mindoodb 0.0.85 → 0.0.88

package/dist/core/BaseMindooTenantDirectory.js

@@ -2,11 +2,13 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.BaseMindooTenantDirectory = void 0;
 const types_1 = require("./types");
+const errors_1 = require("./errors");
 const timeSource_1 = require("./utils/timeSource");
 const singleFlight_1 = require("./utils/singleFlight");
 const logging_1 = require("./logging");
 const grantKeys_1 = require("./accesscontrol/grantKeys");
 const types_2 = require("./accesscontrol/types");
+const builtinDbInvariants_1 = require("./builtinDbInvariants");
 const DirectoryStateNode_1 = require("./accesscontrol/DirectoryStateNode");
 const DirectoryTimeTravelIndex_1 = require("./accesscontrol/DirectoryTimeTravelIndex");
 const directoryProjection_1 = require("./accesscontrol/directoryProjection");
@@ -20,6 +22,48 @@ const MAX_UNKNOWN_KEYS_TRACKED = 1000;
 function unionStrings(existing, added) {
     return Array.from(new Set([...existing, ...added]));
 }
+/**
+ * Grant documents by `username_hash`, maintained by the unified cache pass.
+ * Keeps ids only, never documents, so its size is independent of the
+ * document cache.
+ */
+class GrantDocumentIndex {
+    constructor() {
+        this.idsByHash = new Map();
+        /** id -> hash and position in modification order (grows on every re-seen change). */
+        this.entries = new Map();
+        this.nextOrder = 0;
+    }
+    /** Latest state of a document: its `username_hash` if it is a grant, else undefined. */
+    record(docId, usernameHash) {
+        const previous = this.entries.get(docId);
+        if (previous) {
+            this.entries.delete(docId);
+            const ids = this.idsByHash.get(previous.hash);
+            ids?.delete(docId);
+            if (ids && ids.size === 0)
+                this.idsByHash.delete(previous.hash);
+        }
+        if (typeof usernameHash !== "string")
+            return;
+        this.entries.set(docId, { hash: usernameHash, order: this.nextOrder++ });
+        let ids = this.idsByHash.get(usernameHash);
+        if (!ids) {
+            ids = new Set();
+            this.idsByHash.set(usernameHash, ids);
+        }
+        ids.add(docId);
+    }
+    /** Ids of the grants carrying any of `hashes`, oldest change first. */
+    docIdsFor(hashes) {
+        const ids = [];
+        for (const hash of hashes) {
+            for (const id of this.idsByHash.get(hash) ?? [])
+                ids.push(id);
+        }
+        return ids.sort((a, b) => this.entries.get(a).order - this.entries.get(b).order);
+    }
+}
 class BaseMindooTenantDirectory {
     constructor(tenant, logger) {
         this.directoryDB = null;
@@ -33,6 +77,13 @@ class BaseMindooTenantDirectory {
         // (docs/accesscontrol.md §6.5), so the set of trusted keys is recomputed as
         // the union of all grant documents' current key arrays after each cache pass.
         this.grantDocIdToSigningKeys = new Map();
+        // Index of grant documents: `username_hash` -> ids of the (non-deleted,
+        // readable) grant documents carrying it, plus each id's position in
+        // modification order. findGrantAccessDocuments loads only the documents
+        // it returns instead of re-scanning the whole directory: the token check
+        // runs it on every sync request, and with more grants than the document
+        // cache holds the scan rebuilt every grant from its changes each time.
+        this.grantIndex = new GrantDocumentIndex();
         // Best-effort reverse lookup cache for public signing key -> user details.
         // Entries remain available even after revocation so historical UIs can still show identity labels.
         this.userLookupCache = new Map();
@@ -141,7 +192,19 @@ class BaseMindooTenantDirectory {
         }
         return this.directoryDB;
     }
+    async registerUsers(users, administrationPrivateKey, administrationPrivateKeyPassword) {
+        await this.tenant.withDecryptedKeyReuse(async () => {
+            for (const user of users) {
+                await this.registerUserWithKeyReuse(user.userId, administrationPrivateKey, administrationPrivateKeyPassword, user.userDetails, user.label, user.options);
+            }
+        });
+    }
     async registerUser(userId, administrationPrivateKey, administrationPrivateKeyPassword, userDetails, label, options) {
+        // One registration signs several directory changes and key distributions
+        // with the administration key; decrypt it once instead of for each.
+        await this.tenant.withDecryptedKeyReuse(() => this.registerUserWithKeyReuse(userId, administrationPrivateKey, administrationPrivateKeyPassword, userDetails, label, options));
+    }
+    async registerUserWithKeyReuse(userId, administrationPrivateKey, administrationPrivateKeyPassword, userDetails, label, options) {
         this.logger.info(`Registering user: ${userId.username}`);
         // Check if user with same username (case-insensitive) already has ACTIVE
         // access. A grant whose keys were removed (revocation, §6.5) is ignored
@@ -350,22 +413,26 @@ class BaseMindooTenantDirectory {
         // identity round-trips: a cleartext name never collides with a 64-char hex
         // hash, so this is safe (docs/accesscontrol.md §6.5).
         targetHashes.add(username);
-        const matchesTarget = (value) => typeof value === "string" && targetHashes.has(value);
         const matchingDocs = [];
-        // Use the generator-based iteration API for cleaner code.
+        // The unified cache pass above indexed the grant documents by
+        // username_hash; only the matches are loaded, oldest first as the former
+        // full scan returned them.
         // No signature verification needed - DB already enforces admin-only.
         // Revocation no longer uses a separate document: it removes keys from the
         // grant document in place (docs/accesscontrol.md §6.5). A fully-revoked user
         // therefore still has a grant document here, but with empty key arrays.
         // Callers that need "active access" should inspect the key arrays (see
         // {@link isUserRevoked} / {@link getUserPublicKeys}).
-        for await (const { doc } of directoryDB.iterateChangesSince(null)) {
-            const data = doc.getData();
-            if (data.form === "useroperation" &&
-                data.type === "grantaccess" &&
-                matchesTarget(data.username_hash)) {
+        for (const docId of this.grantIndex.docIdsFor(targetHashes)) {
+            try {
+                matchingDocs.push(await directoryDB.getDocument(docId));
                 this.logger.debug(`Found grant access document for username: ${username}`);
-                matchingDocs.push(doc);
+            }
+            catch (error) {
+                // Deleted since the cache pass: no longer a grant, as for the scan.
+                if (!(error instanceof errors_1.DocumentDeletedError) && !(error instanceof errors_1.DocumentNotFoundError)) {
+                    throw error;
+                }
             }
         }
         this.logger.debug(`Found ${matchingDocs.length} grant access document(s) for username: ${username}`);
@@ -594,6 +661,7 @@ class BaseMindooTenantDirectory {
         // are idempotent) instead of leaving its documents half-applied.
         const fullRebuild = startCursor === null;
         const grantDocIdToSigningKeys = fullRebuild ? new Map() : this.grantDocIdToSigningKeys;
+        const grantIndex = fullRebuild ? new GrantDocumentIndex() : this.grantIndex;
         const userLookupCache = fullRebuild ? new Map() : this.userLookupCache;
         const wipeKeyToGrantDocId = fullRebuild ? new Map() : this.wipeKeyToGrantDocId;
         let tenantSettingsCache = fullRebuild ? null : this.tenantSettingsCache;
@@ -616,6 +684,9 @@ class BaseMindooTenantDirectory {
         // Process changes (documents are returned in order by lastModified, oldest to newest)
         for await (const { doc, cursor } of directoryDB.iterateChangesSince(startCursor)) {
             const data = doc.getData();
+            // Deleted and unreadable documents arrive as tombstones with empty
+            // data and drop out, as they never matched the former full scan.
+            grantIndex.record(doc.getId(), data.form === "useroperation" && data.type === "grantaccess" ? data.username_hash : undefined);
             // Process user operation documents (grant/revoke access)
             if (data.form === "useroperation") {
                 // Check if this is a grant access document. A grant may carry MULTIPLE
@@ -813,6 +884,7 @@ class BaseMindooTenantDirectory {
         }
         this.trustedKeysCache = trustedKeysCache;
         this.grantDocIdToSigningKeys = grantDocIdToSigningKeys;
+        this.grantIndex = grantIndex;
         this.userLookupCache = userLookupCache;
         this.wipeKeyToGrantDocId = wipeKeyToGrantDocId;
         this.tenantSettingsCache = tenantSettingsCache;
@@ -1250,6 +1322,10 @@ class BaseMindooTenantDirectory {
      * server to gate all sync operations for a database id.
      */
     async evaluateDbAccessForSigningKey(input) {
+        return (await this.evaluateDbAccessModeForSigningKey(input)).mode === "read";
+    }
+    /** The configured gates (§6.7 id allowlist, §6.8 read gate), without the personal-database invariant. */
+    async evaluateConfiguredReadGate(input) {
         // Gate 1 — tenant-wide database-id allowlist (`databaseCreationPolicy`).
         // Orthogonal to read access: a database must clear BOTH gates.
         if (!(await this.isDatabaseAllowed(input.dbid, { signingKey: input.signingKey }))) {
@@ -1277,6 +1353,261 @@ class BaseMindooTenantDirectory {
         });
         return decision.allowed;
     }
+    /**
+     * The read scope of a principal in `dbid` (docs/accesscontrol.md §6.12):
+     * `"all"` when it reads every document, `"own"` when the database's
+     * `docReadScope` is `"own"` and the principal is neither the tenant admin nor
+     * matched by a `doc_read_all` allow rule. The directory databases are never
+     * scoped. Evaluated at the directory head, like the read gate.
+     */
+    async evaluateReadScopeForSigningKey(input) {
+        if (input.dbid === types_1.DIRECTORY_DB_ID || input.dbid === types_1.USER_DIRECTORY_DB_ID)
+            return "all";
+        const adminKey = this.tenant.getAdministrationPublicKey();
+        if (input.signingKey === adminKey)
+            return "all";
+        const decision = await this.evaluateAccessForSigningKey({
+            op: "doc_read_all",
+            dbid: input.dbid,
+            signingKey: input.signingKey,
+            trustedTime: Number.MAX_SAFE_INTEGER,
+        });
+        return decision.allowed ? "all" : "own";
+    }
+    /**
+     * The current user's read scope in `dbid` (§6.12), the client-side
+     * counterpart of {@link evaluateReadScopeForSigningKey}, e.g. to tell the
+     * user that a list only shows their own documents.
+     */
+    async getReadScope(dbid) {
+        const currentUser = await this.tenant.getCurrentUserId();
+        return this.evaluateReadScopeForSigningKey({ dbid, signingKey: currentUser.userSigningPublicKey });
+    }
+    /**
+     * Like {@link evaluateDbAccessForSigningKey}, but distinguishes the deposit
+     * right (docs/accesscontrol.md §6.10): `"read"` passes the read gate (all
+     * sync), `"deposit"` fails it but holds a `doc_deposit` allow (push of
+     * sealed creates only), `"none"` neither. `maxRecipients` is the bound from
+     * the matching deposit rule.
+     */
+    async evaluateDbAccessModeForSigningKey(input) {
+        // Built-in personal-database invariant (§6.11): decides first, and a
+        // configured policy can only take away what it grants.
+        const personal = await this.evaluatePersonalDatabaseAccess(input);
+        if (personal) {
+            if (personal.mode === "none")
+                return personal;
+            if ((0, DirectoryStateNode_1.signingKeysEqual)(input.signingKey, this.tenant.getAdministrationPublicKey())) {
+                return personal;
+            }
+            if (personal.mode === "read") {
+                return (await this.evaluateConfiguredReadGate(input)) ? personal : { mode: "none", reason: "denied by the configured policy" };
+            }
+            if (!(await this.isDatabaseAllowed(input.dbid, { signingKey: input.signingKey })))
+                return { mode: "none" };
+            const configured = await this.evaluateAccessForSigningKey({
+                op: "doc_deposit",
+                dbid: input.dbid,
+                signingKey: input.signingKey,
+                trustedTime: Number.MAX_SAFE_INTEGER,
+            });
+            // Only a matching deny rule counts here; the built-in grant replaces the allow rule.
+            return !configured.allowed && configured.matchedRuleId
+                ? { mode: "none", reason: `deposit denied by rule ${configured.matchedRuleId}` }
+                : personal;
+        }
+        if (await this.evaluateConfiguredReadGate(input)) {
+            return { mode: "read" };
+        }
+        // The id allowlist (gate 1) applies to depositors as well.
+        if (!(await this.isDatabaseAllowed(input.dbid, { signingKey: input.signingKey }))) {
+            return { mode: "none" };
+        }
+        const decision = await this.evaluateAccessForSigningKey({
+            op: "doc_deposit",
+            dbid: input.dbid,
+            signingKey: input.signingKey,
+            trustedTime: Number.MAX_SAFE_INTEGER,
+        });
+        if (!decision.allowed)
+            return { mode: "none" };
+        const rule = await this.depositRule(decision.matchedRuleId);
+        return {
+            mode: "deposit",
+            maxRecipients: rule?.maxRecipients ?? types_2.DEFAULT_DEPOSIT_MAX_RECIPIENTS,
+            ...(rule?.docIdPrefixes?.length ? { docIdPrefixes: rule.docIdPrefixes } : {}),
+        };
+    }
+    /**
+     * The built-in rule for personal databases (§6.11), or `null` when `dbid` is
+     * not one. `<prefix><grantDocId>` may be read and synced by the devices on
+     * that grant and by the tenant admin; it may be deposited into by
+     * identities whose grant lists the prefix in `depositPrefixes`; nobody
+     * else gets anything. An unknown grant id leaves everyone but the admin out.
+     */
+    async evaluatePersonalDatabaseAccess(input) {
+        const head = await this.getDirectoryStateHead();
+        const owner = (0, builtinDbInvariants_1.personalDatabaseOwner)(input.dbid, head.defaultPolicy?.personalDatabasePrefixes ?? []);
+        if (!owner)
+            return null;
+        if ((0, DirectoryStateNode_1.signingKeysEqual)(input.signingKey, this.tenant.getAdministrationPublicKey())) {
+            return { mode: "read", reason: "tenant admin" };
+        }
+        const grant = await this.loadGrantDocument(owner.grantDocId);
+        if (grant && (0, grantKeys_1.extractActiveKeyPairs)(grant).some((pair) => (0, DirectoryStateNode_1.signingKeysEqual)(pair.signingPublicKey, input.signingKey))) {
+            return { mode: "read", reason: "a device of the owner" };
+        }
+        const signerGrants = await this.grantsForSigningKey(input.signingKey);
+        const listed = (grant, field) => Array.isArray(grant[field]) && grant[field].includes(owner.prefix);
+        if (signerGrants.some((grant) => listed(grant, "accessPrefixes"))) {
+            return { mode: "read", reason: `service access to ${owner.prefix}* granted` };
+        }
+        const depositors = signerGrants.filter((grant) => listed(grant, "depositPrefixes"));
+        if (depositors.length > 0) {
+            // Document ids a deposit may use: the grant's `depositDocIdPrefixes`
+            // (per database prefix, e.g. {"mmail_": ["memo_"]}), else the built-in
+            // default for the prefix (mmail_: "memo_", MindooMail messages).
+            const configured = depositors
+                .map((grant) => grant.depositDocIdPrefixes)
+                .map((byPrefix) => (byPrefix && Array.isArray(byPrefix[owner.prefix]) ? byPrefix[owner.prefix] : null))
+                .find((list) => list !== null);
+            const docIdPrefixes = configured
+                ? configured.map(String).filter((p) => p.length > 0)
+                : [...(builtinDbInvariants_1.BUILTIN_PERSONAL_DEPOSIT_DOC_ID_PREFIXES[owner.prefix] ?? [])];
+            return {
+                mode: "deposit",
+                maxRecipients: 1,
+                ...(docIdPrefixes.length ? { docIdPrefixes } : {}),
+                reason: `deposit into ${owner.prefix}* granted`,
+            };
+        }
+        // Internal mail (§6.11): members deposit MindooMail messages into each
+        // other's mailbox, under the tenant's `internalMail` setting.
+        if (owner.prefix === "mmail_" && grant && signerGrants.length > 0) {
+            const mode = head.defaultPolicy?.internalMail ?? "members";
+            let allowed = mode === "members";
+            if (mode === "rules") {
+                const decision = await this.evaluateAccessForSigningKey({
+                    op: "doc_deposit",
+                    dbid: input.dbid,
+                    signingKey: input.signingKey,
+                    trustedTime: Number.MAX_SAFE_INTEGER,
+                });
+                allowed = decision.allowed && decision.matchedRuleId !== undefined;
+            }
+            if (allowed) {
+                const limits = head.defaultPolicy?.internalMailLimits ?? {};
+                return {
+                    mode: "deposit",
+                    maxRecipients: 1,
+                    docIdPrefixes: [...(builtinDbInvariants_1.BUILTIN_PERSONAL_DEPOSIT_DOC_ID_PREFIXES.mmail_ ?? [])],
+                    internalMail: {
+                        maxBytesPerMail: limits.maxBytesPerMail ?? types_2.DEFAULT_INTERNAL_MAIL_LIMITS.maxBytesPerMail,
+                        maxMailsPerHour: limits.maxMailsPerHour ?? types_2.DEFAULT_INTERNAL_MAIL_LIMITS.maxMailsPerHour,
+                    },
+                    reason: `internal mail (${mode})`,
+                };
+            }
+        }
+        return { mode: "none", reason: grant ? "personal database of another person" : "personal database without a matching grant" };
+    }
+    /** A `grantaccess` document by id, or null (missing, deleted, or another kind of document). */
+    async loadGrantDocument(grantDocId) {
+        const directoryDB = await this.getDirectoryDB();
+        try {
+            const doc = await directoryDB.getDocument(grantDocId);
+            if (doc.isDeleted())
+                return null;
+            const data = doc.getData();
+            return data.form === "useroperation" && data.type === "grantaccess" ? data : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    /** The active grants that list `signingKey` as a device. */
+    async grantsForSigningKey(signingKey) {
+        const lookup = await this.getUserBySigningPublicKey(signingKey);
+        if (!lookup)
+            return [];
+        const grants = await this.findGrantAccessDocuments(lookup.username);
+        return grants
+            .filter((doc) => !doc.isDeleted())
+            .map((doc) => doc.getData())
+            .filter((data) => (0, grantKeys_1.extractActiveKeyPairs)(data).some((pair) => (0, DirectoryStateNode_1.signingKeysEqual)(pair.signingPublicKey, signingKey)));
+    }
+    /**
+     * Let an identity deposit into personal databases with these prefixes
+     * (§6.11), e.g. `["mmail_"]` for a mail gateway. Written on the person's
+     * grant, admin-signed; an empty list takes the right away again.
+     */
+    async setGrantDepositPrefixes(username, prefixes, administrationPrivateKey, administrationPrivateKeyPassword) {
+        await this.setGrantPersonalDatabaseRights(username, { depositPrefixes: prefixes }, administrationPrivateKey, administrationPrivateKeyPassword);
+    }
+    /**
+     * The rights an identity has in other people's personal databases (§6.11):
+     * `depositPrefixes` (push sealed creates only) and `accessPrefixes` (read
+     * and sync, for a service such as the mail gateway serving every outbox).
+     * Written on the identity's grant, admin-signed; a field left out stays as
+     * it is, an empty list removes the right. `depositDocIdPrefixes` sets the
+     * document ids a deposit may use per database prefix (e.g.
+     * `{ mmail_: ["memo_"] }`, the built-in default); an empty list allows any id.
+     */
+    async setGrantPersonalDatabaseRights(username, rights, administrationPrivateKey, administrationPrivateKeyPassword) {
+        for (const prefix of [...(rights.depositPrefixes ?? []), ...(rights.accessPrefixes ?? [])]) {
+            if (!builtinDbInvariants_1.PERSONAL_DATABASE_PREFIX_REGEX.test(prefix)) {
+                throw new Error(`depositPrefixes: "${prefix}" is not a personal-database prefix like "mmail_"`);
+            }
+        }
+        for (const [prefix, ids] of Object.entries(rights.depositDocIdPrefixes ?? {})) {
+            if (!builtinDbInvariants_1.PERSONAL_DATABASE_PREFIX_REGEX.test(prefix)) {
+                throw new Error(`depositDocIdPrefixes: "${prefix}" is not a personal-database prefix like "mmail_"`);
+            }
+            (0, types_2.validateDocIdPrefixes)(ids, `depositDocIdPrefixes.${prefix}`);
+        }
+        const grants = (await this.findGrantAccessDocuments(username)).filter((doc) => !doc.isDeleted());
+        if (grants.length === 0)
+            throw new Error(`No grant for ${username}`);
+        const directoryDB = await this.getDirectoryDB();
+        const signingKeyPair = {
+            publicKey: this.tenant.getAdministrationPublicKey(),
+            privateKey: administrationPrivateKey,
+        };
+        for (const grant of grants) {
+            await directoryDB.changeDoc(grant, (d) => {
+                const data = d.getData();
+                if (rights.depositPrefixes)
+                    data.depositPrefixes = [...new Set(rights.depositPrefixes)];
+                if (rights.accessPrefixes)
+                    data.accessPrefixes = [...new Set(rights.accessPrefixes)];
+                if (rights.depositDocIdPrefixes) {
+                    const merged = { ...(data.depositDocIdPrefixes ?? {}) };
+                    for (const [prefix, ids] of Object.entries(rights.depositDocIdPrefixes))
+                        merged[prefix] = [...new Set(ids)];
+                    data.depositDocIdPrefixes = merged;
+                }
+            }, { signingKeyPair, signingKeyPassword: administrationPrivateKeyPassword });
+        }
+        await this.updateUnifiedCache();
+    }
+    /**
+     * Whether the current user holds the deposit right on `dbid` (§6.10): a
+     * `doc_deposit` allow rule matches and no deny does. Says nothing about the
+     * read gate; callers check {@link canReadDatabase} first.
+     */
+    async canDepositDatabase(dbid) {
+        if (dbid === types_1.DIRECTORY_DB_ID || dbid === types_1.USER_DIRECTORY_DB_ID)
+            return false;
+        const currentUser = await this.tenant.getCurrentUserId();
+        const access = await this.evaluateDbAccessModeForSigningKey({ dbid, signingKey: currentUser.userSigningPublicKey });
+        return access.mode === "deposit";
+    }
+    async depositRule(ruleId) {
+        if (!ruleId)
+            return null;
+        const head = await this.getDirectoryStateHead();
+        return (head.rulesByType.get("doc_deposit") ?? []).find((r) => r.ruleId === ruleId) ?? null;
+    }
     /**
      * Whether the current user may open and sync `dbid` under the database read
      * gate (`doc_read`, §6.6). The client-side counterpart of
@@ -1293,6 +1624,10 @@ class BaseMindooTenantDirectory {
         const adminKey = this.tenant.getAdministrationPublicKey();
         if (currentUser.userSigningPublicKey === adminKey)
             return true;
+        // The personal-database invariant (§6.11) decides first, policy on top.
+        const personal = await this.evaluatePersonalDatabaseAccess({ dbid, signingKey: currentUser.userSigningPublicKey });
+        if (personal && personal.mode !== "read")
+            return false;
         const decision = await this.canDo("doc_read", dbid);
         return decision.allowed;
     }
@@ -1311,12 +1646,30 @@ class BaseMindooTenantDirectory {
         (0, types_3.validateAccessPolicy)(policy);
         await this.writePolicyDoc(types_3.ACL_DEFAULT_POLICY_DOC_ID, policy, administrationPrivateKey, administrationPrivateKeyPassword);
     }
+    async requireV2EntrySignatures(administrationPrivateKey, administrationPrivateKeyPassword) {
+        const head = await this.getDirectoryStateHead();
+        const existing = head.defaultPolicy?.requireMetadataSignatureSince;
+        if (typeof existing === "number" && Number.isFinite(existing)) {
+            return { since: existing, changed: false };
+        }
+        const since = (0, timeSource_1.semanticNow)();
+        await this.setDefaultAccessPolicy(head.defaultPolicy
+            ? { requireMetadataSignatureSince: since }
+            : // No policy document yet: writing one is what activates access
+                // control, so it carries the master switch, exactly as a new tenant
+                // gets it from the factory.
+                { disableAllAccessChecksAndPolicies: true, requireMetadataSignatureSince: since }, administrationPrivateKey, administrationPrivateKeyPassword);
+        return { since, changed: true };
+    }
     /**
      * Create or update a per-database policy override (§6.2). Fields set here
      * override the tenant default for `dbid`; unset fields inherit it.
      */
     async setDatabaseAccessPolicy(dbid, policy, administrationPrivateKey, administrationPrivateKeyPassword) {
         (0, types_3.validateAccessPolicy)(policy);
+        if (policy.personalDatabasePrefixes !== undefined) {
+            throw new Error("personalDatabasePrefixes is a tenant-level setting; set it on the default policy");
+        }
         if (policy.llm !== undefined) {
             throw new Error("llm is a tenant-level setting; set it on the default policy");
         }
@@ -1368,6 +1721,8 @@ class BaseMindooTenantDirectory {
                 groups: rule.groups ?? [],
             }),
             action: rule.action ?? "allow",
+            ...(rule.maxRecipients !== undefined ? { maxRecipients: rule.maxRecipients } : {}),
+            ...(rule.docIdPrefixes !== undefined ? { docIdPrefixes: [...new Set(rule.docIdPrefixes)] } : {}),
         };
         // Fail fast on malformed clauses / operators (§6.3 closed set).
         (0, types_3.validateAclRule)(ruleDoc);
@@ -1391,6 +1746,14 @@ class BaseMindooTenantDirectory {
                 data.description = ruleDoc.description;
             if (ruleDoc.withfields !== undefined)
                 data.withfields = ruleDoc.withfields;
+            if (ruleDoc.maxRecipients !== undefined)
+                data.maxRecipients = ruleDoc.maxRecipients;
+            else if (data.maxRecipients !== undefined)
+                delete data.maxRecipients;
+            if (ruleDoc.docIdPrefixes?.length)
+                data.docIdPrefixes = ruleDoc.docIdPrefixes;
+            else if (data.docIdPrefixes !== undefined)
+                delete data.docIdPrefixes;
         }, {
             signingKeyPair: adminSigningKeyPair,
             signingKeyPassword: administrationPrivateKeyPassword,