@adaptic/backend-legacy 0.0.996 → 0.0.997

package/esm/auth/cortex-auth-checker.d.ts

@@ -0,0 +1,104 @@
+/**
+ * CORTEX-P0-001 — resolver-level authorization AuthChecker (SHADOW-FIRST).
+ *
+ * A TypeGraphQL {@link AuthChecker} that evaluates whether an operation WOULD be
+ * allowed under resolver-level authorization, closing the residual vector called
+ * out in the tenancy-scoping middleware docs: a governed model reached
+ * transitively through a non-governed root, and — more broadly — any
+ * `@Authorized()`-decorated field executed without a verified principal.
+ *
+ * CRITICAL SAFETY CONTRACT — this change is additive and default-OFF. When
+ * enforcement is OFF (the default), the checker NEVER denies: it returns `true`
+ * for every operation, emitting a structured warn log and incrementing a
+ * Prometheus counter for any operation that enforcement WOULD deny. Live
+ * behaviour is byte-identical to before this change until
+ * `CORTEX_AUTHCHECKER_ENFORCE` is flipped on. Additionally, TypeGraphQL only
+ * invokes an AuthChecker for fields decorated with `@Authorized()`; the
+ * auto-generated typegraphql-prisma resolvers carry no such decorator, so
+ * registering this checker via `buildSchema({ authChecker })` is inert at
+ * runtime until decorators are added in the separate enforcement phase.
+ *
+ * Decision model (mirrors the token-verifier principal kinds):
+ *
+ *   - `server`            — trusted server-to-server caller. ALWAYS allowed; the
+ *     engine + utils call the CRUD resolvers with a server principal and must
+ *     retain full access, bypassing any role gate.
+ *   - `admin` / `user`    — verified end-user. Allowed when the field requires no
+ *     specific role, or when the principal carries one of the required roles;
+ *     otherwise a would-deny with reason `insufficient_role`.
+ *   - `null` (no verified principal) — a genuinely unauthenticated caller on a
+ *     non-public (i.e. `@Authorized()`) operation. A would-deny with reason
+ *     `unauthenticated`.
+ *
+ * @see src/auth/tenancy-scope.ts for the row-level (data-scope) counterpart.
+ * @see src/auth/token-verifier.ts for `BackendPrincipal`.
+ */
+import { Counter } from 'prom-client';
+import type { AuthChecker } from 'type-graphql';
+import type { BackendPrincipal } from './token-verifier';
+/**
+ * Environment variable gating enforcement. When set to `true`/`1`, the checker
+ * fails closed (returns `false`) for any would-deny operation. Unset or any
+ * other value keeps the checker in SHADOW mode (observe + count + allow).
+ */
+export declare const CORTEX_AUTHCHECKER_ENFORCE_ENV = "CORTEX_AUTHCHECKER_ENFORCE";
+/**
+ * Whether resolver-level authorization enforcement is ON. Read fresh on each
+ * call (a cheap env read) so the shadow→enforce graduation can be flipped
+ * operationally without a process restart — the same pattern the tenancy-scoping
+ * middleware uses. Defaults to OFF (shadow) for any unset/unrecognised value.
+ *
+ * @param env - Environment source (defaults to `process.env`); injectable for tests.
+ * @returns `true` only when the flag is explicitly `true`/`1`.
+ */
+export declare function isAuthCheckerEnforced(env?: Record<string, string | undefined>): boolean;
+/**
+ * Finite set of reasons enforcement WOULD deny an operation. Used as the sole
+ * label on {@link cortexAuthCheckerWouldDenyTotal}.
+ */
+export type WouldDenyReason = 'unauthenticated' | 'insufficient_role';
+/**
+ * Counts operations that resolver-level authorization WOULD deny. In shadow mode
+ * this is the primary signal proving whether flipping `CORTEX_AUTHCHECKER_ENFORCE`
+ * to `enforce` would reject any legitimate platform or engine traffic. Labelled
+ * by the discriminated {@link WouldDenyReason}.
+ */
+export declare const cortexAuthCheckerWouldDenyTotal: Counter<"reason">;
+/** The outcome of evaluating whether an operation would be allowed. */
+interface AuthEvaluation {
+    readonly wouldAllow: boolean;
+    /** Populated only when `wouldAllow` is `false`. */
+    readonly reason?: WouldDenyReason;
+}
+/**
+ * Pure evaluation of whether a principal would satisfy the required roles for an
+ * operation. Performs no I/O and no logging.
+ *
+ * @param principal - The verified principal, or `null` for an unauthenticated caller.
+ * @param requiredRoles - Roles declared on the field's `@Authorized(...)` decorator
+ *   (empty when the field only requires authentication).
+ * @returns The {@link AuthEvaluation}.
+ */
+export declare function evaluateWouldAllow(principal: BackendPrincipal | null, requiredRoles: readonly string[]): AuthEvaluation;
+/**
+ * GraphQL context shape this checker reads. `principal` is the verified
+ * `BackendPrincipal` attached to the context in `server.ts` (`null` for an
+ * unauthenticated caller).
+ */
+export interface CortexAuthContext {
+    principal?: BackendPrincipal | null;
+}
+/**
+ * The CORTEX-P0-001 AuthChecker. Register via
+ * `buildSchema({ authChecker: cortexAuthChecker })`.
+ *
+ * SHADOW (default): a would-deny operation increments
+ * {@link cortexAuthCheckerWouldDenyTotal}, emits a warn log, and RETURNS TRUE —
+ * no behaviour change. ENFORCE (`CORTEX_AUTHCHECKER_ENFORCE=true`): a would-deny
+ * operation is logged, the counter is incremented, and the checker RETURNS FALSE
+ * (fail closed). Operations that would be allowed always return `true` with no
+ * metric or log emission.
+ */
+export declare const cortexAuthChecker: AuthChecker<CortexAuthContext>;
+export {};
+//# sourceMappingURL=cortex-auth-checker.d.ts.map

package/esm/auth/cortex-auth-checker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cortex-auth-checker.d.ts","sourceRoot":"","sources":["../../../src/auth/cortex-auth-checker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,WAAW,EAAgB,MAAM,cAAc,CAAC;AAC9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAQzD;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,+BAA+B,CAAC;AAK3E;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,OAAO,CAGT;AAMD;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,iBAAiB,GAAG,mBAAmB,CAAC;AAEtE;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B,mBAK1C,CAAC;AAEH,uEAAuE;AACvE,UAAU,cAAc;IACtB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,mDAAmD;IACnD,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;CACnC;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,gBAAgB,GAAG,IAAI,EAClC,aAAa,EAAE,SAAS,MAAM,EAAE,GAC/B,cAAc,CAyBhB;AAMD;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;CACrC;AAcD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,EAAE,WAAW,CAAC,iBAAiB,CA8B5D,CAAC"}

package/esm/auth/cortex-auth-checker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cortex-auth-checker.js","sourceRoot":"","sources":["../../../src/auth/cortex-auth-checker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAGtC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAEzC,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,4BAA4B,CAAC;AAE3E,kFAAkF;AAClF,MAAM,UAAU,GAAG,OAAO,CAAC;AAE3B;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAA0C,OAAO,CAAC,GAAG;IAErD,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,8BAA8B,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7E,OAAO,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC;AACvC,CAAC;AAYD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,OAAO,CAAC;IACzD,IAAI,EAAE,qCAAqC;IAC3C,IAAI,EAAE,wGAAwG;IAC9G,UAAU,EAAE,CAAC,QAAQ,CAAU;IAC/B,SAAS,EAAE,CAAC,eAAe,CAAC;CAC7B,CAAC,CAAC;AASH;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAChC,SAAkC,EAClC,aAAgC;IAEhC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC1D,CAAC;IAED,8EAA8E;IAC9E,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC9B,CAAC;IAED,yEAAyE;IACzE,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC9B,CAAC;IAED,MAAM,cAAc,GAClB,SAAS,CAAC,IAAI,KAAK,OAAO;QACxB,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC;QAClC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC;IACtB,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;IACxC,MAAM,eAAe,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAExE,OAAO,eAAe;QACpB,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE;QACtB,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;AACzD,CAAC;AAeD,4EAA4E;AAC5E,SAAS,iBAAiB,CACxB,YAA6C;IAE7C,MAAM,EAAE,IAAI,EAAE,GAAG,YAAY,CAAC;IAC9B,OAAO;QACL,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS;QACvC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,SAAS;QAC3D,KAAK,EAAE,IAAI,CAAC,SAAS;KACtB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAmC,CAC/D,YAAY,EACZ,KAAK,EACI,EAAE;IACX,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC;IACzD,MAAM,UAAU,GAAG,kBAAkB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAExD,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,iBAAiB,CAAC;IACtD,MAAM,QAAQ,GAAG,qBAAqB,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAElD,+BAA+B,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAChD,MAAM,CAAC,IAAI,CACT,QAAQ;QACN,CAAC,CAAC,kDAAkD;QACpD,CAAC,CAAC,mDAAmD,EACvD;QACE,GAAG,SAAS;QACZ,MAAM;QACN,QAAQ;QACR,aAAa,EAAE,SAAS,EAAE,IAAI,IAAI,MAAM;QACxC,aAAa,EAAE,CAAC,GAAG,KAAK,CAAC;KAC1B,CACF,CAAC;IAEF,OAAO,CAAC,QAAQ,CAAC;AACnB,CAAC,CAAC"}

package/esm/auth/cortex-auth-checker.mjs

@@ -0,0 +1,146 @@
+/**
+ * CORTEX-P0-001 — resolver-level authorization AuthChecker (SHADOW-FIRST).
+ *
+ * A TypeGraphQL {@link AuthChecker} that evaluates whether an operation WOULD be
+ * allowed under resolver-level authorization, closing the residual vector called
+ * out in the tenancy-scoping middleware docs: a governed model reached
+ * transitively through a non-governed root, and — more broadly — any
+ * `@Authorized()`-decorated field executed without a verified principal.
+ *
+ * CRITICAL SAFETY CONTRACT — this change is additive and default-OFF. When
+ * enforcement is OFF (the default), the checker NEVER denies: it returns `true`
+ * for every operation, emitting a structured warn log and incrementing a
+ * Prometheus counter for any operation that enforcement WOULD deny. Live
+ * behaviour is byte-identical to before this change until
+ * `CORTEX_AUTHCHECKER_ENFORCE` is flipped on. Additionally, TypeGraphQL only
+ * invokes an AuthChecker for fields decorated with `@Authorized()`; the
+ * auto-generated typegraphql-prisma resolvers carry no such decorator, so
+ * registering this checker via `buildSchema({ authChecker })` is inert at
+ * runtime until decorators are added in the separate enforcement phase.
+ *
+ * Decision model (mirrors the token-verifier principal kinds):
+ *
+ *   - `server`            — trusted server-to-server caller. ALWAYS allowed; the
+ *     engine + utils call the CRUD resolvers with a server principal and must
+ *     retain full access, bypassing any role gate.
+ *   - `admin` / `user`    — verified end-user. Allowed when the field requires no
+ *     specific role, or when the principal carries one of the required roles;
+ *     otherwise a would-deny with reason `insufficient_role`.
+ *   - `null` (no verified principal) — a genuinely unauthenticated caller on a
+ *     non-public (i.e. `@Authorized()`) operation. A would-deny with reason
+ *     `unauthenticated`.
+ *
+ * @see src/auth/tenancy-scope.ts for the row-level (data-scope) counterpart.
+ * @see src/auth/token-verifier.ts for `BackendPrincipal`.
+ */
+import { Counter } from 'prom-client';
+import { metricsRegistry } from '../config/metrics.mjs';
+import { logger } from '../utils/logger.mjs';
+// -----------------------------------------------------------------------------
+// Enforcement flag
+// -----------------------------------------------------------------------------
+/**
+ * Environment variable gating enforcement. When set to `true`/`1`, the checker
+ * fails closed (returns `false`) for any would-deny operation. Unset or any
+ * other value keeps the checker in SHADOW mode (observe + count + allow).
+ */
+export const CORTEX_AUTHCHECKER_ENFORCE_ENV = 'CORTEX_AUTHCHECKER_ENFORCE';
+/** The `admin` role string used to satisfy admin-gated `@Authorized()` fields. */
+const ADMIN_ROLE = 'admin';
+/**
+ * Whether resolver-level authorization enforcement is ON. Read fresh on each
+ * call (a cheap env read) so the shadow→enforce graduation can be flipped
+ * operationally without a process restart — the same pattern the tenancy-scoping
+ * middleware uses. Defaults to OFF (shadow) for any unset/unrecognised value.
+ *
+ * @param env - Environment source (defaults to `process.env`); injectable for tests.
+ * @returns `true` only when the flag is explicitly `true`/`1`.
+ */
+export function isAuthCheckerEnforced(env = process.env) {
+    const raw = (env[CORTEX_AUTHCHECKER_ENFORCE_ENV] ?? '').trim().toLowerCase();
+    return raw === 'true' || raw === '1';
+}
+/**
+ * Counts operations that resolver-level authorization WOULD deny. In shadow mode
+ * this is the primary signal proving whether flipping `CORTEX_AUTHCHECKER_ENFORCE`
+ * to `enforce` would reject any legitimate platform or engine traffic. Labelled
+ * by the discriminated {@link WouldDenyReason}.
+ */
+export const cortexAuthCheckerWouldDenyTotal = new Counter({
+    name: 'cortex_authchecker_would_deny_total',
+    help: 'Operations resolver-level authorization would deny, by reason (counted in shadow mode without denying)',
+    labelNames: ['reason'],
+    registers: [metricsRegistry],
+});
+/**
+ * Pure evaluation of whether a principal would satisfy the required roles for an
+ * operation. Performs no I/O and no logging.
+ *
+ * @param principal - The verified principal, or `null` for an unauthenticated caller.
+ * @param requiredRoles - Roles declared on the field's `@Authorized(...)` decorator
+ *   (empty when the field only requires authentication).
+ * @returns The {@link AuthEvaluation}.
+ */
+export function evaluateWouldAllow(principal, requiredRoles) {
+    if (!principal) {
+        return { wouldAllow: false, reason: 'unauthenticated' };
+    }
+    // Server-to-server callers are unconditionally allowed and bypass role gates.
+    if (principal.kind === 'server') {
+        return { wouldAllow: true };
+    }
+    // Authenticated user/admin with no specific role requirement -> allowed.
+    if (requiredRoles.length === 0) {
+        return { wouldAllow: true };
+    }
+    const principalRoles = principal.kind === 'admin'
+        ? [...principal.roles, ADMIN_ROLE]
+        : principal.roles;
+    const roleSet = new Set(principalRoles);
+    const hasRequiredRole = requiredRoles.some((role) => roleSet.has(role));
+    return hasRequiredRole
+        ? { wouldAllow: true }
+        : { wouldAllow: false, reason: 'insufficient_role' };
+}
+/** Describe an operation for structured logs, without leaking arguments. */
+function describeOperation(resolverData) {
+    const { info } = resolverData;
+    return {
+        operationType: info.operation.operation,
+        operationName: info.operation.name?.value ?? info.fieldName,
+        field: info.fieldName,
+    };
+}
+/**
+ * The CORTEX-P0-001 AuthChecker. Register via
+ * `buildSchema({ authChecker: cortexAuthChecker })`.
+ *
+ * SHADOW (default): a would-deny operation increments
+ * {@link cortexAuthCheckerWouldDenyTotal}, emits a warn log, and RETURNS TRUE —
+ * no behaviour change. ENFORCE (`CORTEX_AUTHCHECKER_ENFORCE=true`): a would-deny
+ * operation is logged, the counter is incremented, and the checker RETURNS FALSE
+ * (fail closed). Operations that would be allowed always return `true` with no
+ * metric or log emission.
+ */
+export const cortexAuthChecker = (resolverData, roles) => {
+    const principal = resolverData.context.principal ?? null;
+    const evaluation = evaluateWouldAllow(principal, roles);
+    if (evaluation.wouldAllow) {
+        return true;
+    }
+    const reason = evaluation.reason ?? 'unauthenticated';
+    const enforced = isAuthCheckerEnforced();
+    const operation = describeOperation(resolverData);
+    cortexAuthCheckerWouldDenyTotal.inc({ reason });
+    logger.warn(enforced
+        ? '[cortex-authchecker] denying operation (enforce)'
+        : '[cortex-authchecker] shadow would-deny (allowing)', {
+        ...operation,
+        reason,
+        enforced,
+        principalKind: principal?.kind ?? 'none',
+        requiredRoles: [...roles],
+    });
+    return !enforced;
+};
+//# sourceMappingURL=cortex-auth-checker.js.map

package/esm/middleware/rate-limiter.d.ts

@@ -1,4 +1,27 @@
 import { Request, Response, NextFunction } from 'express';
+import { Counter } from 'prom-client';
+/**
+ * Environment variable gating 429 enforcement. When set to `true`/`1`, the
+ * limiters block over-limit requests with HTTP 429. Unset or any other value
+ * keeps them in SHADOW mode (observe + count + always proceed).
+ */
+export declare const CORTEX_RATE_LIMIT_ENFORCE_ENV = "CORTEX_RATE_LIMIT_ENFORCE";
+/**
+ * Whether rate-limit 429 enforcement is ON. Read fresh on each request (a cheap
+ * env read) so the shadow→enforce graduation can be flipped operationally
+ * without a restart. Defaults to OFF (shadow) for any unset/unrecognised value.
+ *
+ * @param env - Environment source (defaults to `process.env`); injectable for tests.
+ * @returns `true` only when the flag is explicitly `true`/`1`.
+ */
+export declare function isRateLimitEnforced(env?: Record<string, string | undefined>): boolean;
+/**
+ * Counts requests that rate limiting WOULD block (HTTP 429). In shadow mode this
+ * is the signal proving whether flipping `CORTEX_RATE_LIMIT_ENFORCE` to enforce
+ * would reject legitimate traffic. Labelled by the `limiter` name
+ * (`graphql`/`auth`) and the request `tier` (`auth`/`anon`).
+ */
+export declare const cortexRateLimitWouldBlockTotal: Counter<"limiter" | "tier">;
 /**
  * Rate limiter for GraphQL endpoint.
  *

package/esm/middleware/rate-limiter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limiter.d.ts","sourceRoot":"","sources":["../../../src/middleware/rate-limiter.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAyG1D;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,QA9ChB,OAAO,OAAO,QAAQ,QAAQ,YAAY,KAAG,IAuD1D,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,eAAe,QA/Db,OAAO,OAAO,QAAQ,QAAQ,YAAY,KAAG,IAsE1D,CAAC"}
+{"version":3,"file":"rate-limiter.d.ts","sourceRoot":"","sources":["../../../src/middleware/rate-limiter.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAItC;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,8BAA8B,CAAC;AAEzE;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,OAAO,CAGT;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,6BAKzC,CAAC;AAkIH;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,QArEhB,OAAO,OAAO,QAAQ,QAAQ,YAAY,KAAG,IA+E1D,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,eAAe,QAvFb,OAAO,OAAO,QAAQ,QAAQ,YAAY,KAAG,IA+F1D,CAAC"}

package/esm/middleware/rate-limiter.js.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limiter.js","sourceRoot":"","sources":["../../../src/middleware/rate-limiter.ts"],"names":[],"mappings":"AAAA,gHAAgH;AAsBhH;;;;;GAKG;AACH,SAAS,eAAe,CAAC,GAAY;IACnC,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;IACnD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACtC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClC,2EAA2E;IAC3E,0EAA0E;IAC1E,wEAAwE;IACxE,mEAAmE;IACnE,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,iBAAiB,CAAC,MAAuB;IAChD,MAAM,KAAK,GAAmB,EAAE,CAAC;IAEjC,wCAAwC;IACxC,WAAW,CAAC,GAAG,EAAE;QACf,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;YACjC,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;gBAC/B,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,EAAE,KAAK,CAAC,CAAC;IAEV,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;QAC/D,MAAM,UAAU,GAAG,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,aAAa,IAAI,SAAS,CAAC;QACvE,MAAM,aAAa,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,YAAY,GAAG,aAAa;YAChC,CAAC,CAAC,MAAM,CAAC,gBAAgB;YACzB,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC;QAC9B,MAAM,QAAQ,GAAG,GAAG,UAAU,IAAI,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QACpE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;YACxD,KAAK,CAAC,QAAQ,CAAC,GAAG;gBAChB,KAAK,EAAE,CAAC;gBACR,SAAS,EAAE,GAAG,GAAG,MAAM,CAAC,QAAQ;aACjC,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAC7B,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;QAEjE,yBAAyB;QACzB,IAAI,MAAM,CAAC,eAAe,KAAK,KAAK,EAAE,CAAC;YACrC,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC5D,GAAG,CAAC,SAAS,CAAC,uBAAuB,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC7D,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,IAAI,OAAO,CAAC,KAAK,GAAG,YAAY,EAAE,CAAC;YACjC,oEAAoE;YACpE,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC;YACtD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACrC,OAAO;QACT,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,iBAAiB,CAAC;IAClD,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,aAAa;IACvC,gBAAgB,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,MAAM,EAAE,EAAE,CAAC;IACpE,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,KAAK,EAAE,EAAE,CAAC;IAC5E,eAAe,EAAE,IAAI;IACrB,aAAa,EAAE,KAAK;IACpB,OAAO,EAAE;QACP,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC;KACpE;CACF,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC;IAC/C,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,aAAa;IACvC,gBAAgB,EAAE,EAAE;IACpB,kBAAkB,EAAE,EAAE;IACtB,eAAe,EAAE,IAAI;IACrB,aAAa,EAAE,KAAK;IACpB,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC,EAAE;CACxE,CAAC,CAAC"}
+{"version":3,"file":"rate-limiter.js","sourceRoot":"","sources":["../../../src/middleware/rate-limiter.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC,iEAAiE;AACjE,+EAA+E;AAC/E,2EAA2E;AAC3E,2EAA2E;AAC3E,2EAA2E;AAG3E,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAEzC;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,2BAA2B,CAAC;AAEzE;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAA0C,OAAO,CAAC,GAAG;IAErD,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5E,OAAO,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC;AACvC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,IAAI,OAAO,CAAC;IACxD,IAAI,EAAE,qCAAqC;IAC3C,IAAI,EAAE,yGAAyG;IAC/G,UAAU,EAAE,CAAC,SAAS,EAAE,MAAM,CAAU;IACxC,SAAS,EAAE,CAAC,eAAe,CAAC;CAC7B,CAAC,CAAC;AAsBH;;;;;GAKG;AACH,SAAS,eAAe,CAAC,GAAY;IACnC,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;IACnD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACtC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClC,2EAA2E;IAC3E,0EAA0E;IAC1E,wEAAwE;IACxE,mEAAmE;IACnE,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,iBAAiB,CAAC,MAAuB;IAChD,MAAM,KAAK,GAAmB,EAAE,CAAC;IAEjC,wCAAwC;IACxC,WAAW,CAAC,GAAG,EAAE;QACf,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;YACjC,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;gBAC/B,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,EAAE,KAAK,CAAC,CAAC;IAEV,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;QAC/D,MAAM,UAAU,GAAG,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,aAAa,IAAI,SAAS,CAAC;QACvE,MAAM,aAAa,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QAC7C,MAAM,YAAY,GAAG,aAAa;YAChC,CAAC,CAAC,MAAM,CAAC,gBAAgB;YACzB,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC;QAC9B,MAAM,QAAQ,GAAG,GAAG,UAAU,IAAI,IAAI,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;YACxD,KAAK,CAAC,QAAQ,CAAC,GAAG;gBAChB,KAAK,EAAE,CAAC;gBACR,SAAS,EAAE,GAAG,GAAG,MAAM,CAAC,QAAQ;aACjC,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAC7B,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;QACjE,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,GAAG,YAAY,CAAC;QAE/C,6EAA6E;QAC7E,0EAA0E;QAC1E,gEAAgE;QAChE,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAC;YAC3B,IAAI,SAAS,EAAE,CAAC;gBACd,8BAA8B,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACnE,MAAM,CAAC,IAAI,CAAC,mDAAmD,EAAE;oBAC/D,OAAO,EAAE,MAAM,CAAC,IAAI;oBACpB,UAAU;oBACV,IAAI;oBACJ,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,KAAK,EAAE,YAAY;oBACnB,YAAY;iBACb,CAAC,CAAC;YACL,CAAC;YACD,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,oEAAoE;QACpE,qCAAqC;QACrC,IAAI,MAAM,CAAC,eAAe,KAAK,KAAK,EAAE,CAAC;YACrC,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC5D,GAAG,CAAC,SAAS,CAAC,uBAAuB,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC7D,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,IAAI,SAAS,EAAE,CAAC;YACd,oEAAoE;YACpE,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC;YACtD,8BAA8B,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACnE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACrC,OAAO;QACT,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,iBAAiB,CAAC;IAClD,IAAI,EAAE,SAAS;IACf,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,aAAa;IACvC,gBAAgB,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,MAAM,EAAE,EAAE,CAAC;IACpE,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,KAAK,EAAE,EAAE,CAAC;IAC5E,eAAe,EAAE,IAAI;IACrB,aAAa,EAAE,KAAK;IACpB,OAAO,EAAE;QACP,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC;KACpE;CACF,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC;IAC/C,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,aAAa;IACvC,gBAAgB,EAAE,EAAE;IACpB,kBAAkB,EAAE,EAAE;IACtB,eAAe,EAAE,IAAI;IACrB,aAAa,EAAE,KAAK;IACpB,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC,EAAE;CACxE,CAAC,CAAC"}

package/esm/middleware/rate-limiter.mjs

@@ -1,4 +1,42 @@
-// Integration: add to server.ts - app.use('/graphql', graphqlRateLimiter) and app.use('/auth', authRateLimiter)
+// CORTEX-P0-001: mounted in server.ts as
+//   app.use('/graphql', graphqlRateLimiter)   // GraphQL surface
+//   app.use('/api', authRateLimiter)          // authenticated Express surface
+// SHADOW-FIRST: 429 enforcement is gated behind CORTEX_RATE_LIMIT_ENFORCE.
+// While OFF (default), the limiters observe + count requests that WOULD be
+// blocked but never touch the response — live behaviour is byte-identical.
+import { Counter } from 'prom-client';
+import { metricsRegistry } from '../config/metrics.mjs';
+import { logger } from '../utils/logger.mjs';
+/**
+ * Environment variable gating 429 enforcement. When set to `true`/`1`, the
+ * limiters block over-limit requests with HTTP 429. Unset or any other value
+ * keeps them in SHADOW mode (observe + count + always proceed).
+ */
+export const CORTEX_RATE_LIMIT_ENFORCE_ENV = 'CORTEX_RATE_LIMIT_ENFORCE';
+/**
+ * Whether rate-limit 429 enforcement is ON. Read fresh on each request (a cheap
+ * env read) so the shadow→enforce graduation can be flipped operationally
+ * without a restart. Defaults to OFF (shadow) for any unset/unrecognised value.
+ *
+ * @param env - Environment source (defaults to `process.env`); injectable for tests.
+ * @returns `true` only when the flag is explicitly `true`/`1`.
+ */
+export function isRateLimitEnforced(env = process.env) {
+    const raw = (env[CORTEX_RATE_LIMIT_ENFORCE_ENV] ?? '').trim().toLowerCase();
+    return raw === 'true' || raw === '1';
+}
+/**
+ * Counts requests that rate limiting WOULD block (HTTP 429). In shadow mode this
+ * is the signal proving whether flipping `CORTEX_RATE_LIMIT_ENFORCE` to enforce
+ * would reject legitimate traffic. Labelled by the `limiter` name
+ * (`graphql`/`auth`) and the request `tier` (`auth`/`anon`).
+ */
+export const cortexRateLimitWouldBlockTotal = new Counter({
+    name: 'cortex_rate_limit_would_block_total',
+    help: 'Requests rate limiting would block (429), by limiter and tier (counted in shadow mode without blocking)',
+    labelNames: ['limiter', 'tier'],
+    registers: [metricsRegistry],
+});
 /**
  * Checks whether a request carries a valid-looking authentication token.
  * Does not verify the token -- only checks for its presence in the
@@ -44,10 +82,11 @@ function createRateLimiter(config) {
     return (req, res, next) => {
         const identifier = req.ip || req.connection.remoteAddress || 'unknown';
         const authenticated = isAuthenticated(req);
+        const tier = authenticated ? 'auth' : 'anon';
         const effectiveMax = authenticated
             ? config.maxAuthenticated
             : config.maxUnauthenticated;
-        const storeKey = `${identifier}:${authenticated ? 'auth' : 'anon'}`;
+        const storeKey = `${identifier}:${tier}`;
         const now = Date.now();
         if (!store[storeKey] || store[storeKey].resetTime < now) {
             store[storeKey] = {
@@ -61,15 +100,36 @@ function createRateLimiter(config) {
         const current = store[storeKey];
         const remaining = Math.max(0, effectiveMax - current.count);
         const resetSeconds = Math.ceil((current.resetTime - now) / 1000);
-        // Add rate limit headers
+        const overLimit = current.count > effectiveMax;
+        // SHADOW mode (default): observe + count over-limit requests but NEVER touch
+        // the response — no rate-limit headers, no 429. This keeps live behaviour
+        // byte-identical until CORTEX_RATE_LIMIT_ENFORCE is flipped on.
+        if (!isRateLimitEnforced()) {
+            if (overLimit) {
+                cortexRateLimitWouldBlockTotal.inc({ limiter: config.name, tier });
+                logger.warn('[cortex-rate-limit] shadow would-block (allowing)', {
+                    limiter: config.name,
+                    identifier,
+                    tier,
+                    count: current.count,
+                    limit: effectiveMax,
+                    resetSeconds,
+                });
+            }
+            next();
+            return;
+        }
+        // ENFORCE mode: emit the informational rate-limit headers and block
+        // over-limit requests with HTTP 429.
         if (config.standardHeaders !== false) {
             res.setHeader('X-RateLimit-Limit', effectiveMax.toString());
             res.setHeader('X-RateLimit-Remaining', remaining.toString());
             res.setHeader('X-RateLimit-Reset', resetSeconds.toString());
         }
-        if (current.count > effectiveMax) {
+        if (overLimit) {
             // Include Retry-After header on 429 responses (RFC 6585 / RFC 7231)
             res.setHeader('Retry-After', resetSeconds.toString());
+            cortexRateLimitWouldBlockTotal.inc({ limiter: config.name, tier });
             res.status(429).json(config.message);
             return;
         }
@@ -83,6 +143,7 @@ function createRateLimiter(config) {
  * Unauthenticated requests: 200 requests per 15 minutes (configurable via RATE_LIMIT_MAX_UNAUTH)
  */
 export const graphqlRateLimiter = createRateLimiter({
+    name: 'graphql',
     windowMs: 15 * 60 * 1000, // 15 minutes
     maxAuthenticated: parseInt(process.env.RATE_LIMIT_MAX || '1000', 10),
     maxUnauthenticated: parseInt(process.env.RATE_LIMIT_MAX_UNAUTH || '200', 10),
@@ -99,6 +160,7 @@ export const graphqlRateLimiter = createRateLimiter({
  * Unauthenticated requests: 20 requests per 15 minutes
  */
 export const authRateLimiter = createRateLimiter({
+    name: 'auth',
     windowMs: 15 * 60 * 1000, // 15 minutes
     maxAuthenticated: 50,
     maxUnauthenticated: 20,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adaptic/backend-legacy",
-  "version": "0.0.996",
+  "version": "0.0.997",
   "description": "Backend executable CRUD functions with dynamic variables construction, and type definitions for the Adaptic AI platform.",
   "type": "module",
   "types": "index.d.ts",

package/server.cjs

@@ -59,8 +59,10 @@ const body_parser_1 = __importDefault(require("body-parser"));
 const ws_1 = require("ws");
 const ws_2 = require("graphql-ws/lib/use/ws");
 const auth_1 = require("./middleware/auth.cjs");
+const rate_limiter_1 = require("./middleware/rate-limiter.cjs");
 const audit_logger_1 = require("./middleware/audit-logger.cjs");
 const tenancy_scoping_1 = require("./middleware/tenancy-scoping.cjs");
+const cortex_auth_checker_1 = require("./auth/cortex-auth-checker.cjs");
 const http_status_mapper_1 = require("./plugins/http-status-mapper.cjs");
 const graphql_validation_plugin_1 = require("./middleware/graphql-validation-plugin.cjs");
 const query_complexity_1 = require("./middleware/query-complexity.cjs");
@@ -118,12 +120,24 @@ const startServer = async () => {
         // and unauthenticated callers are bypassed in every mode. Gated by
         // `TENANCY_SCOPING_MODE` (default `shadow`).
         globalMiddlewares: [(0, tenancy_scoping_1.createTenancyScopingMiddleware)()],
+        // Resolver-level authorization (CORTEX-P0-001). SHADOW-FIRST: only invoked
+        // for `@Authorized()`-decorated fields and, while `CORTEX_AUTHCHECKER_ENFORCE`
+        // is OFF (default), it observes + counts would-deny operations but always
+        // allows — byte-identical live behaviour until enforcement is flipped on.
+        authChecker: cortex_auth_checker_1.cortexAuthChecker,
     });
     const app = (0, express_1.default)();
     const httpServer = (0, http_1.createServer)(app);
     // HTTP request metrics — must be mounted early to capture every request.
     // The middleware is a no-op when metrics are disabled.
     app.use(metrics_1.metricsMiddleware);
+    // Rate limiting (CORTEX-P0-001). SHADOW-FIRST: mounted on the GraphQL surface
+    // and the authenticated Express `/api` surface. While `CORTEX_RATE_LIMIT_ENFORCE`
+    // is OFF (default), they observe + count requests that WOULD be blocked but
+    // never touch the response, so live behaviour is byte-identical. Mounted
+    // before `/api` auth so limiting precedes the (more expensive) auth work.
+    app.use('/graphql', rate_limiter_1.graphqlRateLimiter);
+    app.use('/api', rate_limiter_1.authRateLimiter);
     app.use('/api', (req, res, next) => (0, auth_1.authMiddleware)(req, res, next));
     // APQ cache: in-memory LRU, gated by `APQ_ENABLED` (default on). The
     // Apollo Server option only accepts a value when a cache is provided;