@aglyn/tenant-data-admin 1.0.0-beta.143

package/src/lib/server/firebase-admin.js

@@ -0,0 +1,343 @@
+/**
+ * @license
+ * Copyright 2022 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ // Initializes the firebase-admin default app (cert credential, RTDB URL,
+// service account, AppCheck) on module load. `firestoreDatabaseId` is the
+// FIRESTORE_DATABASE_ID override (AGL-1490): unset → `(default)` as before;
+// set → every accessor targets the named database (disaster-recovery cutover,
+// see docs/DISASTER_RECOVERY.md).
+import { firestoreDatabaseId } from "@aglyn/shared-util-fbserver";
+import { decode, encode } from "@msgpack/msgpack";
+import { getApp } from "firebase-admin/app";
+import { getAuth } from "firebase-admin/auth";
+import { assertIdTokenNotRevoked } from "./token-revocation.js";
+import { getDatabase } from "firebase-admin/database";
+import { getRemoteConfig } from "firebase-admin/remote-config";
+import { FieldPath, FieldValue, Timestamp, getFirestore } from "firebase-admin/firestore";
+import { getStorage } from "firebase-admin/storage";
+function compress(value) {
+    return Buffer.from(encode(value));
+}
+function decompress(value) {
+    return decode(value);
+}
+export const hostConverter = {
+    toFirestore (data) {
+        if (data.$id) delete data.$id;
+        // data.updatedAt = Timestamp.now()
+        return data;
+    },
+    fromFirestore (snapshot) {
+        if (!snapshot.exists) return undefined;
+        const data = snapshot.data();
+        data.$id = snapshot.id;
+        return data;
+    }
+};
+export const screenConverter = {
+    toFirestore (data) {
+        if (data.$id) delete data.$id;
+        data.updatedAt = Timestamp.now();
+        return data;
+    },
+    fromFirestore (snapshot) {
+        if (!snapshot.exists) return undefined;
+        const data = snapshot.data();
+        data.$id = snapshot.id;
+        return data;
+    }
+};
+export const screenVersionConverter = {
+    toFirestore (data) {
+        if (data.elements) {
+            data.nodes = data.elements;
+            delete data.elements;
+        }
+        if (data['bundleId']) {
+            data.pluginId = data['bundleId'];
+            delete data['bundleId'];
+        }
+        if (data.nodes) data.nodes = compress(data.nodes);
+        if (data.$id) delete data.$id;
+        data.updatedAt = Timestamp.now();
+        return data;
+    },
+    fromFirestore (snapshot) {
+        if (!snapshot.exists) return undefined;
+        const data = snapshot.data();
+        if (data == null ? void 0 : data.elements) {
+            data.nodes = data.elements;
+            delete data.elements;
+        }
+        if (data == null ? void 0 : data['bundleId']) {
+            data.pluginId = data['bundleId'];
+            delete data['bundleId'];
+        }
+        if (data == null ? void 0 : data.nodes) {
+            // Nodes saved while updateDoc bypassed the client converter are plain
+            // maps rather than compressed bytes; decode only binary payloads.
+            data.nodes = ArrayBuffer.isView(data.nodes) ? decompress(data.nodes) : data.nodes;
+        }
+        data.$id = snapshot.id;
+        return data;
+    }
+};
+export const layoutConverter = {
+    toFirestore (data) {
+        if (data.$id) delete data.$id;
+        data.updatedAt = Timestamp.now();
+        return data;
+    },
+    fromFirestore (snapshot) {
+        if (!snapshot.exists) return undefined;
+        const data = snapshot.data();
+        data.$id = snapshot.id;
+        return data;
+    }
+};
+// Layout versions persist nodes exactly like screen versions (compressed).
+export const layoutVersionConverter = screenVersionConverter;
+/**
+ * Compatibility facade replacing firebase-admin v14's removed namespace API
+ * (`import * as admin from 'firebase-admin'`) so existing call sites
+ * (`firebaseAdmin.app().firestore()`, `firebaseAdmin.firestore.FieldValue`,
+ * `firebaseAdmin.database()`) keep working unchanged, backed internally by
+ * the modular SDK.
+ */ /**
+ * Auth wrapped so `verifyIdToken` also asks whether the account was revoked
+ * (AGL-1881).
+ *
+ * WHY HERE, and not at the call sites: the audit found `checkRevoked` set on
+ * 3 of 175 verifications, which is what a per-call-site opt-in converges to.
+ * Every server door in this repo reaches auth through `firebaseAdmin.app()` —
+ * all 117 console API routes, the marketplace/commerce/bookings plugin
+ * servers, `authForPool`, `release-flags` — so this ONE function is where the
+ * question can be asked once and be true everywhere, including on routes
+ * written next year by someone who has never read AGL-1881.
+ * `token-revocation.spec.ts` pins that the wrapping is real; the guard in
+ * `token-revocation-coverage.spec.ts` pins that no future door bypasses it.
+ *
+ * A Proxy rather than a hand-written facade because `BaseAuth` has ~40
+ * methods and a facade that listed 39 of them would silently drop the
+ * fortieth. Only `verifyIdToken` and `tenantManager` are intercepted;
+ * everything else is the SDK's own method, bound to the SDK's own instance.
+ *
+ * `tenantManager` is wrapped recursively because a GCIP tenant's
+ * `TenantAwareAuth` is a DIFFERENT auth object with its own `verifyIdToken`,
+ * and five console routes verify SSO tokens through it. Unwrapped, those five
+ * would be exactly the holes this exists to close.
+ *
+ * An explicit `checkRevoked: true` is left alone: firebase-admin then runs the
+ * same three checks itself, and doing both would buy one answer with two
+ * round trips.
+ */ /**
+ * The pool to ask about a verified token's account (AGL-2486).
+ *
+ * ## The bug this exists to fix
+ *
+ * `BaseAuth.verifyIdToken` does NOT reject a token minted in a GCIP tenant.
+ * Only `TenantAwareAuth` overrides it to compare `firebase.tenant` against
+ * its own id; the project-level handle checks a signature, an issuer and an
+ * audience, all of which are project-wide. So an SSO user's ID token verifies
+ * perfectly through `firebaseAdmin.app().auth()` — and every console API
+ * route verifies exactly that way.
+ *
+ * The revocation check then ran `getUser(uid)` on that same project-level
+ * handle. A tenant uid is not in the project pool: measured on production
+ * 2026-08-22, a staff account in `aglyn-org-y5v14` verified through the
+ * project handle, and a project-level `getUser` of the uid that token carries
+ * threw `auth/user-not-found`. `assertIdTokenNotRevoked` reads "not found" as
+ * "account deleted" — correctly, and fail-CLOSED by design — and threw
+ * `auth/id-token-revoked`. Every SSO user was therefore refused at every door
+ * that verifies a Bearer token, with whatever the route's catch-all produced;
+ * on `/api/presence/token` that was a 500 and live co-editing simply never
+ * started for them.
+ *
+ * ## Why the existing guard did not catch it
+ *
+ * `no-project-level-auth-lookup.spec.ts` reads the RECEIVER NAME of a
+ * `.getUser(` call, and `assertIdTokenNotRevoked` names its parameter `pool`
+ * precisely so that it passes. The name was honest about the contract and
+ * said nothing about the ARGUMENT, which was the project-level handle at the
+ * only call site there is. A guard that reads a name proves a name.
+ *
+ * ## What this does
+ *
+ * Sends the lookup to the pool named by the token's own `firebase.tenant`
+ * claim, so the contract `assertIdTokenNotRevoked` documents ("the lookup is
+ * asked of the pool the token belongs to") becomes structurally true instead
+ * of being an assumption about the caller. One place, so a route written next
+ * year inherits it — the same reasoning that put the revocation check here.
+ *
+ * Returns the handle unchanged for a project-pool token and for an auth
+ * already scoped to that same tenant.
+ *
+ * Returns NULL when the token names a tenant this handle cannot reach — and
+ * the caller then SKIPS the check rather than asking the wrong pool. That is
+ * the whole lesson of this bug: "not found in the pool I happened to ask" is
+ * not evidence that an account was deleted, it is evidence that the question
+ * went to the wrong place, and `assertIdTokenNotRevoked` already models "we
+ * could not ask" as fail-open. Falling back to the verifying handle would
+ * re-create the exact outage in the one configuration where routing fails.
+ * Unreachable in practice — the project-level `Auth` always has a
+ * `tenantManager`, and a `TenantAwareAuth` holding a token for a DIFFERENT
+ * tenant has already thrown `auth/mismatching-tenant-id` before this runs.
+ *
+ * The tenant handle is deliberately NOT wrapped in `revocationCheckedAuth`:
+ * it is used only for `getUser`, and re-wrapping would put the revocation
+ * check inside the revocation check.
+ */ function revocationPool(auth, decoded) {
+    var _decoded_firebase;
+    const self = auth;
+    const tenantId = decoded == null ? void 0 : (_decoded_firebase = decoded.firebase) == null ? void 0 : _decoded_firebase.tenant;
+    // `typeof`, not a truthy test: `strictNullChecks` is off repo-wide, so a
+    // bare `!tenantId` narrows nothing and would also swallow a real id.
+    if (typeof tenantId !== 'string' || !tenantId) return self;
+    // Already the right pool — a route that verified through
+    // `authForPool(tenantId)` has nothing to switch to, and `TenantAwareAuth`
+    // has no `tenantManager` to ask anyway.
+    if (auth.tenantId === tenantId) return self;
+    const tenantManager = auth.tenantManager;
+    if (typeof tenantManager !== 'function') return null;
+    try {
+        const manager = tenantManager.call(auth);
+        return manager.authForTenant(tenantId);
+    } catch (unused) {
+        return null;
+    }
+}
+function revocationCheckedAuth(target) {
+    return new Proxy(target, {
+        get (auth, prop, receiver) {
+            if (prop === 'verifyIdToken') {
+                return async (...args)=>{
+                    const verify = Reflect.get(auth, prop, auth);
+                    // Spread, never `(token, checkRevoked)`: passing an explicit
+                    // `undefined` where the caller passed nothing changes what the SDK
+                    // sees, and a wrapper that alters the call it forwards is not a
+                    // wrapper.
+                    const decoded = await verify.apply(auth, args);
+                    if (args[1] === true) return decoded;
+                    // The pool the TOKEN belongs to, which is not always the pool that
+                    // verified it — see `revocationPool`. Never `receiver`: the lookup
+                    // must not re-enter this proxy.
+                    const pool = revocationPool(auth, decoded);
+                    // `=== null`, not `!pool`: `strictNullChecks` is off repo-wide, so
+                    // a falsy test narrows nothing here.
+                    if (pool === null) {
+                        var _decoded_firebase;
+                        console.warn('[auth] revocation check skipped: no handle for tenant', decoded == null ? void 0 : (_decoded_firebase = decoded.firebase) == null ? void 0 : _decoded_firebase.tenant);
+                        return decoded;
+                    }
+                    await assertIdTokenNotRevoked(pool, decoded);
+                    return decoded;
+                };
+            }
+            if (prop === 'tenantManager') {
+                return (...args)=>{
+                    const manager = Reflect.get(auth, prop, auth).apply(auth, args);
+                    return new Proxy(manager, {
+                        get (mgr, key, mgrReceiver) {
+                            if (key === 'authForTenant') {
+                                return (...tenantArgs)=>revocationCheckedAuth(Reflect.get(mgr, key, mgr).apply(mgr, tenantArgs));
+                            }
+                            const value = Reflect.get(mgr, key, mgrReceiver);
+                            return typeof value === 'function' ? value.bind(mgr) : value;
+                        }
+                    });
+                };
+            }
+            const value = Reflect.get(auth, prop, receiver);
+            // Bound to the SDK instance: firebase-admin's Auth keeps private state
+            // on `this`, and an unbound method handed out through a Proxy loses it.
+            return typeof value === 'function' ? value.bind(auth) : value;
+        }
+    });
+}
+function wrapApp(app) {
+    return {
+        firestore: ()=>getFirestore(app, firestoreDatabaseId()),
+        auth: ()=>revocationCheckedAuth(getAuth(app)),
+        storage: ()=>getStorage(app),
+        // Release-flag management (AGL-230): the staff admin flags API reads
+        // and publishes the Remote Config template server-side.
+        remoteConfig: ()=>getRemoteConfig(app)
+    };
+}
+function firestoreNamespace() {
+    return getFirestore(getApp(), firestoreDatabaseId());
+}
+firestoreNamespace.FieldValue = FieldValue;
+firestoreNamespace.Timestamp = Timestamp;
+firestoreNamespace.FieldPath = FieldPath;
+const firebaseAdmin = {
+    app: (name)=>wrapApp(name ? getApp(name) : getApp()),
+    firestore: firestoreNamespace,
+    database: ()=>getDatabase(getApp())
+};
+/**
+ * Email-verification gate (AGL-479). Email/password accounts must verify
+ * their address before any console access; OAuth accounts arrive with
+ * `email_verified: true`, so they pass untouched. `verifyConsoleIdToken`
+ * verifies the ID token exactly like `auth().verifyIdToken` and additionally
+ * throws `EmailNotVerifiedError` when the address is unverified — verified
+ * callers see identical behavior. Route handlers pair the raw verify with
+ * `emailUnverifiedResponse()` (a 403) so the denial stays distinct from an
+ * invalid-token 401. Fails closed: a token with no `email_verified` claim
+ * (e.g. some custom-token sign-ins) is treated as unverified.
+ *
+ * Exception (AGL-480): staff impersonation sessions carry an `impersonatedBy`
+ * claim (minted by /api/admin/impersonate). Staff have already authenticated
+ * and the act is audited, so the impersonated account's own verification
+ * state must not gate the support session — otherwise staff can't reach a
+ * brand-new, still-unverified owner, the exact account most likely to need
+ * help. `isImpersonationSession` gates that exemption.
+ */ export class EmailNotVerifiedError extends Error {
+    constructor(){
+        super('Email address not verified'), this.code = 'auth/email-not-verified';
+        this.name = 'EmailNotVerifiedError';
+    }
+}
+export function isEmailVerified(decoded) {
+    return decoded.email_verified === true;
+}
+/** Staff impersonation session (AGL-357/AGL-480): token minted with an
+ * `impersonatedBy` claim. Exempt from the email-verification gate. */ export function isImpersonationSession(decoded) {
+    return typeof decoded['impersonatedBy'] === 'string';
+}
+export async function verifyConsoleIdToken(idToken, checkRevoked) {
+    // `firebaseAdmin.app().auth()`, not a bare `getAuth` (AGL-1881): the raw
+    // SDK handle skips the revocation check, and this helper's whole promise is
+    // that it verifies "exactly like `auth().verifyIdToken`" plus the email
+    // gate. A door that reads as the STRICTER one while being the looser one is
+    // the worst shape available.
+    const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken, checkRevoked);
+    if (!isEmailVerified(decoded) && !isImpersonationSession(decoded)) {
+        throw new EmailNotVerifiedError();
+    }
+    return decoded;
+}
+/** 403 sent to callers whose email address is not yet verified (AGL-479). */ export function emailUnverifiedResponse() {
+    return Response.json({
+        error: 'Verify your email to continue',
+        reason: 'email-unverified'
+    }, {
+        status: 403
+    });
+}
+export { firebaseAdmin };
+export default firebaseAdmin;
+
+//# sourceMappingURL=firebase-admin.js.map

package/src/lib/server/firebase-admin.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/firebase-admin.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2022 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport * as Aglyn from '@aglyn/aglyn/server'\n// Initializes the firebase-admin default app (cert credential, RTDB URL,\n// service account, AppCheck) on module load. `firestoreDatabaseId` is the\n// FIRESTORE_DATABASE_ID override (AGL-1490): unset → `(default)` as before;\n// set → every accessor targets the named database (disaster-recovery cutover,\n// see docs/DISASTER_RECOVERY.md).\nimport { firestoreDatabaseId } from '@aglyn/shared-util-fbserver'\nimport { decode, encode } from '@msgpack/msgpack'\nimport { type App, getApp } from 'firebase-admin/app'\nimport {\n  type BaseAuth,\n  type DecodedIdToken,\n  getAuth,\n} from 'firebase-admin/auth'\nimport { assertIdTokenNotRevoked } from './token-revocation'\nimport { getDatabase } from 'firebase-admin/database'\nimport { getRemoteConfig } from 'firebase-admin/remote-config'\nimport {\n  FieldPath,\n  FieldValue,\n  type FirestoreDataConverter,\n  Timestamp,\n  getFirestore,\n} from 'firebase-admin/firestore'\nimport { getStorage } from 'firebase-admin/storage'\n\nfunction compress(value: any) {\n  return Buffer.from(encode(value))\n}\nfunction decompress(value: any) {\n  return decode(value)\n}\n\nexport const hostConverter: FirestoreDataConverter<Aglyn.AglynHost> = {\n  toFirestore(data) {\n    if (data.$id) delete data.$id\n    // data.updatedAt = Timestamp.now()\n    return data\n  },\n  fromFirestore(snapshot) {\n    if (!snapshot.exists) return undefined\n    const data = snapshot.data()\n    data.$id = snapshot.id\n    return data as Aglyn.AglynScreen\n  },\n}\n\nexport const screenConverter: FirestoreDataConverter<Aglyn.AglynScreen> = {\n  toFirestore(data) {\n    if (data.$id) delete data.$id\n    data.updatedAt = Timestamp.now()\n    return data\n  },\n  fromFirestore(snapshot) {\n    if (!snapshot.exists) return undefined\n    const data = snapshot.data()\n    data.$id = snapshot.id\n    return data as Aglyn.AglynScreen\n  },\n}\n\nexport const screenVersionConverter: FirestoreDataConverter<Aglyn.AglynScreenVersion> =\n  {\n    toFirestore(data) {\n      if (data.elements) {\n        data.nodes = data.elements\n        delete data.elements\n      }\n      if (data['bundleId']) {\n        data.pluginId = data['bundleId']\n        delete data['bundleId']\n      }\n      if (data.nodes) data.nodes = compress(data.nodes) as any\n      if (data.$id) delete data.$id\n      data.updatedAt = Timestamp.now()\n      return data\n    },\n    fromFirestore(snapshot) {\n      if (!snapshot.exists) return undefined\n      const data = snapshot.data()\n      if (data?.elements) {\n        data.nodes = data.elements\n        delete data.elements\n      }\n      if (data?.['bundleId']) {\n        data.pluginId = data['bundleId']\n        delete data['bundleId']\n      }\n      if (data?.nodes) {\n        // Nodes saved while updateDoc bypassed the client converter are plain\n        // maps rather than compressed bytes; decode only binary payloads.\n        data.nodes = ArrayBuffer.isView(data.nodes)\n          ? decompress(data.nodes)\n          : data.nodes\n      }\n      data.$id = snapshot.id\n      return data as Aglyn.AglynScreenVersion\n    },\n  }\n\nexport const layoutConverter: FirestoreDataConverter<Aglyn.AglynLayout> = {\n  toFirestore(data) {\n    if (data.$id) delete data.$id\n    data.updatedAt = Timestamp.now()\n    return data\n  },\n  fromFirestore(snapshot) {\n    if (!snapshot.exists) return undefined\n    const data = snapshot.data()\n    data.$id = snapshot.id\n    return data as Aglyn.AglynLayout\n  },\n}\n\n// Layout versions persist nodes exactly like screen versions (compressed).\nexport const layoutVersionConverter =\n  screenVersionConverter as unknown as FirestoreDataConverter<Aglyn.AglynLayoutVersion>\n\n/**\n * Compatibility facade replacing firebase-admin v14's removed namespace API\n * (`import * as admin from 'firebase-admin'`) so existing call sites\n * (`firebaseAdmin.app().firestore()`, `firebaseAdmin.firestore.FieldValue`,\n * `firebaseAdmin.database()`) keep working unchanged, backed internally by\n * the modular SDK.\n */\n/**\n * Auth wrapped so `verifyIdToken` also asks whether the account was revoked\n * (AGL-1881).\n *\n * WHY HERE, and not at the call sites: the audit found `checkRevoked` set on\n * 3 of 175 verifications, which is what a per-call-site opt-in converges to.\n * Every server door in this repo reaches auth through `firebaseAdmin.app()` —\n * all 117 console API routes, the marketplace/commerce/bookings plugin\n * servers, `authForPool`, `release-flags` — so this ONE function is where the\n * question can be asked once and be true everywhere, including on routes\n * written next year by someone who has never read AGL-1881.\n * `token-revocation.spec.ts` pins that the wrapping is real; the guard in\n * `token-revocation-coverage.spec.ts` pins that no future door bypasses it.\n *\n * A Proxy rather than a hand-written facade because `BaseAuth` has ~40\n * methods and a facade that listed 39 of them would silently drop the\n * fortieth. Only `verifyIdToken` and `tenantManager` are intercepted;\n * everything else is the SDK's own method, bound to the SDK's own instance.\n *\n * `tenantManager` is wrapped recursively because a GCIP tenant's\n * `TenantAwareAuth` is a DIFFERENT auth object with its own `verifyIdToken`,\n * and five console routes verify SSO tokens through it. Unwrapped, those five\n * would be exactly the holes this exists to close.\n *\n * An explicit `checkRevoked: true` is left alone: firebase-admin then runs the\n * same three checks itself, and doing both would buy one answer with two\n * round trips.\n */\n/**\n * The pool to ask about a verified token's account (AGL-2486).\n *\n * ## The bug this exists to fix\n *\n * `BaseAuth.verifyIdToken` does NOT reject a token minted in a GCIP tenant.\n * Only `TenantAwareAuth` overrides it to compare `firebase.tenant` against\n * its own id; the project-level handle checks a signature, an issuer and an\n * audience, all of which are project-wide. So an SSO user's ID token verifies\n * perfectly through `firebaseAdmin.app().auth()` — and every console API\n * route verifies exactly that way.\n *\n * The revocation check then ran `getUser(uid)` on that same project-level\n * handle. A tenant uid is not in the project pool: measured on production\n * 2026-08-22, a staff account in `aglyn-org-y5v14` verified through the\n * project handle, and a project-level `getUser` of the uid that token carries\n * threw `auth/user-not-found`. `assertIdTokenNotRevoked` reads \"not found\" as\n * \"account deleted\" — correctly, and fail-CLOSED by design — and threw\n * `auth/id-token-revoked`. Every SSO user was therefore refused at every door\n * that verifies a Bearer token, with whatever the route's catch-all produced;\n * on `/api/presence/token` that was a 500 and live co-editing simply never\n * started for them.\n *\n * ## Why the existing guard did not catch it\n *\n * `no-project-level-auth-lookup.spec.ts` reads the RECEIVER NAME of a\n * `.getUser(` call, and `assertIdTokenNotRevoked` names its parameter `pool`\n * precisely so that it passes. The name was honest about the contract and\n * said nothing about the ARGUMENT, which was the project-level handle at the\n * only call site there is. A guard that reads a name proves a name.\n *\n * ## What this does\n *\n * Sends the lookup to the pool named by the token's own `firebase.tenant`\n * claim, so the contract `assertIdTokenNotRevoked` documents (\"the lookup is\n * asked of the pool the token belongs to\") becomes structurally true instead\n * of being an assumption about the caller. One place, so a route written next\n * year inherits it — the same reasoning that put the revocation check here.\n *\n * Returns the handle unchanged for a project-pool token and for an auth\n * already scoped to that same tenant.\n *\n * Returns NULL when the token names a tenant this handle cannot reach — and\n * the caller then SKIPS the check rather than asking the wrong pool. That is\n * the whole lesson of this bug: \"not found in the pool I happened to ask\" is\n * not evidence that an account was deleted, it is evidence that the question\n * went to the wrong place, and `assertIdTokenNotRevoked` already models \"we\n * could not ask\" as fail-open. Falling back to the verifying handle would\n * re-create the exact outage in the one configuration where routing fails.\n * Unreachable in practice — the project-level `Auth` always has a\n * `tenantManager`, and a `TenantAwareAuth` holding a token for a DIFFERENT\n * tenant has already thrown `auth/mismatching-tenant-id` before this runs.\n *\n * The tenant handle is deliberately NOT wrapped in `revocationCheckedAuth`:\n * it is used only for `getUser`, and re-wrapping would put the revocation\n * check inside the revocation check.\n */\nfunction revocationPool(\n  auth: object,\n  decoded: DecodedIdToken,\n): Pick<BaseAuth, 'getUser'> | null {\n  const self = auth as unknown as Pick<BaseAuth, 'getUser'>\n  const tenantId = decoded?.firebase?.tenant\n  // `typeof`, not a truthy test: `strictNullChecks` is off repo-wide, so a\n  // bare `!tenantId` narrows nothing and would also swallow a real id.\n  if (typeof tenantId !== 'string' || !tenantId) return self\n  // Already the right pool — a route that verified through\n  // `authForPool(tenantId)` has nothing to switch to, and `TenantAwareAuth`\n  // has no `tenantManager` to ask anyway.\n  if ((auth as { tenantId?: string }).tenantId === tenantId) return self\n  const tenantManager = (auth as { tenantManager?: () => unknown })\n    .tenantManager\n  if (typeof tenantManager !== 'function') return null\n  try {\n    const manager = tenantManager.call(auth) as {\n      authForTenant: (id: string) => Pick<BaseAuth, 'getUser'>\n    }\n    return manager.authForTenant(tenantId)\n  } catch {\n    return null\n  }\n}\n\nfunction revocationCheckedAuth<T extends object>(target: T): T {\n  return new Proxy(target, {\n    get(auth, prop, receiver) {\n      if (prop === 'verifyIdToken') {\n        return async (...args: unknown[]) => {\n          const verify = Reflect.get(auth, prop, auth) as (\n            ...a: unknown[]\n          ) => Promise<DecodedIdToken>\n          // Spread, never `(token, checkRevoked)`: passing an explicit\n          // `undefined` where the caller passed nothing changes what the SDK\n          // sees, and a wrapper that alters the call it forwards is not a\n          // wrapper.\n          const decoded = await verify.apply(auth, args)\n          if (args[1] === true) return decoded\n          // The pool the TOKEN belongs to, which is not always the pool that\n          // verified it — see `revocationPool`. Never `receiver`: the lookup\n          // must not re-enter this proxy.\n          const pool = revocationPool(auth, decoded)\n          // `=== null`, not `!pool`: `strictNullChecks` is off repo-wide, so\n          // a falsy test narrows nothing here.\n          if (pool === null) {\n            console.warn(\n              '[auth] revocation check skipped: no handle for tenant',\n              decoded?.firebase?.tenant,\n            )\n            return decoded\n          }\n          await assertIdTokenNotRevoked(pool, decoded)\n          return decoded\n        }\n      }\n      if (prop === 'tenantManager') {\n        return (...args: unknown[]) => {\n          const manager = (\n            Reflect.get(auth, prop, auth) as (...a: unknown[]) => object\n          ).apply(auth, args)\n          return new Proxy(manager, {\n            get(mgr, key, mgrReceiver) {\n              if (key === 'authForTenant') {\n                return (...tenantArgs: unknown[]) =>\n                  revocationCheckedAuth(\n                    (\n                      Reflect.get(mgr, key, mgr) as (...a: unknown[]) => object\n                    ).apply(mgr, tenantArgs),\n                  )\n              }\n              const value = Reflect.get(mgr, key, mgrReceiver)\n              return typeof value === 'function' ? value.bind(mgr) : value\n            },\n          })\n        }\n      }\n      const value = Reflect.get(auth, prop, receiver)\n      // Bound to the SDK instance: firebase-admin's Auth keeps private state\n      // on `this`, and an unbound method handed out through a Proxy loses it.\n      return typeof value === 'function' ? value.bind(auth) : value\n    },\n  })\n}\n\nfunction wrapApp(app: App) {\n  return {\n    firestore: () => getFirestore(app, firestoreDatabaseId()),\n    auth: () => revocationCheckedAuth(getAuth(app)),\n    storage: () => getStorage(app),\n    // Release-flag management (AGL-230): the staff admin flags API reads\n    // and publishes the Remote Config template server-side.\n    remoteConfig: () => getRemoteConfig(app),\n  }\n}\n\nfunction firestoreNamespace() {\n  return getFirestore(getApp(), firestoreDatabaseId())\n}\nfirestoreNamespace.FieldValue = FieldValue\nfirestoreNamespace.Timestamp = Timestamp\nfirestoreNamespace.FieldPath = FieldPath\n\nconst firebaseAdmin = {\n  app: (name?: string) => wrapApp(name ? getApp(name) : getApp()),\n  firestore: firestoreNamespace,\n  database: () => getDatabase(getApp()),\n}\n\n/**\n * Email-verification gate (AGL-479). Email/password accounts must verify\n * their address before any console access; OAuth accounts arrive with\n * `email_verified: true`, so they pass untouched. `verifyConsoleIdToken`\n * verifies the ID token exactly like `auth().verifyIdToken` and additionally\n * throws `EmailNotVerifiedError` when the address is unverified — verified\n * callers see identical behavior. Route handlers pair the raw verify with\n * `emailUnverifiedResponse()` (a 403) so the denial stays distinct from an\n * invalid-token 401. Fails closed: a token with no `email_verified` claim\n * (e.g. some custom-token sign-ins) is treated as unverified.\n *\n * Exception (AGL-480): staff impersonation sessions carry an `impersonatedBy`\n * claim (minted by /api/admin/impersonate). Staff have already authenticated\n * and the act is audited, so the impersonated account's own verification\n * state must not gate the support session — otherwise staff can't reach a\n * brand-new, still-unverified owner, the exact account most likely to need\n * help. `isImpersonationSession` gates that exemption.\n */\nexport class EmailNotVerifiedError extends Error {\n  readonly code = 'auth/email-not-verified'\n  constructor() {\n    super('Email address not verified')\n    this.name = 'EmailNotVerifiedError'\n  }\n}\n\nexport function isEmailVerified(decoded: DecodedIdToken): boolean {\n  return decoded.email_verified === true\n}\n\n/** Staff impersonation session (AGL-357/AGL-480): token minted with an\n * `impersonatedBy` claim. Exempt from the email-verification gate. */\nexport function isImpersonationSession(decoded: DecodedIdToken): boolean {\n  return typeof decoded['impersonatedBy'] === 'string'\n}\n\nexport async function verifyConsoleIdToken(\n  idToken: string,\n  checkRevoked?: boolean,\n): Promise<DecodedIdToken> {\n  // `firebaseAdmin.app().auth()`, not a bare `getAuth` (AGL-1881): the raw\n  // SDK handle skips the revocation check, and this helper's whole promise is\n  // that it verifies \"exactly like `auth().verifyIdToken`\" plus the email\n  // gate. A door that reads as the STRICTER one while being the looser one is\n  // the worst shape available.\n  const decoded = await firebaseAdmin\n    .app()\n    .auth()\n    .verifyIdToken(idToken, checkRevoked)\n  if (!isEmailVerified(decoded) && !isImpersonationSession(decoded)) {\n    throw new EmailNotVerifiedError()\n  }\n  return decoded\n}\n\n/** 403 sent to callers whose email address is not yet verified (AGL-479). */\nexport function emailUnverifiedResponse(): Response {\n  return Response.json(\n    { error: 'Verify your email to continue', reason: 'email-unverified' },\n    { status: 403 },\n  )\n}\n\nexport { firebaseAdmin }\nexport default firebaseAdmin\n"],"names":["firestoreDatabaseId","decode","encode","getApp","getAuth","assertIdTokenNotRevoked","getDatabase","getRemoteConfig","FieldPath","FieldValue","Timestamp","getFirestore","getStorage","compress","value","Buffer","from","decompress","hostConverter","toFirestore","data","$id","fromFirestore","snapshot","exists","undefined","id","screenConverter","updatedAt","now","screenVersionConverter","elements","nodes","pluginId","ArrayBuffer","isView","layoutConverter","layoutVersionConverter","revocationPool","auth","decoded","self","tenantId","firebase","tenant","tenantManager","manager","call","authForTenant","revocationCheckedAuth","target","Proxy","get","prop","receiver","args","verify","Reflect","apply","pool","console","warn","mgr","key","mgrReceiver","tenantArgs","bind","wrapApp","app","firestore","storage","remoteConfig","firestoreNamespace","firebaseAdmin","name","database","EmailNotVerifiedError","Error","code","isEmailVerified","email_verified","isImpersonationSession","verifyConsoleIdToken","idToken","checkRevoked","verifyIdToken","emailUnverifiedResponse","Response","json","error","reason","status"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAGD,yEAAyE;AACzE,0EAA0E;AAC1E,4EAA4E;AAC5E,8EAA8E;AAC9E,kCAAkC;AAClC,SAASA,mBAAmB,QAAQ,8BAA6B;AACjE,SAASC,MAAM,EAAEC,MAAM,QAAQ,mBAAkB;AACjD,SAAmBC,MAAM,QAAQ,qBAAoB;AACrD,SAGEC,OAAO,QACF,sBAAqB;AAC5B,SAASC,uBAAuB,QAAQ,wBAAoB;AAC5D,SAASC,WAAW,QAAQ,0BAAyB;AACrD,SAASC,eAAe,QAAQ,+BAA8B;AAC9D,SACEC,SAAS,EACTC,UAAU,EAEVC,SAAS,EACTC,YAAY,QACP,2BAA0B;AACjC,SAASC,UAAU,QAAQ,yBAAwB;AAEnD,SAASC,SAASC,KAAU;IAC1B,OAAOC,OAAOC,IAAI,CAACd,OAAOY;AAC5B;AACA,SAASG,WAAWH,KAAU;IAC5B,OAAOb,OAAOa;AAChB;AAEA,OAAO,MAAMI,gBAAyD;IACpEC,aAAYC,IAAI;QACd,IAAIA,KAAKC,GAAG,EAAE,OAAOD,KAAKC,GAAG;QAC7B,mCAAmC;QACnC,OAAOD;IACT;IACAE,eAAcC,QAAQ;QACpB,IAAI,CAACA,SAASC,MAAM,EAAE,OAAOC;QAC7B,MAAML,OAAOG,SAASH,IAAI;QAC1BA,KAAKC,GAAG,GAAGE,SAASG,EAAE;QACtB,OAAON;IACT;AACF,EAAC;AAED,OAAO,MAAMO,kBAA6D;IACxER,aAAYC,IAAI;QACd,IAAIA,KAAKC,GAAG,EAAE,OAAOD,KAAKC,GAAG;QAC7BD,KAAKQ,SAAS,GAAGlB,UAAUmB,GAAG;QAC9B,OAAOT;IACT;IACAE,eAAcC,QAAQ;QACpB,IAAI,CAACA,SAASC,MAAM,EAAE,OAAOC;QAC7B,MAAML,OAAOG,SAASH,IAAI;QAC1BA,KAAKC,GAAG,GAAGE,SAASG,EAAE;QACtB,OAAON;IACT;AACF,EAAC;AAED,OAAO,MAAMU,yBACX;IACEX,aAAYC,IAAI;QACd,IAAIA,KAAKW,QAAQ,EAAE;YACjBX,KAAKY,KAAK,GAAGZ,KAAKW,QAAQ;YAC1B,OAAOX,KAAKW,QAAQ;QACtB;QACA,IAAIX,IAAI,CAAC,WAAW,EAAE;YACpBA,KAAKa,QAAQ,GAAGb,IAAI,CAAC,WAAW;YAChC,OAAOA,IAAI,CAAC,WAAW;QACzB;QACA,IAAIA,KAAKY,KAAK,EAAEZ,KAAKY,KAAK,GAAGnB,SAASO,KAAKY,KAAK;QAChD,IAAIZ,KAAKC,GAAG,EAAE,OAAOD,KAAKC,GAAG;QAC7BD,KAAKQ,SAAS,GAAGlB,UAAUmB,GAAG;QAC9B,OAAOT;IACT;IACAE,eAAcC,QAAQ;QACpB,IAAI,CAACA,SAASC,MAAM,EAAE,OAAOC;QAC7B,MAAML,OAAOG,SAASH,IAAI;QAC1B,IAAIA,wBAAAA,KAAMW,QAAQ,EAAE;YAClBX,KAAKY,KAAK,GAAGZ,KAAKW,QAAQ;YAC1B,OAAOX,KAAKW,QAAQ;QACtB;QACA,IAAIX,wBAAAA,IAAM,CAAC,WAAW,EAAE;YACtBA,KAAKa,QAAQ,GAAGb,IAAI,CAAC,WAAW;YAChC,OAAOA,IAAI,CAAC,WAAW;QACzB;QACA,IAAIA,wBAAAA,KAAMY,KAAK,EAAE;YACf,sEAAsE;YACtE,kEAAkE;YAClEZ,KAAKY,KAAK,GAAGE,YAAYC,MAAM,CAACf,KAAKY,KAAK,IACtCf,WAAWG,KAAKY,KAAK,IACrBZ,KAAKY,KAAK;QAChB;QACAZ,KAAKC,GAAG,GAAGE,SAASG,EAAE;QACtB,OAAON;IACT;AACF,EAAC;AAEH,OAAO,MAAMgB,kBAA6D;IACxEjB,aAAYC,IAAI;QACd,IAAIA,KAAKC,GAAG,EAAE,OAAOD,KAAKC,GAAG;QAC7BD,KAAKQ,SAAS,GAAGlB,UAAUmB,GAAG;QAC9B,OAAOT;IACT;IACAE,eAAcC,QAAQ;QACpB,IAAI,CAACA,SAASC,MAAM,EAAE,OAAOC;QAC7B,MAAML,OAAOG,SAASH,IAAI;QAC1BA,KAAKC,GAAG,GAAGE,SAASG,EAAE;QACtB,OAAON;IACT;AACF,EAAC;AAED,2EAA2E;AAC3E,OAAO,MAAMiB,yBACXP,uBAAqF;AAEvF;;;;;;CAMC,GACD;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2BC,GACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwDC,GACD,SAASQ,eACPC,IAAY,EACZC,OAAuB;QAGNA;IADjB,MAAMC,OAAOF;IACb,MAAMG,WAAWF,4BAAAA,oBAAAA,QAASG,QAAQ,qBAAjBH,kBAAmBI,MAAM;IAC1C,yEAAyE;IACzE,qEAAqE;IACrE,IAAI,OAAOF,aAAa,YAAY,CAACA,UAAU,OAAOD;IACtD,yDAAyD;IACzD,0EAA0E;IAC1E,wCAAwC;IACxC,IAAI,AAACF,KAA+BG,QAAQ,KAAKA,UAAU,OAAOD;IAClE,MAAMI,gBAAgB,AAACN,KACpBM,aAAa;IAChB,IAAI,OAAOA,kBAAkB,YAAY,OAAO;IAChD,IAAI;QACF,MAAMC,UAAUD,cAAcE,IAAI,CAACR;QAGnC,OAAOO,QAAQE,aAAa,CAACN;IAC/B,EAAE,eAAM;QACN,OAAO;IACT;AACF;AAEA,SAASO,sBAAwCC,MAAS;IACxD,OAAO,IAAIC,MAAMD,QAAQ;QACvBE,KAAIb,IAAI,EAAEc,IAAI,EAAEC,QAAQ;YACtB,IAAID,SAAS,iBAAiB;gBAC5B,OAAO,OAAO,GAAGE;oBACf,MAAMC,SAASC,QAAQL,GAAG,CAACb,MAAMc,MAAMd;oBAGvC,6DAA6D;oBAC7D,mEAAmE;oBACnE,gEAAgE;oBAChE,WAAW;oBACX,MAAMC,UAAU,MAAMgB,OAAOE,KAAK,CAACnB,MAAMgB;oBACzC,IAAIA,IAAI,CAAC,EAAE,KAAK,MAAM,OAAOf;oBAC7B,mEAAmE;oBACnE,mEAAmE;oBACnE,gCAAgC;oBAChC,MAAMmB,OAAOrB,eAAeC,MAAMC;oBAClC,mEAAmE;oBACnE,qCAAqC;oBACrC,IAAImB,SAAS,MAAM;4BAGfnB;wBAFFoB,QAAQC,IAAI,CACV,yDACArB,4BAAAA,oBAAAA,QAASG,QAAQ,qBAAjBH,kBAAmBI,MAAM;wBAE3B,OAAOJ;oBACT;oBACA,MAAMnC,wBAAwBsD,MAAMnB;oBACpC,OAAOA;gBACT;YACF;YACA,IAAIa,SAAS,iBAAiB;gBAC5B,OAAO,CAAC,GAAGE;oBACT,MAAMT,UAAU,AACdW,QAAQL,GAAG,CAACb,MAAMc,MAAMd,MACxBmB,KAAK,CAACnB,MAAMgB;oBACd,OAAO,IAAIJ,MAAML,SAAS;wBACxBM,KAAIU,GAAG,EAAEC,GAAG,EAAEC,WAAW;4BACvB,IAAID,QAAQ,iBAAiB;gCAC3B,OAAO,CAAC,GAAGE,aACThB,sBACE,AACEQ,QAAQL,GAAG,CAACU,KAAKC,KAAKD,KACtBJ,KAAK,CAACI,KAAKG;4BAEnB;4BACA,MAAMnD,QAAQ2C,QAAQL,GAAG,CAACU,KAAKC,KAAKC;4BACpC,OAAO,OAAOlD,UAAU,aAAaA,MAAMoD,IAAI,CAACJ,OAAOhD;wBACzD;oBACF;gBACF;YACF;YACA,MAAMA,QAAQ2C,QAAQL,GAAG,CAACb,MAAMc,MAAMC;YACtC,uEAAuE;YACvE,wEAAwE;YACxE,OAAO,OAAOxC,UAAU,aAAaA,MAAMoD,IAAI,CAAC3B,QAAQzB;QAC1D;IACF;AACF;AAEA,SAASqD,QAAQC,GAAQ;IACvB,OAAO;QACLC,WAAW,IAAM1D,aAAayD,KAAKpE;QACnCuC,MAAM,IAAMU,sBAAsB7C,QAAQgE;QAC1CE,SAAS,IAAM1D,WAAWwD;QAC1B,qEAAqE;QACrE,wDAAwD;QACxDG,cAAc,IAAMhE,gBAAgB6D;IACtC;AACF;AAEA,SAASI;IACP,OAAO7D,aAAaR,UAAUH;AAChC;AACAwE,mBAAmB/D,UAAU,GAAGA;AAChC+D,mBAAmB9D,SAAS,GAAGA;AAC/B8D,mBAAmBhE,SAAS,GAAGA;AAE/B,MAAMiE,gBAAgB;IACpBL,KAAK,CAACM,OAAkBP,QAAQO,OAAOvE,OAAOuE,QAAQvE;IACtDkE,WAAWG;IACXG,UAAU,IAAMrE,YAAYH;AAC9B;AAEA;;;;;;;;;;;;;;;;;CAiBC,GACD,OAAO,MAAMyE,8BAA8BC;IAEzC,aAAc;QACZ,KAAK,CAAC,oCAFCC,OAAO;QAGd,IAAI,CAACJ,IAAI,GAAG;IACd;AACF;AAEA,OAAO,SAASK,gBAAgBvC,OAAuB;IACrD,OAAOA,QAAQwC,cAAc,KAAK;AACpC;AAEA;oEACoE,GACpE,OAAO,SAASC,uBAAuBzC,OAAuB;IAC5D,OAAO,OAAOA,OAAO,CAAC,iBAAiB,KAAK;AAC9C;AAEA,OAAO,eAAe0C,qBACpBC,OAAe,EACfC,YAAsB;IAEtB,yEAAyE;IACzE,4EAA4E;IAC5E,wEAAwE;IACxE,4EAA4E;IAC5E,6BAA6B;IAC7B,MAAM5C,UAAU,MAAMiC,cACnBL,GAAG,GACH7B,IAAI,GACJ8C,aAAa,CAACF,SAASC;IAC1B,IAAI,CAACL,gBAAgBvC,YAAY,CAACyC,uBAAuBzC,UAAU;QACjE,MAAM,IAAIoC;IACZ;IACA,OAAOpC;AACT;AAEA,2EAA2E,GAC3E,OAAO,SAAS8C;IACd,OAAOC,SAASC,IAAI,CAClB;QAAEC,OAAO;QAAiCC,QAAQ;IAAmB,GACrE;QAAEC,QAAQ;IAAI;AAElB;AAEA,SAASlB,aAAa,GAAE;AACxB,eAAeA,cAAa"}

package/src/lib/server/form-dataset-binding-token.d.ts

@@ -0,0 +1,35 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { FormDatasetBinding } from '@aglyn/aglyn/app-utils/form-dataset-binding';
+/**
+ * The token a page carries for one form's binding on one site.
+ *
+ * Throws when `TOKEN_SIGNING_SECRET` is not configured, like every token this
+ * secret signs; a caller that renders a page decides what an unsigned form
+ * does.
+ */
+export declare function signFormDatasetBinding(hostId: string, binding: FormDatasetBinding): string;
+/**
+ * The binding a token carries, or null when it is not a valid token for
+ * `hostId`.
+ *
+ * Null for anything else at all — not a string, oversized, another version, a
+ * signature that does not match, a site other than this one, or no signing
+ * secret — because the only safe reading of a binding that cannot be verified
+ * is that there is none.
+ */
+export declare function verifyFormDatasetBinding(hostId: string, token: unknown): FormDatasetBinding | null;

package/src/lib/server/form-dataset-binding-token.js

@@ -0,0 +1,107 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { _ as _extends } from "@swc/helpers/_/_extends";
+import { createHmac } from "crypto";
+import { tokenSigningSecret } from "./media-signing.js";
+import { safeEqual } from "./safe-equal.js";
+/**
+ * A form's dataset binding, signed into the page that renders the form.
+ *
+ * `/api/forms/submit` is public and unauthenticated, so nothing in its body
+ * may choose which dataset a record lands in: a dataset id taken from the body
+ * let anyone add rows to any dataset the site can see. The binding is instead
+ * read off the form by the compose that renders the page, signed here, and
+ * carried by the form; the route writes only where a valid signature says.
+ *
+ * What a token grants is what the published form already does. Anyone can read
+ * one out of the page, and replaying it writes to that form's dataset with
+ * that form's field map, for the site it was minted on — nothing a visitor
+ * submitting the form could not already do.
+ *
+ * Signed with the shared, fail-closed `TOKEN_SIGNING_SECRET`, the secret the
+ * other tenant tokens use, under its own `form-dataset-binding:` prefix so it
+ * can never be replayed as any other kind of token. No expiry: a published
+ * page can be served long after it rendered, and an expired token would drop
+ * a live form's records. Rotating the secret, or the version, retires every
+ * token at once.
+ */ const VERSION = 'v1';
+const PREFIX = 'form-dataset-binding';
+/** Far above any real binding, so an oversized body is refused unparsed. */ const MAX_TOKEN_CHARS = 8192;
+const signature = (payload)=>createHmac('sha256', tokenSigningSecret()).update(`${PREFIX}:${VERSION}:${payload}`).digest('hex');
+/**
+ * The token a page carries for one form's binding on one site.
+ *
+ * Throws when `TOKEN_SIGNING_SECRET` is not configured, like every token this
+ * secret signs; a caller that renders a page decides what an unsigned form
+ * does.
+ */ export function signFormDatasetBinding(hostId, binding) {
+    const body = _extends({
+        h: hostId
+    }, binding.datasetId ? {
+        d: binding.datasetId
+    } : {}, binding.datasetName ? {
+        n: binding.datasetName
+    } : {}, {
+        m: binding.fieldMap
+    });
+    const payload = Buffer.from(JSON.stringify(body)).toString('base64url');
+    return `${VERSION}.${payload}.${signature(payload)}`;
+}
+const text = (value, max)=>typeof value === 'string' ? value.trim().slice(0, max) : '';
+/**
+ * The binding a token carries, or null when it is not a valid token for
+ * `hostId`.
+ *
+ * Null for anything else at all — not a string, oversized, another version, a
+ * signature that does not match, a site other than this one, or no signing
+ * secret — because the only safe reading of a binding that cannot be verified
+ * is that there is none.
+ */ export function verifyFormDatasetBinding(hostId, token) {
+    try {
+        if (typeof token !== 'string' || token.length > MAX_TOKEN_CHARS) return null;
+        const [version, payload, signed, extra] = token.split('.');
+        if (version !== VERSION || !payload || !signed || extra !== undefined) {
+            return null;
+        }
+        if (!safeEqual(signed, signature(payload))) return null;
+        const body = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));
+        if (!hostId || (body == null ? void 0 : body.h) !== hostId) return null;
+        const datasetId = text(body.d, 128);
+        const datasetName = text(body.n, 60);
+        if (!datasetId && !datasetName) return null;
+        const fieldMap = {};
+        if (body.m && typeof body.m === 'object' && !Array.isArray(body.m)) {
+            for (const [key, value] of Object.entries(body.m)){
+                const submittedKey = text(key, 64);
+                const datasetFieldId = text(value, 64);
+                if (submittedKey && datasetFieldId) {
+                    fieldMap[submittedKey] = datasetFieldId;
+                }
+            }
+        }
+        return _extends({}, datasetId ? {
+            datasetId
+        } : {}, datasetName ? {
+            datasetName
+        } : {}, {
+            fieldMap
+        });
+    } catch (unused) {
+        return null;
+    }
+}
+
+//# sourceMappingURL=form-dataset-binding-token.js.map

package/src/lib/server/form-dataset-binding-token.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/form-dataset-binding-token.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { FormDatasetBinding } from '@aglyn/aglyn/app-utils/form-dataset-binding'\nimport { createHmac } from 'crypto'\nimport { tokenSigningSecret } from './media-signing'\nimport { safeEqual } from './safe-equal'\n\n/**\n * A form's dataset binding, signed into the page that renders the form.\n *\n * `/api/forms/submit` is public and unauthenticated, so nothing in its body\n * may choose which dataset a record lands in: a dataset id taken from the body\n * let anyone add rows to any dataset the site can see. The binding is instead\n * read off the form by the compose that renders the page, signed here, and\n * carried by the form; the route writes only where a valid signature says.\n *\n * What a token grants is what the published form already does. Anyone can read\n * one out of the page, and replaying it writes to that form's dataset with\n * that form's field map, for the site it was minted on — nothing a visitor\n * submitting the form could not already do.\n *\n * Signed with the shared, fail-closed `TOKEN_SIGNING_SECRET`, the secret the\n * other tenant tokens use, under its own `form-dataset-binding:` prefix so it\n * can never be replayed as any other kind of token. No expiry: a published\n * page can be served long after it rendered, and an expired token would drop\n * a live form's records. Rotating the secret, or the version, retires every\n * token at once.\n */\n\nconst VERSION = 'v1'\nconst PREFIX = 'form-dataset-binding'\n/** Far above any real binding, so an oversized body is refused unparsed. */\nconst MAX_TOKEN_CHARS = 8192\n\ninterface SignedBinding {\n  h: string\n  d?: string\n  n?: string\n  m: Record<string, string>\n}\n\nconst signature = (payload: string): string =>\n  createHmac('sha256', tokenSigningSecret())\n    .update(`${PREFIX}:${VERSION}:${payload}`)\n    .digest('hex')\n\n/**\n * The token a page carries for one form's binding on one site.\n *\n * Throws when `TOKEN_SIGNING_SECRET` is not configured, like every token this\n * secret signs; a caller that renders a page decides what an unsigned form\n * does.\n */\nexport function signFormDatasetBinding(\n  hostId: string,\n  binding: FormDatasetBinding,\n): string {\n  const body: SignedBinding = {\n    h: hostId,\n    ...(binding.datasetId ? { d: binding.datasetId } : {}),\n    ...(binding.datasetName ? { n: binding.datasetName } : {}),\n    m: binding.fieldMap,\n  }\n  const payload = Buffer.from(JSON.stringify(body)).toString('base64url')\n  return `${VERSION}.${payload}.${signature(payload)}`\n}\n\nconst text = (value: unknown, max: number): string =>\n  typeof value === 'string' ? value.trim().slice(0, max) : ''\n\n/**\n * The binding a token carries, or null when it is not a valid token for\n * `hostId`.\n *\n * Null for anything else at all — not a string, oversized, another version, a\n * signature that does not match, a site other than this one, or no signing\n * secret — because the only safe reading of a binding that cannot be verified\n * is that there is none.\n */\nexport function verifyFormDatasetBinding(\n  hostId: string,\n  token: unknown,\n): FormDatasetBinding | null {\n  try {\n    if (typeof token !== 'string' || token.length > MAX_TOKEN_CHARS) return null\n    const [version, payload, signed, extra] = token.split('.')\n    if (version !== VERSION || !payload || !signed || extra !== undefined) {\n      return null\n    }\n    if (!safeEqual(signed, signature(payload))) return null\n    const body = JSON.parse(\n      Buffer.from(payload, 'base64url').toString('utf8'),\n    ) as Partial<SignedBinding>\n    if (!hostId || body?.h !== hostId) return null\n    const datasetId = text(body.d, 128)\n    const datasetName = text(body.n, 60)\n    if (!datasetId && !datasetName) return null\n    const fieldMap: Record<string, string> = {}\n    if (body.m && typeof body.m === 'object' && !Array.isArray(body.m)) {\n      for (const [key, value] of Object.entries(body.m)) {\n        const submittedKey = text(key, 64)\n        const datasetFieldId = text(value, 64)\n        if (submittedKey && datasetFieldId) {\n          fieldMap[submittedKey] = datasetFieldId\n        }\n      }\n    }\n    return {\n      ...(datasetId ? { datasetId } : {}),\n      ...(datasetName ? { datasetName } : {}),\n      fieldMap,\n    }\n  } catch {\n    return null\n  }\n}\n"],"names":["createHmac","tokenSigningSecret","safeEqual","VERSION","PREFIX","MAX_TOKEN_CHARS","signature","payload","update","digest","signFormDatasetBinding","hostId","binding","body","h","datasetId","d","datasetName","n","m","fieldMap","Buffer","from","JSON","stringify","toString","text","value","max","trim","slice","verifyFormDatasetBinding","token","length","version","signed","extra","split","undefined","parse","Array","isArray","key","Object","entries","submittedKey","datasetFieldId"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC;AAGD,SAASA,UAAU,QAAQ,SAAQ;AACnC,SAASC,kBAAkB,QAAQ,qBAAiB;AACpD,SAASC,SAAS,QAAQ,kBAAc;AAExC;;;;;;;;;;;;;;;;;;;;CAoBC,GAED,MAAMC,UAAU;AAChB,MAAMC,SAAS;AACf,0EAA0E,GAC1E,MAAMC,kBAAkB;AASxB,MAAMC,YAAY,CAACC,UACjBP,WAAW,UAAUC,sBAClBO,MAAM,CAAC,GAAGJ,OAAO,CAAC,EAAED,QAAQ,CAAC,EAAEI,SAAS,EACxCE,MAAM,CAAC;AAEZ;;;;;;CAMC,GACD,OAAO,SAASC,uBACdC,MAAc,EACdC,OAA2B;IAE3B,MAAMC,OAAsB;QAC1BC,GAAGH;OACCC,QAAQG,SAAS,GAAG;QAAEC,GAAGJ,QAAQG,SAAS;IAAC,IAAI,CAAC,GAChDH,QAAQK,WAAW,GAAG;QAAEC,GAAGN,QAAQK,WAAW;IAAC,IAAI,CAAC;QACxDE,GAAGP,QAAQQ,QAAQ;;IAErB,MAAMb,UAAUc,OAAOC,IAAI,CAACC,KAAKC,SAAS,CAACX,OAAOY,QAAQ,CAAC;IAC3D,OAAO,GAAGtB,QAAQ,CAAC,EAAEI,QAAQ,CAAC,EAAED,UAAUC,UAAU;AACtD;AAEA,MAAMmB,OAAO,CAACC,OAAgBC,MAC5B,OAAOD,UAAU,WAAWA,MAAME,IAAI,GAAGC,KAAK,CAAC,GAAGF,OAAO;AAE3D;;;;;;;;CAQC,GACD,OAAO,SAASG,yBACdpB,MAAc,EACdqB,KAAc;IAEd,IAAI;QACF,IAAI,OAAOA,UAAU,YAAYA,MAAMC,MAAM,GAAG5B,iBAAiB,OAAO;QACxE,MAAM,CAAC6B,SAAS3B,SAAS4B,QAAQC,MAAM,GAAGJ,MAAMK,KAAK,CAAC;QACtD,IAAIH,YAAY/B,WAAW,CAACI,WAAW,CAAC4B,UAAUC,UAAUE,WAAW;YACrE,OAAO;QACT;QACA,IAAI,CAACpC,UAAUiC,QAAQ7B,UAAUC,WAAW,OAAO;QACnD,MAAMM,OAAOU,KAAKgB,KAAK,CACrBlB,OAAOC,IAAI,CAACf,SAAS,aAAakB,QAAQ,CAAC;QAE7C,IAAI,CAACd,UAAUE,CAAAA,wBAAAA,KAAMC,CAAC,MAAKH,QAAQ,OAAO;QAC1C,MAAMI,YAAYW,KAAKb,KAAKG,CAAC,EAAE;QAC/B,MAAMC,cAAcS,KAAKb,KAAKK,CAAC,EAAE;QACjC,IAAI,CAACH,aAAa,CAACE,aAAa,OAAO;QACvC,MAAMG,WAAmC,CAAC;QAC1C,IAAIP,KAAKM,CAAC,IAAI,OAAON,KAAKM,CAAC,KAAK,YAAY,CAACqB,MAAMC,OAAO,CAAC5B,KAAKM,CAAC,GAAG;YAClE,KAAK,MAAM,CAACuB,KAAKf,MAAM,IAAIgB,OAAOC,OAAO,CAAC/B,KAAKM,CAAC,EAAG;gBACjD,MAAM0B,eAAenB,KAAKgB,KAAK;gBAC/B,MAAMI,iBAAiBpB,KAAKC,OAAO;gBACnC,IAAIkB,gBAAgBC,gBAAgB;oBAClC1B,QAAQ,CAACyB,aAAa,GAAGC;gBAC3B;YACF;QACF;QACA,OAAO,aACD/B,YAAY;YAAEA;QAAU,IAAI,CAAC,GAC7BE,cAAc;YAAEA;QAAY,IAAI,CAAC;YACrCG;;IAEJ,EAAE,eAAM;QACN,OAAO;IACT;AACF"}