@xemahq/biome-database-nest 0.15.0 → 0.16.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (12) hide show
  1. package/dist/index.d.ts +1 -0
  2. package/dist/index.d.ts.map +1 -1
  3. package/dist/index.js +10 -2
  4. package/dist/index.js.map +1 -1
  5. package/dist/lib/nest/org-erasure.module.d.ts.map +1 -1
  6. package/dist/lib/nest/org-erasure.module.js +2 -1
  7. package/dist/lib/nest/org-erasure.module.js.map +1 -1
  8. package/dist/lib/nest/org-protection.d.ts +33 -0
  9. package/dist/lib/nest/org-protection.d.ts.map +1 -0
  10. package/dist/lib/nest/org-protection.js +189 -0
  11. package/dist/lib/nest/org-protection.js.map +1 -0
  12. package/package.json +2 -2
package/dist/index.d.ts CHANGED
@@ -15,5 +15,6 @@ export { PrismaModelOperation, scopeArgsToOrg, type OrgScopeOutcome, type OrgSco
15
15
  export { DEFAULT_ORG_FIELD, collectOrgScopedModels, createTenantIsolationExtension, readRuntimeModels, type CreateTenantIsolationExtensionOptions, type RuntimeDataModelField, type RuntimeDataModelModel, type TenantIsolationExtensionDefinition, type TenantIsolationLogger, type TenantIsolationQueryContext, } from './lib/tenant-isolation/tenant-isolation.extension';
16
16
  export { assertUnscopedModelsDeclared, collectUnscopableModels, formatUnscopedModelReport, normalizeUnscopedModelDeclarations, UndeclaredUnscopedModelsError, type AssertUnscopedModelsOptions, type NormalizedUnscopedModelDeclaration, type UnscopedModelDeclaration, type UnscopedModelDeclarations, } from './lib/tenant-isolation/unscoped-models';
17
17
  export { assertOrgErasureMatchesModels, eraseOrgData, OrgErasureBlockedError, OrgErasureMatchesNothingError, type EraseOrgDataOptions, type OrgErasureReport, } from './lib/tenant-isolation/org-erasure';
18
+ export { assertOrgNotProtected, IdentityOrgProtectionProbe, OrgProtectionGuard, OrgProtectionUnavailableError, ProtectedOrgErasureRefusedError, IDENTITY_SERVICE_NAME, ORGANIZATION_PROTECTED_ERROR_CODE, type OrgProtectionProbe, } from './lib/nest/org-protection';
18
19
  export { OrgErasureModule, OrgErasureController, ORG_ERASURE_RUNNER, ORG_DATA_ERASURE_CAPABILITY, ORG_ERASURE_ROUTE_PATH, type OrgErasureModuleOptions, type OrgErasureRunner, } from './lib/nest/org-erasure.module';
19
20
  //# sourceMappingURL=index.d.ts.map
package/dist/index.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAChF,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,sBAAsB,EACtB,8BAA8B,EAC9B,uBAAuB,EACvB,yBAAyB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,cAAc,EACd,cAAc,EACd,cAAc,EACd,cAAc,EACd,2BAA2B,EAC3B,yBAAyB,EACzB,KAAK,eAAe,GACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,iCAAiC,EACjC,KAAK,mBAAmB,GACzB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,wBAAwB,EACxB,+BAA+B,GAChC,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,yBAAyB,EACzB,KAAK,2BAA2B,GACjC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,0BAA0B,EAC1B,8BAA8B,EAC9B,KAAK,4BAA4B,GAClC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,uBAAuB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,8BAA8B,GACpC,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,4CAA4C,EACjD,KAAK,0BAA0B,GAChC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,wBAAwB,EACxB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,+BAA+B,EACpC,KAAK,6BAA6B,EAClC,KAAK,eAAe,GACrB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,8BAA8B,EAC9B,KAAK,wBAAwB,GAC9B,MAAM,+CAA+C,CAAC;AACvD,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,KAAK,eAAe,EACpB,KAAK,eAAe,GACrB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,8BAA8B,EAC9B,iBAAiB,EACjB,KAAK,qCAAqC,EAC1C,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,kCAAkC,EACvC,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,GACjC,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,yBAAyB,EACzB,kCAAkC,EAClC,6BAA6B,EAC7B,KAAK,2BAA2B,EAChC,KAAK,kCAAkC,EACvC,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,GAC/B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,6BAA6B,EAC7B,YAAY,EACZ,sBAAsB,EACtB,6BAA6B,EAC7B,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,GACtB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,2BAA2B,EAC3B,sBAAsB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,GACtB,MAAM,+BAA+B,CAAC"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAChF,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,sBAAsB,EACtB,8BAA8B,EAC9B,uBAAuB,EACvB,yBAAyB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,cAAc,EACd,cAAc,EACd,cAAc,EACd,cAAc,EACd,2BAA2B,EAC3B,yBAAyB,EACzB,KAAK,eAAe,GACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,iCAAiC,EACjC,KAAK,mBAAmB,GACzB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,wBAAwB,EACxB,+BAA+B,GAChC,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,yBAAyB,EACzB,KAAK,2BAA2B,GACjC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,0BAA0B,EAC1B,8BAA8B,EAC9B,KAAK,4BAA4B,GAClC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,uBAAuB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,8BAA8B,GACpC,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,4CAA4C,EACjD,KAAK,0BAA0B,GAChC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,wBAAwB,EACxB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,+BAA+B,EACpC,KAAK,6BAA6B,EAClC,KAAK,eAAe,GACrB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,8BAA8B,EAC9B,KAAK,wBAAwB,GAC9B,MAAM,+CAA+C,CAAC;AACvD,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,KAAK,eAAe,EACpB,KAAK,eAAe,GACrB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,8BAA8B,EAC9B,iBAAiB,EACjB,KAAK,qCAAqC,EAC1C,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,kCAAkC,EACvC,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,GACjC,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,yBAAyB,EACzB,kCAAkC,EAClC,6BAA6B,EAC7B,KAAK,2BAA2B,EAChC,KAAK,kCAAkC,EACvC,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,GAC/B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,6BAA6B,EAC7B,YAAY,EACZ,sBAAsB,EACtB,6BAA6B,EAC7B,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,GACtB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,kBAAkB,EAClB,6BAA6B,EAC7B,+BAA+B,EAC/B,qBAAqB,EACrB,iCAAiC,EACjC,KAAK,kBAAkB,GACxB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,2BAA2B,EAC3B,sBAAsB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,GACtB,MAAM,+BAA+B,CAAC"}
package/dist/index.js CHANGED
@@ -1,7 +1,7 @@
1
1
  "use strict";
2
2
  Object.defineProperty(exports, "__esModule", { value: true });
3
- exports.ORG_DATA_ERASURE_CAPABILITY = exports.ORG_ERASURE_RUNNER = exports.OrgErasureController = exports.OrgErasureModule = exports.OrgErasureMatchesNothingError = exports.OrgErasureBlockedError = exports.eraseOrgData = exports.assertOrgErasureMatchesModels = exports.UndeclaredUnscopedModelsError = exports.normalizeUnscopedModelDeclarations = exports.formatUnscopedModelReport = exports.collectUnscopableModels = exports.assertUnscopedModelsDeclared = exports.readRuntimeModels = exports.createTenantIsolationExtension = exports.collectOrgScopedModels = exports.DEFAULT_ORG_FIELD = exports.scopeArgsToOrg = exports.PrismaModelOperation = exports.formatTenantIsolationViolation = exports.TenantIsolationViolationKind = exports.TenantIsolationError = exports.resolveTenantIsolationMode = exports.TENANT_ISOLATION_MODE_ENV_VAR = exports.TenantIsolationMode = exports.createBiomePrismaService = exports.BIOME_DATABASE_READY = exports.BiomeDatabaseModule = exports.BiomeDatabaseMigrationMode = exports.bootstrapBiomeDatabases = exports.ORG_DATABASE_POOL_SERVICE_NAME = exports.resolveControlPlaneBaseUrl = exports.fetchSystemDatabaseConfig = exports.createBiomePrismaAdapterFromEnv = exports.createBiomePrismaAdapter = exports.resolveBiomeDatabaseConfigFromEnv = exports.SCHEMA_ROLE_SUFFIX_LENGTH = exports.SCHEMA_ROLE_BASE_MAX_LENGTH = exports.SchemaRoleKind = exports.schemaRoleName = exports.schemaRoleBase = exports.rolesForSchema = exports.sanitizeIdentifierSegment = exports.sanitizeIdentifierChars = exports.POSTGRES_MAX_IDENTIFIER_LENGTH = exports.IDENTIFIER_HASH_LENGTH = exports.fitIdentifier = exports.composeIdentifier = exports.deriveBiomeSchemaName = exports.DEFAULT_BIOME_DB_KEY = void 0;
4
- exports.ORG_ERASURE_ROUTE_PATH = void 0;
3
+ exports.OrgProtectionUnavailableError = exports.OrgProtectionGuard = exports.IdentityOrgProtectionProbe = exports.assertOrgNotProtected = exports.OrgErasureMatchesNothingError = exports.OrgErasureBlockedError = exports.eraseOrgData = exports.assertOrgErasureMatchesModels = exports.UndeclaredUnscopedModelsError = exports.normalizeUnscopedModelDeclarations = exports.formatUnscopedModelReport = exports.collectUnscopableModels = exports.assertUnscopedModelsDeclared = exports.readRuntimeModels = exports.createTenantIsolationExtension = exports.collectOrgScopedModels = exports.DEFAULT_ORG_FIELD = exports.scopeArgsToOrg = exports.PrismaModelOperation = exports.formatTenantIsolationViolation = exports.TenantIsolationViolationKind = exports.TenantIsolationError = exports.resolveTenantIsolationMode = exports.TENANT_ISOLATION_MODE_ENV_VAR = exports.TenantIsolationMode = exports.createBiomePrismaService = exports.BIOME_DATABASE_READY = exports.BiomeDatabaseModule = exports.BiomeDatabaseMigrationMode = exports.bootstrapBiomeDatabases = exports.ORG_DATABASE_POOL_SERVICE_NAME = exports.resolveControlPlaneBaseUrl = exports.fetchSystemDatabaseConfig = exports.createBiomePrismaAdapterFromEnv = exports.createBiomePrismaAdapter = exports.resolveBiomeDatabaseConfigFromEnv = exports.SCHEMA_ROLE_SUFFIX_LENGTH = exports.SCHEMA_ROLE_BASE_MAX_LENGTH = exports.SchemaRoleKind = exports.schemaRoleName = exports.schemaRoleBase = exports.rolesForSchema = exports.sanitizeIdentifierSegment = exports.sanitizeIdentifierChars = exports.POSTGRES_MAX_IDENTIFIER_LENGTH = exports.IDENTIFIER_HASH_LENGTH = exports.fitIdentifier = exports.composeIdentifier = exports.deriveBiomeSchemaName = exports.DEFAULT_BIOME_DB_KEY = void 0;
4
+ exports.ORG_ERASURE_ROUTE_PATH = exports.ORG_DATA_ERASURE_CAPABILITY = exports.ORG_ERASURE_RUNNER = exports.OrgErasureController = exports.OrgErasureModule = exports.ORGANIZATION_PROTECTED_ERROR_CODE = exports.IDENTITY_SERVICE_NAME = exports.ProtectedOrgErasureRefusedError = void 0;
5
5
  var schema_name_1 = require("./lib/schema-name");
6
6
  Object.defineProperty(exports, "DEFAULT_BIOME_DB_KEY", { enumerable: true, get: function () { return schema_name_1.DEFAULT_BIOME_DB_KEY; } });
7
7
  Object.defineProperty(exports, "deriveBiomeSchemaName", { enumerable: true, get: function () { return schema_name_1.deriveBiomeSchemaName; } });
@@ -65,6 +65,14 @@ Object.defineProperty(exports, "assertOrgErasureMatchesModels", { enumerable: tr
65
65
  Object.defineProperty(exports, "eraseOrgData", { enumerable: true, get: function () { return org_erasure_1.eraseOrgData; } });
66
66
  Object.defineProperty(exports, "OrgErasureBlockedError", { enumerable: true, get: function () { return org_erasure_1.OrgErasureBlockedError; } });
67
67
  Object.defineProperty(exports, "OrgErasureMatchesNothingError", { enumerable: true, get: function () { return org_erasure_1.OrgErasureMatchesNothingError; } });
68
+ var org_protection_1 = require("./lib/nest/org-protection");
69
+ Object.defineProperty(exports, "assertOrgNotProtected", { enumerable: true, get: function () { return org_protection_1.assertOrgNotProtected; } });
70
+ Object.defineProperty(exports, "IdentityOrgProtectionProbe", { enumerable: true, get: function () { return org_protection_1.IdentityOrgProtectionProbe; } });
71
+ Object.defineProperty(exports, "OrgProtectionGuard", { enumerable: true, get: function () { return org_protection_1.OrgProtectionGuard; } });
72
+ Object.defineProperty(exports, "OrgProtectionUnavailableError", { enumerable: true, get: function () { return org_protection_1.OrgProtectionUnavailableError; } });
73
+ Object.defineProperty(exports, "ProtectedOrgErasureRefusedError", { enumerable: true, get: function () { return org_protection_1.ProtectedOrgErasureRefusedError; } });
74
+ Object.defineProperty(exports, "IDENTITY_SERVICE_NAME", { enumerable: true, get: function () { return org_protection_1.IDENTITY_SERVICE_NAME; } });
75
+ Object.defineProperty(exports, "ORGANIZATION_PROTECTED_ERROR_CODE", { enumerable: true, get: function () { return org_protection_1.ORGANIZATION_PROTECTED_ERROR_CODE; } });
68
76
  var org_erasure_module_1 = require("./lib/nest/org-erasure.module");
69
77
  Object.defineProperty(exports, "OrgErasureModule", { enumerable: true, get: function () { return org_erasure_module_1.OrgErasureModule; } });
70
78
  Object.defineProperty(exports, "OrgErasureController", { enumerable: true, get: function () { return org_erasure_module_1.OrgErasureController; } });
package/dist/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;AAAA,iDAAgF;AAAvE,mHAAA,oBAAoB,OAAA;AAAE,oHAAA,qBAAqB,OAAA;AACpD,+CAS0B;AARxB,+GAAA,iBAAiB,OAAA;AACjB,2GAAA,aAAa,OAAA;AACb,oHAAA,sBAAsB,OAAA;AACtB,4HAAA,8BAA8B,OAAA;AAC9B,qHAAA,uBAAuB,OAAA;AACvB,uHAAA,yBAAyB,OAAA;AAI3B,+CAQ0B;AAPxB,4GAAA,cAAc,OAAA;AACd,4GAAA,cAAc,OAAA;AACd,4GAAA,cAAc,OAAA;AACd,4GAAA,cAAc,OAAA;AACd,yHAAA,2BAA2B,OAAA;AAC3B,uHAAA,yBAAyB,OAAA;AAG3B,uCAGsB;AAFpB,2HAAA,iCAAiC,OAAA;AAGnC,yCAGuB;AAFrB,mHAAA,wBAAwB,OAAA;AACxB,0HAAA,+BAA+B,OAAA;AAEjC,mEAGoC;AAFlC,iIAAA,yBAAyB,OAAA;AAG3B,yEAIuC;AAHrC,qIAAA,0BAA0B,OAAA;AAC1B,yIAAA,8BAA8B,OAAA;AAGhC,6CAIyB;AAHvB,oHAAA,uBAAuB,OAAA;AAIzB,uDAAkE;AAAzD,4HAAA,0BAA0B,OAAA;AACnC,0EAK0C;AAJxC,4HAAA,mBAAmB,OAAA;AACnB,6HAAA,oBAAoB,OAAA;AAItB,4EAQ2C;AAPzC,kIAAA,wBAAwB,OAAA;AAQ1B,sFAIsD;AAHpD,4HAAA,mBAAmB,OAAA;AACnB,sIAAA,6BAA6B,OAAA;AAC7B,mIAAA,0BAA0B,OAAA;AAE5B,wFAKuD;AAJrD,8HAAA,oBAAoB,OAAA;AACpB,sIAAA,4BAA4B,OAAA;AAC5B,wIAAA,8BAA8B,OAAA;AAGhC,8DAK0C;AAJxC,iHAAA,oBAAoB,OAAA;AACpB,2GAAA,cAAc,OAAA;AAIhB,gGAW2D;AAVzD,+HAAA,iBAAiB,OAAA;AACjB,oIAAA,sBAAsB,OAAA;AACtB,4IAAA,8BAA8B,OAAA;AAC9B,+HAAA,iBAAiB,OAAA;AAQnB,0EAUgD;AAT9C,+HAAA,4BAA4B,OAAA;AAC5B,0HAAA,uBAAuB,OAAA;AACvB,4HAAA,yBAAyB,OAAA;AACzB,qIAAA,kCAAkC,OAAA;AAClC,gIAAA,6BAA6B,OAAA;AAM/B,kEAO4C;AAN1C,4HAAA,6BAA6B,OAAA;AAC7B,2GAAA,YAAY,OAAA;AACZ,qHAAA,sBAAsB,OAAA;AACtB,4HAAA,6BAA6B,OAAA;AAI/B,oEAQuC;AAPrC,sHAAA,gBAAgB,OAAA;AAChB,0HAAA,oBAAoB,OAAA;AACpB,wHAAA,kBAAkB,OAAA;AAClB,iIAAA,2BAA2B,OAAA;AAC3B,4HAAA,sBAAsB,OAAA"}
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;AAAA,iDAAgF;AAAvE,mHAAA,oBAAoB,OAAA;AAAE,oHAAA,qBAAqB,OAAA;AACpD,+CAS0B;AARxB,+GAAA,iBAAiB,OAAA;AACjB,2GAAA,aAAa,OAAA;AACb,oHAAA,sBAAsB,OAAA;AACtB,4HAAA,8BAA8B,OAAA;AAC9B,qHAAA,uBAAuB,OAAA;AACvB,uHAAA,yBAAyB,OAAA;AAI3B,+CAQ0B;AAPxB,4GAAA,cAAc,OAAA;AACd,4GAAA,cAAc,OAAA;AACd,4GAAA,cAAc,OAAA;AACd,4GAAA,cAAc,OAAA;AACd,yHAAA,2BAA2B,OAAA;AAC3B,uHAAA,yBAAyB,OAAA;AAG3B,uCAGsB;AAFpB,2HAAA,iCAAiC,OAAA;AAGnC,yCAGuB;AAFrB,mHAAA,wBAAwB,OAAA;AACxB,0HAAA,+BAA+B,OAAA;AAEjC,mEAGoC;AAFlC,iIAAA,yBAAyB,OAAA;AAG3B,yEAIuC;AAHrC,qIAAA,0BAA0B,OAAA;AAC1B,yIAAA,8BAA8B,OAAA;AAGhC,6CAIyB;AAHvB,oHAAA,uBAAuB,OAAA;AAIzB,uDAAkE;AAAzD,4HAAA,0BAA0B,OAAA;AACnC,0EAK0C;AAJxC,4HAAA,mBAAmB,OAAA;AACnB,6HAAA,oBAAoB,OAAA;AAItB,4EAQ2C;AAPzC,kIAAA,wBAAwB,OAAA;AAQ1B,sFAIsD;AAHpD,4HAAA,mBAAmB,OAAA;AACnB,sIAAA,6BAA6B,OAAA;AAC7B,mIAAA,0BAA0B,OAAA;AAE5B,wFAKuD;AAJrD,8HAAA,oBAAoB,OAAA;AACpB,sIAAA,4BAA4B,OAAA;AAC5B,wIAAA,8BAA8B,OAAA;AAGhC,8DAK0C;AAJxC,iHAAA,oBAAoB,OAAA;AACpB,2GAAA,cAAc,OAAA;AAIhB,gGAW2D;AAVzD,+HAAA,iBAAiB,OAAA;AACjB,oIAAA,sBAAsB,OAAA;AACtB,4IAAA,8BAA8B,OAAA;AAC9B,+HAAA,iBAAiB,OAAA;AAQnB,0EAUgD;AAT9C,+HAAA,4BAA4B,OAAA;AAC5B,0HAAA,uBAAuB,OAAA;AACvB,4HAAA,yBAAyB,OAAA;AACzB,qIAAA,kCAAkC,OAAA;AAClC,gIAAA,6BAA6B,OAAA;AAM/B,kEAO4C;AAN1C,4HAAA,6BAA6B,OAAA;AAC7B,2GAAA,YAAY,OAAA;AACZ,qHAAA,sBAAsB,OAAA;AACtB,4HAAA,6BAA6B,OAAA;AAI/B,4DASmC;AARjC,uHAAA,qBAAqB,OAAA;AACrB,4HAAA,0BAA0B,OAAA;AAC1B,oHAAA,kBAAkB,OAAA;AAClB,+HAAA,6BAA6B,OAAA;AAC7B,iIAAA,+BAA+B,OAAA;AAC/B,uHAAA,qBAAqB,OAAA;AACrB,mIAAA,iCAAiC,OAAA;AAGnC,oEAQuC;AAPrC,sHAAA,gBAAgB,OAAA;AAChB,0HAAA,oBAAoB,OAAA;AACpB,wHAAA,kBAAkB,OAAA;AAClB,iIAAA,2BAA2B,OAAA;AAC3B,4HAAA,sBAAsB,OAAA"}
package/dist/lib/nest/org-erasure.module.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"org-erasure.module.d.ts","sourceRoot":"","sources":["../../../src/lib/nest/org-erasure.module.ts"],"names":[],"mappings":"AAoCA,OAAO,EAOL,KAAK,aAAa,EAClB,KAAK,IAAI,EACV,MAAM,gBAAgB,CAAC;AAKxB,OAAO,EAGL,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACtB,MAAM,iCAAiC,CAAC;AAMzC,eAAO,MAAM,kBAAkB,eAE9B,CAAC;AAUF,eAAO,MAAM,2BAA2B,0BAA0B,CAAC;AAGnE,eAAO,MAAM,sBAAsB,yBAAyB,CAAC;AAE7D,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACjD;AAED,qBAGa,oBAAoB;IAED,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,gBAAgB;IASvE,KAAK,CAAiB,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;CAGhE;AAED,MAAM,WAAW,uBAAwB,SAAQ,mBAAmB;IAMlE,QAAQ,CAAC,kBAAkB,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,MAAM,GAAG,MAAM,CAAC;CAC9D;AAQD,qBAAa,gBAAgB;IAC3B,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,uBAAuB,GAAG,aAAa;CAwChE"}
1
+ {"version":3,"file":"org-erasure.module.d.ts","sourceRoot":"","sources":["../../../src/lib/nest/org-erasure.module.ts"],"names":[],"mappings":"AAoCA,OAAO,EAOL,KAAK,aAAa,EAClB,KAAK,IAAI,EACV,MAAM,gBAAgB,CAAC;AAMxB,OAAO,EAGL,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACtB,MAAM,iCAAiC,CAAC;AAMzC,eAAO,MAAM,kBAAkB,eAE9B,CAAC;AAUF,eAAO,MAAM,2BAA2B,0BAA0B,CAAC;AAGnE,eAAO,MAAM,sBAAsB,yBAAyB,CAAC;AAE7D,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACjD;AAYD,qBAGa,oBAAoB;IAED,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,gBAAgB;IASvE,KAAK,CAAiB,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;CAGhE;AAED,MAAM,WAAW,uBAAwB,SAAQ,mBAAmB;IAMlE,QAAQ,CAAC,kBAAkB,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,MAAM,GAAG,MAAM,CAAC;CAC9D;AAQD,qBAAa,gBAAgB;IAC3B,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,uBAAuB,GAAG,aAAa;CA8ChE"}
package/dist/lib/nest/org-erasure.module.js CHANGED
@@ -17,6 +17,7 @@ const common_1 = require("@nestjs/common");
17
17
  const swagger_1 = require("@nestjs/swagger");
18
18
  const platform_common_1 = require("@xemahq/platform-common");
19
19
  const xema_decorators_1 = require("@xemahq/xema-decorators");
20
+ const org_protection_1 = require("./org-protection");
20
21
  const org_erasure_1 = require("../tenant-isolation/org-erasure");
21
22
  const tenant_isolation_extension_1 = require("../tenant-isolation/tenant-isolation.extension");
22
23
  exports.ORG_ERASURE_RUNNER = Symbol.for('@xemahq/biome-database-nest/org-erasure-runner');
@@ -45,7 +46,7 @@ __decorate([
45
46
  ], OrgErasureController.prototype, "erase", null);
46
47
  exports.OrgErasureController = OrgErasureController = __decorate([
47
48
  (0, swagger_1.ApiTags)('org-erasure'),
48
- (0, common_1.UseGuards)(platform_common_1.ServiceActorGuard),
49
+ (0, common_1.UseGuards)(platform_common_1.ServiceActorGuard, org_protection_1.OrgProtectionGuard),
49
50
  (0, common_1.Controller)('internal/org-erasure'),
50
51
  __param(0, (0, common_1.Inject)(exports.ORG_ERASURE_RUNNER)),
51
52
  __metadata("design:paramtypes", [Object])
package/dist/lib/nest/org-erasure.module.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"org-erasure.module.js","sourceRoot":"","sources":["../../../src/lib/nest/org-erasure.module.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAoCA,2CASwB;AACxB,6CAAwD;AACxD,6DAA4D;AAC5D,6DAAmF;AAEnF,iEAKyC;AACzC,+FAAmF;AAKtE,QAAA,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAC1C,gDAAgD,CACjD,CAAC;AAUW,QAAA,2BAA2B,GAAG,uBAAuB,CAAC;AAGtD,QAAA,sBAAsB,GAAG,sBAAsB,CAAC;AAStD,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAEgB;IAD/C,YAC+C,MAAwB;QAAxB,WAAM,GAAN,MAAM,CAAkB;IACpE,CAAC;IAQJ,KAAK,CAAiB,KAAa;QACjC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;CACF,CAAA;AAdY,oDAAoB;AAW/B;IANC,IAAA,mCAAiB,EAAC,EAAE,QAAQ,EAAE,uCAAqB,CAAC,OAAO,EAAE,CAAC;IAC9D,IAAA,aAAI,EAAC,QAAQ,CAAC;IACd,IAAA,sBAAY,EAAC;QACZ,OAAO,EACL,6EAA6E;KAChF,CAAC;IACK,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;;;;iDAEpB;+BAbU,oBAAoB;IAHhC,IAAA,iBAAO,EAAC,aAAa,CAAC;IACtB,IAAA,kBAAS,EAAC,mCAAiB,CAAC;IAC5B,IAAA,mBAAU,EAAC,sBAAsB,CAAC;IAG9B,WAAA,IAAA,eAAM,EAAC,0BAAkB,CAAC,CAAA;;GAFlB,oBAAoB,CAchC;AAiBD,MAAa,gBAAgB;IAC3B,MAAM,CAAC,OAAO,CAAC,OAAgC;QAC7C,MAAM,EAAE,kBAAkB,EAAE,GAAG,YAAY,EAAE,GAAG,OAAO,CAAC;QACxD,OAAO;YACL,MAAM,EAAE,gBAAgB;YACxB,WAAW,EAAE,CAAC,oBAAoB,CAAC;YACnC,SAAS,EAAE;gBACT;oBACE,OAAO,EAAE,0BAAkB;oBAC3B,UAAU,EAAE,CAAC,MAAwB,EAAoB,EAAE;wBACzD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;wBAajC,MAAM,MAAM,GAAG;4BACb,GAAG,IAAA,2CAA6B,EAAC,MAAM,EAAE,YAAY,CAAC;yBACvD,CAAC,IAAI,EAAE,CAAC;wBACT,IAAI,eAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,GAAG,CACnC,qCACE,YAAY,CAAC,QAAQ,IAAI,8CAC3B,UAAU,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzD,CAAC;wBACF,OAAO;4BACL,KAAK,EAAE,CAAC,KAAa,EAA6B,EAAE,CAClD,IAAA,0BAAY,EAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC;yBACvD,CAAC;oBACJ,CAAC;oBACD,MAAM,EAAE,CAAC,kBAAkB,CAAC;iBAC7B;aACF;SACF,CAAC;IACJ,CAAC;CACF;AAzCD,4CAyCC"}
1
+ {"version":3,"file":"org-erasure.module.js","sourceRoot":"","sources":["../../../src/lib/nest/org-erasure.module.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAoCA,2CASwB;AACxB,6CAAwD;AACxD,6DAA4D;AAC5D,6DAAmF;AAEnF,qDAAsD;AACtD,iEAKyC;AACzC,+FAAmF;AAKtE,QAAA,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAC1C,gDAAgD,CACjD,CAAC;AAUW,QAAA,2BAA2B,GAAG,uBAAuB,CAAC;AAGtD,QAAA,sBAAsB,GAAG,sBAAsB,CAAC;AAmBtD,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAEgB;IAD/C,YAC+C,MAAwB;QAAxB,WAAM,GAAN,MAAM,CAAkB;IACpE,CAAC;IAQJ,KAAK,CAAiB,KAAa;QACjC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;CACF,CAAA;AAdY,oDAAoB;AAW/B;IANC,IAAA,mCAAiB,EAAC,EAAE,QAAQ,EAAE,uCAAqB,CAAC,OAAO,EAAE,CAAC;IAC9D,IAAA,aAAI,EAAC,QAAQ,CAAC;IACd,IAAA,sBAAY,EAAC;QACZ,OAAO,EACL,6EAA6E;KAChF,CAAC;IACK,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;;;;iDAEpB;+BAbU,oBAAoB;IAHhC,IAAA,iBAAO,EAAC,aAAa,CAAC;IACtB,IAAA,kBAAS,EAAC,mCAAiB,EAAE,mCAAkB,CAAC;IAChD,IAAA,mBAAU,EAAC,sBAAsB,CAAC;IAG9B,WAAA,IAAA,eAAM,EAAC,0BAAkB,CAAC,CAAA;;GAFlB,oBAAoB,CAchC;AAiBD,MAAa,gBAAgB;IAC3B,MAAM,CAAC,OAAO,CAAC,OAAgC;QAC7C,MAAM,EAAE,kBAAkB,EAAE,GAAG,YAAY,EAAE,GAAG,OAAO,CAAC;QACxD,OAAO;YACL,MAAM,EAAE,gBAAgB;YACxB,WAAW,EAAE,CAAC,oBAAoB,CAAC;YACnC,SAAS,EAAE;gBAOT;oBACE,OAAO,EAAE,0BAAkB;oBAC3B,UAAU,EAAE,CAAC,MAAwB,EAAoB,EAAE;wBACzD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;wBAajC,MAAM,MAAM,GAAG;4BACb,GAAG,IAAA,2CAA6B,EAAC,MAAM,EAAE,YAAY,CAAC;yBACvD,CAAC,IAAI,EAAE,CAAC;wBACT,IAAI,eAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,GAAG,CACnC,qCACE,YAAY,CAAC,QAAQ,IAAI,8CAC3B,UAAU,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzD,CAAC;wBACF,OAAO;4BACL,KAAK,EAAE,CAAC,KAAa,EAA6B,EAAE,CAClD,IAAA,0BAAY,EAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC;yBACvD,CAAC;oBACJ,CAAC;oBACD,MAAM,EAAE,CAAC,kBAAkB,CAAC;iBAC7B;aACF;SACF,CAAC;IACJ,CAAC;CACF;AA/CD,4CA+CC"}
package/dist/lib/nest/org-protection.d.ts ADDED
@@ -0,0 +1,33 @@
1
+ import { ForbiddenException, ServiceUnavailableException, type CanActivate, type ExecutionContext } from '@nestjs/common';
2
+ import { IdentityBootstrapService } from '@xemahq/identity-client';
3
+ import type { ServiceRegistry } from '@xemahq/kernel-contracts/service-registry';
4
+ export declare const IDENTITY_SERVICE_NAME = "identity-api";
5
+ export declare const ORGANIZATION_PROTECTED_ERROR_CODE = "ORGANIZATION_PROTECTED";
6
+ export interface OrgProtectionProbe {
7
+ isOrgProtected(orgId: string): Promise<boolean>;
8
+ }
9
+ export declare class ProtectedOrgErasureRefusedError extends ForbiddenException {
10
+ readonly orgId: string;
11
+ constructor(orgId: string);
12
+ }
13
+ export declare class OrgProtectionUnavailableError extends ServiceUnavailableException {
14
+ readonly orgId: string;
15
+ readonly reason: string;
16
+ constructor(orgId: string, reason: string);
17
+ }
18
+ export declare function assertOrgNotProtected(probe: OrgProtectionProbe, orgId: string): Promise<void>;
19
+ export declare class IdentityOrgProtectionProbe implements OrgProtectionProbe {
20
+ private readonly registry;
21
+ private readonly identity;
22
+ private readonly logger;
23
+ constructor(registry: ServiceRegistry, identity: IdentityBootstrapService);
24
+ isOrgProtected(orgId: string): Promise<boolean>;
25
+ private fetchOrganization;
26
+ }
27
+ export declare function assertOrgProtectionArmable(registry: ServiceRegistry | null | undefined, identity: IdentityBootstrapService | null | undefined): asserts registry is ServiceRegistry;
28
+ export declare class OrgProtectionGuard implements CanActivate {
29
+ private readonly probe;
30
+ constructor(registry: ServiceRegistry | null, identity: IdentityBootstrapService | null);
31
+ canActivate(context: ExecutionContext): Promise<boolean>;
32
+ }
33
+ //# sourceMappingURL=org-protection.d.ts.map
package/dist/lib/nest/org-protection.d.ts.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"org-protection.d.ts","sourceRoot":"","sources":["../../../src/lib/nest/org-protection.ts"],"names":[],"mappings":"AA8CA,OAAO,EACL,kBAAkB,EAKlB,2BAA2B,EAC3B,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAOnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2CAA2C,CAAC;AAGjF,eAAO,MAAM,qBAAqB,iBAAiB,CAAC;AAGpD,eAAO,MAAM,iCAAiC,2BAA2B,CAAC;AAO1E,MAAM,WAAW,kBAAkB;IAMjC,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACjD;AAGD,qBAAa,+BAAgC,SAAQ,kBAAkB;IACzD,QAAQ,CAAC,KAAK,EAAE,MAAM;gBAAb,KAAK,EAAE,MAAM;CASnC;AAMD,qBAAa,6BAA8B,SAAQ,2BAA2B;IAE1E,QAAQ,CAAC,KAAK,EAAE,MAAM;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM;gBADd,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM;CAW1B;AAQD,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,kBAAkB,EACzB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAsBf;AAWD,qBACa,0BAA2B,YAAW,kBAAkB;IAIjC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzD,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAJ3B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA+C;gBAGnB,QAAQ,EAAE,eAAe,EACzD,QAAQ,EAAE,wBAAwB;IAG/C,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;YA4CvC,iBAAiB;CAyChC;AAqBD,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,EAC5C,QAAQ,EAAE,wBAAwB,GAAG,IAAI,GAAG,SAAS,GACpD,OAAO,CAAC,QAAQ,IAAI,eAAe,CAqBrC;AA+BD,qBACa,kBAAmB,YAAW,WAAW;IACpD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqB;gBAKzC,QAAQ,EAAE,eAAe,GAAG,IAAI,EAShC,QAAQ,EAAE,wBAAwB,GAAG,IAAI;IAarC,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;CAiB/D"}
package/dist/lib/nest/org-protection.js ADDED
@@ -0,0 +1,189 @@
1
+ "use strict";
2
+ var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
3
+ var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
4
+ if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
5
+ else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
6
+ return c > 3 && r && Object.defineProperty(target, key, r), r;
7
+ };
8
+ var __metadata = (this && this.__metadata) || function (k, v) {
9
+ if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
10
+ };
11
+ var __param = (this && this.__param) || function (paramIndex, decorator) {
12
+ return function (target, key) { decorator(target, key, paramIndex); }
13
+ };
14
+ var IdentityOrgProtectionProbe_1;
15
+ Object.defineProperty(exports, "__esModule", { value: true });
16
+ exports.OrgProtectionGuard = exports.IdentityOrgProtectionProbe = exports.OrgProtectionUnavailableError = exports.ProtectedOrgErasureRefusedError = exports.ORGANIZATION_PROTECTED_ERROR_CODE = exports.IDENTITY_SERVICE_NAME = void 0;
17
+ exports.assertOrgNotProtected = assertOrgNotProtected;
18
+ exports.assertOrgProtectionArmable = assertOrgProtectionArmable;
19
+ const common_1 = require("@nestjs/common");
20
+ const identity_client_1 = require("@xemahq/identity-client");
21
+ const platform_common_1 = require("@xemahq/platform-common");
22
+ const service_registry_nest_1 = require("@xemahq/service-registry-nest");
23
+ exports.IDENTITY_SERVICE_NAME = 'identity-api';
24
+ exports.ORGANIZATION_PROTECTED_ERROR_CODE = 'ORGANIZATION_PROTECTED';
25
+ class ProtectedOrgErasureRefusedError extends common_1.ForbiddenException {
26
+ orgId;
27
+ constructor(orgId) {
28
+ super({
29
+ error: exports.ORGANIZATION_PROTECTED_ERROR_CODE,
30
+ message: `Refusing to erase organization "${orgId}": it is marked protected in ` +
31
+ `identity-api. Protection is a property of the organization, not of ` +
32
+ `the caller — clear it there first if the protection no longer applies.`,
33
+ });
34
+ this.orgId = orgId;
35
+ }
36
+ }
37
+ exports.ProtectedOrgErasureRefusedError = ProtectedOrgErasureRefusedError;
38
+ class OrgProtectionUnavailableError extends common_1.ServiceUnavailableException {
39
+ orgId;
40
+ reason;
41
+ constructor(orgId, reason) {
42
+ super({
43
+ error: 'ORG_PROTECTION_UNDETERMINED',
44
+ message: `Refusing to erase organization "${orgId}": could not establish ` +
45
+ `whether it is protected (${reason}). Erasure is irreversible, so an ` +
46
+ `undetermined protection status fails CLOSED. Retry once the ` +
47
+ `protection lookup succeeds.`,
48
+ });
49
+ this.orgId = orgId;
50
+ this.reason = reason;
51
+ }
52
+ }
53
+ exports.OrgProtectionUnavailableError = OrgProtectionUnavailableError;
54
+ async function assertOrgNotProtected(probe, orgId) {
55
+ const trimmed = orgId.trim();
56
+ if (trimmed === '') {
57
+ throw new OrgProtectionUnavailableError(orgId, 'orgId is empty');
58
+ }
59
+ let isProtected;
60
+ try {
61
+ isProtected = await probe.isOrgProtected(trimmed);
62
+ }
63
+ catch (error) {
64
+ throw new OrgProtectionUnavailableError(trimmed, error instanceof Error ? error.message : String(error));
65
+ }
66
+ if (isProtected) {
67
+ throw new ProtectedOrgErasureRefusedError(trimmed);
68
+ }
69
+ }
70
+ let IdentityOrgProtectionProbe = IdentityOrgProtectionProbe_1 = class IdentityOrgProtectionProbe {
71
+ registry;
72
+ identity;
73
+ logger = new common_1.Logger(IdentityOrgProtectionProbe_1.name);
74
+ constructor(registry, identity) {
75
+ this.registry = registry;
76
+ this.identity = identity;
77
+ }
78
+ async isOrgProtected(orgId) {
79
+ const realms = this.identity.getAllowedRealms();
80
+ if (realms.length === 0) {
81
+ throw new Error('this service has no allowed realms — identity registration has not ' +
82
+ 'completed, so no organization can be resolved');
83
+ }
84
+ const baseUrl = (await (0, service_registry_nest_1.resolveHttpUrl)(this.registry, exports.IDENTITY_SERVICE_NAME))
85
+ .replace(/\/$/, '');
86
+ const token = await this.identity.getAccessToken();
87
+ for (const realm of realms) {
88
+ const record = await this.fetchOrganization(baseUrl, token, orgId, realm);
89
+ if (record === null) {
90
+ continue;
91
+ }
92
+ const isProtected = record['isProtected'];
93
+ if (typeof isProtected !== 'boolean') {
94
+ throw new Error(`identity-api returned organization "${orgId}" (realm "${realm}") ` +
95
+ `without a boolean "isProtected" field (present keys: ` +
96
+ `[${Object.keys(record).join(', ')}]). An identity-api that cannot ` +
97
+ `report protection cannot be read as reporting "unprotected".`);
98
+ }
99
+ if (isProtected) {
100
+ this.logger.warn(`organization "${orgId}" is protected in realm "${realm}" — erasure refused`);
101
+ }
102
+ return isProtected;
103
+ }
104
+ throw new Error(`identity-api has no organization "${orgId}" in any realm this service ` +
105
+ `is registered for [${realms.join(', ')}]. "Not found" is not "not ` +
106
+ `protected": either the organization id is wrong, or it lives in a ` +
107
+ `realm this service cannot see.`);
108
+ }
109
+ async fetchOrganization(baseUrl, token, orgId, realm) {
110
+ const url = `${baseUrl}/internal/organizations/${encodeURIComponent(orgId)}` +
111
+ `?realm=${encodeURIComponent(realm)}`;
112
+ const response = await fetch(url, {
113
+ method: 'GET',
114
+ headers: {
115
+ authorization: `Bearer ${token}`,
116
+ accept: 'application/json',
117
+ },
118
+ });
119
+ if (response.status === 404) {
120
+ return null;
121
+ }
122
+ if (!response.ok) {
123
+ const body = await response.text().catch(() => '<unreadable body>');
124
+ throw new Error(`GET ${url} responded ${response.status} ${response.statusText}: ${body}`);
125
+ }
126
+ const payload = await response.json();
127
+ const record = (0, platform_common_1.unwrapPlatformResponseEnvelope)(payload, `orgProtectionProbe: ${url}`);
128
+ if (record === null || typeof record !== 'object') {
129
+ throw new Error(`GET ${url} returned a non-object organization record ` +
130
+ `(${JSON.stringify(record)}).`);
131
+ }
132
+ return record;
133
+ }
134
+ };
135
+ exports.IdentityOrgProtectionProbe = IdentityOrgProtectionProbe;
136
+ exports.IdentityOrgProtectionProbe = IdentityOrgProtectionProbe = IdentityOrgProtectionProbe_1 = __decorate([
137
+ (0, common_1.Injectable)(),
138
+ __param(0, (0, common_1.Inject)(service_registry_nest_1.SERVICE_REGISTRY_TOKEN)),
139
+ __metadata("design:paramtypes", [Object, identity_client_1.IdentityBootstrapService])
140
+ ], IdentityOrgProtectionProbe);
141
+ function assertOrgProtectionArmable(registry, identity) {
142
+ const missing = [];
143
+ if (registry === null || registry === undefined) {
144
+ missing.push('SERVICE_REGISTRY_TOKEN (@xemahq/service-registry-nest)');
145
+ }
146
+ if (identity === null || identity === undefined) {
147
+ missing.push('IdentityBootstrapService (@xemahq/identity-client)');
148
+ }
149
+ if (missing.length > 0) {
150
+ throw new Error(`[org-erasure] this service mounts the org-erasure route but cannot ` +
151
+ `construct its protected-organization fence: ${missing.join(' and ')} ` +
152
+ `${missing.length > 1 ? 'are' : 'is'} not resolvable. Both are ` +
153
+ `exported GLOBALLY by \`XemaServiceModule.forBiome\` (which composes ` +
154
+ `ServiceRegistryModule + IdentityBootstrapModule, each \`global: ` +
155
+ `true\`), so a service reaching this error has not wired the platform ` +
156
+ `bootstrap. Refusing to start: an org-erasure route served without the ` +
157
+ `fence lets any service token in the fleet irreversibly erase a ` +
158
+ `PROTECTED organization.`);
159
+ }
160
+ }
161
+ let OrgProtectionGuard = class OrgProtectionGuard {
162
+ probe;
163
+ constructor(registry, identity) {
164
+ assertOrgProtectionArmable(registry, identity);
165
+ this.probe = new IdentityOrgProtectionProbe(registry, identity);
166
+ }
167
+ async canActivate(context) {
168
+ const request = context
169
+ .switchToHttp()
170
+ .getRequest();
171
+ const orgId = request.params?.['orgId'];
172
+ if (typeof orgId !== 'string' || orgId.trim() === '') {
173
+ throw new OrgProtectionUnavailableError(String(orgId), 'the route declares no ":orgId" parameter — OrgProtectionGuard is ' +
174
+ 'mounted on a route it cannot fence');
175
+ }
176
+ await assertOrgNotProtected(this.probe, orgId);
177
+ return true;
178
+ }
179
+ };
180
+ exports.OrgProtectionGuard = OrgProtectionGuard;
181
+ exports.OrgProtectionGuard = OrgProtectionGuard = __decorate([
182
+ (0, common_1.Injectable)(),
183
+ __param(0, (0, common_1.Optional)()),
184
+ __param(0, (0, common_1.Inject)(service_registry_nest_1.SERVICE_REGISTRY_TOKEN)),
185
+ __param(1, (0, common_1.Optional)()),
186
+ __param(1, (0, common_1.Inject)(identity_client_1.IdentityBootstrapService)),
187
+ __metadata("design:paramtypes", [Object, Object])
188
+ ], OrgProtectionGuard);
189
+ //# sourceMappingURL=org-protection.js.map
package/dist/lib/nest/org-protection.js.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"org-protection.js","sourceRoot":"","sources":["../../../src/lib/nest/org-protection.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AA4HA,sDAyBC;AA8HD,gEAwBC;AA7PD,2CASwB;AACxB,6DAAmE;AACnE,6DAAyE;AACzE,yEAGuC;AAK1B,QAAA,qBAAqB,GAAG,cAAc,CAAC;AAGvC,QAAA,iCAAiC,GAAG,wBAAwB,CAAC;AAiB1E,MAAa,+BAAgC,SAAQ,2BAAkB;IAChD;IAArB,YAAqB,KAAa;QAChC,KAAK,CAAC;YACJ,KAAK,EAAE,yCAAiC;YACxC,OAAO,EACL,mCAAmC,KAAK,+BAA+B;gBACvE,qEAAqE;gBACrE,wEAAwE;SAC3E,CAAC,CAAC;QAPgB,UAAK,GAAL,KAAK,CAAQ;IAQlC,CAAC;CACF;AAVD,0EAUC;AAMD,MAAa,6BAA8B,SAAQ,oCAA2B;IAEjE;IACA;IAFX,YACW,KAAa,EACb,MAAc;QAEvB,KAAK,CAAC;YACJ,KAAK,EAAE,6BAA6B;YACpC,OAAO,EACL,mCAAmC,KAAK,yBAAyB;gBACjE,4BAA4B,MAAM,oCAAoC;gBACtE,8DAA8D;gBAC9D,6BAA6B;SAChC,CAAC,CAAC;QAVM,UAAK,GAAL,KAAK,CAAQ;QACb,WAAM,GAAN,MAAM,CAAQ;IAUzB,CAAC;CACF;AAdD,sEAcC;AAQM,KAAK,UAAU,qBAAqB,CACzC,KAAyB,EACzB,KAAa;IAEb,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,6BAA6B,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IACnE,CAAC;IAED,IAAI,WAAoB,CAAC;IACzB,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAIf,MAAM,IAAI,6BAA6B,CACrC,OAAO,EACP,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAC;IACJ,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,IAAI,+BAA+B,CAAC,OAAO,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAYM,IAAM,0BAA0B,kCAAhC,MAAM,0BAA0B;IAIc;IAChC;IAJF,MAAM,GAAG,IAAI,eAAM,CAAC,4BAA0B,CAAC,IAAI,CAAC,CAAC;IAEtE,YACmD,QAAyB,EACzD,QAAkC;QADF,aAAQ,GAAR,QAAQ,CAAiB;QACzD,aAAQ,GAAR,QAAQ,CAA0B;IAClD,CAAC;IAEJ,KAAK,CAAC,cAAc,CAAC,KAAa;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;QAChD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,qEAAqE;gBACnE,+CAA+C,CAClD,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,MAAM,IAAA,sCAAc,EAAC,IAAI,CAAC,QAAQ,EAAE,6BAAqB,CAAC,CAAC;aACzE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACtB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QAEnD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;YAC1E,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,SAAS;YACX,CAAC;YACD,MAAM,WAAW,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;YAC1C,IAAI,OAAO,WAAW,KAAK,SAAS,EAAE,CAAC;gBACrC,MAAM,IAAI,KAAK,CACb,uCAAuC,KAAK,aAAa,KAAK,KAAK;oBACjE,uDAAuD;oBACvD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,kCAAkC;oBACpE,8DAA8D,CACjE,CAAC;YACJ,CAAC;YACD,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,iBAAiB,KAAK,4BAA4B,KAAK,qBAAqB,CAC7E,CAAC;YACJ,CAAC;YACD,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,MAAM,IAAI,KAAK,CACb,qCAAqC,KAAK,8BAA8B;YACtE,sBAAsB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B;YACpE,oEAAoE;YACpE,gCAAgC,CACnC,CAAC;IACJ,CAAC;IAGO,KAAK,CAAC,iBAAiB,CAC7B,OAAe,EACf,KAAa,EACb,KAAa,EACb,KAAa;QAEb,MAAM,GAAG,GACP,GAAG,OAAO,2BAA2B,kBAAkB,CAAC,KAAK,CAAC,EAAE;YAChE,UAAU,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QAExC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,MAAM,EAAE,kBAAkB;aAC3B;SACF,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,CAAC;YACpE,MAAM,IAAI,KAAK,CACb,OAAO,GAAG,cAAc,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,KAAK,IAAI,EAAE,CAC1E,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,IAAA,gDAA8B,EAC3C,OAAO,EACP,uBAAuB,GAAG,EAAE,CAC7B,CAAC;QACF,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CACb,OAAO,GAAG,6CAA6C;gBACrD,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CACjC,CAAC;QACJ,CAAC;QACD,OAAO,MAAiC,CAAC;IAC3C,CAAC;CACF,CAAA;AA7FY,gEAA0B;qCAA1B,0BAA0B;IADtC,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,8CAAsB,CAAC,CAAA;6CACJ,0CAAwB;GAL1C,0BAA0B,CA6FtC;AAqBD,SAAgB,0BAA0B,CACxC,QAA4C,EAC5C,QAAqD;IAErD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChD,OAAO,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChD,OAAO,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,qEAAqE;YACnE,+CAA+C,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG;YACvE,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,4BAA4B;YAChE,sEAAsE;YACtE,kEAAkE;YAClE,uEAAuE;YACvE,wEAAwE;YACxE,iEAAiE;YACjE,yBAAyB,CAC5B,CAAC;IACJ,CAAC;AACH,CAAC;AAgCM,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IACZ,KAAK,CAAqB;IAE3C,YAGE,QAAgC,EAShC,QAAyC;QAMzC,0BAA0B,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,GAAG,IAAI,0BAA0B,CACzC,QAAQ,EACR,QAAoC,CACrC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO;aACpB,YAAY,EAAE;aACd,UAAU,EAAmD,CAAC;QACjE,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC;QAExC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACrD,MAAM,IAAI,6BAA6B,CACrC,MAAM,CAAC,KAAK,CAAC,EACb,mEAAmE;gBACjE,oCAAoC,CACvC,CAAC;QACJ,CAAC;QAED,MAAM,qBAAqB,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AA7CY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,8CAAsB,CAAC,CAAA;IAQ9B,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,0CAAwB,CAAC,CAAA;;GAdxB,kBAAkB,CA6C9B"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@xemahq/biome-database-nest",
3
- "version": "0.15.0",
3
+ "version": "0.16.0",
4
4
  "description": "Explicit database migration ownership, least-privilege runtime verification, and schema-qualified Prisma wiring for Xema biome services.",
5
5
  "license": "Apache-2.0",
6
6
  "author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
@@ -35,7 +35,7 @@
35
35
  "typescript": "5.9.3",
36
36
  "@xemahq/platform-common": "^0.10.0",
37
37
  "@xemahq/service-registry-nest": "0.8.1",
38
- "@xemahq/xema-decorators": "0.7.0"
38
+ "@xemahq/xema-decorators": "0.7.1"
39
39
  },
40
40
  "peerDependencies": {
41
41
  "@nestjs/common": "^10 || ^11",