 'application_access_grant_transition_not_permitted_from_current_status',\n      // No same-person refusal, deliberately. An operator thinking better of their own request should\n      // be able to withdraw it; the two-person rule constrains what an operator can GRANT themselves,\n      // never what they can refuse themselves.\n    }),\n    makeDecisionFactory(ApplicationAccessGrants_Operations.REVOKE, {\n      debugLabel: 'application-access-grants.revoke.api',\n      auditTransition: PlatformAccessGrantLifecycleTransition.REVOKED,\n      nextStatus: PlatformAccessGrantStatus.REVOKED,\n      // Both a pending request and a live elevation can be withdrawn; a terminal one cannot be\n      // re-terminated, which would rewrite the decision history.\n      permittedFrom: PLATFORM_ACCESS_GRANT_REVOCABLE_STATUSES,\n      stampsApprover: false,\n      transitionRefusalReason: 'application_access_grant_transition_not_permitted_from_current_status',\n    }),\n    /**\n     * The one transition with no human actor. Permitted from ACTIVE alone: a grant that was DENIED or\n     * REVOKED is terminal and must keep saying which, because relabelling it EXPIRED would rewrite the\n     * decision history an audit reads.\n     */\n    makeDecisionFactory(ApplicationAccessGrants_Operations.EXPIRE, {\n      debugLabel: 'application-access-grants.expire.internal',\n      auditTransition: PlatformAccessGrantLifecycleTransition.EXPIRED,\n      nextStatus: PlatformAccessGrantStatus.EXPIRED,\n      permittedFrom: [PlatformAccessGrantStatus.ACTIVE],\n      stampsApprover: false,\n      transitionRefusalReason: 'application_access_grant_transition_not_permitted_from_current_status',\n      variantType: ResourceOperationVariantType.INTERNAL_CALL,\n    }),\n  ];\n}\n"]}

package/dist/esm/security/authorizations/application-wide-read-admission.backend.d.ts

@@ -0,0 +1,84 @@
+/**
+ * # Which reads require an APPLICATION-WIDE elevation
+ *
+ * assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — a read that spans every tenant is
+ * admitted only under a requested, justified, time-bound, second-signed grant.
+ * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE
+ *
+ * ## The inversion this closes
+ *
+ * Measured 2026-09-09. A PER-ROW crossing into ONE tenant required a usable `platformAccessGrants`
+ * row: requested, justified, approved by that tenant, and expiring on its own. The APPLICATION-WIDE
+ * read — the whole user directory, the whole cross-tenant audit trail — required nothing but an
+ * administrator role, and sat at a LOWER role tier. The narrow act carried elevation and expiry; the
+ * widest read did not.
+ *
+ * ## The rule, stated once
+ *
+ * > **A read that this deployment can already SEE as application-wide requires an application-wide
+ * > grant.**
+ *
+ * "Can already see" is not a new judgement. Two authorities already answer it, and they are the two
+ * that decide what the audit trail RECORDS:
+ *
+ * | authority | the population it names | the evidence it produces |
+ * |---|---|---|
+ * | {@link isUnconfinedScopeRootDirectoryRead} | a scope-root collection read the confinement authority declines to confine | `PLATFORM_DIRECTORY_ACCESS` |
+ * | {@link isObservedCrossTenantRead} | a DECLARED cross-tenant read on an APPLICATION-scoped resource | `CROSS_TENANT_ADMINISTRATIVE_ACCESS` |
+ *
+ * **This module composes those two and adds no third derivation.** That is the point rather than an
+ * economy: the admission and the observation must agree about which reads are in scope, or the trail
+ * records elevations the gate never required (or, worse, the gate refuses reads the trail says
+ * nothing about). `.claude/rules/invariant-call-site-enumeration.md` is a catalogue of what a second
+ * look-alike derivation of one predicate costs.
+ *
+ * ## What it deliberately does NOT gate
+ *
+ * **The per-row tenant crossing.** That door already works — a usable `platformAccessGrants` row,
+ * scoped to the named tenant, approved by that tenant where the tenant opted in. Requiring an
+ * application-wide grant there too would replace a customer-approvable control with a
+ * platform-internal one, which is a step DOWN the ladder in
+ * `.claude/rules/administrative-continuity-floors.md`. The finding says so in as many words: do not
+ * weaken the per-row model to make the two symmetric.
+ *
+ * **The grant resources themselves.** An operator would otherwise need an application-wide grant in
+ * order to ask for one, and the second administrator would need one in order to sign. Both grant
+ * resources are exempt WHOLESALE rather than per verb, and that is wider than the tenant resource's
+ * `requestAccess`-only exemption on purpose: `applicationAccessGrants` is APPLICATION-scoped, so its
+ * own `list` — the pending queue a second administrator works from — is a scope-root-adjacent
+ * application-tier read, and gating the queue on a grant would make the approval flow unreachable.
+ * The exemption is safe for the same reason the tenant one is: these rows are the elevation LEDGER,
+ * they belong to no tenant, and reading them discloses no customer's data.
+ *
+ * **An exempt execution type.** Both underlying authorities already skip
+ * `INTERNALLY_INITIATED_REQUEST` and `WEBHOOK_CALLBACK`; gating a batch, a cron, a cascade or a
+ * verified webhook on a human's elevation would fail closed on every sweep in the system. Inherited
+ * rather than restated, so the three answers cannot drift.
+ */
+import { CoreResourceOperation } from '@wildo-ai/saas-models';
+import { type ScopeRootCollectionConfinementSignal } from '../../security/authorizations/scope-root-collection-confinement.backend';
+import { type CrossTenantReadObservationOperation } from '../../security/authorizations/cross-tenant-read-observation.backend';
+/** What this authority needs from the resource configuration. Deliberately narrow, like its siblings. */
+export interface ApplicationWideReadAdmissionResource {
+    readonly resourceIdentifier?: string;
+    readonly resourcePrimaryScope?: string;
+}
+/**
+ * Does this read reach application-wide, and therefore owe an application-wide elevation?
+ *
+ * Returns `false` for everything else, which is the overwhelming majority of reads — the two
+ * authorities it composes are both narrow by construction, so a caller pays two boolean checks and a
+ * set lookup on the ordinary path.
+ */
+export declare function readRequiresApplicationWideGrant(params: {
+    readonly executionContext: ScopeRootCollectionConfinementSignal;
+    /**
+     * The EXECUTED operation variant. Passed explicitly for the reason the observation authority
+     * documents: a resource authors ONE variant per operation and the config factory derives `summary`
+     * and `context` variants from it, so "the operation" is ambiguous unless the executed one is named.
+     */
+    readonly operation: CrossTenantReadObservationOperation | undefined;
+    readonly resourceConfiguration: ApplicationWideReadAdmissionResource;
+    readonly executedCoreOperation: CoreResourceOperation | undefined;
+}): boolean;
+//# sourceMappingURL=application-wide-read-admission.backend.d.ts.map

package/dist/esm/security/authorizations/application-wide-read-admission.backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"application-wide-read-admission.backend.d.ts","sourceRoot":"","sources":["../../../../src/security/authorizations/application-wide-read-admission.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAEH,OAAO,EACL,qBAAqB,EAEtB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAEL,KAAK,oCAAoC,EAC1C,MAAM,sFAAsF,CAAC;AAC9F,OAAO,EAEL,KAAK,mCAAmC,EACzC,MAAM,kFAAkF,CAAC;AAc1F,yGAAyG;AACzG,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC;AAED;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAAC,MAAM,EAAE;IACvD,QAAQ,CAAC,gBAAgB,EAAE,oCAAoC,CAAC;IAChE;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,mCAAmC,GAAG,SAAS,CAAC;IACpE,QAAQ,CAAC,qBAAqB,EAAE,oCAAoC,CAAC;IACrE,QAAQ,CAAC,qBAAqB,EAAE,qBAAqB,GAAG,SAAS,CAAC;CACnE,GAAG,OAAO,CAoBV"}

package/dist/esm/security/authorizations/application-wide-read-admission.backend.js

@@ -0,0 +1,99 @@
+/**
+ * # Which reads require an APPLICATION-WIDE elevation
+ *
+ * assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — a read that spans every tenant is
+ * admitted only under a requested, justified, time-bound, second-signed grant.
+ * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE
+ *
+ * ## The inversion this closes
+ *
+ * Measured 2026-09-09. A PER-ROW crossing into ONE tenant required a usable `platformAccessGrants`
+ * row: requested, justified, approved by that tenant, and expiring on its own. The APPLICATION-WIDE
+ * read — the whole user directory, the whole cross-tenant audit trail — required nothing but an
+ * administrator role, and sat at a LOWER role tier. The narrow act carried elevation and expiry; the
+ * widest read did not.
+ *
+ * ## The rule, stated once
+ *
+ * > **A read that this deployment can already SEE as application-wide requires an application-wide
+ * > grant.**
+ *
+ * "Can already see" is not a new judgement. Two authorities already answer it, and they are the two
+ * that decide what the audit trail RECORDS:
+ *
+ * | authority | the population it names | the evidence it produces |
+ * |---|---|---|
+ * | {@link isUnconfinedScopeRootDirectoryRead} | a scope-root collection read the confinement authority declines to confine | `PLATFORM_DIRECTORY_ACCESS` |
+ * | {@link isObservedCrossTenantRead} | a DECLARED cross-tenant read on an APPLICATION-scoped resource | `CROSS_TENANT_ADMINISTRATIVE_ACCESS` |
+ *
+ * **This module composes those two and adds no third derivation.** That is the point rather than an
+ * economy: the admission and the observation must agree about which reads are in scope, or the trail
+ * records elevations the gate never required (or, worse, the gate refuses reads the trail says
+ * nothing about). `.claude/rules/invariant-call-site-enumeration.md` is a catalogue of what a second
+ * look-alike derivation of one predicate costs.
+ *
+ * ## What it deliberately does NOT gate
+ *
+ * **The per-row tenant crossing.** That door already works — a usable `platformAccessGrants` row,
+ * scoped to the named tenant, approved by that tenant where the tenant opted in. Requiring an
+ * application-wide grant there too would replace a customer-approvable control with a
+ * platform-internal one, which is a step DOWN the ladder in
+ * `.claude/rules/administrative-continuity-floors.md`. The finding says so in as many words: do not
+ * weaken the per-row model to make the two symmetric.
+ *
+ * **The grant resources themselves.** An operator would otherwise need an application-wide grant in
+ * order to ask for one, and the second administrator would need one in order to sign. Both grant
+ * resources are exempt WHOLESALE rather than per verb, and that is wider than the tenant resource's
+ * `requestAccess`-only exemption on purpose: `applicationAccessGrants` is APPLICATION-scoped, so its
+ * own `list` — the pending queue a second administrator works from — is a scope-root-adjacent
+ * application-tier read, and gating the queue on a grant would make the approval flow unreachable.
+ * The exemption is safe for the same reason the tenant one is: these rows are the elevation LEDGER,
+ * they belong to no tenant, and reading them discloses no customer's data.
+ *
+ * **An exempt execution type.** Both underlying authorities already skip
+ * `INTERNALLY_INITIATED_REQUEST` and `WEBHOOK_CALLBACK`; gating a batch, a cron, a cascade or a
+ * verified webhook on a human's elevation would fail closed on every sweep in the system. Inherited
+ * rather than restated, so the three answers cannot drift.
+ */
+import { CoreResourceType, } from '@wildo-ai/saas-models';
+import { isUnconfinedScopeRootDirectoryRead, } from '../../security/authorizations/scope-root-collection-confinement.backend.js';
+import { isObservedCrossTenantRead, } from '../../security/authorizations/cross-tenant-read-observation.backend.js';
+/**
+ * The elevation LEDGER itself — never gated on an elevation.
+ *
+ * A set rather than two comparisons so the enumeration is readable, and so a third grant resource (a
+ * future scope) is added in one place instead of being discovered by an operator who cannot request
+ * access to request access.
+ */
+const ACCESS_GRANT_LEDGER_RESOURCES = Object.freeze([
+    String(CoreResourceType.PLATFORM_ACCESS_GRANTS),
+    String(CoreResourceType.APPLICATION_ACCESS_GRANTS),
+]);
+/**
+ * Does this read reach application-wide, and therefore owe an application-wide elevation?
+ *
+ * Returns `false` for everything else, which is the overwhelming majority of reads — the two
+ * authorities it composes are both narrow by construction, so a caller pays two boolean checks and a
+ * set lookup on the ordinary path.
+ */
+export function readRequiresApplicationWideGrant(params) {
+    // The ledger is exempt WHOLESALE — see the module JSDoc. Checked FIRST so no later branch can make
+    // the approval flow unreachable.
+    if (ACCESS_GRANT_LEDGER_RESOURCES.includes(String(params.resourceConfiguration.resourceIdentifier ?? ''))) {
+        return false;
+    }
+    // Composed, never re-derived. Either authority answering `true` is an application-wide read.
+    if (isUnconfinedScopeRootDirectoryRead({
+        executionContext: params.executionContext,
+        resourceConfiguration: params.resourceConfiguration,
+        executedCoreOperation: params.executedCoreOperation,
+    }))
+        return true;
+    return isObservedCrossTenantRead({
+        executionContext: params.executionContext,
+        operation: params.operation,
+        resourceConfiguration: params.resourceConfiguration,
+        executedCoreOperation: params.executedCoreOperation,
+    });
+}
+//# sourceMappingURL=application-wide-read-admission.backend.js.map

package/dist/esm/security/authorizations/application-wide-read-admission.backend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"application-wide-read-admission.backend.js","sourceRoot":"","sources":["../../../../src/security/authorizations/application-wide-read-admission.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAEH,OAAO,EAEL,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,kCAAkC,GAEnC,MAAM,sFAAsF,CAAC;AAC9F,OAAO,EACL,yBAAyB,GAE1B,MAAM,kFAAkF,CAAC;AAE1F;;;;;;GAMG;AACH,MAAM,6BAA6B,GAAsB,MAAM,CAAC,MAAM,CAAC;IACrE,MAAM,CAAC,gBAAgB,CAAC,sBAAsB,CAAC;IAC/C,MAAM,CAAC,gBAAgB,CAAC,yBAAyB,CAAC;CACnD,CAAC,CAAC;AAQH;;;;;;GAMG;AACH,MAAM,UAAU,gCAAgC,CAAC,MAUhD;IACC,mGAAmG;IACnG,iCAAiC;IACjC,IAAI,6BAA6B,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QAC1G,OAAO,KAAK,CAAC;IACf,CAAC;IAED,6FAA6F;IAC7F,IAAI,kCAAkC,CAAC;QACrC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;QACnD,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;KACpD,CAAC;QAAE,OAAO,IAAI,CAAC;IAEhB,OAAO,yBAAyB,CAAC;QAC/B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;QACnD,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;KACpD,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * # Which reads require an APPLICATION-WIDE elevation\n *\n * assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — a read that spans every tenant is\n * admitted only under a requested, justified, time-bound, second-signed grant.\n * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE\n *\n * ## The inversion this closes\n *\n * Measured 2026-09-09. A PER-ROW crossing into ONE tenant required a usable `platformAccessGrants`\n * row: requested, justified, approved by that tenant, and expiring on its own. The APPLICATION-WIDE\n * read — the whole user directory, the whole cross-tenant audit trail — required nothing but an\n * administrator role, and sat at a LOWER role tier. The narrow act carried elevation and expiry; the\n * widest read did not.\n *\n * ## The rule, stated once\n *\n * > **A read that this deployment can already SEE as application-wide requires an application-wide\n * > grant.**\n *\n * \"Can already see\" is not a new judgement. Two authorities already answer it, and they are the two\n * that decide what the audit trail RECORDS:\n *\n * | authority | the population it names | the evidence it produces |\n * |---|---|---|\n * | {@link isUnconfinedScopeRootDirectoryRead} | a scope-root collection read the confinement authority declines to confine | `PLATFORM_DIRECTORY_ACCESS` |\n * | {@link isObservedCrossTenantRead} | a DECLARED cross-tenant read on an APPLICATION-scoped resource | `CROSS_TENANT_ADMINISTRATIVE_ACCESS` |\n *\n * **This module composes those two and adds no third derivation.** That is the point rather than an\n * economy: the admission and the observation must agree about which reads are in scope, or the trail\n * records elevations the gate never required (or, worse, the gate refuses reads the trail says\n * nothing about). `.claude/rules/invariant-call-site-enumeration.md` is a catalogue of what a second\n * look-alike derivation of one predicate costs.\n *\n * ## What it deliberately does NOT gate\n *\n * **The per-row tenant crossing.** That door already works — a usable `platformAccessGrants` row,\n * scoped to the named tenant, approved by that tenant where the tenant opted in. Requiring an\n * application-wide grant there too would replace a customer-approvable control with a\n * platform-internal one, which is a step DOWN the ladder in\n * `.claude/rules/administrative-continuity-floors.md`. The finding says so in as many words: do not\n * weaken the per-row model to make the two symmetric.\n *\n * **The grant resources themselves.** An operator would otherwise need an application-wide grant in\n * order to ask for one, and the second administrator would need one in order to sign. Both grant\n * resources are exempt WHOLESALE rather than per verb, and that is wider than the tenant resource's\n * `requestAccess`-only exemption on purpose: `applicationAccessGrants` is APPLICATION-scoped, so its\n * own `list` — the pending queue a second administrator works from — is a scope-root-adjacent\n * application-tier read, and gating the queue on a grant would make the approval flow unreachable.\n * The exemption is safe for the same reason the tenant one is: these rows are the elevation LEDGER,\n * they belong to no tenant, and reading them discloses no customer's data.\n *\n * **An exempt execution type.** Both underlying authorities already skip\n * `INTERNALLY_INITIATED_REQUEST` and `WEBHOOK_CALLBACK`; gating a batch, a cron, a cascade or a\n * verified webhook on a human's elevation would fail closed on every sweep in the system. Inherited\n * rather than restated, so the three answers cannot drift.\n */\n\nimport {\n  CoreResourceOperation,\n  CoreResourceType,\n} from '@wildo-ai/saas-models';\n\nimport {\n  isUnconfinedScopeRootDirectoryRead,\n  type ScopeRootCollectionConfinementSignal,\n} from '~wildo-backend-lib/security/authorizations/scope-root-collection-confinement.backend';\nimport {\n  isObservedCrossTenantRead,\n  type CrossTenantReadObservationOperation,\n} from '~wildo-backend-lib/security/authorizations/cross-tenant-read-observation.backend';\n\n/**\n * The elevation LEDGER itself — never gated on an elevation.\n *\n * A set rather than two comparisons so the enumeration is readable, and so a third grant resource (a\n * future scope) is added in one place instead of being discovered by an operator who cannot request\n * access to request access.\n */\nconst ACCESS_GRANT_LEDGER_RESOURCES: readonly string[] = Object.freeze([\n  String(CoreResourceType.PLATFORM_ACCESS_GRANTS),\n  String(CoreResourceType.APPLICATION_ACCESS_GRANTS),\n]);\n\n/** What this authority needs from the resource configuration. Deliberately narrow, like its siblings. */\nexport interface ApplicationWideReadAdmissionResource {\n  readonly resourceIdentifier?: string;\n  readonly resourcePrimaryScope?: string;\n}\n\n/**\n * Does this read reach application-wide, and therefore owe an application-wide elevation?\n *\n * Returns `false` for everything else, which is the overwhelming majority of reads — the two\n * authorities it composes are both narrow by construction, so a caller pays two boolean checks and a\n * set lookup on the ordinary path.\n */\nexport function readRequiresApplicationWideGrant(params: {\n  readonly executionContext: ScopeRootCollectionConfinementSignal;\n  /**\n   * The EXECUTED operation variant. Passed explicitly for the reason the observation authority\n   * documents: a resource authors ONE variant per operation and the config factory derives `summary`\n   * and `context` variants from it, so \"the operation\" is ambiguous unless the executed one is named.\n   */\n  readonly operation: CrossTenantReadObservationOperation | undefined;\n  readonly resourceConfiguration: ApplicationWideReadAdmissionResource;\n  readonly executedCoreOperation: CoreResourceOperation | undefined;\n}): boolean {\n  // The ledger is exempt WHOLESALE — see the module JSDoc. Checked FIRST so no later branch can make\n  // the approval flow unreachable.\n  if (ACCESS_GRANT_LEDGER_RESOURCES.includes(String(params.resourceConfiguration.resourceIdentifier ?? ''))) {\n    return false;\n  }\n\n  // Composed, never re-derived. Either authority answering `true` is an application-wide read.\n  if (isUnconfinedScopeRootDirectoryRead({\n    executionContext: params.executionContext,\n    resourceConfiguration: params.resourceConfiguration,\n    executedCoreOperation: params.executedCoreOperation,\n  })) return true;\n\n  return isObservedCrossTenantRead({\n    executionContext: params.executionContext,\n    operation: params.operation,\n    resourceConfiguration: params.resourceConfiguration,\n    executedCoreOperation: params.executedCoreOperation,\n  });\n}\n"]}

package/dist/esm/security/authorizations/authorization-denial-audit.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorization-denial-audit.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/security/authorizations/authorization-denial-audit.backend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,6BAA6B,EAC9B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AAExF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAElG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH;;;GAGG;AACH,eAAO,MAAM,iCAAiC,MAAM,CAAC;AAmBrD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE;IAC/C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,6BAA6B,CAAC;CAC7C,GAAG,MAAM,CAST;AAED;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAMvE;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,OAAO,EACd,kBAAkB,EAAE,6BAA6B,GAChD,6BAA6B,GAAG,SAAS,CAiB3C;AAED,6CAA6C;AAC7C,MAAM,WAAW,2BAA2B;IAC1C,wDAAwD;IACxD,UAAU,EAAE,OAAO,CAAC;IACpB,qEAAqE;IACrE,eAAe,EAAE,MAAM,CAAC;IACxB,+FAA+F;IAC/F,sBAAsB,EAAE,OAAO,CAAC;CACjC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kCAAkC,CACtD,IAAI,EAAE;IAAE,YAAY,CAAC,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,EAC5D,MAAM,EAAE;IACN,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,6BAA6B,CAAC;CAC7C,GACA,OAAO,CAAC,2BAA2B,CAAC,CAgCtC"}
+{"version":3,"file":"authorization-denial-audit.backend.utils.d.ts","sourceRoot":"","sources":["../../../../src/security/authorizations/authorization-denial-audit.backend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,6BAA6B,EAC9B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AAExF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAElG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH;;;GAGG;AACH,eAAO,MAAM,iCAAiC,MAAM,CAAC;AAmBrD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE;IAC/C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,6BAA6B,CAAC;CAC7C,GAAG,MAAM,CAST;AAED;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAMvE;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,OAAO,EACd,kBAAkB,EAAE,6BAA6B,GAChD,6BAA6B,GAAG,SAAS,CAiB3C;AAED,6CAA6C;AAC7C,MAAM,WAAW,2BAA2B;IAC1C,wDAAwD;IACxD,UAAU,EAAE,OAAO,CAAC;IACpB,qEAAqE;IACrE,eAAe,EAAE,MAAM,CAAC;IACxB,+FAA+F;IAC/F,sBAAsB,EAAE,OAAO,CAAC;CACjC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kCAAkC,CACtD,IAAI,EAAE;IAAE,YAAY,CAAC,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,EAC5D,MAAM,EAAE;IACN,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,6BAA6B,CAAC;CAC7C,GACA,OAAO,CAAC,2BAA2B,CAAC,CAgCtC"}

package/dist/esm/security/authorizations/cross-tenant-read-observation.backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cross-tenant-read-observation.backend.d.ts","sourceRoot":"","sources":["../../../../../src/security/authorizations/cross-tenant-read-observation.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAEH,OAAO,EACL,qBAAqB,EAGtB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAEL,KAAK,oCAAoC,EAC1C,MAAM,sFAAsF,CAAC;AAoC9F;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,uCAAuC,CAAC,EAAE,OAAO,CAAC;CAC5D;AAED,yGAAyG;AACzG,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC;AAED,qFAAqF;AACrF,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;CACtC;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE;IAChD,QAAQ,CAAC,gBAAgB,EAAE,oCAAoC,CAAC;IAChE,QAAQ,CAAC,SAAS,EAAE,mCAAmC,GAAG,SAAS,CAAC;IACpE,QAAQ,CAAC,qBAAqB,EAAE,kCAAkC,CAAC;IACnE,QAAQ,CAAC,qBAAqB,EAAE,qBAAqB,GAAG,SAAS,CAAC;CACnE,GAAG,OAAO,CAUV;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,+BAA+B,CAAC,MAAM,EAAE;IACtD,QAAQ,CAAC,gBAAgB,EAAE,oCAAoC,CAAC;IAChE,QAAQ,CAAC,SAAS,EAAE,mCAAmC,GAAG,SAAS,CAAC;IACpE,QAAQ,CAAC,qBAAqB,EAAE,kCAAkC,CAAC;IACnE,QAAQ,CAAC,qBAAqB,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAClE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB,GAAG,uBAAuB,EAAE,CAiC5B"}
+{"version":3,"file":"cross-tenant-read-observation.backend.d.ts","sourceRoot":"","sources":["../../../../src/security/authorizations/cross-tenant-read-observation.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAEH,OAAO,EACL,qBAAqB,EAGtB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAEL,KAAK,oCAAoC,EAC1C,MAAM,sFAAsF,CAAC;AAoC9F;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,uCAAuC,CAAC,EAAE,OAAO,CAAC;CAC5D;AAED,yGAAyG;AACzG,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC;AAED,qFAAqF;AACrF,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;CACtC;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE;IAChD,QAAQ,CAAC,gBAAgB,EAAE,oCAAoC,CAAC;IAChE,QAAQ,CAAC,SAAS,EAAE,mCAAmC,GAAG,SAAS,CAAC;IACpE,QAAQ,CAAC,qBAAqB,EAAE,kCAAkC,CAAC;IACnE,QAAQ,CAAC,qBAAqB,EAAE,qBAAqB,GAAG,SAAS,CAAC;CACnE,GAAG,OAAO,CAUV;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,+BAA+B,CAAC,MAAM,EAAE;IACtD,QAAQ,CAAC,gBAAgB,EAAE,oCAAoC,CAAC;IAChE,QAAQ,CAAC,SAAS,EAAE,mCAAmC,GAAG,SAAS,CAAC;IACpE,QAAQ,CAAC,qBAAqB,EAAE,kCAAkC,CAAC;IACnE,QAAQ,CAAC,qBAAqB,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAClE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB,GAAG,uBAAuB,EAAE,CAiC5B"}