@adaptic/backend-legacy 0.0.1009 → 0.0.1011

package/esm/NewsArticleAssetSentiment.mjs

@@ -89,6 +89,11 @@ export const NewsArticleAssetSentiment = {
                                                 set: props.news.topics
                                             } : undefined,
                                             logo: props.news.logo !== undefined ? props.news.logo : undefined,
+                                            symbols: props.news.symbols !== undefined ? {
+                                                set: props.news.symbols
+                                            } : undefined,
+                                            relevance: props.news.relevance !== undefined ? props.news.relevance : undefined,
+                                            publishedAt: props.news.publishedAt !== undefined ? props.news.publishedAt : undefined,
                                         },
                                     }
                                 } : undefined,
@@ -572,6 +577,15 @@ export const NewsArticleAssetSentiment = {
                                         logo: props.news.logo !== undefined ? {
                                             set: props.news.logo
                                         } : undefined,
+                                        symbols: props.news.symbols !== undefined ? {
+                                            set: props.news.symbols
+                                        } : undefined,
+                                        relevance: props.news.relevance !== undefined ? {
+                                            set: props.news.relevance
+                                        } : undefined,
+                                        publishedAt: props.news.publishedAt !== undefined ? {
+                                            set: props.news.publishedAt
+                                        } : undefined,
                                     },
                                     create: {
                                         title: props.news.title !== undefined ? props.news.title : undefined,
@@ -591,6 +605,11 @@ export const NewsArticleAssetSentiment = {
                                             set: props.news.topics
                                         } : undefined,
                                         logo: props.news.logo !== undefined ? props.news.logo : undefined,
+                                        symbols: props.news.symbols !== undefined ? {
+                                            set: props.news.symbols
+                                        } : undefined,
+                                        relevance: props.news.relevance !== undefined ? props.news.relevance : undefined,
+                                        publishedAt: props.news.publishedAt !== undefined ? props.news.publishedAt : undefined,
                                     },
                                 }
                             } : undefined,
@@ -1172,6 +1191,11 @@ export const NewsArticleAssetSentiment = {
                                                 set: props.news.topics
                                             } : undefined,
                                             logo: props.news.logo !== undefined ? props.news.logo : undefined,
+                                            symbols: props.news.symbols !== undefined ? {
+                                                set: props.news.symbols
+                                            } : undefined,
+                                            relevance: props.news.relevance !== undefined ? props.news.relevance : undefined,
+                                            publishedAt: props.news.publishedAt !== undefined ? props.news.publishedAt : undefined,
                                         },
                                     }
                                 } : undefined,
@@ -1373,6 +1397,15 @@ export const NewsArticleAssetSentiment = {
                                         logo: props.news.logo !== undefined ? {
                                             set: props.news.logo
                                         } : undefined,
+                                        symbols: props.news.symbols !== undefined ? {
+                                            set: props.news.symbols
+                                        } : undefined,
+                                        relevance: props.news.relevance !== undefined ? {
+                                            set: props.news.relevance
+                                        } : undefined,
+                                        publishedAt: props.news.publishedAt !== undefined ? {
+                                            set: props.news.publishedAt
+                                        } : undefined,
                                     },
                                     create: {
                                         title: props.news.title !== undefined ? props.news.title : undefined,
@@ -1392,6 +1425,11 @@ export const NewsArticleAssetSentiment = {
                                             set: props.news.topics
                                         } : undefined,
                                         logo: props.news.logo !== undefined ? props.news.logo : undefined,
+                                        symbols: props.news.symbols !== undefined ? {
+                                            set: props.news.symbols
+                                        } : undefined,
+                                        relevance: props.news.relevance !== undefined ? props.news.relevance : undefined,
+                                        publishedAt: props.news.publishedAt !== undefined ? props.news.publishedAt : undefined,
                                     },
                                 }
                             } : undefined,
@@ -2009,6 +2047,15 @@ export const NewsArticleAssetSentiment = {
                                         logo: prop.news.logo !== undefined ? {
                                             set: prop.news.logo
                                         } : undefined,
+                                        symbols: prop.news.symbols !== undefined ? {
+                                            set: prop.news.symbols
+                                        } : undefined,
+                                        relevance: prop.news.relevance !== undefined ? {
+                                            set: prop.news.relevance
+                                        } : undefined,
+                                        publishedAt: prop.news.publishedAt !== undefined ? {
+                                            set: prop.news.publishedAt
+                                        } : undefined,
                                     },
                                     create: {
                                         title: prop.news.title !== undefined ? prop.news.title : undefined,
@@ -2028,6 +2075,11 @@ export const NewsArticleAssetSentiment = {
                                             set: prop.news.topics
                                         } : undefined,
                                         logo: prop.news.logo !== undefined ? prop.news.logo : undefined,
+                                        symbols: prop.news.symbols !== undefined ? {
+                                            set: prop.news.symbols
+                                        } : undefined,
+                                        relevance: prop.news.relevance !== undefined ? prop.news.relevance : undefined,
+                                        publishedAt: prop.news.publishedAt !== undefined ? prop.news.publishedAt : undefined,
                                     },
                                 }
                             } : undefined,

package/esm/auth/graphql-auth-shadow.d.ts

@@ -0,0 +1,194 @@
+/**
+ * GraphQL context-layer authentication SHADOW observer.
+ *
+ * This is the transport/context-level counterpart to the resolver-level
+ * {@link ../auth/cortex-auth-checker.cortexAuthChecker}. The two observe DIFFERENT
+ * populations and are complementary:
+ *
+ *   - `cortexAuthChecker` runs ONLY for `@Authorized()`-decorated fields (today:
+ *     the 5 investor-relations models + delete mutations). It cannot see an
+ *     unauthenticated request to any of the hundreds of auto-generated,
+ *     undecorated CRUD fields — which is the overwhelming majority of live
+ *     traffic (the platform, the account-audit scripts, and the engine all reach
+ *     undecorated resolvers).
+ *   - THIS observer runs in the `/graphql` HTTP + WebSocket `context()` callback,
+ *     BEFORE any resolver, on EVERY request. It records whether a request arrived
+ *     with a verified principal, with no principal, or with an invalid token —
+ *     the true, complete denominator+numerator the enforcement decision needs.
+ *
+ * WHY (audit context): the `/graphql` `context()` currently lets a request with
+ * NO bearer token fall through as `{ principal: null }` and ALLOWS it. Requiring
+ * a principal at this layer (rejecting `null`) is the change that would break the
+ * entire product today (cookie-authenticated platform, token-less audit scripts,
+ * the engine's `SERVER_AUTH_TOKEN` gate). Before that enforcement can ever be
+ * flipped, we must first MEASURE, in production, exactly who reaches `/graphql`
+ * without a verified principal. This module provides that measurement WITHOUT
+ * changing behaviour: it counts and (throttled) logs would-denies and always
+ * returns control to the caller.
+ *
+ * SAFETY CONTRACT — observe-only, never blocks:
+ *   - The Prometheus counter {@link graphqlAuthContextEvaluationsTotal} increments
+ *     on every context evaluation, labelled by transport + outcome. It is the
+ *     primary quantitative signal and carries only BOUNDED labels (never the
+ *     attacker-controllable operation name / origin / IP).
+ *   - For the `no_principal` outcome — the would-deny — a structured identity log
+ *     is emitted, THROTTLED to the first occurrence of each
+ *     `(transport, operationName, origin)` per dedup window. Unthrottled logging
+ *     of every unauthenticated request would flood Cloud Logging and bury real
+ *     warnings (audit B01-backend-legacy-10); the counter carries the per-request
+ *     cardinality instead.
+ *   - The dedup store is capped and rotates novel keys into a shared overflow
+ *     bucket so an attacker rotating spoofed origins/operation names cannot grow
+ *     memory without bound (audit B01-backend-legacy-12).
+ *
+ * @see src/auth/cortex-auth-checker.ts for the resolver-level shadow checker.
+ * @see docs/security/2026-08-23-graphql-auth-enforcement-runbook.md for the
+ *      staged enforcement plan this observer feeds.
+ */
+import { Counter, Gauge } from 'prom-client';
+/** The GraphQL transport a context evaluation ran on. */
+export type GraphqlTransport = 'http' | 'ws';
+/**
+ * Outcome of a `/graphql` `context()` evaluation.
+ *
+ *   - `authenticated`  — a verified {@link ../auth/token-verifier.BackendPrincipal}
+ *     was attached.
+ *   - `no_principal`   — no bearer token was presented; the request falls through
+ *     with `principal: null`. This is the WOULD-DENY case under principal-required
+ *     enforcement — the sole behaviour the enforcement flip changes.
+ *   - `invalid_token`  — a token was presented but failed verification. This is
+ *     ALREADY rejected today (HTTP 401 / WS close); recorded here only to complete
+ *     the denominator.
+ */
+export type AuthContextOutcome = 'authenticated' | 'no_principal' | 'invalid_token';
+/**
+ * Caller identity captured for a would-deny (`no_principal`) request. Every field
+ * is best-effort and may be absent (server-to-server callers send no `origin`;
+ * the WS operation name is not always known at context time). Nothing here is
+ * ever used as a Prometheus label — only in the throttled structured log.
+ */
+export interface ShadowAuthIdentity {
+    /** Transport the request arrived on. */
+    transport: GraphqlTransport;
+    /** GraphQL operation name, when resolvable from the request body / args. */
+    operationName?: string;
+    /** `Origin` header — distinguishes browser callers (platform) from scripts. */
+    origin?: string;
+    /** Client IP, as resolved by the caller (Express `req.ip` honours trust-proxy). */
+    ip?: string;
+    /** `User-Agent` header, when present. */
+    userAgent?: string;
+    /**
+     * Whether an `Authorization` header was present at all. `true` here with a
+     * `no_principal` outcome means the header was present but not a `Bearer <token>`
+     * (or an empty bearer) — a distinct, actionable misconfiguration.
+     */
+    authHeaderPresent: boolean;
+}
+/**
+ * Counts EVERY `/graphql` context evaluation, labelled by {@link GraphqlTransport}
+ * and {@link AuthContextOutcome}. This single series is both the denominator
+ * (total requests seen) and the numerator (`outcome="no_principal"` = would-denies).
+ *
+ * Graduation rule for the runbook: the enforcement flip is safe to consider only
+ * once `outcome="no_principal"` has been driven to (effectively) zero for the
+ * transport being enforced, sustained across a full trading week — i.e. every
+ * legitimate caller has been migrated to presenting a verified principal.
+ *
+ * Labels are deliberately BOUNDED (2 transports x 3 outcomes = 6 series). The
+ * high-cardinality identity (operation name, origin, IP) lives only in the
+ * throttled log, never as a metric label — an unauthenticated caller controls
+ * those strings and could otherwise explode metric cardinality.
+ */
+export declare const graphqlAuthContextEvaluationsTotal: Counter<"outcome" | "transport">;
+/**
+ * Current tracked-key cardinality of the throttled-log dedup store. Bounds
+ * visibility into the store ahead of the {@link MAX_TRACKED_SHADOW_KEYS} cap
+ * (audit B01-backend-legacy-12).
+ */
+export declare const graphqlAuthShadowTrackedKeys: Gauge<string>;
+/**
+ * Environment variable that DISABLES the throttled identity log. Absent (the
+ * default) keeps logging ON. Set to `true`/`1` to silence the per-caller log
+ * lines if they ever become operationally noisy — the {@link
+ * graphqlAuthContextEvaluationsTotal} counter continues unaffected, so the
+ * quantitative signal is never lost.
+ */
+export declare const GRAPHQL_AUTH_SHADOW_LOG_DISABLED_ENV = "GRAPHQL_AUTH_SHADOW_LOG_DISABLED";
+/**
+ * Whether the throttled identity log is disabled. Read fresh each call (a cheap
+ * env read) so it can be toggled operationally without a restart — matching the
+ * shadow-flag convention used by the AuthChecker and rate limiter.
+ *
+ * @param env - Environment source (defaults to `process.env`); injectable for tests.
+ * @returns `true` only when the flag is explicitly `true`/`1`.
+ */
+export declare function isShadowAuthLoggingDisabled(env?: Record<string, string | undefined>): boolean;
+/**
+ * Dedup window for the identity log: at most one line per distinct
+ * `(transport, operationName, origin)` key per window. Sized long (10 min) so a
+ * high-volume unauthenticated caller (e.g. the whole platform) contributes ~one
+ * line per window rather than one per request.
+ */
+export declare const SHADOW_LOG_DEDUP_WINDOW_MS: number;
+/**
+ * Normalise a raw header value (`string | string[] | undefined`, arriving typed
+ * as `unknown`) to a single string. Node folds repeated headers into an array;
+ * we keep the first value.
+ *
+ * @param value - Raw header value.
+ * @returns The string value, or `undefined` when absent/unusable.
+ */
+export declare function headerToString(value: unknown): string | undefined;
+/**
+ * Extract a GraphQL operation name from a parsed HTTP request body.
+ *
+ * @param body - The JSON-parsed `/graphql` POST body (typed `unknown`).
+ * @returns The `operationName`, or `undefined` when absent/empty.
+ */
+export declare function extractOperationName(body: unknown): string | undefined;
+/**
+ * Extract a GraphQL operation name from graphql-ws `ExecutionArgs`.
+ *
+ * @param args - The third argument to the graphql-ws `context` callback (typed `unknown`).
+ * @returns The `operationName`, or `undefined` when absent/empty.
+ */
+export declare function extractOperationNameFromArgs(args: unknown): string | undefined;
+/**
+ * Extract `origin` / `userAgent` / `ip` from the graphql-ws `ctx.extra` object
+ * (`{ request, socket }` for the `ws` integration), tolerating any shape.
+ *
+ * @param extra - The graphql-ws context `extra` (typed `unknown`).
+ * @returns Best-effort header identity for the WebSocket upgrade request.
+ */
+export declare function extractHeaderIdentityFromWsExtra(extra: unknown): {
+    origin?: string;
+    userAgent?: string;
+    ip?: string;
+};
+/**
+ * Record a context evaluation outcome on {@link graphqlAuthContextEvaluationsTotal}.
+ * Use for the `authenticated` and `invalid_token` outcomes; the `no_principal`
+ * outcome is recorded (with identity logging) by {@link recordShadowAuthMiss}.
+ *
+ * @param transport - The transport the evaluation ran on.
+ * @param outcome - The evaluation outcome.
+ */
+export declare function recordAuthContextOutcome(transport: GraphqlTransport, outcome: AuthContextOutcome): void;
+/**
+ * Record a would-deny (`no_principal`) request: increment the counter and, unless
+ * logging is disabled, emit a throttled structured identity log. NEVER blocks and
+ * NEVER throws — safe to call on the hot path of the `context()` callback.
+ *
+ * @param identity - Best-effort caller identity for the unauthenticated request.
+ */
+export declare function recordShadowAuthMiss(identity: ShadowAuthIdentity): void;
+/**
+ * Test-only reset of the throttled-log dedup store. Mirrors the token-verifier's
+ * `_resetGoogleAudienceCacheForTests` convention so tests can assert first-in-window
+ * emission deterministically without waiting out a real window.
+ *
+ * @internal
+ */
+export declare function _resetShadowAuthStateForTests(): void;
+//# sourceMappingURL=graphql-auth-shadow.d.ts.map

package/esm/auth/graphql-auth-shadow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"graphql-auth-shadow.d.ts","sourceRoot":"","sources":["../../../src/auth/graphql-auth-shadow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAQ7C,yDAAyD;AACzD,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,IAAI,CAAC;AAE7C;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,kBAAkB,GAC1B,eAAe,GACf,cAAc,GACd,eAAe,CAAC;AAEpB;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,wCAAwC;IACxC,SAAS,EAAE,gBAAgB,CAAC;IAC5B,4EAA4E;IAC5E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,yCAAyC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAMD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,kCAAkC,kCAK7C,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,eAIvC,CAAC;AAMH;;;;;;GAMG;AACH,eAAO,MAAM,oCAAoC,qCACb,CAAC;AAErC;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,OAAO,CAKT;AAMD;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,QAAiB,CAAC;AA+EzD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAIjE;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAItE;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,OAAO,GACZ,MAAM,GAAG,SAAS,CAIpB;AAED;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,OAAO,GAAG;IAChE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,EAAE,CAAC,EAAE,MAAM,CAAC;CACb,CAqBA;AAaD;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,gBAAgB,EAC3B,OAAO,EAAE,kBAAkB,GAC1B,IAAI,CAEN;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CA4BvE;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,IAAI,IAAI,CAEpD"}

package/esm/auth/graphql-auth-shadow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"graphql-auth-shadow.js","sourceRoot":"","sources":["../../../src/auth/graphql-auth-shadow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAmDzC,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,IAAI,OAAO,CAAC;IAC5D,IAAI,EAAE,wCAAwC;IAC9C,IAAI,EAAE,6IAA6I;IACnJ,UAAU,EAAE,CAAC,WAAW,EAAE,SAAS,CAAU;IAC7C,SAAS,EAAE,CAAC,eAAe,CAAC;CAC7B,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,KAAK,CAAC;IACpD,IAAI,EAAE,kCAAkC;IACxC,IAAI,EAAE,kGAAkG;IACxG,SAAS,EAAE,CAAC,eAAe,CAAC;CAC7B,CAAC,CAAC;AAEH,gFAAgF;AAChF,6EAA6E;AAC7E,gFAAgF;AAEhF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAC/C,kCAAkC,CAAC;AAErC;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAA0C,OAAO,CAAC,GAAG;IAErD,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,oCAAoC,CAAC,IAAI,EAAE,CAAC;SAC1D,IAAI,EAAE;SACN,WAAW,EAAE,CAAC;IACjB,OAAO,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC;AACvC,CAAC;AAED,gFAAgF;AAChF,8EAA8E;AAC9E,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzD,+CAA+C;AAC/C,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAEvC;;;;GAIG;AACH,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAEvC,gEAAgE;AAChE,MAAM,YAAY,GAAG,UAAU,CAAC;AAEhC,iFAAiF;AACjF,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEhC,mEAAmE;AACnE,MAAM,UAAU,GAAG,GAAG,CAAC;AAOvB,MAAM,cAAc,GAAG,IAAI,GAAG,EAA0B,CAAC;AAEzD,iFAAiF;AACjF,4EAA4E;AAC5E,WAAW,CAAC,GAAG,EAAE;IACf,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,cAAc,EAAE,CAAC;QAC1C,IAAI,KAAK,CAAC,aAAa,GAAG,GAAG,EAAE,CAAC;YAC9B,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,4BAA4B,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;AACxD,CAAC,EAAE,uBAAuB,CAAC,CAAC,KAAK,EAAE,CAAC;AAEpC;;;;;;;GAOG;AACH,SAAS,qBAAqB,CAAC,GAAW;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,QAAQ,GAAG,GAAG,CAAC;IAEnB,+EAA+E;IAC/E,yBAAyB;IACzB,IACE,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC7B,cAAc,CAAC,IAAI,IAAI,uBAAuB,EAC9C,CAAC;QACD,QAAQ,GAAG,YAAY,CAAC;IAC1B,CAAC;IAED,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,aAAa,GAAG,GAAG,EAAE,CAAC;QAC9C,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE;YAC3B,KAAK,EAAE,CAAC;YACR,aAAa,EAAE,GAAG,GAAG,0BAA0B;SAChD,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC;IACpB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gFAAgF;AAChF,iFAAiF;AACjF,uEAAuE;AACvE,gFAAgF;AAEhF;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1E,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAa;IAChD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAChE,MAAM,EAAE,GAAI,IAAoC,CAAC,aAAa,CAAC;IAC/D,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAC1C,IAAa;IAEb,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAChE,MAAM,EAAE,GAAI,IAAoC,CAAC,aAAa,CAAC;IAC/D,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAClE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gCAAgC,CAAC,KAAc;IAK7D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAC3D,MAAM,OAAO,GAAI,KAA+B,CAAC,OAAO,CAAC;IACzD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAE/D,MAAM,OAAO,GAAI,OAAiC,CAAC,OAAO,CAAC;IAC3D,MAAM,MAAM,GAAI,OAAgC,CAAC,MAAM,CAAC;IACxD,MAAM,SAAS,GACb,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;QAC7C,CAAC,CAAE,OAAmC;QACtC,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,aAAa,GACjB,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAC3C,CAAC,CAAE,MAAsC,CAAC,aAAa;QACvD,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO;QACL,MAAM,EAAE,cAAc,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC3C,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAClD,EAAE,EAAE,OAAO,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;KAClE,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAS,UAAU,CAAC,KAAyB,EAAE,GAAW;IACxD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AAChE,CAAC;AAED,gFAAgF;AAChF,mEAAmE;AACnE,gFAAgF;AAEhF;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CACtC,SAA2B,EAC3B,OAA2B;IAE3B,kCAAkC,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAA4B;IAC/D,kCAAkC,CAAC,GAAG,CAAC;QACrC,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,OAAO,EAAE,cAAc;KACxB,CAAC,CAAC;IAEH,IAAI,2BAA2B,EAAE;QAAE,OAAO;IAE1C,MAAM,aAAa,GACjB,UAAU,CAAC,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAC,IAAI,WAAW,CAAC;IACzE,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC,IAAI,QAAQ,CAAC;IAC5E,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC,SAAS,IAAI,aAAa,IAAI,MAAM,EAAE,CAAC;IAE/D,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC;QAAE,OAAO;IAExC,MAAM,CAAC,IAAI,CACT,uGAAuG,EACvG;QACE,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,aAAa;QACb,MAAM;QACN,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,SAAS;QAClE,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;QAC7C,aAAa,EAAE,0BAA0B;QACzC,IAAI,EAAE,yLAAyL;KAChM,CACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,6BAA6B;IAC3C,cAAc,CAAC,KAAK,EAAE,CAAC;AACzB,CAAC"}

package/esm/auth/graphql-auth-shadow.mjs

@@ -0,0 +1,305 @@
+/**
+ * GraphQL context-layer authentication SHADOW observer.
+ *
+ * This is the transport/context-level counterpart to the resolver-level
+ * {@link ../auth/cortex-auth-checker.cortexAuthChecker}. The two observe DIFFERENT
+ * populations and are complementary:
+ *
+ *   - `cortexAuthChecker` runs ONLY for `@Authorized()`-decorated fields (today:
+ *     the 5 investor-relations models + delete mutations). It cannot see an
+ *     unauthenticated request to any of the hundreds of auto-generated,
+ *     undecorated CRUD fields — which is the overwhelming majority of live
+ *     traffic (the platform, the account-audit scripts, and the engine all reach
+ *     undecorated resolvers).
+ *   - THIS observer runs in the `/graphql` HTTP + WebSocket `context()` callback,
+ *     BEFORE any resolver, on EVERY request. It records whether a request arrived
+ *     with a verified principal, with no principal, or with an invalid token —
+ *     the true, complete denominator+numerator the enforcement decision needs.
+ *
+ * WHY (audit context): the `/graphql` `context()` currently lets a request with
+ * NO bearer token fall through as `{ principal: null }` and ALLOWS it. Requiring
+ * a principal at this layer (rejecting `null`) is the change that would break the
+ * entire product today (cookie-authenticated platform, token-less audit scripts,
+ * the engine's `SERVER_AUTH_TOKEN` gate). Before that enforcement can ever be
+ * flipped, we must first MEASURE, in production, exactly who reaches `/graphql`
+ * without a verified principal. This module provides that measurement WITHOUT
+ * changing behaviour: it counts and (throttled) logs would-denies and always
+ * returns control to the caller.
+ *
+ * SAFETY CONTRACT — observe-only, never blocks:
+ *   - The Prometheus counter {@link graphqlAuthContextEvaluationsTotal} increments
+ *     on every context evaluation, labelled by transport + outcome. It is the
+ *     primary quantitative signal and carries only BOUNDED labels (never the
+ *     attacker-controllable operation name / origin / IP).
+ *   - For the `no_principal` outcome — the would-deny — a structured identity log
+ *     is emitted, THROTTLED to the first occurrence of each
+ *     `(transport, operationName, origin)` per dedup window. Unthrottled logging
+ *     of every unauthenticated request would flood Cloud Logging and bury real
+ *     warnings (audit B01-backend-legacy-10); the counter carries the per-request
+ *     cardinality instead.
+ *   - The dedup store is capped and rotates novel keys into a shared overflow
+ *     bucket so an attacker rotating spoofed origins/operation names cannot grow
+ *     memory without bound (audit B01-backend-legacy-12).
+ *
+ * @see src/auth/cortex-auth-checker.ts for the resolver-level shadow checker.
+ * @see docs/security/2026-08-23-graphql-auth-enforcement-runbook.md for the
+ *      staged enforcement plan this observer feeds.
+ */
+import { Counter, Gauge } from 'prom-client';
+import { metricsRegistry } from '../config/metrics.mjs';
+import { logger } from '../utils/logger.mjs';
+// -----------------------------------------------------------------------------
+// Metrics
+// -----------------------------------------------------------------------------
+/**
+ * Counts EVERY `/graphql` context evaluation, labelled by {@link GraphqlTransport}
+ * and {@link AuthContextOutcome}. This single series is both the denominator
+ * (total requests seen) and the numerator (`outcome="no_principal"` = would-denies).
+ *
+ * Graduation rule for the runbook: the enforcement flip is safe to consider only
+ * once `outcome="no_principal"` has been driven to (effectively) zero for the
+ * transport being enforced, sustained across a full trading week — i.e. every
+ * legitimate caller has been migrated to presenting a verified principal.
+ *
+ * Labels are deliberately BOUNDED (2 transports x 3 outcomes = 6 series). The
+ * high-cardinality identity (operation name, origin, IP) lives only in the
+ * throttled log, never as a metric label — an unauthenticated caller controls
+ * those strings and could otherwise explode metric cardinality.
+ */
+export const graphqlAuthContextEvaluationsTotal = new Counter({
+    name: 'graphql_auth_context_evaluations_total',
+    help: 'GraphQL /graphql context evaluations by transport and outcome (outcome="no_principal" is the shadow would-deny; observe-only, never blocks)',
+    labelNames: ['transport', 'outcome'],
+    registers: [metricsRegistry],
+});
+/**
+ * Current tracked-key cardinality of the throttled-log dedup store. Bounds
+ * visibility into the store ahead of the {@link MAX_TRACKED_SHADOW_KEYS} cap
+ * (audit B01-backend-legacy-12).
+ */
+export const graphqlAuthShadowTrackedKeys = new Gauge({
+    name: 'graphql_auth_shadow_tracked_keys',
+    help: 'Current distinct (transport, operationName, origin) keys tracked by the shadow-auth log throttle',
+    registers: [metricsRegistry],
+});
+// -----------------------------------------------------------------------------
+// Logging-enable flag (counter is always on; this only gates the detail log)
+// -----------------------------------------------------------------------------
+/**
+ * Environment variable that DISABLES the throttled identity log. Absent (the
+ * default) keeps logging ON. Set to `true`/`1` to silence the per-caller log
+ * lines if they ever become operationally noisy — the {@link
+ * graphqlAuthContextEvaluationsTotal} counter continues unaffected, so the
+ * quantitative signal is never lost.
+ */
+export const GRAPHQL_AUTH_SHADOW_LOG_DISABLED_ENV = 'GRAPHQL_AUTH_SHADOW_LOG_DISABLED';
+/**
+ * Whether the throttled identity log is disabled. Read fresh each call (a cheap
+ * env read) so it can be toggled operationally without a restart — matching the
+ * shadow-flag convention used by the AuthChecker and rate limiter.
+ *
+ * @param env - Environment source (defaults to `process.env`); injectable for tests.
+ * @returns `true` only when the flag is explicitly `true`/`1`.
+ */
+export function isShadowAuthLoggingDisabled(env = process.env) {
+    const raw = (env[GRAPHQL_AUTH_SHADOW_LOG_DISABLED_ENV] ?? '')
+        .trim()
+        .toLowerCase();
+    return raw === 'true' || raw === '1';
+}
+// -----------------------------------------------------------------------------
+// Throttled-log dedup store (mirrors the rate-limiter's capped store pattern)
+// -----------------------------------------------------------------------------
+/**
+ * Dedup window for the identity log: at most one line per distinct
+ * `(transport, operationName, origin)` key per window. Sized long (10 min) so a
+ * high-volume unauthenticated caller (e.g. the whole platform) contributes ~one
+ * line per window rather than one per request.
+ */
+export const SHADOW_LOG_DEDUP_WINDOW_MS = 10 * 60 * 1000;
+/** Sweep cadence for expired dedup windows. */
+const STORE_SWEEP_INTERVAL_MS = 60_000;
+/**
+ * Cap on distinct dedup keys. Past the cap, novel keys aggregate into a single
+ * shared overflow bucket instead of allocating — bounding memory under an
+ * attacker rotating spoofed origins / operation names (audit B01-backend-legacy-12).
+ */
+const MAX_TRACKED_SHADOW_KEYS = 10_000;
+/** Dedup key used once the store cardinality cap is reached. */
+const OVERFLOW_KEY = 'overflow';
+/** Max characters retained from a caller-supplied string used in a dedup key. */
+const MAX_KEY_SEGMENT_LEN = 120;
+/** Max characters retained from a `User-Agent` in the log body. */
+const MAX_UA_LEN = 200;
+const shadowLogStore = new Map();
+// Sweep expired windows every minute. `unref()` so importing this module (tests,
+// one-off scripts) never keeps the process alive on account of the sweeper.
+setInterval(() => {
+    const now = Date.now();
+    for (const [key, entry] of shadowLogStore) {
+        if (entry.windowResetAt < now) {
+            shadowLogStore.delete(key);
+        }
+    }
+    graphqlAuthShadowTrackedKeys.set(shadowLogStore.size);
+}, STORE_SWEEP_INTERVAL_MS).unref();
+/**
+ * Decide whether to emit an identity log line for `key` now: emit on the first
+ * occurrence within the current dedup window, then suppress until the window
+ * rolls over. Applies the cardinality cap + overflow bucket.
+ *
+ * @param key - The `(transport, operationName, origin)` dedup key.
+ * @returns `true` when this is the first sighting of the key in the window.
+ */
+function shouldEmitIdentityLog(key) {
+    const now = Date.now();
+    let storeKey = key;
+    // Cardinality cap: fold novel keys into the shared overflow bucket rather than
+    // growing without bound.
+    if (!shadowLogStore.has(storeKey) &&
+        shadowLogStore.size >= MAX_TRACKED_SHADOW_KEYS) {
+        storeKey = OVERFLOW_KEY;
+    }
+    const existing = shadowLogStore.get(storeKey);
+    if (!existing || existing.windowResetAt < now) {
+        shadowLogStore.set(storeKey, {
+            count: 1,
+            windowResetAt: now + SHADOW_LOG_DEDUP_WINDOW_MS,
+        });
+        return true;
+    }
+    existing.count += 1;
+    return false;
+}
+// -----------------------------------------------------------------------------
+// Extraction helpers (accept `unknown` so callers pass framework objects without
+// leaking `any` or coupling this module to Express / graphql-ws types)
+// -----------------------------------------------------------------------------
+/**
+ * Normalise a raw header value (`string | string[] | undefined`, arriving typed
+ * as `unknown`) to a single string. Node folds repeated headers into an array;
+ * we keep the first value.
+ *
+ * @param value - Raw header value.
+ * @returns The string value, or `undefined` when absent/unusable.
+ */
+export function headerToString(value) {
+    if (typeof value === 'string')
+        return value;
+    if (Array.isArray(value) && typeof value[0] === 'string')
+        return value[0];
+    return undefined;
+}
+/**
+ * Extract a GraphQL operation name from a parsed HTTP request body.
+ *
+ * @param body - The JSON-parsed `/graphql` POST body (typed `unknown`).
+ * @returns The `operationName`, or `undefined` when absent/empty.
+ */
+export function extractOperationName(body) {
+    if (typeof body !== 'object' || body === null)
+        return undefined;
+    const op = body.operationName;
+    return typeof op === 'string' && op.length > 0 ? op : undefined;
+}
+/**
+ * Extract a GraphQL operation name from graphql-ws `ExecutionArgs`.
+ *
+ * @param args - The third argument to the graphql-ws `context` callback (typed `unknown`).
+ * @returns The `operationName`, or `undefined` when absent/empty.
+ */
+export function extractOperationNameFromArgs(args) {
+    if (typeof args !== 'object' || args === null)
+        return undefined;
+    const op = args.operationName;
+    return typeof op === 'string' && op.length > 0 ? op : undefined;
+}
+/**
+ * Extract `origin` / `userAgent` / `ip` from the graphql-ws `ctx.extra` object
+ * (`{ request, socket }` for the `ws` integration), tolerating any shape.
+ *
+ * @param extra - The graphql-ws context `extra` (typed `unknown`).
+ * @returns Best-effort header identity for the WebSocket upgrade request.
+ */
+export function extractHeaderIdentityFromWsExtra(extra) {
+    if (typeof extra !== 'object' || extra === null)
+        return {};
+    const request = extra.request;
+    if (typeof request !== 'object' || request === null)
+        return {};
+    const headers = request.headers;
+    const socket = request.socket;
+    const headerBag = typeof headers === 'object' && headers !== null
+        ? headers
+        : {};
+    const remoteAddress = typeof socket === 'object' && socket !== null
+        ? socket.remoteAddress
+        : undefined;
+    return {
+        origin: headerToString(headerBag['origin']),
+        userAgent: headerToString(headerBag['user-agent']),
+        ip: typeof remoteAddress === 'string' ? remoteAddress : undefined,
+    };
+}
+/** Trim + length-cap a caller-supplied string for safe use in a dedup key. */
+function capSegment(value, max) {
+    if (!value)
+        return '';
+    const trimmed = value.trim();
+    return trimmed.length > max ? trimmed.slice(0, max) : trimmed;
+}
+// -----------------------------------------------------------------------------
+// Recording entry points (called from server.ts context callbacks)
+// -----------------------------------------------------------------------------
+/**
+ * Record a context evaluation outcome on {@link graphqlAuthContextEvaluationsTotal}.
+ * Use for the `authenticated` and `invalid_token` outcomes; the `no_principal`
+ * outcome is recorded (with identity logging) by {@link recordShadowAuthMiss}.
+ *
+ * @param transport - The transport the evaluation ran on.
+ * @param outcome - The evaluation outcome.
+ */
+export function recordAuthContextOutcome(transport, outcome) {
+    graphqlAuthContextEvaluationsTotal.inc({ transport, outcome });
+}
+/**
+ * Record a would-deny (`no_principal`) request: increment the counter and, unless
+ * logging is disabled, emit a throttled structured identity log. NEVER blocks and
+ * NEVER throws — safe to call on the hot path of the `context()` callback.
+ *
+ * @param identity - Best-effort caller identity for the unauthenticated request.
+ */
+export function recordShadowAuthMiss(identity) {
+    graphqlAuthContextEvaluationsTotal.inc({
+        transport: identity.transport,
+        outcome: 'no_principal',
+    });
+    if (isShadowAuthLoggingDisabled())
+        return;
+    const operationName = capSegment(identity.operationName, MAX_KEY_SEGMENT_LEN) || '<unnamed>';
+    const origin = capSegment(identity.origin, MAX_KEY_SEGMENT_LEN) || '<none>';
+    const key = `${identity.transport}|${operationName}|${origin}`;
+    if (!shouldEmitIdentityLog(key))
+        return;
+    logger.warn('[graphql-auth-shadow] would-deny: unauthenticated /graphql request (allowing — no verified principal)', {
+        transport: identity.transport,
+        operationName,
+        origin,
+        ip: identity.ip,
+        userAgent: capSegment(identity.userAgent, MAX_UA_LEN) || undefined,
+        authHeaderPresent: identity.authHeaderPresent,
+        dedupWindowMs: SHADOW_LOG_DEDUP_WINDOW_MS,
+        note: 'First occurrence of this (transport, operationName, origin) in the current dedup window. Every occurrence is counted on graphql_auth_context_evaluations_total{outcome="no_principal"}.',
+    });
+}
+/**
+ * Test-only reset of the throttled-log dedup store. Mirrors the token-verifier's
+ * `_resetGoogleAudienceCacheForTests` convention so tests can assert first-in-window
+ * emission deterministically without waiting out a real window.
+ *
+ * @internal
+ */
+export function _resetShadowAuthStateForTests() {
+    shadowLogStore.clear();
+}
+//# sourceMappingURL=graphql-auth-shadow.js.map

package/esm/generated/selectionSets/EconomicEvent.d.ts

@@ -1,2 +1,2 @@
-export declare const EconomicEvent = "\n  id\n  title\n  description\n  date\n  importance\n  createdAt\n  updatedAt\n";
+export declare const EconomicEvent = "\n  id\n  title\n  description\n  date\n  importance\n  country\n  eventTime\n  actual\n  forecast\n  previous\n  unit\n  source\n  createdAt\n  updatedAt\n";
 //# sourceMappingURL=EconomicEvent.d.ts.map

package/esm/generated/selectionSets/EconomicEvent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"EconomicEvent.d.ts","sourceRoot":"","sources":["../../../../src/generated/selectionSets/EconomicEvent.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,aAAa,qFAQzB,CAAC"}
+{"version":3,"file":"EconomicEvent.d.ts","sourceRoot":"","sources":["../../../../src/generated/selectionSets/EconomicEvent.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,aAAa,iKAezB,CAAC"}

package/esm/generated/selectionSets/EconomicEvent.js.map

@@ -1 +1 @@
-{"version":3,"file":"EconomicEvent.js","sourceRoot":"","sources":["../../../../src/generated/selectionSets/EconomicEvent.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;CAQ5B,CAAC"}
+{"version":3,"file":"EconomicEvent.js","sourceRoot":"","sources":["../../../../src/generated/selectionSets/EconomicEvent.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;CAe5B,CAAC"}

package/esm/generated/selectionSets/EconomicEvent.mjs

@@ -4,6 +4,13 @@ export const EconomicEvent = `
   description
   date
   importance
+  country
+  eventTime
+  actual
+  forecast
+  previous
+  unit
+  source
   createdAt
   updatedAt
 `;

package/esm/generated/selectionSets/NewsArticle.d.ts

@@ -1,2 +1,2 @@
-export declare const NewsArticle = "\n  id\n  title\n  content\n  source\n  sourceDomain\n  url\n  sentiment\n  authors\n  summary\n  bannerImage\n  timePublished\n  category\n  topics\n  logo\n  createdAt\n  updatedAt\n";
+export declare const NewsArticle = "\n  id\n  title\n  content\n  source\n  sourceDomain\n  url\n  sentiment\n  authors\n  summary\n  bannerImage\n  timePublished\n  category\n  topics\n  logo\n  symbols\n  relevance\n  publishedAt\n  createdAt\n  updatedAt\n";
 //# sourceMappingURL=NewsArticle.d.ts.map