@de-otio/chaoskb-server 0.2.0

package/dist/lib/handler/routes/rotation.d.ts

@@ -0,0 +1,24 @@
+import { DynamoDBDocumentClient } from '@aws-sdk/lib-dynamodb';
+interface HandlerResponse {
+    statusCode: number;
+    body: string;
+    headers: Record<string, string>;
+}
+/**
+ * POST /v1/rotate-start — Phase 1 of two-phase key rotation.
+ *
+ * Authenticated with the OLD key. Stores the new public key alongside the
+ * old key and marks the rotation as started. Both old and new keys are
+ * accepted for authentication going forward.
+ */
+export declare function handleRotateStart(tenantId: string, oldFingerprint: string, rawBody: string | null | undefined, ddb: DynamoDBDocumentClient, tableName: string): Promise<HandlerResponse>;
+/**
+ * POST /v1/rotate-confirm — Phase 2 of two-phase key rotation.
+ *
+ * Authenticated with the NEW key. Adds the device to the confirmations list.
+ * When all registered devices have confirmed (or the 48h timeout has elapsed),
+ * completes the rotation by removing the old key and rotation record.
+ */
+export declare function handleRotateConfirm(tenantId: string, fingerprint: string, ddb: DynamoDBDocumentClient, tableName: string): Promise<HandlerResponse>;
+export {};
+//# sourceMappingURL=rotation.d.ts.map

package/dist/lib/handler/routes/rotation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotation.d.ts","sourceRoot":"","sources":["../../../../lib/handler/routes/rotation.ts"],"names":[],"mappings":"AACA,OAAO,EACL,sBAAsB,EAMvB,MAAM,uBAAuB,CAAC;AAG/B,UAAU,eAAe;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AA6BD;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAClC,GAAG,EAAE,sBAAsB,EAC3B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,eAAe,CAAC,CAoH1B;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,sBAAsB,EAC3B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,eAAe,CAAC,CA6F1B"}

package/dist/lib/handler/routes/rotation.js

@@ -0,0 +1,291 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handleRotateStart = handleRotateStart;
+exports.handleRotateConfirm = handleRotateConfirm;
+const crypto = __importStar(require("crypto"));
+const lib_dynamodb_1 = require("@aws-sdk/lib-dynamodb");
+const logger_js_1 = require("../logger.js");
+/** 48 hours in milliseconds — timeout for rotation confirmation phase. */
+const ROTATION_TIMEOUT_MS = 48 * 60 * 60 * 1000;
+function fingerprintFromPublicKey(publicKeyBase64) {
+    return crypto.createHash('sha256').update(Buffer.from(publicKeyBase64, 'base64')).digest('base64');
+}
+function tenantIdFromPublicKey(publicKeyBase64) {
+    const hash = crypto.createHash('sha256').update(publicKeyBase64).digest('hex');
+    return hash.slice(0, 32);
+}
+function isValidBase64(value) {
+    if (!value || value.length < 4 || value.length > 8192)
+        return false;
+    try {
+        const decoded = Buffer.from(value, 'base64');
+        return decoded.length > 0;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * POST /v1/rotate-start — Phase 1 of two-phase key rotation.
+ *
+ * Authenticated with the OLD key. Stores the new public key alongside the
+ * old key and marks the rotation as started. Both old and new keys are
+ * accepted for authentication going forward.
+ */
+async function handleRotateStart(tenantId, oldFingerprint, rawBody, ddb, tableName) {
+    if (!rawBody) {
+        return {
+            statusCode: 400,
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ error: 'invalid_request', message: 'Request body is required' }),
+        };
+    }
+    let request;
+    try {
+        request = JSON.parse(rawBody);
+    }
+    catch {
+        return {
+            statusCode: 400,
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ error: 'invalid_request', message: 'Invalid JSON body' }),
+        };
+    }
+    if (!request.newPublicKey || !isValidBase64(request.newPublicKey)) {
+        return {
+            statusCode: 400,
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ error: 'invalid_request', message: 'newPublicKey is required and must be valid base64' }),
+        };
+    }
+    if (!request.wrappedBlob || !isValidBase64(request.wrappedBlob)) {
+        return {
+            statusCode: 400,
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ error: 'invalid_request', message: 'wrappedBlob is required and must be valid base64' }),
+        };
+    }
+    // Check for existing rotation in progress
+    const existingRotation = await ddb.send(new lib_dynamodb_1.GetCommand({
+        TableName: tableName,
+        Key: {
+            PK: `TENANT#${tenantId}`,
+            SK: 'ROTATION',
+        },
+    }));
+    if (existingRotation.Item) {
+        return {
+            statusCode: 409,
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ error: 'rotation_in_progress', message: 'A key rotation is already in progress' }),
+        };
+    }
+    const newFingerprint = fingerprintFromPublicKey(request.newPublicKey);
+    const now = new Date().toISOString();
+    // Store rotation record
+    await ddb.send(new lib_dynamodb_1.PutCommand({
+        TableName: tableName,
+        Item: {
+            PK: `TENANT#${tenantId}`,
+            SK: 'ROTATION',
+            phase: 'started',
+            newPublicKey: request.newPublicKey,
+            newFingerprint,
+            oldFingerprint,
+            startedAt: now,
+            confirmations: [],
+        },
+    }));
+    // Store the new public key in tenant META so auth middleware accepts both keys
+    await ddb.send(new lib_dynamodb_1.UpdateCommand({
+        TableName: tableName,
+        Key: {
+            PK: `TENANT#${tenantId}`,
+            SK: 'META',
+        },
+        UpdateExpression: 'SET newPublicKey = :npk, rotationState = :state, updatedAt = :now',
+        ExpressionAttributeValues: {
+            ':npk': request.newPublicKey,
+            ':state': 'ROTATION_STARTED',
+            ':now': now,
+        },
+    }));
+    // Store the wrapped blob for the new key
+    await ddb.send(new lib_dynamodb_1.PutCommand({
+        TableName: tableName,
+        Item: {
+            PK: `TENANT#${tenantId}`,
+            SK: `WRAPPED_KEY#${newFingerprint}`,
+            data: request.wrappedBlob,
+            updatedAt: now,
+        },
+    }));
+    logger_js_1.logger.info('Key rotation started', { tenantId, oldFingerprint, newFingerprint });
+    return {
+        statusCode: 200,
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+            status: 'rotation_started',
+            newFingerprint,
+            oldFingerprint,
+        }),
+    };
+}
+/**
+ * POST /v1/rotate-confirm — Phase 2 of two-phase key rotation.
+ *
+ * Authenticated with the NEW key. Adds the device to the confirmations list.
+ * When all registered devices have confirmed (or the 48h timeout has elapsed),
+ * completes the rotation by removing the old key and rotation record.
+ */
+async function handleRotateConfirm(tenantId, fingerprint, ddb, tableName) {
+    // Get the rotation record
+    const rotationResult = await ddb.send(new lib_dynamodb_1.GetCommand({
+        TableName: tableName,
+        Key: {
+            PK: `TENANT#${tenantId}`,
+            SK: 'ROTATION',
+        },
+    }));
+    if (!rotationResult.Item) {
+        return {
+            statusCode: 404,
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ error: 'not_found', message: 'No key rotation in progress' }),
+        };
+    }
+    const rotation = rotationResult.Item;
+    const confirmations = rotation['confirmations'] ?? [];
+    // Add this device fingerprint to confirmations if not already present
+    if (!confirmations.includes(fingerprint)) {
+        confirmations.push(fingerprint);
+        await ddb.send(new lib_dynamodb_1.UpdateCommand({
+            TableName: tableName,
+            Key: {
+                PK: `TENANT#${tenantId}`,
+                SK: 'ROTATION',
+            },
+            UpdateExpression: 'SET confirmations = :c',
+            ExpressionAttributeValues: {
+                ':c': confirmations,
+            },
+        }));
+    }
+    // Check if rotation should be completed:
+    // Either all devices confirmed or 48h timeout elapsed
+    const startedAt = new Date(rotation['startedAt']).getTime();
+    const timeoutReached = Date.now() - startedAt > ROTATION_TIMEOUT_MS;
+    // Count registered devices (WRAPPED_KEY# entries = registered devices)
+    const deviceResult = await ddb.send(new lib_dynamodb_1.QueryCommand({
+        TableName: tableName,
+        KeyConditionExpression: 'PK = :pk AND begins_with(SK, :prefix)',
+        ExpressionAttributeValues: {
+            ':pk': `TENANT#${tenantId}`,
+            ':prefix': 'WRAPPED_KEY#',
+        },
+        Select: 'COUNT',
+    }));
+    const deviceCount = deviceResult.Count ?? 0;
+    const allConfirmed = confirmations.length >= deviceCount;
+    if (allConfirmed || timeoutReached) {
+        // Complete the rotation: Phase 2
+        await completeRotation(tenantId, rotation, ddb, tableName);
+        logger_js_1.logger.info('Key rotation completed', {
+            tenantId,
+            newFingerprint: rotation['newFingerprint'],
+            reason: timeoutReached ? 'timeout' : 'all_confirmed',
+        });
+        return {
+            statusCode: 200,
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                status: 'rotation_complete',
+                confirmations: confirmations.length,
+                totalDevices: deviceCount,
+            }),
+        };
+    }
+    return {
+        statusCode: 200,
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+            status: 'confirmation_recorded',
+            confirmations: confirmations.length,
+            totalDevices: deviceCount,
+        }),
+    };
+}
+/**
+ * Complete the rotation by:
+ * 1. Updating tenant META with the new public key as primary
+ * 2. Deleting old wrapped key blob
+ * 3. Deleting the rotation record
+ */
+async function completeRotation(tenantId, rotation, ddb, tableName) {
+    const newPublicKey = rotation['newPublicKey'];
+    const oldFingerprint = rotation['oldFingerprint'];
+    const now = new Date().toISOString();
+    // Update tenant META: replace primary public key, clear rotation state
+    await ddb.send(new lib_dynamodb_1.UpdateCommand({
+        TableName: tableName,
+        Key: {
+            PK: `TENANT#${tenantId}`,
+            SK: 'META',
+        },
+        UpdateExpression: 'SET publicKey = :pk, updatedAt = :now REMOVE newPublicKey, rotationState',
+        ExpressionAttributeValues: {
+            ':pk': newPublicKey,
+            ':now': now,
+        },
+    }));
+    // Delete old wrapped key blob
+    await ddb.send(new lib_dynamodb_1.DeleteCommand({
+        TableName: tableName,
+        Key: {
+            PK: `TENANT#${tenantId}`,
+            SK: `WRAPPED_KEY#${oldFingerprint}`,
+        },
+    }));
+    // Delete rotation record
+    await ddb.send(new lib_dynamodb_1.DeleteCommand({
+        TableName: tableName,
+        Key: {
+            PK: `TENANT#${tenantId}`,
+            SK: 'ROTATION',
+        },
+    }));
+}
+//# sourceMappingURL=rotation.js.map

package/dist/lib/handler/routes/rotation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotation.js","sourceRoot":"","sources":["../../../../lib/handler/routes/rotation.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmDA,8CA0HC;AASD,kDAkGC;AAxRD,+CAAiC;AACjC,wDAO+B;AAC/B,4CAAsC;AAatC,0EAA0E;AAC1E,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEhD,SAAS,wBAAwB,CAAC,eAAuB;IACvD,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACrG,CAAC;AAED,SAAS,qBAAqB,CAAC,eAAuB;IACpD,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/E,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI;QAAE,OAAO,KAAK,CAAC;IACpE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC7C,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,iBAAiB,CACrC,QAAgB,EAChB,cAAsB,EACtB,OAAkC,EAClC,GAA2B,EAC3B,SAAiB;IAEjB,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;SACxF,CAAC;IACJ,CAAC;IAED,IAAI,OAA2B,CAAC;IAChC,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;SACjF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QAClE,OAAO;YACL,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,mDAAmD,EAAE,CAAC;SACjH,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAChE,OAAO;YACL,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,kDAAkD,EAAE,CAAC;SAChH,CAAC;IACJ,CAAC;IAED,0CAA0C;IAC1C,MAAM,gBAAgB,GAAG,MAAM,GAAG,CAAC,IAAI,CACrC,IAAI,yBAAU,CAAC;QACb,SAAS,EAAE,SAAS;QACpB,GAAG,EAAE;YACH,EAAE,EAAE,UAAU,QAAQ,EAAE;YACxB,EAAE,EAAE,UAAU;SACf;KACF,CAAC,CACH,CAAC;IAEF,IAAI,gBAAgB,CAAC,IAAI,EAAE,CAAC;QAC1B,OAAO;YACL,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC;SAC1G,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,wBAAwB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAErC,wBAAwB;IACxB,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,yBAAU,CAAC;QACb,SAAS,EAAE,SAAS;QACpB,IAAI,EAAE;YACJ,EAAE,EAAE,UAAU,QAAQ,EAAE;YACxB,EAAE,EAAE,UAAU;YACd,KAAK,EAAE,SAAS;YAChB,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,cAAc;YACd,cAAc;YACd,SAAS,EAAE,GAAG;YACd,aAAa,EAAE,EAAE;SAClB;KACF,CAAC,CACH,CAAC;IAEF,+EAA+E;IAC/E,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,4BAAa,CAAC;QAChB,SAAS,EAAE,SAAS;QACpB,GAAG,EAAE;YACH,EAAE,EAAE,UAAU,QAAQ,EAAE;YACxB,EAAE,EAAE,MAAM;SACX;QACD,gBAAgB,EAAE,mEAAmE;QACrF,yBAAyB,EAAE;YACzB,MAAM,EAAE,OAAO,CAAC,YAAY;YAC5B,QAAQ,EAAE,kBAAkB;YAC5B,MAAM,EAAE,GAAG;SACZ;KACF,CAAC,CACH,CAAC;IAEF,yCAAyC;IACzC,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,yBAAU,CAAC;QACb,SAAS,EAAE,SAAS;QACpB,IAAI,EAAE;YACJ,EAAE,EAAE,UAAU,QAAQ,EAAE;YACxB,EAAE,EAAE,eAAe,cAAc,EAAE;YACnC,IAAI,EAAE,OAAO,CAAC,WAAW;YACzB,SAAS,EAAE,GAAG;SACf;KACF,CAAC,CACH,CAAC;IAEF,kBAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,cAAc,EAAE,CAAC,CAAC;IAElF,OAAO;QACL,UAAU,EAAE,GAAG;QACf,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,MAAM,EAAE,kBAAkB;YAC1B,cAAc;YACd,cAAc;SACf,CAAC;KACH,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,WAAmB,EACnB,GAA2B,EAC3B,SAAiB;IAEjB,0BAA0B;IAC1B,MAAM,cAAc,GAAG,MAAM,GAAG,CAAC,IAAI,CACnC,IAAI,yBAAU,CAAC;QACb,SAAS,EAAE,SAAS;QACpB,GAAG,EAAE;YACH,EAAE,EAAE,UAAU,QAAQ,EAAE;YACxB,EAAE,EAAE,UAAU;SACf;KACF,CAAC,CACH,CAAC;IAEF,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACzB,OAAO;YACL,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC;SACrF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC;IACrC,MAAM,aAAa,GAAa,QAAQ,CAAC,eAAe,CAAa,IAAI,EAAE,CAAC;IAE5E,sEAAsE;IACtE,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACzC,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAEhC,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,4BAAa,CAAC;YAChB,SAAS,EAAE,SAAS;YACpB,GAAG,EAAE;gBACH,EAAE,EAAE,UAAU,QAAQ,EAAE;gBACxB,EAAE,EAAE,UAAU;aACf;YACD,gBAAgB,EAAE,wBAAwB;YAC1C,yBAAyB,EAAE;gBACzB,IAAI,EAAE,aAAa;aACpB;SACF,CAAC,CACH,CAAC;IACJ,CAAC;IAED,yCAAyC;IACzC,sDAAsD;IACtD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAW,CAAC,CAAC,OAAO,EAAE,CAAC;IACtE,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,mBAAmB,CAAC;IAEpE,uEAAuE;IACvE,MAAM,YAAY,GAAG,MAAM,GAAG,CAAC,IAAI,CACjC,IAAI,2BAAY,CAAC;QACf,SAAS,EAAE,SAAS;QACpB,sBAAsB,EAAE,uCAAuC;QAC/D,yBAAyB,EAAE;YACzB,KAAK,EAAE,UAAU,QAAQ,EAAE;YAC3B,SAAS,EAAE,cAAc;SAC1B;QACD,MAAM,EAAE,OAAO;KAChB,CAAC,CACH,CAAC;IAEF,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,IAAI,CAAC,CAAC;IAC5C,MAAM,YAAY,GAAG,aAAa,CAAC,MAAM,IAAI,WAAW,CAAC;IAEzD,IAAI,YAAY,IAAI,cAAc,EAAE,CAAC;QACnC,iCAAiC;QACjC,MAAM,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;QAE3D,kBAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE;YACpC,QAAQ;YACR,cAAc,EAAE,QAAQ,CAAC,gBAAgB,CAAC;YAC1C,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe;SACrD,CAAC,CAAC;QAEH,OAAO;YACL,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,MAAM,EAAE,mBAAmB;gBAC3B,aAAa,EAAE,aAAa,CAAC,MAAM;gBACnC,YAAY,EAAE,WAAW;aAC1B,CAAC;SACH,CAAC;IACJ,CAAC;IAED,OAAO;QACL,UAAU,EAAE,GAAG;QACf,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,MAAM,EAAE,uBAAuB;YAC/B,aAAa,EAAE,aAAa,CAAC,MAAM;YACnC,YAAY,EAAE,WAAW;SAC1B,CAAC;KACH,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,gBAAgB,CAC7B,QAAgB,EAChB,QAAiC,EACjC,GAA2B,EAC3B,SAAiB;IAEjB,MAAM,YAAY,GAAG,QAAQ,CAAC,cAAc,CAAW,CAAC;IACxD,MAAM,cAAc,GAAG,QAAQ,CAAC,gBAAgB,CAAW,CAAC;IAC5D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAErC,uEAAuE;IACvE,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,4BAAa,CAAC;QAChB,SAAS,EAAE,SAAS;QACpB,GAAG,EAAE;YACH,EAAE,EAAE,UAAU,QAAQ,EAAE;YACxB,EAAE,EAAE,MAAM;SACX;QACD,gBAAgB,EAAE,0EAA0E;QAC5F,yBAAyB,EAAE;YACzB,KAAK,EAAE,YAAY;YACnB,MAAM,EAAE,GAAG;SACZ;KACF,CAAC,CACH,CAAC;IAEF,8BAA8B;IAC9B,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,4BAAa,CAAC;QAChB,SAAS,EAAE,SAAS;QACpB,GAAG,EAAE;YACH,EAAE,EAAE,UAAU,QAAQ,EAAE;YACxB,EAAE,EAAE,eAAe,cAAc,EAAE;SACpC;KACF,CAAC,CACH,CAAC;IAEF,yBAAyB;IACzB,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,4BAAa,CAAC;QAChB,SAAS,EAAE,SAAS;QACpB,GAAG,EAAE;YACH,EAAE,EAAE,UAAU,QAAQ,EAAE;YACxB,EAAE,EAAE,UAAU;SACf;KACF,CAAC,CACH,CAAC;AACJ,CAAC"}

package/dist/lib/handler/routes/rotation.ts

@@ -0,0 +1,336 @@
+import * as crypto from 'crypto';
+import {
+  DynamoDBDocumentClient,
+  PutCommand,
+  GetCommand,
+  UpdateCommand,
+  DeleteCommand,
+  QueryCommand,
+} from '@aws-sdk/lib-dynamodb';
+import { logger } from '../logger.js';
+
+interface HandlerResponse {
+  statusCode: number;
+  body: string;
+  headers: Record<string, string>;
+}
+
+interface RotateStartRequest {
+  newPublicKey: string;
+  wrappedBlob: string; // base64-encoded wrapped master key blob
+}
+
+/** 48 hours in milliseconds — timeout for rotation confirmation phase. */
+const ROTATION_TIMEOUT_MS = 48 * 60 * 60 * 1000;
+
+function fingerprintFromPublicKey(publicKeyBase64: string): string {
+  return crypto.createHash('sha256').update(Buffer.from(publicKeyBase64, 'base64')).digest('base64');
+}
+
+function tenantIdFromPublicKey(publicKeyBase64: string): string {
+  const hash = crypto.createHash('sha256').update(publicKeyBase64).digest('hex');
+  return hash.slice(0, 32);
+}
+
+function isValidBase64(value: string): boolean {
+  if (!value || value.length < 4 || value.length > 8192) return false;
+  try {
+    const decoded = Buffer.from(value, 'base64');
+    return decoded.length > 0;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * POST /v1/rotate-start — Phase 1 of two-phase key rotation.
+ *
+ * Authenticated with the OLD key. Stores the new public key alongside the
+ * old key and marks the rotation as started. Both old and new keys are
+ * accepted for authentication going forward.
+ */
+export async function handleRotateStart(
+  tenantId: string,
+  oldFingerprint: string,
+  rawBody: string | null | undefined,
+  ddb: DynamoDBDocumentClient,
+  tableName: string,
+): Promise<HandlerResponse> {
+  if (!rawBody) {
+    return {
+      statusCode: 400,
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ error: 'invalid_request', message: 'Request body is required' }),
+    };
+  }
+
+  let request: RotateStartRequest;
+  try {
+    request = JSON.parse(rawBody);
+  } catch {
+    return {
+      statusCode: 400,
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ error: 'invalid_request', message: 'Invalid JSON body' }),
+    };
+  }
+
+  if (!request.newPublicKey || !isValidBase64(request.newPublicKey)) {
+    return {
+      statusCode: 400,
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ error: 'invalid_request', message: 'newPublicKey is required and must be valid base64' }),
+    };
+  }
+
+  if (!request.wrappedBlob || !isValidBase64(request.wrappedBlob)) {
+    return {
+      statusCode: 400,
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ error: 'invalid_request', message: 'wrappedBlob is required and must be valid base64' }),
+    };
+  }
+
+  // Check for existing rotation in progress
+  const existingRotation = await ddb.send(
+    new GetCommand({
+      TableName: tableName,
+      Key: {
+        PK: `TENANT#${tenantId}`,
+        SK: 'ROTATION',
+      },
+    }),
+  );
+
+  if (existingRotation.Item) {
+    return {
+      statusCode: 409,
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ error: 'rotation_in_progress', message: 'A key rotation is already in progress' }),
+    };
+  }
+
+  const newFingerprint = fingerprintFromPublicKey(request.newPublicKey);
+  const now = new Date().toISOString();
+
+  // Store rotation record
+  await ddb.send(
+    new PutCommand({
+      TableName: tableName,
+      Item: {
+        PK: `TENANT#${tenantId}`,
+        SK: 'ROTATION',
+        phase: 'started',
+        newPublicKey: request.newPublicKey,
+        newFingerprint,
+        oldFingerprint,
+        startedAt: now,
+        confirmations: [],
+      },
+    }),
+  );
+
+  // Store the new public key in tenant META so auth middleware accepts both keys
+  await ddb.send(
+    new UpdateCommand({
+      TableName: tableName,
+      Key: {
+        PK: `TENANT#${tenantId}`,
+        SK: 'META',
+      },
+      UpdateExpression: 'SET newPublicKey = :npk, rotationState = :state, updatedAt = :now',
+      ExpressionAttributeValues: {
+        ':npk': request.newPublicKey,
+        ':state': 'ROTATION_STARTED',
+        ':now': now,
+      },
+    }),
+  );
+
+  // Store the wrapped blob for the new key
+  await ddb.send(
+    new PutCommand({
+      TableName: tableName,
+      Item: {
+        PK: `TENANT#${tenantId}`,
+        SK: `WRAPPED_KEY#${newFingerprint}`,
+        data: request.wrappedBlob,
+        updatedAt: now,
+      },
+    }),
+  );
+
+  logger.info('Key rotation started', { tenantId, oldFingerprint, newFingerprint });
+
+  return {
+    statusCode: 200,
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({
+      status: 'rotation_started',
+      newFingerprint,
+      oldFingerprint,
+    }),
+  };
+}
+
+/**
+ * POST /v1/rotate-confirm — Phase 2 of two-phase key rotation.
+ *
+ * Authenticated with the NEW key. Adds the device to the confirmations list.
+ * When all registered devices have confirmed (or the 48h timeout has elapsed),
+ * completes the rotation by removing the old key and rotation record.
+ */
+export async function handleRotateConfirm(
+  tenantId: string,
+  fingerprint: string,
+  ddb: DynamoDBDocumentClient,
+  tableName: string,
+): Promise<HandlerResponse> {
+  // Get the rotation record
+  const rotationResult = await ddb.send(
+    new GetCommand({
+      TableName: tableName,
+      Key: {
+        PK: `TENANT#${tenantId}`,
+        SK: 'ROTATION',
+      },
+    }),
+  );
+
+  if (!rotationResult.Item) {
+    return {
+      statusCode: 404,
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ error: 'not_found', message: 'No key rotation in progress' }),
+    };
+  }
+
+  const rotation = rotationResult.Item;
+  const confirmations: string[] = rotation['confirmations'] as string[] ?? [];
+
+  // Add this device fingerprint to confirmations if not already present
+  if (!confirmations.includes(fingerprint)) {
+    confirmations.push(fingerprint);
+
+    await ddb.send(
+      new UpdateCommand({
+        TableName: tableName,
+        Key: {
+          PK: `TENANT#${tenantId}`,
+          SK: 'ROTATION',
+        },
+        UpdateExpression: 'SET confirmations = :c',
+        ExpressionAttributeValues: {
+          ':c': confirmations,
+        },
+      }),
+    );
+  }
+
+  // Check if rotation should be completed:
+  // Either all devices confirmed or 48h timeout elapsed
+  const startedAt = new Date(rotation['startedAt'] as string).getTime();
+  const timeoutReached = Date.now() - startedAt > ROTATION_TIMEOUT_MS;
+
+  // Count registered devices (WRAPPED_KEY# entries = registered devices)
+  const deviceResult = await ddb.send(
+    new QueryCommand({
+      TableName: tableName,
+      KeyConditionExpression: 'PK = :pk AND begins_with(SK, :prefix)',
+      ExpressionAttributeValues: {
+        ':pk': `TENANT#${tenantId}`,
+        ':prefix': 'WRAPPED_KEY#',
+      },
+      Select: 'COUNT',
+    }),
+  );
+
+  const deviceCount = deviceResult.Count ?? 0;
+  const allConfirmed = confirmations.length >= deviceCount;
+
+  if (allConfirmed || timeoutReached) {
+    // Complete the rotation: Phase 2
+    await completeRotation(tenantId, rotation, ddb, tableName);
+
+    logger.info('Key rotation completed', {
+      tenantId,
+      newFingerprint: rotation['newFingerprint'],
+      reason: timeoutReached ? 'timeout' : 'all_confirmed',
+    });
+
+    return {
+      statusCode: 200,
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        status: 'rotation_complete',
+        confirmations: confirmations.length,
+        totalDevices: deviceCount,
+      }),
+    };
+  }
+
+  return {
+    statusCode: 200,
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({
+      status: 'confirmation_recorded',
+      confirmations: confirmations.length,
+      totalDevices: deviceCount,
+    }),
+  };
+}
+
+/**
+ * Complete the rotation by:
+ * 1. Updating tenant META with the new public key as primary
+ * 2. Deleting old wrapped key blob
+ * 3. Deleting the rotation record
+ */
+async function completeRotation(
+  tenantId: string,
+  rotation: Record<string, unknown>,
+  ddb: DynamoDBDocumentClient,
+  tableName: string,
+): Promise<void> {
+  const newPublicKey = rotation['newPublicKey'] as string;
+  const oldFingerprint = rotation['oldFingerprint'] as string;
+  const now = new Date().toISOString();
+
+  // Update tenant META: replace primary public key, clear rotation state
+  await ddb.send(
+    new UpdateCommand({
+      TableName: tableName,
+      Key: {
+        PK: `TENANT#${tenantId}`,
+        SK: 'META',
+      },
+      UpdateExpression: 'SET publicKey = :pk, updatedAt = :now REMOVE newPublicKey, rotationState',
+      ExpressionAttributeValues: {
+        ':pk': newPublicKey,
+        ':now': now,
+      },
+    }),
+  );
+
+  // Delete old wrapped key blob
+  await ddb.send(
+    new DeleteCommand({
+      TableName: tableName,
+      Key: {
+        PK: `TENANT#${tenantId}`,
+        SK: `WRAPPED_KEY#${oldFingerprint}`,
+      },
+    }),
+  );
+
+  // Delete rotation record
+  await ddb.send(
+    new DeleteCommand({
+      TableName: tableName,
+      Key: {
+        PK: `TENANT#${tenantId}`,
+        SK: 'ROTATION',
+      },
+    }),
+  );
+}

package/dist/lib/handler/routes/tenants.d.ts

@@ -0,0 +1,11 @@
+import { DynamoDBDocumentClient } from '@aws-sdk/lib-dynamodb';
+interface HandlerResponse {
+    statusCode: number;
+    body: string;
+    headers: Record<string, string>;
+}
+export declare function handleCreateTenant(body: string | null | undefined, tenantId: string, ddb: DynamoDBDocumentClient, tableName: string): Promise<HandlerResponse>;
+export declare function handleListTenants(tenantId: string, ddb: DynamoDBDocumentClient, tableName: string): Promise<HandlerResponse>;
+export declare function handleDeleteTenant(projectTenantId: string, tenantId: string, ddb: DynamoDBDocumentClient, tableName: string): Promise<HandlerResponse>;
+export {};
+//# sourceMappingURL=tenants.d.ts.map

package/dist/lib/handler/routes/tenants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenants.d.ts","sourceRoot":"","sources":["../../../../lib/handler/routes/tenants.ts"],"names":[],"mappings":"AACA,OAAO,EACL,sBAAsB,EAIvB,MAAM,uBAAuB,CAAC;AAG/B,UAAU,eAAe;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC/B,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,sBAAsB,EAC3B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,eAAe,CAAC,CAgE1B;AAED,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,sBAAsB,EAC3B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,eAAe,CAAC,CAuB1B;AAED,wBAAsB,kBAAkB,CACtC,eAAe,EAAE,MAAM,EACvB,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,sBAAsB,EAC3B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,eAAe,CAAC,CA6E1B"}