happy2 0.0.11 → 0.0.13

package/packages/happy2-server/dist/modules/permission/roleCreate.js

@@ -0,0 +1,70 @@
+import { createId } from "@paralleldrive/cuid2";
+import { sql } from "drizzle-orm";
+import { CollaborationError } from "../chat/types.js";
+import { isUniqueConstraint } from "../chat/isUniqueConstraint.js";
+import { chatAppendAudit } from "../chat/chatAppendAudit.js";
+import { withTransaction } from "../drizzle.js";
+import { rolePermissions, roles } from "../schema.js";
+import { permissionMutationRecord } from "./impl/permissionMutationRecord.js";
+import { userRequirePermission } from "./userRequirePermission.js";
+/**
+ * Creates a custom roles row and its complete rolePermissions allow-list in one transaction, recording audit and sync evidence for management clients.
+ * The action owns role-name uniqueness and grant persistence so no partially configured role can become assignable.
+ */
+export async function roleCreate(executor, input) {
+    return withTransaction(executor, async (tx) => {
+        await userRequirePermission(tx, input.actorUserId, "manageAdminRoles");
+        const [existing] = await tx
+            .select({ id: roles.id })
+            .from(roles)
+            .where(sql `lower(${roles.name}) = lower(${input.name})`)
+            .limit(1);
+        if (existing)
+            throw new CollaborationError("conflict", "A role with this name exists");
+        const id = createId();
+        try {
+            await tx.insert(roles).values({
+                id,
+                name: input.name,
+                description: input.description ?? null,
+                createdByUserId: input.actorUserId,
+            });
+        }
+        catch (error) {
+            if (isUniqueConstraint(error))
+                throw new CollaborationError("conflict", "A role with this name exists");
+            throw error;
+        }
+        if (input.permissions.length)
+            await tx.insert(rolePermissions).values(input.permissions.map((permission) => ({
+                roleId: id,
+                permission,
+            })));
+        await chatAppendAudit(tx, {
+            actorUserId: input.actorUserId,
+            action: "role.created",
+            targetType: "role",
+            targetId: id,
+            after: { name: input.name, permissions: input.permissions },
+        });
+        const mutation = await permissionMutationRecord(tx, {
+            actorUserId: input.actorUserId,
+            affectedUserIds: [],
+            broadcast: true,
+            entityId: id,
+            kind: "role.created",
+        });
+        return {
+            role: {
+                id,
+                name: input.name,
+                ...(input.description ? { description: input.description } : {}),
+                builtin: null,
+                permissions: input.permissions,
+                userIds: [],
+            },
+            mutation,
+        };
+    });
+}
+//# sourceMappingURL=roleCreate.js.map

package/packages/happy2-server/dist/modules/permission/roleCreate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roleCreate.js","sourceRoot":"","sources":["../../../sources/modules/permission/roleCreate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAwB,eAAe,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAE9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC5B,QAAyB,EACzB,KAKC;IAED,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1C,MAAM,qBAAqB,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;QACvE,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;aACxB,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CAAC,GAAG,CAAA,SAAS,KAAK,CAAC,IAAI,aAAa,KAAK,CAAC,IAAI,GAAG,CAAC;aACvD,KAAK,CAAC,CAAC,CAAC,CAAC;QACd,IAAI,QAAQ;YAAE,MAAM,IAAI,kBAAkB,CAAC,UAAU,EAAE,8BAA8B,CAAC,CAAC;QACvF,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAC;QACtB,IAAI,CAAC;YACD,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;gBAC1B,EAAE;gBACF,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;gBACtC,eAAe,EAAE,KAAK,CAAC,WAAW;aACrC,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,kBAAkB,CAAC,KAAK,CAAC;gBACzB,MAAM,IAAI,kBAAkB,CAAC,UAAU,EAAE,8BAA8B,CAAC,CAAC;YAC7E,MAAM,KAAK,CAAC;QAChB,CAAC;QACD,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM;YACxB,MAAM,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CACnC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;gBACnC,MAAM,EAAE,EAAE;gBACV,UAAU;aACb,CAAC,CAAC,CACN,CAAC;QACN,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,cAAc;YACtB,UAAU,EAAE,MAAM;YAClB,QAAQ,EAAE,EAAE;YACZ,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE;SAC9D,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,EAAE,EAAE;YAChD,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,eAAe,EAAE,EAAE;YACnB,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE,EAAE;YACZ,IAAI,EAAE,cAAc;SACvB,CAAC,CAAC;QACH,OAAO;YACH,IAAI,EAAE;gBACF,EAAE;gBACF,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,OAAO,EAAE,IAAI;gBACb,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,OAAO,EAAE,EAAE;aACd;YACD,QAAQ;SACX,CAAC;IACN,CAAC,CAAC,CAAC;AACP,CAAC"}

package/packages/happy2-server/dist/modules/permission/roleDelete.d.ts

@@ -0,0 +1,11 @@
+import { type DrizzleExecutor } from "../drizzle.js";
+import type { PermissionMutation } from "./types.js";
+/**
+ * Deletes one custom roles row and its cascading grants and assignments while refusing either durable built-in marker.
+ * Capturing affected users before deletion allows the same commit to notify every client whose effective permissions changed.
+ */
+export declare function roleDelete(executor: DrizzleExecutor, input: {
+    actorUserId: string;
+    roleId: string;
+}): Promise<PermissionMutation>;
+//# sourceMappingURL=roleDelete.d.ts.map

package/packages/happy2-server/dist/modules/permission/roleDelete.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roleDelete.d.ts","sourceRoot":"","sources":["../../../sources/modules/permission/roleDelete.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,eAAe,EAAmB,MAAM,eAAe,CAAC;AAGtE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAGrD;;;GAGG;AACH,wBAAsB,UAAU,CAC5B,QAAQ,EAAE,eAAe,EACzB,KAAK,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC/C,OAAO,CAAC,kBAAkB,CAAC,CA6B7B"}

package/packages/happy2-server/dist/modules/permission/roleDelete.js

@@ -0,0 +1,41 @@
+import { eq } from "drizzle-orm";
+import { chatAppendAudit } from "../chat/chatAppendAudit.js";
+import { CollaborationError } from "../chat/types.js";
+import { withTransaction } from "../drizzle.js";
+import { roles, userRoles } from "../schema.js";
+import { permissionMutationRecord } from "./impl/permissionMutationRecord.js";
+import { userRequirePermission } from "./userRequirePermission.js";
+/**
+ * Deletes one custom roles row and its cascading grants and assignments while refusing either durable built-in marker.
+ * Capturing affected users before deletion allows the same commit to notify every client whose effective permissions changed.
+ */
+export async function roleDelete(executor, input) {
+    return withTransaction(executor, async (tx) => {
+        await userRequirePermission(tx, input.actorUserId, "manageAdminRoles");
+        const [role] = await tx.select().from(roles).where(eq(roles.id, input.roleId)).limit(1);
+        if (!role)
+            throw new CollaborationError("not_found", "Role was not found");
+        if (role.builtinKind)
+            throw new CollaborationError("invalid", "Built-in roles cannot be deleted");
+        const affectedUserIds = (await tx
+            .select({ userId: userRoles.userId })
+            .from(userRoles)
+            .where(eq(userRoles.roleId, input.roleId))).map(({ userId }) => userId);
+        await tx.delete(roles).where(eq(roles.id, input.roleId));
+        await chatAppendAudit(tx, {
+            actorUserId: input.actorUserId,
+            action: "role.deleted",
+            targetType: "role",
+            targetId: input.roleId,
+            before: { name: role.name },
+        });
+        return permissionMutationRecord(tx, {
+            actorUserId: input.actorUserId,
+            affectedUserIds,
+            broadcast: true,
+            entityId: input.roleId,
+            kind: "permissions.changed",
+        });
+    });
+}
+//# sourceMappingURL=roleDelete.js.map

package/packages/happy2-server/dist/modules/permission/roleDelete.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roleDelete.js","sourceRoot":"","sources":["../../../sources/modules/permission/roleDelete.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAwB,eAAe,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAE9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC5B,QAAyB,EACzB,KAA8C;IAE9C,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1C,MAAM,qBAAqB,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;QACvE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxF,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,kBAAkB,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;QAC3E,IAAI,IAAI,CAAC,WAAW;YAChB,MAAM,IAAI,kBAAkB,CAAC,SAAS,EAAE,kCAAkC,CAAC,CAAC;QAChF,MAAM,eAAe,GAAG,CACpB,MAAM,EAAE;aACH,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;aACpC,IAAI,CAAC,SAAS,CAAC;aACf,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CACjD,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QACzD,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,cAAc;YACtB,UAAU,EAAE,MAAM;YAClB,QAAQ,EAAE,KAAK,CAAC,MAAM;YACtB,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;SAC9B,CAAC,CAAC;QACH,OAAO,wBAAwB,CAAC,EAAE,EAAE;YAChC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,eAAe;YACf,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE,KAAK,CAAC,MAAM;YACtB,IAAI,EAAE,qBAAqB;SAC9B,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC"}

package/packages/happy2-server/dist/modules/permission/roleList.d.ts

@@ -0,0 +1,8 @@
+import type { DrizzleExecutor } from "../drizzle.js";
+import { type RoleSummary } from "./types.js";
+/**
+ * Lists every custom and built-in role with its grants and assigned users for an actor allowed to administer role membership.
+ * Returning built-in markers from durable rows lets clients preserve the undeletable admin/member identities after either role is renamed.
+ */
+export declare function roleList(executor: DrizzleExecutor, actorUserId: string): Promise<RoleSummary[]>;
+//# sourceMappingURL=roleList.d.ts.map

package/packages/happy2-server/dist/modules/permission/roleList.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roleList.d.ts","sourceRoot":"","sources":["../../../sources/modules/permission/roleList.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAGrD,OAAO,EAAgC,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAE5E;;;GAGG;AACH,wBAAsB,QAAQ,CAC1B,QAAQ,EAAE,eAAe,EACzB,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,WAAW,EAAE,CAAC,CA6BxB"}

package/packages/happy2-server/dist/modules/permission/roleList.js

@@ -0,0 +1,36 @@
+import { rolePermissions, roles, userRoles } from "../schema.js";
+import { userRequirePermission } from "./userRequirePermission.js";
+import { permissions } from "./types.js";
+/**
+ * Lists every custom and built-in role with its grants and assigned users for an actor allowed to administer role membership.
+ * Returning built-in markers from durable rows lets clients preserve the undeletable admin/member identities after either role is renamed.
+ */
+export async function roleList(executor, actorUserId) {
+    await userRequirePermission(executor, actorUserId, "manageAdminRoles");
+    const [roleRows, permissionRows, assignmentRows] = await Promise.all([
+        executor.select().from(roles).orderBy(roles.createdAt, roles.id),
+        executor
+            .select({ roleId: rolePermissions.roleId, permission: rolePermissions.permission })
+            .from(rolePermissions),
+        executor
+            .select({ roleId: userRoles.roleId, userId: userRoles.userId })
+            .from(userRoles)
+            .orderBy(userRoles.createdAt, userRoles.userId),
+    ]);
+    return roleRows.map((role) => {
+        const granted = new Set(permissionRows
+            .filter(({ roleId }) => roleId === role.id)
+            .map(({ permission }) => permission));
+        return {
+            id: role.id,
+            name: role.name,
+            ...(role.description ? { description: role.description } : {}),
+            builtin: role.builtinKind,
+            permissions: permissions.filter((permission) => granted.has(permission)),
+            userIds: assignmentRows
+                .filter(({ roleId }) => roleId === role.id)
+                .map(({ userId }) => userId),
+        };
+    });
+}
+//# sourceMappingURL=roleList.js.map

package/packages/happy2-server/dist/modules/permission/roleList.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roleList.js","sourceRoot":"","sources":["../../../sources/modules/permission/roleList.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,WAAW,EAAqC,MAAM,YAAY,CAAC;AAE5E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC1B,QAAyB,EACzB,WAAmB;IAEnB,MAAM,qBAAqB,CAAC,QAAQ,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC;IACvE,MAAM,CAAC,QAAQ,EAAE,cAAc,EAAE,cAAc,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACjE,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC;QAChE,QAAQ;aACH,MAAM,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,eAAe,CAAC,UAAU,EAAE,CAAC;aAClF,IAAI,CAAC,eAAe,CAAC;QAC1B,QAAQ;aACH,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;aAC9D,IAAI,CAAC,SAAS,CAAC;aACf,OAAO,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC;KACtD,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACzB,MAAM,OAAO,GAAG,IAAI,GAAG,CACnB,cAAc;aACT,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,CAAC;aAC1C,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,UAAwB,CAAC,CACzD,CAAC;QACF,OAAO;YACH,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,OAAO,EAAE,IAAI,CAAC,WAAqC;YACnD,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACxE,OAAO,EAAE,cAAc;iBAClB,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,CAAC;iBAC1C,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC;SACnC,CAAC;IACN,CAAC,CAAC,CAAC;AACP,CAAC"}

package/packages/happy2-server/dist/modules/permission/roleUpdate.d.ts

@@ -0,0 +1,14 @@
+import { type DrizzleExecutor } from "../drizzle.js";
+import type { Permission, PermissionMutation } from "./types.js";
+/**
+ * Updates a roles row's editable metadata and optional complete rolePermissions allow-list while preserving its immutable built-in marker.
+ * Permission changes notify every assigned user in the same transaction so their clients can immediately refetch `/v0/me`.
+ */
+export declare function roleUpdate(executor: DrizzleExecutor, input: {
+    actorUserId: string;
+    roleId: string;
+    name?: string;
+    description?: string | null;
+    permissions?: Permission[];
+}): Promise<PermissionMutation>;
+//# sourceMappingURL=roleUpdate.d.ts.map

package/packages/happy2-server/dist/modules/permission/roleUpdate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roleUpdate.d.ts","sourceRoot":"","sources":["../../../sources/modules/permission/roleUpdate.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,eAAe,EAAmB,MAAM,eAAe,CAAC;AAGtE,OAAO,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAGjE;;;GAGG;AACH,wBAAsB,UAAU,CAC5B,QAAQ,EAAE,eAAe,EACzB,KAAK,EAAE;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC;CAC9B,GACF,OAAO,CAAC,kBAAkB,CAAC,CAoE7B"}

package/packages/happy2-server/dist/modules/permission/roleUpdate.js

@@ -0,0 +1,78 @@
+import { eq, sql } from "drizzle-orm";
+import { chatAppendAudit } from "../chat/chatAppendAudit.js";
+import { CollaborationError } from "../chat/types.js";
+import { isUniqueConstraint } from "../chat/isUniqueConstraint.js";
+import { withTransaction } from "../drizzle.js";
+import { rolePermissions, roles, userRoles } from "../schema.js";
+import { permissionMutationRecord } from "./impl/permissionMutationRecord.js";
+import { userRequirePermission } from "./userRequirePermission.js";
+/**
+ * Updates a roles row's editable metadata and optional complete rolePermissions allow-list while preserving its immutable built-in marker.
+ * Permission changes notify every assigned user in the same transaction so their clients can immediately refetch `/v0/me`.
+ */
+export async function roleUpdate(executor, input) {
+    return withTransaction(executor, async (tx) => {
+        await userRequirePermission(tx, input.actorUserId, "manageAdminRoles");
+        const [role] = await tx.select().from(roles).where(eq(roles.id, input.roleId)).limit(1);
+        if (!role)
+            throw new CollaborationError("not_found", "Role was not found");
+        if (input.name !== undefined) {
+            const [duplicate] = await tx
+                .select({ id: roles.id })
+                .from(roles)
+                .where(sql `${roles.id} <> ${input.roleId} AND lower(${roles.name}) = lower(${input.name})`)
+                .limit(1);
+            if (duplicate)
+                throw new CollaborationError("conflict", "A role with this name exists");
+        }
+        try {
+            await tx
+                .update(roles)
+                .set({
+                ...(input.name === undefined ? {} : { name: input.name }),
+                ...(input.description === undefined ? {} : { description: input.description }),
+                updatedAt: new Date().toISOString(),
+            })
+                .where(eq(roles.id, input.roleId));
+        }
+        catch (error) {
+            if (isUniqueConstraint(error))
+                throw new CollaborationError("conflict", "A role with this name exists");
+            throw error;
+        }
+        if (input.permissions !== undefined) {
+            await tx.delete(rolePermissions).where(eq(rolePermissions.roleId, input.roleId));
+            if (input.permissions.length)
+                await tx.insert(rolePermissions).values(input.permissions.map((permission) => ({
+                    roleId: input.roleId,
+                    permission,
+                })));
+        }
+        const affectedUserIds = input.permissions === undefined
+            ? []
+            : (await tx
+                .select({ userId: userRoles.userId })
+                .from(userRoles)
+                .where(eq(userRoles.roleId, input.roleId))).map(({ userId }) => userId);
+        await chatAppendAudit(tx, {
+            actorUserId: input.actorUserId,
+            action: "role.updated",
+            targetType: "role",
+            targetId: input.roleId,
+            before: { name: role.name, description: role.description },
+            after: {
+                name: input.name,
+                description: input.description,
+                permissions: input.permissions,
+            },
+        });
+        return permissionMutationRecord(tx, {
+            actorUserId: input.actorUserId,
+            affectedUserIds,
+            broadcast: true,
+            entityId: input.roleId,
+            kind: input.permissions === undefined ? "role.updated" : "permissions.changed",
+        });
+    });
+}
+//# sourceMappingURL=roleUpdate.js.map

package/packages/happy2-server/dist/modules/permission/roleUpdate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roleUpdate.js","sourceRoot":"","sources":["../../../sources/modules/permission/roleUpdate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAwB,eAAe,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAE9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC5B,QAAyB,EACzB,KAMC;IAED,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1C,MAAM,qBAAqB,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;QACvE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxF,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,kBAAkB,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;QAC3E,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE;iBACvB,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;iBACxB,IAAI,CAAC,KAAK,CAAC;iBACX,KAAK,CACF,GAAG,CAAA,GAAG,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC,MAAM,cAAc,KAAK,CAAC,IAAI,aAAa,KAAK,CAAC,IAAI,GAAG,CACtF;iBACA,KAAK,CAAC,CAAC,CAAC,CAAC;YACd,IAAI,SAAS;gBAAE,MAAM,IAAI,kBAAkB,CAAC,UAAU,EAAE,8BAA8B,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,CAAC;YACD,MAAM,EAAE;iBACH,MAAM,CAAC,KAAK,CAAC;iBACb,GAAG,CAAC;gBACD,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;gBACzD,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;gBAC9E,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACtC,CAAC;iBACD,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,kBAAkB,CAAC,KAAK,CAAC;gBACzB,MAAM,IAAI,kBAAkB,CAAC,UAAU,EAAE,8BAA8B,CAAC,CAAC;YAC7E,MAAM,KAAK,CAAC;QAChB,CAAC;QACD,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YACjF,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM;gBACxB,MAAM,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CACnC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;oBACnC,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,UAAU;iBACb,CAAC,CAAC,CACN,CAAC;QACV,CAAC;QACD,MAAM,eAAe,GACjB,KAAK,CAAC,WAAW,KAAK,SAAS;YAC3B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CACI,MAAM,EAAE;iBACH,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;iBACpC,IAAI,CAAC,SAAS,CAAC;iBACf,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CACjD,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,cAAc;YACtB,UAAU,EAAE,MAAM;YAClB,QAAQ,EAAE,KAAK,CAAC,MAAM;YACtB,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE;YAC1D,KAAK,EAAE;gBACH,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;aACjC;SACJ,CAAC,CAAC;QACH,OAAO,wBAAwB,CAAC,EAAE,EAAE;YAChC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,eAAe;YACf,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE,KAAK,CAAC,MAAM;YACtB,IAAI,EAAE,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,qBAAqB;SACjF,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC"}

package/packages/happy2-server/dist/modules/permission/types.d.ts

@@ -0,0 +1,24 @@
+export declare const permissions: readonly ["manageSecrets", "assignSecrets", "manageImages", "assignImagesToChats", "managePlugins", "viewAllMembers", "manageAdminRoles"];
+export type Permission = (typeof permissions)[number];
+export interface EffectivePermissions {
+    allowed: Permission[];
+    owner: boolean;
+}
+export interface RoleSummary {
+    id: string;
+    name: string;
+    description?: string;
+    builtin: "admin" | "member" | null;
+    permissions: Permission[];
+    userIds: string[];
+}
+export interface PermissionMutation {
+    affectedUserIds: string[];
+    broadcast: boolean;
+    sync: {
+        sequence: string;
+        chats: [];
+        areas: ["permissions"];
+    };
+}
+//# sourceMappingURL=types.d.ts.map

package/packages/happy2-server/dist/modules/permission/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../sources/modules/permission/types.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,WAAW,YACpB,eAAe,EACf,eAAe,EACf,cAAc,EACd,qBAAqB,EACrB,eAAe,EACf,gBAAgB,EAChB,kBAAkB,CACZ,CAAC;AAEX,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAEtD,MAAM,WAAW,oBAAoB;IACjC,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,IAAI,CAAC;IACnC,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,OAAO,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IAC/B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,SAAS,EAAE,OAAO,CAAC;IACnB,IAAI,EAAE;QACF,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,EAAE,CAAC;QACV,KAAK,EAAE,CAAC,aAAa,CAAC,CAAC;KAC1B,CAAC;CACL"}

package/packages/happy2-server/dist/modules/permission/types.js

@@ -0,0 +1,10 @@
+export const permissions = [
+    "manageSecrets",
+    "assignSecrets",
+    "manageImages",
+    "assignImagesToChats",
+    "managePlugins",
+    "viewAllMembers",
+    "manageAdminRoles",
+];
+//# sourceMappingURL=types.js.map

package/packages/happy2-server/dist/modules/permission/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../sources/modules/permission/types.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,WAAW,GAAG;IACvB,eAAe;IACf,eAAe;IACf,cAAc;IACd,qBAAqB;IACrB,eAAe;IACf,gBAAgB;IAChB,kBAAkB;CACZ,CAAC"}

package/packages/happy2-server/dist/modules/permission/userPermissionGet.d.ts

@@ -0,0 +1,16 @@
+import type { DrizzleExecutor } from "../drizzle.js";
+import { permissionGetEffective } from "./permissionGetEffective.js";
+import { type Permission } from "./types.js";
+/**
+ * Returns one active user's direct grants, assigned role identifiers, and effective permission projection to an authorized role administrator.
+ * Keeping direct and inherited state distinct lets management clients edit explicit grants without accidentally flattening role membership.
+ */
+export declare function userPermissionGet(executor: DrizzleExecutor, input: {
+    actorUserId: string;
+    userId: string;
+}): Promise<{
+    direct: Permission[];
+    roleIds: string[];
+    effective: Awaited<ReturnType<typeof permissionGetEffective>>;
+}>;
+//# sourceMappingURL=userPermissionGet.d.ts.map

package/packages/happy2-server/dist/modules/permission/userPermissionGet.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"userPermissionGet.d.ts","sourceRoot":"","sources":["../../../sources/modules/permission/userPermissionGet.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE,OAAO,EAAe,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAE1D;;;GAGG;AACH,wBAAsB,iBAAiB,CACnC,QAAQ,EAAE,eAAe,EACzB,KAAK,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC/C,OAAO,CAAC;IACP,MAAM,EAAE,UAAU,EAAE,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAAC,CAAC;CACjE,CAAC,CAuBD"}

package/packages/happy2-server/dist/modules/permission/userPermissionGet.js

@@ -0,0 +1,33 @@
+import { eq } from "drizzle-orm";
+import { userRequireActiveHuman } from "../chat/userRequireActiveHuman.js";
+import { userPermissions, userRoles } from "../schema.js";
+import { permissionGetEffective } from "./permissionGetEffective.js";
+import { userRequirePermission } from "./userRequirePermission.js";
+import { permissions } from "./types.js";
+/**
+ * Returns one active user's direct grants, assigned role identifiers, and effective permission projection to an authorized role administrator.
+ * Keeping direct and inherited state distinct lets management clients edit explicit grants without accidentally flattening role membership.
+ */
+export async function userPermissionGet(executor, input) {
+    await userRequirePermission(executor, input.actorUserId, "manageAdminRoles");
+    await userRequireActiveHuman(executor, input.userId);
+    const [directRows, roleRows, effective] = await Promise.all([
+        executor
+            .select({ permission: userPermissions.permission })
+            .from(userPermissions)
+            .where(eq(userPermissions.userId, input.userId)),
+        executor
+            .select({ roleId: userRoles.roleId })
+            .from(userRoles)
+            .where(eq(userRoles.userId, input.userId))
+            .orderBy(userRoles.createdAt, userRoles.roleId),
+        permissionGetEffective(executor, input.userId),
+    ]);
+    const directSet = new Set(directRows.map(({ permission }) => permission));
+    return {
+        direct: permissions.filter((permission) => directSet.has(permission)),
+        roleIds: roleRows.map(({ roleId }) => roleId),
+        effective,
+    };
+}
+//# sourceMappingURL=userPermissionGet.js.map

package/packages/happy2-server/dist/modules/permission/userPermissionGet.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"userPermissionGet.js","sourceRoot":"","sources":["../../../sources/modules/permission/userPermissionGet.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAE3E,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,WAAW,EAAmB,MAAM,YAAY,CAAC;AAE1D;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACnC,QAAyB,EACzB,KAA8C;IAM9C,MAAM,qBAAqB,CAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;IAC7E,MAAM,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACxD,QAAQ;aACH,MAAM,CAAC,EAAE,UAAU,EAAE,eAAe,CAAC,UAAU,EAAE,CAAC;aAClD,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACpD,QAAQ;aACH,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;aACpC,IAAI,CAAC,SAAS,CAAC;aACf,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;aACzC,OAAO,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC;QACnD,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC;KACjD,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,IAAI,GAAG,CACrB,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,UAAwB,CAAC,CAC/D,CAAC;IACF,OAAO;QACH,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACrE,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC;QAC7C,SAAS;KACZ,CAAC;AACN,CAAC"}

package/packages/happy2-server/dist/modules/permission/userPermissionUpdate.d.ts

@@ -0,0 +1,12 @@
+import { type DrizzleExecutor } from "../drizzle.js";
+import type { Permission, PermissionMutation } from "./types.js";
+/**
+ * Replaces an active user's complete userPermissions allow-list without altering grants inherited from assigned roles.
+ * The replacement and targeted invalidation share one transaction so `/v0/me` can be safely refetched as soon as clients receive the hint.
+ */
+export declare function userPermissionUpdate(executor: DrizzleExecutor, input: {
+    actorUserId: string;
+    userId: string;
+    permissions: Permission[];
+}): Promise<PermissionMutation>;
+//# sourceMappingURL=userPermissionUpdate.d.ts.map

package/packages/happy2-server/dist/modules/permission/userPermissionUpdate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"userPermissionUpdate.d.ts","sourceRoot":"","sources":["../../../sources/modules/permission/userPermissionUpdate.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,eAAe,EAAmB,MAAM,eAAe,CAAC;AAGtE,OAAO,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAGjE;;;GAGG;AACH,wBAAsB,oBAAoB,CACtC,QAAQ,EAAE,eAAe,EACzB,KAAK,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,UAAU,EAAE,CAAA;CAAE,GAC1E,OAAO,CAAC,kBAAkB,CAAC,CAiC7B"}

package/packages/happy2-server/dist/modules/permission/userPermissionUpdate.js

@@ -0,0 +1,44 @@
+import { eq } from "drizzle-orm";
+import { chatAppendAudit } from "../chat/chatAppendAudit.js";
+import { userRequireActiveHuman } from "../chat/userRequireActiveHuman.js";
+import { withTransaction } from "../drizzle.js";
+import { userPermissions } from "../schema.js";
+import { permissionMutationRecord } from "./impl/permissionMutationRecord.js";
+import { userRequirePermission } from "./userRequirePermission.js";
+/**
+ * Replaces an active user's complete userPermissions allow-list without altering grants inherited from assigned roles.
+ * The replacement and targeted invalidation share one transaction so `/v0/me` can be safely refetched as soon as clients receive the hint.
+ */
+export async function userPermissionUpdate(executor, input) {
+    return withTransaction(executor, async (tx) => {
+        await userRequirePermission(tx, input.actorUserId, "manageAdminRoles");
+        await userRequireActiveHuman(tx, input.userId);
+        const before = await tx
+            .select({ permission: userPermissions.permission })
+            .from(userPermissions)
+            .where(eq(userPermissions.userId, input.userId));
+        await tx.delete(userPermissions).where(eq(userPermissions.userId, input.userId));
+        if (input.permissions.length)
+            await tx.insert(userPermissions).values(input.permissions.map((permission) => ({
+                userId: input.userId,
+                permission,
+                grantedByUserId: input.actorUserId,
+            })));
+        await chatAppendAudit(tx, {
+            actorUserId: input.actorUserId,
+            action: "user.permissions_updated",
+            targetType: "user",
+            targetId: input.userId,
+            before: { permissions: before.map(({ permission }) => permission) },
+            after: { permissions: input.permissions },
+        });
+        return permissionMutationRecord(tx, {
+            actorUserId: input.actorUserId,
+            affectedUserIds: [input.userId],
+            broadcast: false,
+            entityId: input.userId,
+            kind: "permissions.changed",
+        });
+    });
+}
+//# sourceMappingURL=userPermissionUpdate.js.map

package/packages/happy2-server/dist/modules/permission/userPermissionUpdate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"userPermissionUpdate.js","sourceRoot":"","sources":["../../../sources/modules/permission/userPermissionUpdate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAC3E,OAAO,EAAwB,eAAe,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAE9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACtC,QAAyB,EACzB,KAAyE;IAEzE,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1C,MAAM,qBAAqB,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;QACvE,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,EAAE;aAClB,MAAM,CAAC,EAAE,UAAU,EAAE,eAAe,CAAC,UAAU,EAAE,CAAC;aAClD,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QACrD,MAAM,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QACjF,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM;YACxB,MAAM,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CACnC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;gBACnC,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,UAAU;gBACV,eAAe,EAAE,KAAK,CAAC,WAAW;aACrC,CAAC,CAAC,CACN,CAAC;QACN,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,0BAA0B;YAClC,UAAU,EAAE,MAAM;YAClB,QAAQ,EAAE,KAAK,CAAC,MAAM;YACtB,MAAM,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE;YACnE,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE;SAC5C,CAAC,CAAC;QACH,OAAO,wBAAwB,CAAC,EAAE,EAAE;YAChC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,eAAe,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;YAC/B,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,KAAK,CAAC,MAAM;YACtB,IAAI,EAAE,qBAAqB;SAC9B,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC"}

package/packages/happy2-server/dist/modules/permission/userRequireAnyPermission.d.ts

@@ -0,0 +1,8 @@
+import type { DrizzleExecutor } from "../drizzle.js";
+import type { Permission } from "./types.js";
+/**
+ * Requires at least one permission from an explicit set for shared read surfaces used by adjacent management capabilities.
+ * The owner remains allow-all, while ordinary users must receive one listed grant directly or through a role.
+ */
+export declare function userRequireAnyPermission(executor: DrizzleExecutor, userId: string, required: readonly Permission[]): Promise<void>;
+//# sourceMappingURL=userRequireAnyPermission.d.ts.map

package/packages/happy2-server/dist/modules/permission/userRequireAnyPermission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"userRequireAnyPermission.d.ts","sourceRoot":"","sources":["../../../sources/modules/permission/userRequireAnyPermission.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C;;;GAGG;AACH,wBAAsB,wBAAwB,CAC1C,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,SAAS,UAAU,EAAE,GAChC,OAAO,CAAC,IAAI,CAAC,CAOf"}

package/packages/happy2-server/dist/modules/permission/userRequireAnyPermission.js

@@ -0,0 +1,12 @@
+import { CollaborationError } from "../chat/types.js";
+import { permissionEffectiveDb } from "./impl/permissionEffectiveDb.js";
+/**
+ * Requires at least one permission from an explicit set for shared read surfaces used by adjacent management capabilities.
+ * The owner remains allow-all, while ordinary users must receive one listed grant directly or through a role.
+ */
+export async function userRequireAnyPermission(executor, userId, required) {
+    const effective = await permissionEffectiveDb(executor, userId);
+    if (!effective || !required.some((permission) => effective.allowed.includes(permission)))
+        throw new CollaborationError("forbidden", `${required.join(" or ")} permission is required`);
+}
+//# sourceMappingURL=userRequireAnyPermission.js.map

package/packages/happy2-server/dist/modules/permission/userRequireAnyPermission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"userRequireAnyPermission.js","sourceRoot":"","sources":["../../../sources/modules/permission/userRequireAnyPermission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAGxE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC1C,QAAyB,EACzB,MAAc,EACd,QAA+B;IAE/B,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChE,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACpF,MAAM,IAAI,kBAAkB,CACxB,WAAW,EACX,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,yBAAyB,CACpD,CAAC;AACV,CAAC"}

package/packages/happy2-server/dist/modules/permission/userRequirePermission.d.ts

@@ -0,0 +1,8 @@
+import type { DrizzleExecutor } from "../drizzle.js";
+import type { Permission } from "./types.js";
+/**
+ * Requires one effective permission from an active human user, treating the durable server owner as an explicit allow-all principal.
+ * Centralizing this check prevents feature routes from confusing legacy administrator labels with narrowly delegated authority.
+ */
+export declare function userRequirePermission(executor: DrizzleExecutor, userId: string, permission: Permission): Promise<void>;
+//# sourceMappingURL=userRequirePermission.d.ts.map

package/packages/happy2-server/dist/modules/permission/userRequirePermission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"userRequirePermission.d.ts","sourceRoot":"","sources":["../../../sources/modules/permission/userRequirePermission.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C;;;GAGG;AACH,wBAAsB,qBAAqB,CACvC,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,GACvB,OAAO,CAAC,IAAI,CAAC,CAIf"}

package/packages/happy2-server/dist/modules/permission/userRequirePermission.js

@@ -0,0 +1,12 @@
+import { CollaborationError } from "../chat/types.js";
+import { permissionEffectiveDb } from "./impl/permissionEffectiveDb.js";
+/**
+ * Requires one effective permission from an active human user, treating the durable server owner as an explicit allow-all principal.
+ * Centralizing this check prevents feature routes from confusing legacy administrator labels with narrowly delegated authority.
+ */
+export async function userRequirePermission(executor, userId, permission) {
+    const effective = await permissionEffectiveDb(executor, userId);
+    if (!effective?.allowed.includes(permission))
+        throw new CollaborationError("forbidden", `${permission} permission is required`);
+}
+//# sourceMappingURL=userRequirePermission.js.map

package/packages/happy2-server/dist/modules/permission/userRequirePermission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"userRequirePermission.js","sourceRoot":"","sources":["../../../sources/modules/permission/userRequirePermission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAGxE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACvC,QAAyB,EACzB,MAAc,EACd,UAAsB;IAEtB,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;QACxC,MAAM,IAAI,kBAAkB,CAAC,WAAW,EAAE,GAAG,UAAU,yBAAyB,CAAC,CAAC;AAC1F,CAAC"}

package/packages/happy2-server/dist/modules/permission/userRoleAssign.d.ts

@@ -0,0 +1,12 @@
+import { type DrizzleExecutor } from "../drizzle.js";
+import type { PermissionMutation } from "./types.js";
+/**
+ * Inserts one userRoles assignment for an active human user, synchronizing users when the durable admin marker is assigned.
+ * The grant, audit record, and targeted permission invalidation commit atomically so authorization never changes silently.
+ */
+export declare function userRoleAssign(executor: DrizzleExecutor, input: {
+    actorUserId: string;
+    userId: string;
+    roleId: string;
+}): Promise<PermissionMutation>;
+//# sourceMappingURL=userRoleAssign.d.ts.map

package/packages/happy2-server/dist/modules/permission/userRoleAssign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"userRoleAssign.d.ts","sourceRoot":"","sources":["../../../sources/modules/permission/userRoleAssign.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,eAAe,EAAmB,MAAM,eAAe,CAAC;AAGtE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAGrD;;;GAGG;AACH,wBAAsB,cAAc,CAChC,QAAQ,EAAE,eAAe,EACzB,KAAK,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC/D,OAAO,CAAC,kBAAkB,CAAC,CA+B7B"}

package/packages/happy2-server/dist/modules/permission/userRoleAssign.js

@@ -0,0 +1,46 @@
+import { eq } from "drizzle-orm";
+import { chatAppendAudit } from "../chat/chatAppendAudit.js";
+import { CollaborationError } from "../chat/types.js";
+import { userRequireActiveHuman } from "../chat/userRequireActiveHuman.js";
+import { withTransaction } from "../drizzle.js";
+import { roles, userRoles, users } from "../schema.js";
+import { permissionMutationRecord } from "./impl/permissionMutationRecord.js";
+import { userRequirePermission } from "./userRequirePermission.js";
+/**
+ * Inserts one userRoles assignment for an active human user, synchronizing users when the durable admin marker is assigned.
+ * The grant, audit record, and targeted permission invalidation commit atomically so authorization never changes silently.
+ */
+export async function userRoleAssign(executor, input) {
+    return withTransaction(executor, async (tx) => {
+        await userRequirePermission(tx, input.actorUserId, "manageAdminRoles");
+        await userRequireActiveHuman(tx, input.userId);
+        const [role] = await tx.select().from(roles).where(eq(roles.id, input.roleId)).limit(1);
+        if (!role)
+            throw new CollaborationError("not_found", "Role was not found");
+        await tx
+            .insert(userRoles)
+            .values({
+            userId: input.userId,
+            roleId: input.roleId,
+            assignedByUserId: input.actorUserId,
+        })
+            .onConflictDoNothing();
+        if (role.builtinKind === "admin")
+            await tx.update(users).set({ role: "admin" }).where(eq(users.id, input.userId));
+        await chatAppendAudit(tx, {
+            actorUserId: input.actorUserId,
+            action: "user.role_assigned",
+            targetType: "user",
+            targetId: input.userId,
+            after: { roleId: input.roleId },
+        });
+        return permissionMutationRecord(tx, {
+            actorUserId: input.actorUserId,
+            affectedUserIds: [input.userId],
+            broadcast: false,
+            entityId: input.userId,
+            kind: "permissions.changed",
+        });
+    });
+}
+//# sourceMappingURL=userRoleAssign.js.map

package/packages/happy2-server/dist/modules/permission/userRoleAssign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"userRoleAssign.js","sourceRoot":"","sources":["../../../sources/modules/permission/userRoleAssign.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAC3E,OAAO,EAAwB,eAAe,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAE9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAChC,QAAyB,EACzB,KAA8D;IAE9D,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1C,MAAM,qBAAqB,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;QACvE,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxF,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,kBAAkB,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;QAC3E,MAAM,EAAE;aACH,MAAM,CAAC,SAAS,CAAC;aACjB,MAAM,CAAC;YACJ,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,gBAAgB,EAAE,KAAK,CAAC,WAAW;SACtC,CAAC;aACD,mBAAmB,EAAE,CAAC;QAC3B,IAAI,IAAI,CAAC,WAAW,KAAK,OAAO;YAC5B,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QACpF,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,oBAAoB;YAC5B,UAAU,EAAE,MAAM;YAClB,QAAQ,EAAE,KAAK,CAAC,MAAM;YACtB,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;SAClC,CAAC,CAAC;QACH,OAAO,wBAAwB,CAAC,EAAE,EAAE;YAChC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,eAAe,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;YAC/B,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,KAAK,CAAC,MAAM;YACtB,IAAI,EAAE,qBAAqB;SAC9B,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC"}