@actuate-media/cms-core 0.36.0 → 0.37.0

package/dist/__tests__/api/security-routes.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=security-routes.test.d.ts.map

package/dist/__tests__/api/security-routes.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-routes.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/api/security-routes.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/api/security-routes.test.js

@@ -0,0 +1,212 @@
+import { beforeEach, describe, expect, it } from 'vitest';
+import { handleActuateAPI } from '../../api/index.js';
+import { initDB } from '../../db.js';
+import { generateApiKey } from '../../security/api-key-enhanced.js';
+/**
+ * Contract tests for the Security Center endpoints:
+ *   - GET  /security                     → authed (admin), computed posture.
+ *   - PUT  /security                     → persists enforced policy, lockout-safe.
+ *   - POST /security/sessions/revoke-all → revokes the caller's other sessions.
+ *
+ * Proves the response never leaks secret values, that lockout-safe MFA enabling
+ * is enforced server-side, and that policy round-trips through the settings global.
+ */
+const VALID_SECRET = 'a'.repeat(48);
+function createMockDB(state, apiKey) {
+    const tx = {
+        document: {
+            update: async ({ data }) => {
+                state.settings = data.data;
+                return { id: 'settings-doc', data: state.settings };
+            },
+            create: async ({ data }) => {
+                state.settings = data.data;
+                return { id: 'settings-doc', data: state.settings };
+            },
+        },
+        version: { create: async () => ({ id: 'v1' }) },
+    };
+    return {
+        apiKey: {
+            findMany: async () => (apiKey ? [apiKey] : []),
+            findUnique: async ({ where }) => apiKey && apiKey.keyHash === where.keyHash ? apiKey : null,
+            update: async () => apiKey,
+        },
+        document: {
+            findFirst: async () => ({ id: 'settings-doc', data: state.settings }),
+            findMany: async () => [],
+            count: async () => 0,
+        },
+        version: { create: async () => ({ id: 'v1' }) },
+        user: {
+            findMany: async () => [
+                { role: 'ADMIN', isActive: true, totpEnabled: state.viewerHasMfa },
+                { role: 'EDITOR', isActive: true, totpEnabled: false },
+            ],
+            findUnique: async () => ({ totpEnabled: state.viewerHasMfa }),
+            count: async () => 1,
+        },
+        session: {
+            findMany: async () => [],
+            count: async () => 2,
+            updateMany: async (args) => {
+                state.revokeAllArgs = args;
+                return { count: state.revokeAllResult };
+            },
+        },
+        auditLog: {
+            count: async () => 3,
+            create: async () => ({ id: 'log1' }),
+        },
+        $transaction: async (fn) => fn(tx),
+    };
+}
+async function makeKey(scopes) {
+    const { key, keyHash, keyPrefix } = await generateApiKey({ prefix: 'act_sk', scopes });
+    return {
+        key,
+        record: {
+            id: 'apikey-1',
+            keyHash,
+            keyPrefix,
+            userId: 'user-1',
+            scopes,
+            ipRestrictions: null,
+            expiresAt: null,
+            lastUsedAt: null,
+            revokedAt: null,
+        },
+    };
+}
+function freshState() {
+    return {
+        settings: { siteTitle: 'Actuate Media' },
+        viewerHasMfa: false,
+        revokeAllResult: 2,
+    };
+}
+beforeEach(() => {
+    delete globalThis.__actuateConfig;
+    process.env.CMS_SECRET = VALID_SECRET;
+});
+describe('GET /security', () => {
+    it('requires authentication', async () => {
+        const db = createMockDB(freshState());
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
+        const res = await handler(new Request('https://example.com/api/cms/security'));
+        expect(res.status).toBe(401);
+    });
+    it('rejects non-admin API keys', async () => {
+        const { key, record } = await makeKey({ media: true });
+        const db = createMockDB(freshState(), record);
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
+        const res = await handler(new Request('https://example.com/api/cms/security', {
+            headers: { Authorization: `Bearer ${key}` },
+        }));
+        expect(res.status).toBe(403);
+    });
+    it('returns computed posture + summaries and never leaks secret values', async () => {
+        const { key, record } = await makeKey({ admin: true });
+        const db = createMockDB(freshState(), record);
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
+        const res = await handler(new Request('https://example.com/api/cms/security', {
+            headers: { Authorization: `Bearer ${key}` },
+        }));
+        expect(res.status).toBe(200);
+        const body = (await res.json());
+        expect(body.data.status.status).toBeDefined();
+        expect(Array.isArray(body.data.status.checks)).toBe(true);
+        expect(body.data.users.totalAdmins).toBe(1);
+        expect(body.data.secrets.cmsSecret).toBe('pass');
+        expect(body.data.activeSessions).toBe(2);
+        expect(body.data.failedLogins24h).toBe(3);
+        // The raw secret value must never appear anywhere in the payload.
+        expect(JSON.stringify(body)).not.toContain(VALID_SECRET);
+    });
+});
+describe('PUT /security', () => {
+    it('persists the enforced policy and reflects it on read-back', async () => {
+        const { key, record } = await makeKey({ admin: true });
+        const state = freshState();
+        const db = createMockDB(state, record);
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
+        const res = await handler(new Request('https://example.com/api/cms/security', {
+            method: 'PUT',
+            headers: { Authorization: `Bearer ${key}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                mfa: { required: false, gracePeriodDays: 14 },
+                session: { maxConcurrentSessions: 3 },
+            }),
+        }));
+        expect(res.status).toBe(200);
+        const body = (await res.json());
+        expect(body.data.settings.session.maxConcurrentSessions).toBe(3);
+        expect(body.data.settings.mfa.gracePeriodDays).toBe(14);
+        // Persisted into the settings global without clobbering siblings.
+        expect(state.settings.security.session.maxConcurrentSessions).toBe(3);
+        expect(state.settings.siteTitle).toBe('Actuate Media');
+    });
+    it('blocks enabling MFA when the acting admin has no MFA (lockout-safe)', async () => {
+        const { key, record } = await makeKey({ admin: true });
+        const state = freshState();
+        state.viewerHasMfa = false;
+        const db = createMockDB(state, record);
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
+        const res = await handler(new Request('https://example.com/api/cms/security', {
+            method: 'PUT',
+            headers: { Authorization: `Bearer ${key}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                mfa: { required: true, gracePeriodDays: 7 },
+                session: { maxConcurrentSessions: 5 },
+            }),
+        }));
+        expect(res.status).toBe(409);
+        const body = (await res.json());
+        expect(body.code).toBe('MFA_LOCKOUT_RISK');
+        // Nothing should have been persisted.
+        expect(state.settings.security).toBeUndefined();
+    });
+    it('allows enabling MFA when the acting admin has MFA', async () => {
+        const { key, record } = await makeKey({ admin: true });
+        const state = freshState();
+        state.viewerHasMfa = true;
+        const db = createMockDB(state, record);
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
+        const res = await handler(new Request('https://example.com/api/cms/security', {
+            method: 'PUT',
+            headers: { Authorization: `Bearer ${key}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                mfa: { required: true, gracePeriodDays: 7 },
+                session: { maxConcurrentSessions: 5 },
+            }),
+        }));
+        expect(res.status).toBe(200);
+        expect(state.settings.security.mfa.required).toBe(true);
+        expect(typeof state.settings.security.mfa.requiredAt).toBe('string');
+    });
+});
+describe('POST /security/sessions/revoke-all', () => {
+    it("revokes the caller's other sessions and returns the count", async () => {
+        const { key, record } = await makeKey({ admin: true });
+        const state = freshState();
+        const db = createMockDB(state, record);
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
+        const res = await handler(new Request('https://example.com/api/cms/security/sessions/revoke-all', {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${key}` },
+        }));
+        expect(res.status).toBe(200);
+        const body = (await res.json());
+        expect(body.data.revoked).toBe(2);
+        // Excludes the current session id.
+        expect(state.revokeAllArgs?.where?.id?.not).toBe('apikey-1');
+    });
+});
+//# sourceMappingURL=security-routes.test.js.map

package/dist/__tests__/api/security-routes.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-routes.test.js","sourceRoot":"","sources":["../../../src/__tests__/api/security-routes.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAA;AAGnE;;;;;;;;GAQG;AACH,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AAqBnC,SAAS,YAAY,CAAC,KAAgB,EAAE,MAAyB;IAC/D,MAAM,EAAE,GAAG;QACT,QAAQ,EAAE;YACR,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAA+C,EAAE,EAAE;gBACtE,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAA;gBAC1B,OAAO,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAA;YACrD,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAA+C,EAAE,EAAE;gBACtE,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAA;gBAC1B,OAAO,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAA;YACrD,CAAC;SACF;QACD,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;KAChD,CAAA;IACD,OAAO;QACL,MAAM,EAAE;YACN,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,UAAU,EAAE,KAAK,EAAE,EAAE,KAAK,EAAkC,EAAE,EAAE,CAC9D,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;YAC5D,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM;SAC3B;QACD,QAAQ,EAAE;YACR,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;YACrE,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE;YACxB,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;SACrB;QACD,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;QAC/C,IAAI,EAAE;YACJ,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC;gBACpB,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,YAAY,EAAE;gBAClE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE;aACvD;YACD,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;YAC7D,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;SACrB;QACD,OAAO,EAAE;YACP,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE;YACxB,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YACpB,UAAU,EAAE,KAAK,EAAE,IAA2C,EAAE,EAAE;gBAChE,KAAK,CAAC,aAAa,GAAG,IAAI,CAAA;gBAC1B,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,eAAe,EAAE,CAAA;YACzC,CAAC;SACF;QACD,QAAQ,EAAE;YACR,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YACpB,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;SACrC;QACD,YAAY,EAAE,KAAK,EAAE,EAAsC,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;KAChE,CAAA;AACV,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,MAAmB;IACxC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,cAAc,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;IACtF,OAAO;QACL,GAAG;QACH,MAAM,EAAE;YACN,EAAE,EAAE,UAAU;YACd,OAAO;YACP,SAAS;YACT,MAAM,EAAE,QAAQ;YAChB,MAAM;YACN,cAAc,EAAE,IAAI;YACpB,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,IAAI;SAChB;KACF,CAAA;AACH,CAAC;AAED,SAAS,UAAU;IACjB,OAAO;QACL,QAAQ,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE;QACxC,YAAY,EAAE,KAAK;QACnB,eAAe,EAAE,CAAC;KACnB,CAAA;AACH,CAAC;AAED,UAAU,CAAC,GAAG,EAAE;IACd,OAAQ,UAAkB,CAAC,eAAe,CAAA;IAC1C,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,YAAY,CAAA;AACvC,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,yBAAyB,EAAE,KAAK,IAAI,EAAE;QACvC,MAAM,EAAE,GAAG,YAAY,CAAC,UAAU,EAAE,CAAC,CAAA;QACrC,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QACnF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,OAAO,CAAC,sCAAsC,CAAC,CAAC,CAAA;QAC9E,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;QAC1C,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACtD,MAAM,EAAE,GAAG,YAAY,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,CAAA;QAC7C,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QACnF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,sCAAsC,EAAE;YAClD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE;SAC5C,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACtD,MAAM,EAAE,GAAG,YAAY,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,CAAA;QAC7C,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QACnF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,sCAAsC,EAAE;YAClD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE;SAC5C,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAQ,CAAA;QAEtC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAA;QAC7C,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACzD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC3C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAChD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACxC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACzC,kEAAkE;QAClE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAA;IAC1D,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACtD,MAAM,KAAK,GAAG,UAAU,EAAE,CAAA;QAC1B,MAAM,EAAE,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QACtC,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QAEnF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,sCAAsC,EAAE;YAClD,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,GAAG,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,EAAE;gBAC7C,OAAO,EAAE,EAAE,qBAAqB,EAAE,CAAC,EAAE;aACtC,CAAC;SACH,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAQ,CAAA;QACtC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAChE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACvD,kEAAkE;QAClE,MAAM,CAAE,KAAK,CAAC,QAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC9E,MAAM,CAAE,KAAK,CAAC,QAAgB,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACtD,MAAM,KAAK,GAAG,UAAU,EAAE,CAAA;QAC1B,KAAK,CAAC,YAAY,GAAG,KAAK,CAAA;QAC1B,MAAM,EAAE,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QACtC,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QAEnF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,sCAAsC,EAAE;YAClD,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,EAAE;gBAC3C,OAAO,EAAE,EAAE,qBAAqB,EAAE,CAAC,EAAE;aACtC,CAAC;SACH,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAQ,CAAA;QACtC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;QAC1C,sCAAsC;QACtC,MAAM,CAAE,KAAK,CAAC,QAAgB,CAAC,QAAQ,CAAC,CAAC,aAAa,EAAE,CAAA;IAC1D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACtD,MAAM,KAAK,GAAG,UAAU,EAAE,CAAA;QAC1B,KAAK,CAAC,YAAY,GAAG,IAAI,CAAA;QACzB,MAAM,EAAE,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QACtC,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QAEnF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,sCAAsC,EAAE;YAClD,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,EAAE;gBAC3C,OAAO,EAAE,EAAE,qBAAqB,EAAE,CAAC,EAAE;aACtC,CAAC;SACH,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,CAAE,KAAK,CAAC,QAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAChE,MAAM,CAAC,OAAQ,KAAK,CAAC,QAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC/E,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;IAClD,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACtD,MAAM,KAAK,GAAG,UAAU,EAAE,CAAA;QAC1B,MAAM,EAAE,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QACtC,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QAEnF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,0DAA0D,EAAE;YACtE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE;SAC5C,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAQ,CAAA;QACtC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjC,mCAAmC;QACnC,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAC9D,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/security/center.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=center.test.d.ts.map

package/dist/__tests__/security/center.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"center.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/security/center.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/security/center.test.js

@@ -0,0 +1,226 @@
+import { describe, expect, it } from 'vitest';
+import { DEFAULT_SECURITY_SETTINGS, computeSecurityStatus, mfaEnableLockoutError, parseSecuritySettings, summarizeApiKeys, summarizeUsers, validateIpRange, validateSecuritySettings, } from '../../security/center/index.js';
+function baseInput(overrides = {}) {
+    return {
+        isProduction: true,
+        settings: {
+            mfa: { required: true, gracePeriodDays: 7 },
+            session: { maxConcurrentSessions: 5 },
+        },
+        users: {
+            totalUsers: 3,
+            totalAdmins: 2,
+            withMfa: 2,
+            withoutMfa: 1,
+            adminsWithoutMfa: 0,
+            inactive: 0,
+        },
+        apiKeys: { active: 1, withoutExpiration: 0, broadScope: 0, staleUnused90d: 0 },
+        secrets: {
+            cmsSecret: 'pass',
+            encryptionKey: 'pass',
+            rateLimitBackend: 'distributed',
+            apiKeysHashed: true,
+            webhookSecretsEncrypted: true,
+        },
+        ipAllowlist: {
+            enabled: false,
+            source: 'none',
+            ranges: [],
+            currentIp: '1.2.3.4',
+            currentIpAllowed: null,
+        },
+        failedLogins24h: 0,
+        activeSessions: 1,
+        csrfEnabled: true,
+        uploadValidation: true,
+        auditEnabled: true,
+        ...overrides,
+    };
+}
+describe('computeSecurityStatus', () => {
+    it('reports secure when all controls pass', () => {
+        const status = computeSecurityStatus(baseInput());
+        expect(status.status).toBe('secure');
+        expect(status.score).toBe(100);
+        expect(status.warnings).toHaveLength(0);
+        // Every advertised check is present.
+        const keys = status.checks.map((c) => c.key);
+        expect(keys).toEqual(expect.arrayContaining([
+            'mfa',
+            'sessions',
+            'api_keys',
+            'csrf',
+            'rate_limit',
+            'cms_secret',
+            'audit',
+        ]));
+    });
+    it('is at_risk when CSRF is disabled', () => {
+        const status = computeSecurityStatus(baseInput({ csrfEnabled: false }));
+        expect(status.status).toBe('at_risk');
+        expect(status.warnings.some((w) => w.id === 'csrf-disabled' && w.severity === 'critical')).toBe(true);
+        expect(status.score).toBeLessThan(100);
+    });
+    it('is at_risk when MFA is required but an admin has not enrolled', () => {
+        const status = computeSecurityStatus(baseInput({
+            users: {
+                totalUsers: 3,
+                totalAdmins: 2,
+                withMfa: 1,
+                withoutMfa: 1,
+                adminsWithoutMfa: 1,
+                inactive: 0,
+            },
+        }));
+        expect(status.status).toBe('at_risk');
+        expect(status.warnings.some((w) => w.id === 'mfa-required-gap')).toBe(true);
+        const mfaCheck = status.checks.find((c) => c.key === 'mfa');
+        expect(mfaCheck?.status).toBe('fail');
+    });
+    it('is at_risk in production when CMS_SECRET is missing', () => {
+        const status = computeSecurityStatus(baseInput({ secrets: { ...baseInput().secrets, cmsSecret: 'fail' } }));
+        expect(status.status).toBe('at_risk');
+        expect(status.warnings.some((w) => w.id === 'cms-secret-missing')).toBe(true);
+    });
+    it('needs_attention when MFA is not required in production', () => {
+        const status = computeSecurityStatus(baseInput({
+            settings: {
+                mfa: { required: false, gracePeriodDays: 7 },
+                session: { maxConcurrentSessions: 5 },
+            },
+        }));
+        expect(status.status).toBe('needs_attention');
+        expect(status.warnings.some((w) => w.id === 'mfa-not-required')).toBe(true);
+    });
+    it('warns (not critical) about in-memory rate limiting in production', () => {
+        const status = computeSecurityStatus(baseInput({ secrets: { ...baseInput().secrets, rateLimitBackend: 'in_memory' } }));
+        expect(status.status).toBe('needs_attention');
+        expect(status.warnings.some((w) => w.id === 'rate-limit-in-memory')).toBe(true);
+    });
+    it('is unknown when secret state cannot be determined', () => {
+        const status = computeSecurityStatus(baseInput({ secrets: { ...baseInput().secrets, cmsSecret: 'unknown' } }));
+        expect(status.status).toBe('unknown');
+    });
+    it('flags broad-scope API keys as a failing check', () => {
+        const status = computeSecurityStatus(baseInput({ apiKeys: { active: 2, withoutExpiration: 0, broadScope: 1, staleUnused90d: 0 } }));
+        expect(status.checks.find((c) => c.key === 'api_keys')?.status).toBe('fail');
+        expect(status.warnings.some((w) => w.id === 'api-keys-broad')).toBe(true);
+    });
+});
+describe('validateSecuritySettings', () => {
+    it('accepts valid settings', () => {
+        expect(validateSecuritySettings(DEFAULT_SECURITY_SETTINGS)).toEqual([]);
+    });
+    it('rejects an out-of-range grace period', () => {
+        const issues = validateSecuritySettings({
+            mfa: { required: true, gracePeriodDays: 999 },
+            session: { maxConcurrentSessions: 5 },
+        });
+        expect(issues.some((i) => i.field === 'mfaGracePeriodDays' && i.severity === 'error')).toBe(true);
+    });
+    it('rejects an out-of-range concurrent session cap', () => {
+        const issues = validateSecuritySettings({
+            mfa: { required: false, gracePeriodDays: 0 },
+            session: { maxConcurrentSessions: -1 },
+        });
+        expect(issues.some((i) => i.field === 'maxConcurrentSessions')).toBe(true);
+    });
+});
+describe('parseSecuritySettings', () => {
+    it('returns defaults for an empty blob', () => {
+        expect(parseSecuritySettings({})).toEqual(DEFAULT_SECURITY_SETTINGS);
+    });
+    it('coerces and clamps values', () => {
+        const parsed = parseSecuritySettings({
+            security: {
+                mfa: { required: 'yes', gracePeriodDays: 9999 },
+                session: { maxConcurrentSessions: -5 },
+            },
+        });
+        expect(parsed.mfa.required).toBe(true);
+        expect(parsed.mfa.gracePeriodDays).toBe(365);
+        expect(parsed.session.maxConcurrentSessions).toBe(0);
+    });
+    it('preserves requiredAt when present', () => {
+        const parsed = parseSecuritySettings({
+            security: {
+                mfa: { required: true, gracePeriodDays: 1, requiredAt: '2026-01-01T00:00:00.000Z' },
+            },
+        });
+        expect(parsed.mfa.requiredAt).toBe('2026-01-01T00:00:00.000Z');
+    });
+});
+describe('validateIpRange', () => {
+    it.each([
+        '192.168.1.1',
+        '10.0.0.0/8',
+        '172.16.0.0/12',
+        '0.0.0.0/0',
+        '2001:db8::1',
+        '2001:db8::/32',
+        '::1',
+    ])('accepts %s', (entry) => {
+        expect(validateIpRange(entry)).toBe(true);
+    });
+    it.each(['', 'not-an-ip', '999.1.1.1', '10.0.0.0/33', '1.2.3.4/abc', '2001:db8::/129', '1.2.3'])('rejects %s', (entry) => {
+        expect(validateIpRange(entry)).toBe(false);
+    });
+});
+describe('mfaEnableLockoutError', () => {
+    it('blocks enabling MFA when the acting admin has no MFA', () => {
+        expect(mfaEnableLockoutError({ enabling: true, viewerHasMfa: false, totalAdmins: 1 })).toMatch(/lock yourself out/i);
+    });
+    it('allows enabling when the acting admin has MFA', () => {
+        expect(mfaEnableLockoutError({ enabling: true, viewerHasMfa: true, totalAdmins: 1 })).toBeNull();
+    });
+    it('never blocks when not enabling', () => {
+        expect(mfaEnableLockoutError({ enabling: false, viewerHasMfa: false, totalAdmins: 3 })).toBeNull();
+    });
+});
+describe('summarizeUsers', () => {
+    it('counts admin MFA coverage and inactive accounts', () => {
+        const summary = summarizeUsers([
+            { role: 'ADMIN', isActive: true, totpEnabled: true },
+            { role: 'ADMIN', isActive: true, totpEnabled: false },
+            { role: 'EDITOR', isActive: true, totpEnabled: false },
+            { role: 'ADMIN', isActive: false, totpEnabled: false },
+        ]);
+        expect(summary.totalUsers).toBe(4);
+        expect(summary.totalAdmins).toBe(3);
+        expect(summary.withMfa).toBe(1);
+        expect(summary.adminsWithoutMfa).toBe(1); // inactive admin excluded
+        expect(summary.inactive).toBe(1);
+    });
+});
+describe('summarizeApiKeys', () => {
+    const now = Date.parse('2026-06-01T00:00:00.000Z');
+    it('classifies risk and excludes revoked/expired keys', () => {
+        const summary = summarizeApiKeys([
+            { scopes: { admin: true }, expiresAt: null, lastUsedAt: null, revokedAt: null },
+            {
+                scopes: { media: true },
+                expiresAt: '2026-12-01T00:00:00.000Z',
+                lastUsedAt: '2026-01-01T00:00:00.000Z',
+                revokedAt: null,
+            },
+            {
+                scopes: { media: true },
+                expiresAt: '2020-01-01T00:00:00.000Z',
+                lastUsedAt: null,
+                revokedAt: null,
+            }, // expired
+            {
+                scopes: { admin: true },
+                expiresAt: null,
+                lastUsedAt: null,
+                revokedAt: '2026-01-01T00:00:00.000Z',
+            }, // revoked
+        ], now);
+        expect(summary.active).toBe(2);
+        expect(summary.broadScope).toBe(1);
+        expect(summary.withoutExpiration).toBe(1);
+        expect(summary.staleUnused90d).toBe(1); // key 2 last used > 90d before `now`
+    });
+});
+//# sourceMappingURL=center.test.js.map

package/dist/__tests__/security/center.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"center.test.js","sourceRoot":"","sources":["../../../src/__tests__/security/center.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,wBAAwB,GAEzB,MAAM,gCAAgC,CAAA;AAEvC,SAAS,SAAS,CAAC,YAA0C,EAAE;IAC7D,OAAO;QACL,YAAY,EAAE,IAAI;QAClB,QAAQ,EAAE;YACR,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,EAAE;YAC3C,OAAO,EAAE,EAAE,qBAAqB,EAAE,CAAC,EAAE;SACtC;QACD,KAAK,EAAE;YACL,UAAU,EAAE,CAAC;YACb,WAAW,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;YACV,UAAU,EAAE,CAAC;YACb,gBAAgB,EAAE,CAAC;YACnB,QAAQ,EAAE,CAAC;SACZ;QACD,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE;QAC9E,OAAO,EAAE;YACP,SAAS,EAAE,MAAM;YACjB,aAAa,EAAE,MAAM;YACrB,gBAAgB,EAAE,aAAa;YAC/B,aAAa,EAAE,IAAI;YACnB,uBAAuB,EAAE,IAAI;SAC9B;QACD,WAAW,EAAE;YACX,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,EAAE;YACV,SAAS,EAAE,SAAS;YACpB,gBAAgB,EAAE,IAAI;SACvB;QACD,eAAe,EAAE,CAAC;QAClB,cAAc,EAAE,CAAC;QACjB,WAAW,EAAE,IAAI;QACjB,gBAAgB,EAAE,IAAI;QACtB,YAAY,EAAE,IAAI;QAClB,GAAG,SAAS;KACb,CAAA;AACH,CAAC;AAED,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,EAAE,CAAC,CAAA;QACjD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACpC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC9B,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QACvC,qCAAqC;QACrC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAC5C,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAClB,MAAM,CAAC,eAAe,CAAC;YACrB,KAAK;YACL,UAAU;YACV,UAAU;YACV,MAAM;YACN,YAAY;YACZ,YAAY;YACZ,OAAO;SACR,CAAC,CACH,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;QACvE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACrC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,eAAe,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAC7F,IAAI,CACL,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,MAAM,GAAG,qBAAqB,CAClC,SAAS,CAAC;YACR,KAAK,EAAE;gBACL,UAAU,EAAE,CAAC;gBACb,WAAW,EAAE,CAAC;gBACd,OAAO,EAAE,CAAC;gBACV,UAAU,EAAE,CAAC;gBACb,gBAAgB,EAAE,CAAC;gBACnB,QAAQ,EAAE,CAAC;aACZ;SACF,CAAC,CACH,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACrC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC3E,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,CAAA;QAC3D,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,MAAM,GAAG,qBAAqB,CAClC,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,SAAS,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CACtE,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACrC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC/E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,MAAM,GAAG,qBAAqB,CAClC,SAAS,CAAC;YACR,QAAQ,EAAE;gBACR,GAAG,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,EAAE;gBAC5C,OAAO,EAAE,EAAE,qBAAqB,EAAE,CAAC,EAAE;aACtC;SACF,CAAC,CACH,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;QAC7C,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC7E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,MAAM,GAAG,qBAAqB,CAClC,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,SAAS,EAAE,CAAC,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,EAAE,CAAC,CAClF,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;QAC7C,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACjF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,MAAM,GAAG,qBAAqB,CAClC,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,SAAS,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC,CACzE,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,MAAM,GAAG,qBAAqB,CAClC,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,EAAE,CAAC,CAC9F,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC5E,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC3E,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAChC,MAAM,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IACzE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,MAAM,GAAG,wBAAwB,CAAC;YACtC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE;YAC7C,OAAO,EAAE,EAAE,qBAAqB,EAAE,CAAC,EAAE;SACtC,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,oBAAoB,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CACzF,IAAI,CACL,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,MAAM,GAAG,wBAAwB,CAAC;YACtC,GAAG,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,EAAE;YAC5C,OAAO,EAAE,EAAE,qBAAqB,EAAE,CAAC,CAAC,EAAE;SACvC,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC5E,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAA;IACtE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,MAAM,GAAG,qBAAqB,CAAC;YACnC,QAAQ,EAAE;gBACR,GAAG,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE;gBAC/C,OAAO,EAAE,EAAE,qBAAqB,EAAE,CAAC,CAAC,EAAE;aACvC;SACF,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACtC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACtD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,MAAM,GAAG,qBAAqB,CAAC;YACnC,QAAQ,EAAE;gBACR,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,EAAE,UAAU,EAAE,0BAA0B,EAAE;aACpF;SACF,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAA;IAChE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,IAAI,CAAC;QACN,aAAa;QACb,YAAY;QACZ,eAAe;QACf,WAAW;QACX,aAAa;QACb,eAAe;QACf,KAAK;KACN,CAAC,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE;QACzB,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC3C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAC9F,YAAY,EACZ,CAAC,KAAK,EAAE,EAAE;QACR,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC5C,CAAC,CACF,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,CAAC,qBAAqB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAC5F,oBAAoB,CACrB,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,qBAAqB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;IAClG,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,CACJ,qBAAqB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAChF,CAAC,QAAQ,EAAE,CAAA;IACd,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,OAAO,GAAG,cAAc,CAAC;YAC7B,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE;YACpD,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE;YACrD,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE;YACtD,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE;SACvD,CAAC,CAAA;QACF,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAClC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACnC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC/B,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA,CAAC,0BAA0B;QACnE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAA;IAElD,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,OAAO,GAAG,gBAAgB,CAC9B;YACE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;YAC/E;gBACE,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;gBACvB,SAAS,EAAE,0BAA0B;gBACrC,UAAU,EAAE,0BAA0B;gBACtC,SAAS,EAAE,IAAI;aAChB;YACD;gBACE,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;gBACvB,SAAS,EAAE,0BAA0B;gBACrC,UAAU,EAAE,IAAI;gBAChB,SAAS,EAAE,IAAI;aAChB,EAAE,UAAU;YACb;gBACE,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;gBACvB,SAAS,EAAE,IAAI;gBACf,UAAU,EAAE,IAAI;gBAChB,SAAS,EAAE,0BAA0B;aACtC,EAAE,UAAU;SACd,EACD,GAAG,CACJ,CAAA;QACD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC9B,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAClC,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACzC,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA,CAAC,qCAAqC;IAC9E,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/api/handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../src/api/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AA+/B5C,iFAAiF;AACjF,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C;AA8JD,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAS9E;AAyRD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAwxUzD"}
+{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../src/api/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AA+/B5C,iFAAiF;AACjF,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C;AA8JD,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAS9E;AAiTD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CA68UzD"}