libre-webui 0.22.1 → 0.23.0

package/backend/dist/services/authorizationService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorizationService.js","sourceRoot":"","sources":["../../src/services/authorizationService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAMzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAS/D,MAAM,CAAC,MAAM,wBAAwB,GAAqC;IACxE,SAAS;IACT,gBAAgB;IAChB,MAAM;IACN,sBAAsB;IACtB,UAAU;IACV,SAAS;CACV,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,KAAc,EACkB,EAAE,CAClC,OAAO,KAAK,KAAK,QAAQ;IACxB,wBAA8C,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAiBlE,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAE3C,YAAY,OAAO,GAAG,eAAe;QACnC,KAAK,CAAC,OAAO,CAAC,CAAC;QAFR,eAAU,GAAG,GAAG,CAAC;QAGxB,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC;AAE/E,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,cAAc,CAAC,iBAAiB,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC;AAEnE,sEAAsE;AACtE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,MAAc,EAAqB,EAAE,CAC1E,QAAQ,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;AAEhD,MAAM,mBAAmB,GAAG,CAC1B,OAAwB,EACxB,MAAmB,EACV,EAAE;IACX,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,OAAO,KAAK,OAAO,IAAI,OAAO,KAAK,OAAO,CAAC;IAC1E,OAAO,OAAO,KAAK,OAAO,CAAC;AAC7B,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,KAAK,EAC3B,KAAiB,EACjB,SAAoB,EACI,EAAE;IAC1B,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAC3E,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,MAAM;YACT,OAAO,CAAC,MAAM,iBAAiB,EAAE,CAAC,KAAK,WAAW;gBAChD,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,2BAA2B,EAAE;gBACxD,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;QACjE,KAAK,gBAAgB;YACnB,OAAO,CAAC,MAAM,oBAAoB,EAAE,CAAC,KAAK,WAAW;gBACnD,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,2BAA2B,EAAE;gBACxD,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;QACjE,KAAK,YAAY;YACf,OAAO,CAAC,MAAM,sBAAsB,EAAE,CAAC,KAAK,WAAW;gBACrD,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,2BAA2B,EAAE;gBACxD,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;QACjE,KAAK,QAAQ;YACX,OAAO,CAAC,MAAM,gBAAgB,EAAE,CAAC;gBAC/B,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE;gBAC9C,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACvD,CAAC;AACH,CAAC,CAAC;AAEF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,MAAc,EACd,YAAmC,EACnC,UAAkB,EACoB,EAAE;IACxC,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,MAAM,CAAC,CAAC;IACtD,OAAO,QAAQ,EAAE,CAAC,MAAM,CAAC,aAAa,CACpC,YAAY,EACZ,UAAU,EACV,MAAM,EACN,QAAQ,CACT,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAC5B,KAAiB,EACjB,MAAmB,EACnB,QAAuB,EACC,EAAE;IAC1B,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC5D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACxD,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,WAAW,GACf,QAAQ,CAAC,WAAW;QACpB,CAAC,MAAM,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IACxD,IAAI,WAAW,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC5C,CAAC;IACD,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,kBAAkB,CACrC,KAAK,CAAC,MAAM,EACZ,QAAQ,CAAC,IAAI,EACb,QAAQ,CAAC,EAAE,CACZ,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CACrC,mBAAmB,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CAC9C,CAAC;IACF,IAAI,UAAU,EAAE,CAAC;QACf,OAAO;YACL,OAAO,EAAE,IAAI;YACb,MAAM,EACJ,UAAU,CAAC,cAAc,KAAK,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa;SACxE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,UAAU;KACnE,CAAC;AACJ,CAAC,CAAC;AAEF,qDAAqD;AACrD,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EACpC,KAAiB,EACjB,MAAmB,EACnB,QAAuB,EACC,EAAE;IAC1B,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC1D,IAAI,CAAC,QAAQ,CAAC,OAAO;QAAE,MAAM,IAAI,kBAAkB,EAAE,CAAC;IACtD,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAkBF;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,EAAE,IAI5C,EAAgC,EAAE;IACjC,MAAM,KAAK,GAAe;QACxB,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClE,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACjE,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;QACxD,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC;QAClE,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC;QAC9D,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;KAC3D,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG;QAChB,GAAG,CAAC,MAAM,QAAQ,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;KAC/D,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,SAAS,CAAC,IAAI,CACZ,GAAG,CAAC,MAAM,QAAQ,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CACjE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI;QACvB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;QAC3B,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACjE,QAAQ,EAAE;YACR,IAAI,EAAE,IAAI,CAAC,OAAO;YAClB,gBAAgB,EAAE,aAAa,CAAC,OAAO;YACvC,YAAY,EAAE,SAAS,CAAC,OAAO;YAC/B,MAAM,EAAE,MAAM,CAAC,OAAO;SACvB;QACD,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC9B,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,YAAY,EAAE,KAAK,CAAC,aAAa;YACjC,UAAU,EAAE,KAAK,CAAC,WAAW;YAC7B,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,GAAG,EAAE,KAAK,CAAC,cAAc;YACzB,WAAW,EAAE,KAAK,CAAC,YAAY;SAChC,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC,CAAC"}

package/backend/dist/services/groupService.d.ts

@@ -0,0 +1,27 @@
+import type { StoredGroupMemberRecord, StoredGroupRecord } from '../persistence/index.js';
+export declare class GroupError extends Error {
+    readonly statusCode: number;
+    constructor(message: string, statusCode: number);
+}
+export interface GroupWithMembers extends StoredGroupRecord {
+    members: StoredGroupMemberRecord[];
+}
+export declare const listGroups: () => Promise<StoredGroupRecord[]>;
+export declare const listGroupsWithMembers: () => Promise<GroupWithMembers[]>;
+export declare const getGroup: (groupId: string) => Promise<StoredGroupRecord | null>;
+export declare const getGroupByName: (name: string) => Promise<StoredGroupRecord | null>;
+export declare const listGroupsForUser: (userId: string) => Promise<StoredGroupRecord[]>;
+export declare const createGroup: (input: {
+    name: string;
+    description?: string | null;
+}, actorUserId: string) => Promise<StoredGroupRecord>;
+export declare const updateGroup: (groupId: string, patch: {
+    name?: string;
+    description?: string | null;
+}, actorUserId: string) => Promise<StoredGroupRecord | null>;
+export declare const deleteGroup: (groupId: string, actorUserId: string) => Promise<boolean>;
+export declare const addGroupMember: (groupId: string, userId: string, actorUserId: string) => Promise<boolean>;
+export declare const removeGroupMember: (groupId: string, userId: string, actorUserId: string) => Promise<boolean>;
+/** Deletion hygiene: strip a retiring user from groups and their grants. */
+export declare const removeUserFromSecurityPrincipals: (userId: string) => Promise<void>;
+//# sourceMappingURL=groupService.d.ts.map

package/backend/dist/services/groupService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"groupService.d.ts","sourceRoot":"","sources":["../../src/services/groupService.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EACV,uBAAuB,EACvB,iBAAiB,EAClB,MAAM,yBAAyB,CAAC;AAKjC,qBAAa,UAAW,SAAQ,KAAK;IAGjC,QAAQ,CAAC,UAAU,EAAE,MAAM;IAF7B,YACE,OAAO,EAAE,MAAM,EACN,UAAU,EAAE,MAAM,EAI5B;CACF;AAiBD,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB;IACzD,OAAO,EAAE,uBAAuB,EAAE,CAAC;CACpC;AAED,eAAO,MAAM,UAAU,QAAO,OAAO,CAAC,iBAAiB,EAAE,CAC/B,CAAC;AAE3B,eAAO,MAAM,qBAAqB,QAAa,OAAO,CAAC,gBAAgB,EAAE,CAQxE,CAAC;AAEF,eAAO,MAAM,QAAQ,YAAa,MAAM,KAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CACtC,CAAC;AAEtC,eAAO,MAAM,cAAc,SACnB,MAAM,KACX,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAuC,CAAC;AAE3E,eAAO,MAAM,iBAAiB,WACpB,MAAM,KACb,OAAO,CAAC,iBAAiB,EAAE,CAAgD,CAAC;AAE/E,eAAO,MAAM,WAAW,UACf;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,eACvC,MAAM,KAClB,OAAO,CAAC,iBAAiB,CAwC3B,CAAC;AAEF,eAAO,MAAM,WAAW,YACb,MAAM,SACR;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,eACxC,MAAM,KAClB,OAAO,CAAC,iBAAiB,GAAG,IAAI,CA6ClC,CAAC;AAEF,eAAO,MAAM,WAAW,YACb,MAAM,eACF,MAAM,KAClB,OAAO,CAAC,OAAO,CAwBjB,CAAC;AAEF,eAAO,MAAM,cAAc,YAChB,MAAM,UACP,MAAM,eACD,MAAM,KAClB,OAAO,CAAC,OAAO,CAoCjB,CAAC;AAEF,eAAO,MAAM,iBAAiB,YACnB,MAAM,UACP,MAAM,eACD,MAAM,KAClB,OAAO,CAAC,OAAO,CAsBjB,CAAC;AAEF,4EAA4E;AAC5E,eAAO,MAAM,gCAAgC,WACnC,MAAM,KACb,OAAO,CAAC,IAAI,CAGd,CAAC"}

package/backend/dist/services/groupService.js

@@ -0,0 +1,245 @@
+/*
+ * Libre WebUI
+ * Copyright (C) 2025 Kroonen AI, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Groups and memberships (IAM-02).
+ *
+ * Groups are administrator-managed principals for grants and external
+ * identity mapping. Every mutation commits atomically with its security
+ * audit event (AUDIT-02): the SQLite path runs both writes in one owned
+ * synchronous transaction, the PostgreSQL path in one serializable
+ * transaction, so a group change can never exist without its audit trail.
+ *
+ * Revocation is immediate by construction: membership is read from the
+ * database at decision time, never cached.
+ */
+import { randomUUID } from 'node:crypto';
+import { getPersistence } from '../persistence/index.js';
+import { encryptionService } from './encryptionService.js';
+import { buildAuditEvent } from './securityAuditService.js';
+import { userModel } from '../models/userModel.js';
+export class GroupError extends Error {
+    constructor(message, statusCode) {
+        super(message);
+        this.statusCode = statusCode;
+        this.name = 'GroupError';
+    }
+}
+const GROUP_NAME_PATTERN = /^[\p{L}\p{N}][\p{L}\p{N} ._-]{0,127}$/u;
+const normalizeName = (name) => {
+    const trimmed = name.trim();
+    if (!GROUP_NAME_PATTERN.test(trimmed)) {
+        throw new GroupError('Group names are 1-128 letters, numbers, spaces, dots, underscores, or dashes', 400);
+    }
+    return trimmed;
+};
+const security = () => getPersistence(encryptionService).repositories.security;
+export const listGroups = () => security().groups.list();
+export const listGroupsWithMembers = async () => {
+    const groups = await security().groups.list();
+    return Promise.all(groups.map(async (group) => ({
+        ...group,
+        members: await security().groups.listMembers(group.id),
+    })));
+};
+export const getGroup = (groupId) => security().groups.findById(groupId);
+export const getGroupByName = (name) => security().groups.findByName(name);
+export const listGroupsForUser = (userId) => security().groups.listGroupsForUser(userId);
+export const createGroup = async (input, actorUserId) => {
+    const name = normalizeName(input.name);
+    const now = Date.now();
+    const record = {
+        id: randomUUID(),
+        name,
+        description: input.description?.trim() || null,
+        created_by: actorUserId,
+        created_at: now,
+        updated_at: now,
+    };
+    const audit = buildAuditEvent({
+        action: 'group.create',
+        result: 'success',
+        actorUserId,
+        targetType: 'group',
+        targetId: record.id,
+        details: { name },
+    });
+    const persistence = getPersistence(encryptionService);
+    if (persistence.dialect === 'sqlite') {
+        await persistence.transaction(({ security: tx }) => {
+            if (tx.groups.findByName(name)) {
+                throw new GroupError('A group with this name already exists', 409);
+            }
+            tx.groups.insert(record);
+            tx.audit.insert(audit);
+            return undefined;
+        });
+        return record;
+    }
+    await persistence.transaction(async ({ security: tx }) => {
+        if (await tx.groups.findByName(name)) {
+            throw new GroupError('A group with this name already exists', 409);
+        }
+        await tx.groups.insert(record);
+        await tx.audit.insert(audit);
+    });
+    return record;
+};
+export const updateGroup = async (groupId, patch, actorUserId) => {
+    const name = patch.name !== undefined ? normalizeName(patch.name) : undefined;
+    const update = {
+        ...(name !== undefined ? { name } : {}),
+        ...(patch.description !== undefined
+            ? { description: patch.description?.trim() || null }
+            : {}),
+        updated_at: Date.now(),
+    };
+    const audit = buildAuditEvent({
+        action: 'group.update',
+        result: 'success',
+        actorUserId,
+        targetType: 'group',
+        targetId: groupId,
+        details: { ...(name !== undefined ? { name } : {}) },
+    });
+    const persistence = getPersistence(encryptionService);
+    if (persistence.dialect === 'sqlite') {
+        const updated = await persistence.transaction(({ security: tx }) => {
+            if (name !== undefined) {
+                const existing = tx.groups.findByName(name);
+                if (existing && existing.id !== groupId) {
+                    throw new GroupError('A group with this name already exists', 409);
+                }
+            }
+            const applied = tx.groups.update(groupId, update);
+            if (applied)
+                tx.audit.insert(audit);
+            return applied;
+        });
+        return updated ? security().groups.findById(groupId) : null;
+    }
+    const updated = await persistence.transaction(async ({ security: tx }) => {
+        if (name !== undefined) {
+            const existing = await tx.groups.findByName(name);
+            if (existing && existing.id !== groupId) {
+                throw new GroupError('A group with this name already exists', 409);
+            }
+        }
+        const applied = await tx.groups.update(groupId, update);
+        if (applied)
+            await tx.audit.insert(audit);
+        return applied;
+    });
+    return updated ? security().groups.findById(groupId) : null;
+};
+export const deleteGroup = async (groupId, actorUserId) => {
+    const audit = buildAuditEvent({
+        action: 'group.delete',
+        result: 'success',
+        actorUserId,
+        targetType: 'group',
+        targetId: groupId,
+    });
+    const persistence = getPersistence(encryptionService);
+    if (persistence.dialect === 'sqlite') {
+        return persistence.transaction(({ security: tx }) => {
+            // Grants held by the group disappear with it; memberships cascade.
+            tx.grants.deleteForPrincipal('group', groupId);
+            const deleted = tx.groups.delete(groupId);
+            if (deleted)
+                tx.audit.insert(audit);
+            return deleted;
+        });
+    }
+    return persistence.transaction(async ({ security: tx }) => {
+        await tx.grants.deleteForPrincipal('group', groupId);
+        const deleted = await tx.groups.delete(groupId);
+        if (deleted)
+            await tx.audit.insert(audit);
+        return deleted;
+    });
+};
+export const addGroupMember = async (groupId, userId, actorUserId) => {
+    const user = await userModel.getUserById(userId);
+    if (!user)
+        throw new GroupError('User not found', 404);
+    const member = {
+        group_id: groupId,
+        user_id: userId,
+        added_by: actorUserId,
+        added_at: Date.now(),
+    };
+    const audit = buildAuditEvent({
+        action: 'group.member-add',
+        result: 'success',
+        actorUserId,
+        targetType: 'group',
+        targetId: groupId,
+        details: { userId },
+    });
+    const persistence = getPersistence(encryptionService);
+    if (persistence.dialect === 'sqlite') {
+        return persistence.transaction(({ security: tx }) => {
+            if (!tx.groups.findById(groupId)) {
+                throw new GroupError('Group not found', 404);
+            }
+            const added = tx.groups.addMember(member);
+            if (added)
+                tx.audit.insert(audit);
+            return added;
+        });
+    }
+    return persistence.transaction(async ({ security: tx }) => {
+        if (!(await tx.groups.findById(groupId))) {
+            throw new GroupError('Group not found', 404);
+        }
+        const added = await tx.groups.addMember(member);
+        if (added)
+            await tx.audit.insert(audit);
+        return added;
+    });
+};
+export const removeGroupMember = async (groupId, userId, actorUserId) => {
+    const audit = buildAuditEvent({
+        action: 'group.member-remove',
+        result: 'success',
+        actorUserId,
+        targetType: 'group',
+        targetId: groupId,
+        details: { userId },
+    });
+    const persistence = getPersistence(encryptionService);
+    if (persistence.dialect === 'sqlite') {
+        return persistence.transaction(({ security: tx }) => {
+            const removed = tx.groups.removeMember(groupId, userId);
+            if (removed)
+                tx.audit.insert(audit);
+            return removed;
+        });
+    }
+    return persistence.transaction(async ({ security: tx }) => {
+        const removed = await tx.groups.removeMember(groupId, userId);
+        if (removed)
+            await tx.audit.insert(audit);
+        return removed;
+    });
+};
+/** Deletion hygiene: strip a retiring user from groups and their grants. */
+export const removeUserFromSecurityPrincipals = async (userId) => {
+    await security().groups.removeUserFromAllGroups(userId);
+    await security().grants.deleteForPrincipal('user', userId);
+};
+//# sourceMappingURL=groupService.js.map

package/backend/dist/services/groupService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"groupService.js","sourceRoot":"","sources":["../../src/services/groupService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAKzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAEnD,MAAM,OAAO,UAAW,SAAQ,KAAK;IACnC,YACE,OAAe,EACN,UAAkB;QAE3B,KAAK,CAAC,OAAO,CAAC,CAAC;0BAFN,UAAU;QAGnB,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,kBAAkB,GAAG,wCAAwC,CAAC;AAEpE,MAAM,aAAa,GAAG,CAAC,IAAY,EAAU,EAAE;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,UAAU,CAClB,8EAA8E,EAC9E,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AAEF,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC;AAM/E,MAAM,CAAC,MAAM,UAAU,GAAG,GAAiC,EAAE,CAC3D,QAAQ,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;AAE3B,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,IAAiC,EAAE;IAC3E,MAAM,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9C,OAAO,OAAO,CAAC,GAAG,CAChB,MAAM,CAAC,GAAG,CAAC,KAAK,EAAC,KAAK,EAAC,EAAE,CAAC,CAAC;QACzB,GAAG,KAAK;QACR,OAAO,EAAE,MAAM,QAAQ,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;KACvD,CAAC,CAAC,CACJ,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAqC,EAAE,CAC7E,QAAQ,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAEtC,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,IAAY,EACuB,EAAE,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AAE3E,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,MAAc,EACgB,EAAE,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;AAE/E,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAC9B,KAAoD,EACpD,WAAmB,EACS,EAAE;IAC9B,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAsB;QAChC,EAAE,EAAE,UAAU,EAAE;QAChB,IAAI;QACJ,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,IAAI;QAC9C,UAAU,EAAE,WAAW;QACvB,UAAU,EAAE,GAAG;QACf,UAAU,EAAE,GAAG;KAChB,CAAC;IACF,MAAM,KAAK,GAAG,eAAe,CAAC;QAC5B,MAAM,EAAE,cAAc;QACtB,MAAM,EAAE,SAAS;QACjB,WAAW;QACX,UAAU,EAAE,OAAO;QACnB,QAAQ,EAAE,MAAM,CAAC,EAAE;QACnB,OAAO,EAAE,EAAE,IAAI,EAAE;KAClB,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;IACtD,IAAI,WAAW,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,WAAW,CAAC,WAAW,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE;YACjD,IAAI,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,UAAU,CAAC,uCAAuC,EAAE,GAAG,CAAC,CAAC;YACrE,CAAC;YACD,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACzB,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE;QACvD,IAAI,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,UAAU,CAAC,uCAAuC,EAAE,GAAG,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAC9B,OAAe,EACf,KAAqD,EACrD,WAAmB,EACgB,EAAE;IACrC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,MAAM,MAAM,GAAG;QACb,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS;YACjC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE;YACpD,CAAC,CAAC,EAAE,CAAC;QACP,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;KACvB,CAAC;IACF,MAAM,KAAK,GAAG,eAAe,CAAC;QAC5B,MAAM,EAAE,cAAc;QACtB,MAAM,EAAE,SAAS;QACjB,WAAW;QACX,UAAU,EAAE,OAAO;QACnB,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;KACrD,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;IACtD,IAAI,WAAW,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE;YACjE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,MAAM,QAAQ,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;gBAC5C,IAAI,QAAQ,IAAI,QAAQ,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;oBACxC,MAAM,IAAI,UAAU,CAAC,uCAAuC,EAAE,GAAG,CAAC,CAAC;gBACrE,CAAC;YACH,CAAC;YACD,MAAM,OAAO,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAClD,IAAI,OAAO;gBAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACpC,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE;QACvE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,QAAQ,IAAI,QAAQ,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;gBACxC,MAAM,IAAI,UAAU,CAAC,uCAAuC,EAAE,GAAG,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxD,IAAI,OAAO;YAAE,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1C,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9D,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAC9B,OAAe,EACf,WAAmB,EACD,EAAE;IACpB,MAAM,KAAK,GAAG,eAAe,CAAC;QAC5B,MAAM,EAAE,cAAc;QACtB,MAAM,EAAE,SAAS;QACjB,WAAW;QACX,UAAU,EAAE,OAAO;QACnB,QAAQ,EAAE,OAAO;KAClB,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;IACtD,IAAI,WAAW,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACrC,OAAO,WAAW,CAAC,WAAW,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE;YAClD,mEAAmE;YACnE,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC/C,MAAM,OAAO,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,OAAO;gBAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACpC,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE;QACxD,MAAM,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,OAAO;YAAE,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1C,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EACjC,OAAe,EACf,MAAc,EACd,WAAmB,EACD,EAAE;IACpB,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;IACvD,MAAM,MAAM,GAA4B;QACtC,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,MAAM;QACf,QAAQ,EAAE,WAAW;QACrB,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;KACrB,CAAC;IACF,MAAM,KAAK,GAAG,eAAe,CAAC;QAC5B,MAAM,EAAE,kBAAkB;QAC1B,MAAM,EAAE,SAAS;QACjB,WAAW;QACX,UAAU,EAAE,OAAO;QACnB,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,EAAE,MAAM,EAAE;KACpB,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;IACtD,IAAI,WAAW,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACrC,OAAO,WAAW,CAAC,WAAW,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE;YAClD,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;YAC/C,CAAC;YACD,MAAM,KAAK,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,KAAK;gBAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAClC,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE;QACxD,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,KAAK;YAAE,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EACpC,OAAe,EACf,MAAc,EACd,WAAmB,EACD,EAAE;IACpB,MAAM,KAAK,GAAG,eAAe,CAAC;QAC5B,MAAM,EAAE,qBAAqB;QAC7B,MAAM,EAAE,SAAS;QACjB,WAAW;QACX,UAAU,EAAE,OAAO;QACnB,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,EAAE,MAAM,EAAE;KACpB,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;IACtD,IAAI,WAAW,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACrC,OAAO,WAAW,CAAC,WAAW,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE;YAClD,MAAM,OAAO,GAAG,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACxD,IAAI,OAAO;gBAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACpC,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE;QACxD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9D,IAAI,OAAO;YAAE,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1C,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,gCAAgC,GAAG,KAAK,EACnD,MAAc,EACC,EAAE;IACjB,MAAM,QAAQ,EAAE,CAAC,MAAM,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;IACxD,MAAM,QAAQ,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAC7D,CAAC,CAAC"}

package/backend/dist/services/groupVectorPrincipalResolver.d.ts

@@ -0,0 +1,12 @@
+import type { VectorPrincipalResolver } from '../platform/storage/vectorStore.js';
+/**
+ * Resolves a user's group principals from the trust-foundation membership
+ * table, so vector-store ACL predicates can honor group grants. Memberships
+ * are read fresh on every query: removing a member revokes their
+ * group-granted retrieval immediately.
+ */
+export declare class GroupVectorPrincipalResolver implements VectorPrincipalResolver {
+    resolveGroupIds(userId: string): Promise<readonly string[]>;
+}
+export declare const groupVectorPrincipalResolver: GroupVectorPrincipalResolver;
+//# sourceMappingURL=groupVectorPrincipalResolver.d.ts.map

package/backend/dist/services/groupVectorPrincipalResolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"groupVectorPrincipalResolver.d.ts","sourceRoot":"","sources":["../../src/services/groupVectorPrincipalResolver.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAIlF;;;;;GAKG;AACH,qBAAa,4BAA6B,YAAW,uBAAuB;IACpE,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAKhE;CACF;AAED,eAAO,MAAM,4BAA4B,8BAAqC,CAAC"}

package/backend/dist/services/groupVectorPrincipalResolver.js

@@ -0,0 +1,33 @@
+/*
+ * Libre WebUI
+ * Copyright (C) 2025 Kroonen AI, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { getPersistence } from '../persistence/index.js';
+import { encryptionService } from './encryptionService.js';
+/**
+ * Resolves a user's group principals from the trust-foundation membership
+ * table, so vector-store ACL predicates can honor group grants. Memberships
+ * are read fresh on every query: removing a member revokes their
+ * group-granted retrieval immediately.
+ */
+export class GroupVectorPrincipalResolver {
+    async resolveGroupIds(userId) {
+        if (!userId)
+            return [];
+        return getPersistence(encryptionService).repositories.security.groups.listGroupIdsForUser(userId);
+    }
+}
+export const groupVectorPrincipalResolver = new GroupVectorPrincipalResolver();
+//# sourceMappingURL=groupVectorPrincipalResolver.js.map

package/backend/dist/services/groupVectorPrincipalResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"groupVectorPrincipalResolver.js","sourceRoot":"","sources":["../../src/services/groupVectorPrincipalResolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D;;;;;GAKG;AACH,MAAM,OAAO,4BAA4B;IACvC,KAAK,CAAC,eAAe,CAAC,MAAc;QAClC,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC;QACvB,OAAO,cAAc,CACnB,iBAAiB,CAClB,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC7D,CAAC;CACF;AAED,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,4BAA4B,EAAE,CAAC"}

package/backend/dist/services/modelAccessService.d.ts

@@ -6,6 +6,7 @@ export declare function getModelDownloadMode(): Promise<ModelDownloadMode>;
 export declare function setModelDownloadMode(mode: ModelDownloadMode): Promise<void>;
 /** Whether a user may pull models right now. */
 export declare function userCanDownloadModels(user: {
+    id?: string;
     role?: string;
     status?: string;
 }): Promise<boolean>;

package/backend/dist/services/modelAccessService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"modelAccessService.d.ts","sourceRoot":"","sources":["../../src/services/modelAccessService.ts"],"names":[],"mappings":"AA4BA,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,WAAW,CAAC;AAEvD,eAAO,MAAM,oBAAoB,EAAE,SAAS,iBAAiB,EAG5D,CAAC;AAEF,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAE7D,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,iBAAiB,CAK5B;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAOvE;AAED,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,IAAI,CAAC,CAKf;AAED,gDAAgD;AAChD,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,OAAO,CAAC,CAInB"}
+{"version":3,"file":"modelAccessService.d.ts","sourceRoot":"","sources":["../../src/services/modelAccessService.ts"],"names":[],"mappings":"AA4BA,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,WAAW,CAAC;AAEvD,eAAO,MAAM,oBAAoB,EAAE,SAAS,iBAAiB,EAG5D,CAAC;AAEF,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAE7D,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,iBAAiB,CAK5B;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAOvE;AAED,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,IAAI,CAAC,CAKf;AAED,gDAAgD;AAChD,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,OAAO,CAAC,CAQnB"}

package/backend/dist/services/modelAccessService.js

@@ -49,10 +49,8 @@ export async function setModelDownloadMode(mode) {
 }
 /** Whether a user may pull models right now. */
 export async function userCanDownloadModels(user) {
-    if (user.status !== undefined && user.status !== 'active')
-        return false;
-    if (user.role === 'admin')
-        return true;
-    return (await getModelDownloadMode()) === 'all-users';
+    const { authorize } = await import('./authorizationService.js');
+    const decision = await authorize({ userId: user.id ?? '', role: user.role, status: user.status }, 'use', { type: 'feature', id: 'model-download' });
+    return decision.allowed;
 }
 //# sourceMappingURL=modelAccessService.js.map

package/backend/dist/services/modelAccessService.js.map

@@ -1 +1 @@
-{"version":3,"file":"modelAccessService.js","sourceRoot":"","sources":["../../src/services/modelAccessService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;;GAOG;AAEH,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAIhF,MAAM,CAAC,MAAM,oBAAoB,GAAiC;IAChE,QAAQ;IACR,WAAW;CACZ,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAE7D,MAAM,UAAU,mBAAmB,CACjC,KAAc;IAEd,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACxB,oBAA0C,CAAC,QAAQ,CAAC,KAAK,CAAC,CAC5D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,uBAAuB,CAAC,CAAC;QAC9D,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAuB;IAEvB,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,gCAAgC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,gBAAgB,CAAC,uBAAuB,EAAE,IAAI,CAAC,CAAC;AACxD,CAAC;AAED,gDAAgD;AAChD,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAG3C;IACC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxE,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,CAAC,MAAM,oBAAoB,EAAE,CAAC,KAAK,WAAW,CAAC;AACxD,CAAC"}
+{"version":3,"file":"modelAccessService.js","sourceRoot":"","sources":["../../src/services/modelAccessService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;;GAOG;AAEH,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAIhF,MAAM,CAAC,MAAM,oBAAoB,GAAiC;IAChE,QAAQ;IACR,WAAW;CACZ,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAE7D,MAAM,UAAU,mBAAmB,CACjC,KAAc;IAEd,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACxB,oBAA0C,CAAC,QAAQ,CAAC,KAAK,CAAC,CAC5D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,uBAAuB,CAAC,CAAC;QAC9D,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAuB;IAEvB,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,gCAAgC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,gBAAgB,CAAC,uBAAuB,EAAE,IAAI,CAAC,CAAC;AACxD,CAAC;AAED,gDAAgD;AAChD,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAI3C;IACC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAC9B,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAC/D,KAAK,EACL,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAC1C,CAAC;IACF,OAAO,QAAQ,CAAC,OAAO,CAAC;AAC1B,CAAC"}

package/backend/dist/services/oauthSecurity.d.ts

@@ -1,7 +1,18 @@
 import type { Request, Response } from 'express';
-export type OAuthProvider = 'github' | 'huggingface';
+export type OAuthProvider = 'github' | 'huggingface' | 'oidc';
 /** Start a browser-bound OAuth flow and return the state sent to the provider. */
 export declare const beginOAuthFlow: (req: Request, res: Response, provider: OAuthProvider) => string;
+/**
+ * Start a browser-bound OAuth flow that also needs per-flow secrets (PKCE
+ * verifier, OIDC nonce). The payload rides in the same HttpOnly state
+ * cookie, encoded alongside the CSRF state.
+ */
+export declare const beginOAuthFlowWithPayload: (req: Request, res: Response, provider: OAuthProvider, payload: Record<string, string>) => string;
+/**
+ * Validate state and return the per-flow payload stored at flow start.
+ * The cookie is always cleared, so a callback cannot be replayed.
+ */
+export declare const consumeOAuthStatePayload: (req: Request, res: Response, provider: OAuthProvider, receivedState: string) => Record<string, string> | null;
 /** Validate and clear OAuth state so a callback cannot be replayed in-browser. */
 export declare const consumeOAuthState: (req: Request, res: Response, provider: OAuthProvider, receivedState: string) => boolean;
 /**

package/backend/dist/services/oauthSecurity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauthSecurity.d.ts","sourceRoot":"","sources":["../../src/services/oauthSecurity.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAiB,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEhE,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,aAAa,CAAC;AAgErD,kFAAkF;AAClF,eAAO,MAAM,cAAc,QACpB,OAAO,OACP,QAAQ,YACH,aAAa,KACtB,MAQF,CAAC;AAEF,kFAAkF;AAClF,eAAO,MAAM,iBAAiB,QACvB,OAAO,OACP,QAAQ,YACH,aAAa,iBACR,MAAM,KACpB,OAQF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,qBAAqB,SAC1B,OAAO,OACR,QAAQ,SACN,MAAM,KACZ,IAQF,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,yBAAyB,QAC/B,OAAO,OACP,QAAQ,KACZ,MAAM,GAAG,SASX,CAAC"}
+{"version":3,"file":"oauthSecurity.d.ts","sourceRoot":"","sources":["../../src/services/oauthSecurity.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAiB,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEhE,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,aAAa,GAAG,MAAM,CAAC;AAgE9D,kFAAkF;AAClF,eAAO,MAAM,cAAc,QACpB,OAAO,OACP,QAAQ,YACH,aAAa,KACtB,MAQF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,QAC/B,OAAO,OACP,QAAQ,YACH,aAAa,WACd,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC9B,MAYF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,QAC9B,OAAO,OACP,QAAQ,YACH,aAAa,iBACR,MAAM,KACpB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAyB3B,CAAC;AAEF,kFAAkF;AAClF,eAAO,MAAM,iBAAiB,QACvB,OAAO,OACP,QAAQ,YACH,aAAa,iBACR,MAAM,KACpB,OAQF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,qBAAqB,SAC1B,OAAO,OACR,QAAQ,SACN,MAAM,KACZ,IAQF,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,yBAAyB,QAC/B,OAAO,OACP,QAAQ,KACZ,MAAM,GAAG,SASX,CAAC"}

package/backend/dist/services/oauthSecurity.js

@@ -67,6 +67,47 @@ export const beginOAuthFlow = (req, res, provider) => {
     res.cookie(stateCookieName(provider), state, cookieOptions(req, stateCookiePath(provider), STATE_TTL_MS));
     return state;
 };
+/**
+ * Start a browser-bound OAuth flow that also needs per-flow secrets (PKCE
+ * verifier, OIDC nonce). The payload rides in the same HttpOnly state
+ * cookie, encoded alongside the CSRF state.
+ */
+export const beginOAuthFlowWithPayload = (req, res, provider, payload) => {
+    const state = randomBytes(32).toString('base64url');
+    const envelope = Buffer.from(JSON.stringify({ state, ...payload }), 'utf8').toString('base64url');
+    res.cookie(stateCookieName(provider), envelope, cookieOptions(req, stateCookiePath(provider), STATE_TTL_MS));
+    return state;
+};
+/**
+ * Validate state and return the per-flow payload stored at flow start.
+ * The cookie is always cleared, so a callback cannot be replayed.
+ */
+export const consumeOAuthStatePayload = (req, res, provider, receivedState) => {
+    const path = stateCookiePath(provider);
+    const raw = readCookie(req, stateCookieName(provider));
+    res.clearCookie(stateCookieName(provider), clearCookieOptions(req, path));
+    if (!raw || !receivedState)
+        return null;
+    try {
+        const parsed = JSON.parse(Buffer.from(raw, 'base64url').toString('utf8'));
+        if (!parsed || typeof parsed !== 'object')
+            return null;
+        const envelope = parsed;
+        if (typeof envelope.state !== 'string' ||
+            !secureEqual(envelope.state, receivedState)) {
+            return null;
+        }
+        const payload = {};
+        for (const [key, value] of Object.entries(envelope)) {
+            if (key !== 'state' && typeof value === 'string')
+                payload[key] = value;
+        }
+        return payload;
+    }
+    catch {
+        return null;
+    }
+};
 /** Validate and clear OAuth state so a callback cannot be replayed in-browser. */
 export const consumeOAuthState = (req, res, provider, receivedState) => {
     const path = stateCookiePath(provider);

package/backend/dist/services/oauthSecurity.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauthSecurity.js","sourceRoot":"","sources":["../../src/services/oauthSecurity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAKtD,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACpC,MAAM,uBAAuB,GAAG,EAAE,GAAG,IAAI,CAAC;AAC1C,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AAClD,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAE9C,MAAM,eAAe,GAAG,CAAC,QAAuB,EAAU,EAAE,CAC1D,qBAAqB,QAAQ,EAAE,CAAC;AAElC,MAAM,eAAe,GAAG,CAAC,QAAuB,EAAU,EAAE,CAC1D,mBAAmB,QAAQ,EAAE,CAAC;AAEhC,MAAM,eAAe,GAAG,CAAC,GAAY,EAAW,EAAE,CAChD,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;AAEzC,MAAM,aAAa,GAAG,CACpB,GAAY,EACZ,IAAY,EACZ,MAAc,EACC,EAAE,CAAC,CAAC;IACnB,QAAQ,EAAE,IAAI;IACd,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC;IAC5B,QAAQ,EAAE,KAAK;IACf,IAAI;IACJ,MAAM;CACP,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,CAAC,GAAY,EAAE,IAAY,EAAiB,EAAE,CAAC,CAAC;IACzE,QAAQ,EAAE,IAAI;IACd,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC;IAC5B,QAAQ,EAAE,KAAK;IACf,IAAI;CACL,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,CAAC,GAAY,EAAE,IAAY,EAAsB,EAAE;IACpE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;IAClC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAE9B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,SAAS,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI;YAAE,SAAS;QAEvD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAClD,IAAI,CAAC;YACH,OAAO,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,KAAa,EAAW,EAAE;IAC3D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO,CACL,UAAU,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;QACxC,eAAe,CAAC,UAAU,EAAE,WAAW,CAAC,CACzC,CAAC;AACJ,CAAC,CAAC;AAEF,kFAAkF;AAClF,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,GAAY,EACZ,GAAa,EACb,QAAuB,EACf,EAAE;IACV,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,GAAG,CAAC,MAAM,CACR,eAAe,CAAC,QAAQ,CAAC,EACzB,KAAK,EACL,aAAa,CAAC,GAAG,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC,CAC5D,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,kFAAkF;AAClF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,GAAY,EACZ,GAAa,EACb,QAAuB,EACvB,aAAqB,EACZ,EAAE;IACX,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjE,GAAG,CAAC,WAAW,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IAE1E,OAAO,OAAO,CACZ,aAAa,IAAI,aAAa,IAAI,WAAW,CAAC,aAAa,EAAE,aAAa,CAAC,CAC5E,CAAC;AACJ,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,IAAa,EACb,GAAa,EACb,KAAa,EACP,EAAE;IACR,GAAG,CAAC,MAAM,CAAC,mBAAmB,EAAE,KAAK,EAAE;QACrC,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,uBAAuB;KAChC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,gFAAgF;AAChF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,GAAY,EACZ,GAAa,EACO,EAAE;IACtB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IACnD,GAAG,CAAC,WAAW,CAAC,mBAAmB,EAAE;QACnC,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,mBAAmB;KAC1B,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC,CAAC"}
+{"version":3,"file":"oauthSecurity.js","sourceRoot":"","sources":["../../src/services/oauthSecurity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAKtD,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACpC,MAAM,uBAAuB,GAAG,EAAE,GAAG,IAAI,CAAC;AAC1C,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AAClD,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAE9C,MAAM,eAAe,GAAG,CAAC,QAAuB,EAAU,EAAE,CAC1D,qBAAqB,QAAQ,EAAE,CAAC;AAElC,MAAM,eAAe,GAAG,CAAC,QAAuB,EAAU,EAAE,CAC1D,mBAAmB,QAAQ,EAAE,CAAC;AAEhC,MAAM,eAAe,GAAG,CAAC,GAAY,EAAW,EAAE,CAChD,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;AAEzC,MAAM,aAAa,GAAG,CACpB,GAAY,EACZ,IAAY,EACZ,MAAc,EACC,EAAE,CAAC,CAAC;IACnB,QAAQ,EAAE,IAAI;IACd,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC;IAC5B,QAAQ,EAAE,KAAK;IACf,IAAI;IACJ,MAAM;CACP,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,CAAC,GAAY,EAAE,IAAY,EAAiB,EAAE,CAAC,CAAC;IACzE,QAAQ,EAAE,IAAI;IACd,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC;IAC5B,QAAQ,EAAE,KAAK;IACf,IAAI;CACL,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,CAAC,GAAY,EAAE,IAAY,EAAsB,EAAE;IACpE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;IAClC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAE9B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,SAAS,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI;YAAE,SAAS;QAEvD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAClD,IAAI,CAAC;YACH,OAAO,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,KAAa,EAAW,EAAE;IAC3D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO,CACL,UAAU,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;QACxC,eAAe,CAAC,UAAU,EAAE,WAAW,CAAC,CACzC,CAAC;AACJ,CAAC,CAAC;AAEF,kFAAkF;AAClF,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,GAAY,EACZ,GAAa,EACb,QAAuB,EACf,EAAE;IACV,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,GAAG,CAAC,MAAM,CACR,eAAe,CAAC,QAAQ,CAAC,EACzB,KAAK,EACL,aAAa,CAAC,GAAG,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC,CAC5D,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,GAAY,EACZ,GAAa,EACb,QAAuB,EACvB,OAA+B,EACvB,EAAE;IACV,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAC1B,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC,EACrC,MAAM,CACP,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxB,GAAG,CAAC,MAAM,CACR,eAAe,CAAC,QAAQ,CAAC,EACzB,QAAQ,EACR,aAAa,CAAC,GAAG,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC,CAC5D,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACtC,GAAY,EACZ,GAAa,EACb,QAAuB,EACvB,aAAqB,EACU,EAAE;IACjC,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvD,GAAG,CAAC,WAAW,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1E,IAAI,CAAC,GAAG,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAChC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAC/C,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACvD,MAAM,QAAQ,GAAG,MAAiC,CAAC;QACnD,IACE,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ;YAClC,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,EAC3C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpD,IAAI,GAAG,KAAK,OAAO,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACzE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,kFAAkF;AAClF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,GAAY,EACZ,GAAa,EACb,QAAuB,EACvB,aAAqB,EACZ,EAAE;IACX,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjE,GAAG,CAAC,WAAW,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IAE1E,OAAO,OAAO,CACZ,aAAa,IAAI,aAAa,IAAI,WAAW,CAAC,aAAa,EAAE,aAAa,CAAC,CAC5E,CAAC;AACJ,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,IAAa,EACb,GAAa,EACb,KAAa,EACP,EAAE;IACR,GAAG,CAAC,MAAM,CAAC,mBAAmB,EAAE,KAAK,EAAE;QACrC,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,uBAAuB;KAChC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,gFAAgF;AAChF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,GAAY,EACZ,GAAa,EACO,EAAE;IACtB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IACnD,GAAG,CAAC,WAAW,CAAC,mBAAmB,EAAE;QACnC,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,mBAAmB;KAC1B,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC,CAAC"}

package/backend/dist/services/resourceGrantService.d.ts

@@ -0,0 +1,28 @@
+import type { StoredResourceGrantRecord } from '../persistence/index.js';
+import { type AuthzActor, type ShareableResourceType } from './authorizationService.js';
+export declare class ResourceGrantError extends Error {
+    readonly statusCode: number;
+    constructor(message: string, statusCode: number);
+}
+/**
+ * Whether the actor may manage sharing for a resource: the owner always
+ * can; other users need an `admin` grant on that resource.
+ */
+export declare const canManageGrants: (actor: AuthzActor, resourceType: ShareableResourceType, resourceId: string) => Promise<{
+    allowed: boolean;
+    ownerUserId: string | null;
+}>;
+export declare const listGrantsForResource: (actor: AuthzActor, resourceType: string, resourceId: string) => Promise<StoredResourceGrantRecord[]>;
+export declare const createGrant: (actor: AuthzActor, input: {
+    resourceType: string;
+    resourceId: string;
+    principalType: string;
+    principalId: string;
+    permission: string;
+}) => Promise<StoredResourceGrantRecord>;
+export declare const deleteGrant: (actor: AuthzActor, grantId: string) => Promise<boolean>;
+/** Resources shared with the actor (directly or via groups). */
+export declare const listGrantsForActor: (actor: AuthzActor) => Promise<StoredResourceGrantRecord[]>;
+/** Deletion hygiene: called when a resource is removed. */
+export declare const deleteGrantsForResource: (resourceType: string, resourceId: string) => Promise<number>;
+//# sourceMappingURL=resourceGrantService.d.ts.map

package/backend/dist/services/resourceGrantService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resourceGrantService.d.ts","sourceRoot":"","sources":["../../src/services/resourceGrantService.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAGV,yBAAyB,EAC1B,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAGL,KAAK,UAAU,EACf,KAAK,qBAAqB,EAC3B,MAAM,2BAA2B,CAAC;AAGnC,qBAAa,kBAAmB,SAAQ,KAAK;IAGzC,QAAQ,CAAC,UAAU,EAAE,MAAM;IAF7B,YACE,OAAO,EAAE,MAAM,EACN,UAAU,EAAE,MAAM,EAI5B;CACF;AAaD;;;GAGG;AACH,eAAO,MAAM,eAAe,UACnB,UAAU,gBACH,qBAAqB,cACvB,MAAM,KACjB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAU1D,CAAC;AAEF,eAAO,MAAM,qBAAqB,UACzB,UAAU,gBACH,MAAM,cACR,MAAM,KACjB,OAAO,CAAC,yBAAyB,EAAE,CAUrC,CAAC;AAEF,eAAO,MAAM,WAAW,UACf,UAAU,SACV;IACL,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB,KACA,OAAO,CAAC,yBAAyB,CAsEnC,CAAC;AAEF,eAAO,MAAM,WAAW,UACf,UAAU,WACR,MAAM,KACd,OAAO,CAAC,OAAO,CA2CjB,CAAC;AAEF,gEAAgE;AAChE,eAAO,MAAM,kBAAkB,UACtB,UAAU,KAChB,OAAO,CAAC,yBAAyB,EAAE,CAWrC,CAAC;AAEF,2DAA2D;AAC3D,eAAO,MAAM,uBAAuB,iBACpB,MAAM,cACR,MAAM,KACjB,OAAO,CAAC,MAAM,CAC8C,CAAC"}