@de-otio/chaoskb-server 0.2.0

package/dist/lib/handler/index.ts

@@ -0,0 +1,372 @@
+import { DynamoDBClient } from '@aws-sdk/client-dynamodb';
+import { DynamoDBDocumentClient } from '@aws-sdk/lib-dynamodb';
+import { logger } from './logger.js';
+import { authenticateRequest, AuthError } from './middleware/ssh-auth.js';
+import { checkIpRateLimit, rateLimitHeaders } from './middleware/rate-limit.js';
+import { handleHealth } from './routes/health.js';
+import { handleRegister, handleChallenge } from './routes/register.js';
+import {
+  handlePutBlob,
+  handleGetBlob,
+  handleDeleteBlob,
+  handleListBlobs,
+  handleCountBlobs,
+} from './routes/blobs.js';
+import { handleRestore } from './routes/restore.js';
+import { handleCreateTenant, handleListTenants, handleDeleteTenant } from './routes/tenants.js';
+import { handleExport } from './routes/export.js';
+import { handlePutWrappedKey, handleGetWrappedKey } from './routes/wrapped-key.js';
+import { handleRotateStart, handleRotateConfirm } from './routes/rotation.js';
+import { handleGetAuditLog } from './routes/audit.js';
+import { handleRevokeAll } from './routes/revocation.js';
+import {
+  handleCreateLinkCodeFull,
+  handleLinkConfirm,
+  handleGetLinkCodeStatus,
+  handleListDevices,
+  handleDeleteDevice,
+} from './routes/devices.js';
+import {
+  handleCreateInvite,
+  handleListInvites,
+  handleAcceptInvite,
+  handleDeclineInvite,
+} from './routes/invites.js';
+import { handleListAvailableProjects } from './routes/projects.js';
+import { handleGetNotifications, handleDismissNotification } from './routes/notifications.js';
+
+interface LambdaFunctionURLEvent {
+  requestContext: {
+    http: { method: string; path: string; sourceIp?: string };
+    requestId: string;
+  };
+  headers: Record<string, string>;
+  queryStringParameters?: Record<string, string>;
+  body?: string;
+  isBase64Encoded: boolean;
+}
+
+interface LambdaFunctionURLResult {
+  statusCode: number;
+  headers: Record<string, string>;
+  body: string;
+  isBase64Encoded?: boolean;
+}
+
+const TABLE_NAME = process.env['TABLE_NAME'] ?? '';
+const SIGNUPS_ENABLED_PARAM = process.env['SIGNUPS_ENABLED_PARAM'] ?? '';
+
+const client = new DynamoDBClient({});
+const ddb = DynamoDBDocumentClient.from(client, {
+  marshallOptions: { removeUndefinedValues: true },
+});
+
+const CORS_HEADERS: Record<string, string> = {
+  'Access-Control-Allow-Origin': 'none',
+  'Access-Control-Allow-Methods': 'GET, PUT, POST, DELETE, OPTIONS',
+  'Access-Control-Allow-Headers': 'Content-Type, Authorization',
+};
+
+function response(
+  statusCode: number,
+  body: string,
+  headers: Record<string, string> = {},
+  isBase64Encoded = false,
+): LambdaFunctionURLResult {
+  return {
+    statusCode,
+    headers: { ...CORS_HEADERS, ...headers },
+    body,
+    isBase64Encoded,
+  };
+}
+
+export const handler = async (event: LambdaFunctionURLEvent): Promise<LambdaFunctionURLResult> => {
+  const startTime = Date.now();
+  const method = event.requestContext.http.method;
+  const path = event.requestContext.http.path;
+  const requestId = event.requestContext.requestId;
+
+  logger.info('Request received', { requestId, operation: `${method} ${path}` });
+
+  try {
+    // OPTIONS (CORS preflight)
+    if (method === 'OPTIONS') {
+      return response(204, '', {});
+    }
+
+    // Health check — no auth
+    if (method === 'GET' && path === '/health') {
+      const result = handleHealth();
+      return response(result.statusCode, result.body, result.headers);
+    }
+
+    // Registration challenge — no auth, IP rate limited
+    if (method === 'GET' && path === '/v1/register/challenge') {
+      const sourceIp = event.headers['x-forwarded-for']?.split(',')[0]?.trim()
+        ?? event.requestContext.http.sourceIp
+        ?? 'unknown';
+      const rateCheck = await checkIpRateLimit(sourceIp, 'CHALLENGE', ddb, TABLE_NAME);
+      if (!rateCheck.allowed) {
+        return response(429, JSON.stringify({ error: 'rate_limited', message: 'Too many requests' }), {
+          'Content-Type': 'application/json',
+          ...rateLimitHeaders(rateCheck),
+        });
+      }
+      const result = await handleChallenge(ddb, TABLE_NAME);
+      return response(result.statusCode, result.body, result.headers);
+    }
+
+    // Link confirm — no auth, IP rate limited (new device submits its public key)
+    if (method === 'POST' && path === '/v1/link-confirm') {
+      const sourceIp = event.headers['x-forwarded-for']?.split(',')[0]?.trim()
+        ?? event.requestContext.http.sourceIp
+        ?? 'unknown';
+      const rateCheck = await checkIpRateLimit(sourceIp, 'LINK_CONFIRM', ddb, TABLE_NAME);
+      if (!rateCheck.allowed) {
+        return response(429, JSON.stringify({ error: 'rate_limited', message: 'Too many requests' }), {
+          'Content-Type': 'application/json',
+          ...rateLimitHeaders(rateCheck),
+        });
+      }
+      const result = await handleLinkConfirm(event.body, ddb, TABLE_NAME);
+      return response(result.statusCode, result.body, result.headers);
+    }
+
+    // Register — no auth, IP rate limited (1 req/sec)
+    if (method === 'POST' && path === '/v1/auth/register') {
+      const sourceIp = event.headers['x-forwarded-for']?.split(',')[0]?.trim()
+        ?? event.requestContext.http.sourceIp
+        ?? 'unknown';
+      const rateCheck = await checkIpRateLimit(sourceIp, 'REGISTER', ddb, TABLE_NAME);
+      if (!rateCheck.allowed) {
+        return response(429, JSON.stringify({ error: 'rate_limited', message: 'Too many requests' }), {
+          'Content-Type': 'application/json',
+          ...rateLimitHeaders(rateCheck),
+        });
+      }
+      const result = await handleRegister(event.body, ddb, TABLE_NAME, SIGNUPS_ENABLED_PARAM);
+      return response(result.statusCode, result.body, result.headers);
+    }
+
+    // All other routes require authentication
+    const auth = await authenticateRequest(event, ddb, TABLE_NAME);
+    const tenantId = auth.tenantId;
+
+    // Revoke all devices (emergency)
+    if (path === '/v1/revoke-all' && method === 'POST') {
+      const result = await handleRevokeAll(tenantId, ddb, TABLE_NAME);
+      return response(result.statusCode, result.body, result.headers);
+    }
+
+    // Audit log
+    if (path === '/v1/audit' && method === 'GET') {
+      const result = await handleGetAuditLog(tenantId, ddb, TABLE_NAME);
+      return response(result.statusCode, result.body, result.headers);
+    }
+
+    // Key rotation routes
+    if (path === '/v1/rotate-start' && method === 'POST') {
+      const result = await handleRotateStart(tenantId, auth.fingerprint, event.body, ddb, TABLE_NAME);
+      return response(result.statusCode, result.body, result.headers);
+    }
+
+    if (path === '/v1/rotate-confirm' && method === 'POST') {
+      const result = await handleRotateConfirm(tenantId, auth.fingerprint, ddb, TABLE_NAME);
+      return response(result.statusCode, result.body, result.headers);
+    }
+
+    // Device linking routes (authenticated)
+    if (path === '/v1/link-code' && method === 'POST') {
+      const result = await handleCreateLinkCodeFull(tenantId, event.body, ddb, TABLE_NAME);
+      return response(result.statusCode, result.body, result.headers);
+    }
+
+    const linkStatusMatch = path.match(/^\/v1\/link-code\/([^/]+)\/status$/);
+    if (linkStatusMatch && method === 'GET') {
+      const codeHash = linkStatusMatch[1];
+      const result = await handleGetLinkCodeStatus(tenantId, codeHash, ddb, TABLE_NAME);
+      return response(result.statusCode, result.body, result.headers);
+    }
+
+    // Device management routes (authenticated)
+    if (path === '/v1/devices' && method === 'GET') {
+      const result = await handleListDevices(tenantId, ddb, TABLE_NAME);
+      return response(result.statusCode, result.body, result.headers);
+    }
+
+    const deviceDeleteMatch = path.match(/^\/v1\/devices\/([^/]+)$/);
+    if (deviceDeleteMatch && method === 'DELETE') {
+      const fingerprint = deviceDeleteMatch[1];
+      const result = await handleDeleteDevice(tenantId, fingerprint, ddb, TABLE_NAME);
+      return response(result.statusCode, result.body, result.headers);
+    }
+
+    // Wrapped key routes
+    if (path === '/v1/wrapped-key' && method === 'PUT') {
+      const result = await handlePutWrappedKey(
+        tenantId,
+        auth.fingerprint,
+        event.body,
+        event.isBase64Encoded,
+        ddb,
+        TABLE_NAME,
+      );
+      return response(result.statusCode, result.body, result.headers);
+    }
+
+    if (path === '/v1/wrapped-key' && method === 'GET') {
+      const result = await handleGetWrappedKey(tenantId, auth.fingerprint, ddb, TABLE_NAME);
+      if (result.statusCode === 200 && result.headers['Content-Type'] === 'application/octet-stream') {
+        return response(result.statusCode, result.body, result.headers, true);
+      }
+      return response(result.statusCode, result.body, result.headers);
+    }
+
+    // Blob routes
+    const blobMatch = path.match(/^\/v1\/blobs\/([^/]+)$/);
+    const restoreMatch = path.match(/^\/v1\/blobs\/([^/]+)\/restore$/);
+
+    if (restoreMatch && method === 'POST') {
+      const blobId = restoreMatch[1];
+      const result = await handleRestore(blobId, tenantId, ddb, TABLE_NAME);
+      return response(result.statusCode, result.body, result.headers);
+    }
+
+    if (path === '/v1/blobs/count' && method === 'GET') {
+      const result = await handleCountBlobs(tenantId, ddb, TABLE_NAME);
+      return response(result.statusCode, result.body, result.headers);
+    }
+
+    if (blobMatch) {
+      const blobId = blobMatch[1];
+
+      if (method === 'PUT') {
+        const contentType = event.headers['content-type'] || event.headers['Content-Type'] || '';
+        const result = await handlePutBlob(
+          blobId,
+          tenantId,
+          event.body,
+          event.isBase64Encoded,
+          contentType,
+          ddb,
+          TABLE_NAME,
+        );
+        if (result.statusCode === 200 && result.headers['Content-Type'] === 'application/octet-stream') {
+          return response(result.statusCode, result.body, result.headers, true);
+        }
+        return response(result.statusCode, result.body, result.headers);
+      }
+
+      if (method === 'GET') {
+        const result = await handleGetBlob(blobId, tenantId, ddb, TABLE_NAME);
+        if (result.statusCode === 200 && result.headers['Content-Type'] === 'application/octet-stream') {
+          return response(result.statusCode, result.body, result.headers, true);
+        }
+        return response(result.statusCode, result.body, result.headers);
+      }
+
+      if (method === 'DELETE') {
+        const result = await handleDeleteBlob(blobId, tenantId, ddb, TABLE_NAME);
+        return response(result.statusCode, result.body, result.headers);
+      }
+    }
+
+    if (path === '/v1/blobs' && method === 'GET') {
+      const since = event.queryStringParameters?.['since'];
+      const result = await handleListBlobs(tenantId, since, ddb, TABLE_NAME);
+      return response(result.statusCode, result.body, result.headers);
+    }
+
+    // Tenant routes
+    const tenantDeleteMatch = path.match(/^\/v1\/tenants\/([^/]+)$/);
+
+    if (path === '/v1/tenants' && method === 'POST') {
+      const result = await handleCreateTenant(event.body, tenantId, ddb, TABLE_NAME);
+      return response(result.statusCode, result.body, result.headers);
+    }
+
+    if (path === '/v1/tenants' && method === 'GET') {
+      const result = await handleListTenants(tenantId, ddb, TABLE_NAME);
+      return response(result.statusCode, result.body, result.headers);
+    }
+
+    if (tenantDeleteMatch && method === 'DELETE') {
+      const projectTenantId = tenantDeleteMatch[1];
+      const result = await handleDeleteTenant(projectTenantId, tenantId, ddb, TABLE_NAME);
+      return response(result.statusCode, result.body, result.headers);
+    }
+
+    // Invite routes
+    const inviteActionMatch = path.match(/^\/v1\/invites\/([^/]+)\/(accept|decline)$/);
+
+    if (path === '/v1/invites' && method === 'POST') {
+      const result = await handleCreateInvite(tenantId, auth.fingerprint, event.body, ddb, TABLE_NAME);
+      return response(result.statusCode, result.body, result.headers);
+    }
+
+    if (path === '/v1/invites' && method === 'GET') {
+      const result = await handleListInvites(tenantId, auth.fingerprint, ddb, TABLE_NAME);
+      return response(result.statusCode, result.body, result.headers);
+    }
+
+    if (inviteActionMatch && method === 'POST') {
+      const inviteId = inviteActionMatch[1];
+      const action = inviteActionMatch[2];
+
+      if (action === 'accept') {
+        const result = await handleAcceptInvite(tenantId, auth.fingerprint, inviteId, ddb, TABLE_NAME);
+        return response(result.statusCode, result.body, result.headers);
+      }
+
+      if (action === 'decline') {
+        const result = await handleDeclineInvite(tenantId, auth.fingerprint, inviteId, event.body, ddb, TABLE_NAME);
+        return response(result.statusCode, result.body, result.headers);
+      }
+    }
+
+    // Notifications
+    if (path === '/v1/notifications' && method === 'GET') {
+      const result = await handleGetNotifications(tenantId, ddb, TABLE_NAME);
+      return response(result.statusCode, result.body, result.headers);
+    }
+
+    const notificationDismissMatch = path.match(/^\/v1\/notifications\/(.+)\/dismiss$/);
+    if (notificationDismissMatch && method === 'POST') {
+      const notificationId = decodeURIComponent(notificationDismissMatch[1]);
+      const result = await handleDismissNotification(tenantId, notificationId, ddb, TABLE_NAME);
+      return response(result.statusCode, result.body, result.headers);
+    }
+
+    // Shared projects
+    if (path === '/v1/projects/available' && method === 'GET') {
+      const result = await handleListAvailableProjects(tenantId, ddb, TABLE_NAME);
+      return response(result.statusCode, result.body, result.headers);
+    }
+
+    // Export
+    if (path === '/v1/export' && method === 'GET') {
+      const result = await handleExport(tenantId, ddb, TABLE_NAME);
+      return response(result.statusCode, result.body, result.headers);
+    }
+
+    // Not found
+    return response(404, JSON.stringify({ error: 'not_found', message: `No route for ${method} ${path}` }), {
+      'Content-Type': 'application/json',
+    });
+  } catch (err: unknown) {
+    const durationMs = Date.now() - startTime;
+
+    if (err instanceof AuthError) {
+      logger.warn('Auth failed', { requestId, durationMs, error: err.message });
+      return response(err.statusCode, JSON.stringify({ error: 'auth_error', message: err.message }), {
+        'Content-Type': 'application/json',
+      });
+    }
+
+    logger.error('Unhandled error', { requestId, durationMs, error: String(err) });
+    return response(500, JSON.stringify({ error: 'internal_error', message: 'Internal server error' }), {
+      'Content-Type': 'application/json',
+    });
+  }
+};

package/dist/lib/handler/logger.d.ts

@@ -0,0 +1,16 @@
+export interface LogFields {
+    tenantId?: string;
+    operation?: string;
+    blobCount?: number;
+    durationMs?: number;
+    requestId?: string;
+    [key: string]: unknown;
+}
+export declare class Logger {
+    private log;
+    info(message: string, fields?: LogFields): void;
+    warn(message: string, fields?: LogFields): void;
+    error(message: string, fields?: LogFields): void;
+}
+export declare const logger: Logger;
+//# sourceMappingURL=logger.d.ts.map

package/dist/lib/handler/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../../lib/handler/logger.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAID,qBAAa,MAAM;IACjB,OAAO,CAAC,GAAG;IAUX,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,GAAG,IAAI;IAI/C,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,GAAG,IAAI;IAI/C,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,GAAG,IAAI;CAGjD;AAED,eAAO,MAAM,MAAM,QAAe,CAAC"}

package/dist/lib/handler/logger.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.logger = exports.Logger = void 0;
+class Logger {
+    log(level, message, fields) {
+        const entry = {
+            timestamp: new Date().toISOString(),
+            level,
+            message,
+            ...fields,
+        };
+        console.log(JSON.stringify(entry));
+    }
+    info(message, fields) {
+        this.log('INFO', message, fields);
+    }
+    warn(message, fields) {
+        this.log('WARN', message, fields);
+    }
+    error(message, fields) {
+        this.log('ERROR', message, fields);
+    }
+}
+exports.Logger = Logger;
+exports.logger = new Logger();
+//# sourceMappingURL=logger.js.map

package/dist/lib/handler/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../../lib/handler/logger.ts"],"names":[],"mappings":";;;AAWA,MAAa,MAAM;IACT,GAAG,CAAC,KAAe,EAAE,OAAe,EAAE,MAAkB;QAC9D,MAAM,KAAK,GAAG;YACZ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,KAAK;YACL,OAAO;YACP,GAAG,MAAM;SACV,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,CAAC,OAAe,EAAE,MAAkB;QACtC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,CAAC,OAAe,EAAE,MAAkB;QACtC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,OAAe,EAAE,MAAkB;QACvC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;CACF;AAtBD,wBAsBC;AAEY,QAAA,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC"}

package/dist/lib/handler/logger.ts

@@ -0,0 +1,36 @@
+export interface LogFields {
+  tenantId?: string;
+  operation?: string;
+  blobCount?: number;
+  durationMs?: number;
+  requestId?: string;
+  [key: string]: unknown;
+}
+
+type LogLevel = 'INFO' | 'WARN' | 'ERROR';
+
+export class Logger {
+  private log(level: LogLevel, message: string, fields?: LogFields): void {
+    const entry = {
+      timestamp: new Date().toISOString(),
+      level,
+      message,
+      ...fields,
+    };
+    console.log(JSON.stringify(entry));
+  }
+
+  info(message: string, fields?: LogFields): void {
+    this.log('INFO', message, fields);
+  }
+
+  warn(message: string, fields?: LogFields): void {
+    this.log('WARN', message, fields);
+  }
+
+  error(message: string, fields?: LogFields): void {
+    this.log('ERROR', message, fields);
+  }
+}
+
+export const logger = new Logger();

package/dist/lib/handler/middleware/input-validation.d.ts

@@ -0,0 +1,6 @@
+export interface ValidationResult {
+    valid: boolean;
+    error?: string;
+}
+export declare function validateBlobUpload(body: Buffer, contentType: string): ValidationResult;
+//# sourceMappingURL=input-validation.d.ts.map

package/dist/lib/handler/middleware/input-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"input-validation.d.ts","sourceRoot":"","sources":["../../../../lib/handler/middleware/input-validation.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAKD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,gBAAgB,CAmCtF"}

package/dist/lib/handler/middleware/input-validation.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateBlobUpload = validateBlobUpload;
+const MAX_BLOB_SIZE = 1_048_576; // 1 MB
+const MIN_BLOB_SIZE = 1;
+function validateBlobUpload(body, contentType) {
+    if (contentType !== 'application/octet-stream') {
+        return { valid: false, error: 'Content-Type must be application/octet-stream' };
+    }
+    if (body.length < MIN_BLOB_SIZE) {
+        return { valid: false, error: 'Blob must be at least 1 byte' };
+    }
+    if (body.length > MAX_BLOB_SIZE) {
+        return { valid: false, error: `Blob exceeds maximum size of ${MAX_BLOB_SIZE} bytes` };
+    }
+    // Parse as JSON and check envelope structure
+    let parsed;
+    try {
+        parsed = JSON.parse(body.toString('utf-8'));
+    }
+    catch {
+        return { valid: false, error: 'Blob must be valid JSON' };
+    }
+    if (typeof parsed !== 'object' || parsed === null) {
+        return { valid: false, error: 'Blob must be a JSON object' };
+    }
+    const envelope = parsed;
+    if (!('v' in envelope)) {
+        return { valid: false, error: 'Missing required field: v' };
+    }
+    if (envelope['v'] !== 1) {
+        return { valid: false, error: `Unsupported envelope version: ${envelope['v']}` };
+    }
+    return { valid: true };
+}
+//# sourceMappingURL=input-validation.js.map

package/dist/lib/handler/middleware/input-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"input-validation.js","sourceRoot":"","sources":["../../../../lib/handler/middleware/input-validation.ts"],"names":[],"mappings":";;AAQA,gDAmCC;AAtCD,MAAM,aAAa,GAAG,SAAS,CAAC,CAAC,OAAO;AACxC,MAAM,aAAa,GAAG,CAAC,CAAC;AAExB,SAAgB,kBAAkB,CAAC,IAAY,EAAE,WAAmB;IAClE,IAAI,WAAW,KAAK,0BAA0B,EAAE,CAAC;QAC/C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,+CAA+C,EAAE,CAAC;IAClF,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;QAChC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;IACjE,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;QAChC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,gCAAgC,aAAa,QAAQ,EAAE,CAAC;IACxF,CAAC;IAED,6CAA6C;IAC7C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC5D,CAAC;IAED,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;IAC/D,CAAC;IAED,MAAM,QAAQ,GAAG,MAAiC,CAAC;IACnD,IAAI,CAAC,CAAC,GAAG,IAAI,QAAQ,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;IAC9D,CAAC;IAED,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,iCAAiC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IACnF,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC"}

package/dist/lib/handler/middleware/input-validation.ts

@@ -0,0 +1,44 @@
+export interface ValidationResult {
+  valid: boolean;
+  error?: string;
+}
+
+const MAX_BLOB_SIZE = 1_048_576; // 1 MB
+const MIN_BLOB_SIZE = 1;
+
+export function validateBlobUpload(body: Buffer, contentType: string): ValidationResult {
+  if (contentType !== 'application/octet-stream') {
+    return { valid: false, error: 'Content-Type must be application/octet-stream' };
+  }
+
+  if (body.length < MIN_BLOB_SIZE) {
+    return { valid: false, error: 'Blob must be at least 1 byte' };
+  }
+
+  if (body.length > MAX_BLOB_SIZE) {
+    return { valid: false, error: `Blob exceeds maximum size of ${MAX_BLOB_SIZE} bytes` };
+  }
+
+  // Parse as JSON and check envelope structure
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(body.toString('utf-8'));
+  } catch {
+    return { valid: false, error: 'Blob must be valid JSON' };
+  }
+
+  if (typeof parsed !== 'object' || parsed === null) {
+    return { valid: false, error: 'Blob must be a JSON object' };
+  }
+
+  const envelope = parsed as Record<string, unknown>;
+  if (!('v' in envelope)) {
+    return { valid: false, error: 'Missing required field: v' };
+  }
+
+  if (envelope['v'] !== 1) {
+    return { valid: false, error: `Unsupported envelope version: ${envelope['v']}` };
+  }
+
+  return { valid: true };
+}

package/dist/lib/handler/middleware/rate-limit.d.ts

@@ -0,0 +1,14 @@
+import { DynamoDBDocumentClient } from '@aws-sdk/lib-dynamodb';
+export interface RateLimitResult {
+    allowed: boolean;
+    remaining: number;
+    retryAfter?: number;
+}
+export declare function checkRateLimit(tenantId: string, operation: string, ddb: DynamoDBDocumentClient, tableName: string): Promise<RateLimitResult>;
+/**
+ * Rate limit by source IP for unauthenticated endpoints (registration, contact).
+ * Default: 1 request per second per IP. LINK_CONFIRM: 1 request per 5 seconds.
+ */
+export declare function checkIpRateLimit(sourceIp: string, operation: string, ddb: DynamoDBDocumentClient, tableName: string, limit?: number): Promise<RateLimitResult>;
+export declare function rateLimitHeaders(result: RateLimitResult): Record<string, string>;
+//# sourceMappingURL=rate-limit.d.ts.map

package/dist/lib/handler/middleware/rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../../lib/handler/middleware/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAiB,MAAM,uBAAuB,CAAC;AAE9E,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAWD,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,sBAAsB,EAC3B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,eAAe,CAAC,CAqC1B;AAOD;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,sBAAsB,EAC3B,SAAS,EAAE,MAAM,EACjB,KAAK,SAAI,GACR,OAAO,CAAC,eAAe,CAAC,CAkC1B;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQhF"}

package/dist/lib/handler/middleware/rate-limit.js

@@ -0,0 +1,94 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkRateLimit = checkRateLimit;
+exports.checkIpRateLimit = checkIpRateLimit;
+exports.rateLimitHeaders = rateLimitHeaders;
+const lib_dynamodb_1 = require("@aws-sdk/lib-dynamodb");
+const LIMITS = {
+    PUT: 100,
+    GET: 1000,
+    DELETE: 100,
+    LIST: 100,
+};
+const WINDOW_SECONDS = 60;
+async function checkRateLimit(tenantId, operation, ddb, tableName) {
+    const limit = LIMITS[operation] ?? 300;
+    const now = Math.floor(Date.now() / 1000);
+    const windowKey = Math.floor(now / WINDOW_SECONDS);
+    const ttl = windowKey * WINDOW_SECONDS + WINDOW_SECONDS + 120; // window + 2 min buffer
+    const result = await ddb.send(new lib_dynamodb_1.UpdateCommand({
+        TableName: tableName,
+        Key: {
+            PK: `RATE#${tenantId}`,
+            SK: `${operation}#${windowKey}`,
+        },
+        UpdateExpression: 'SET #count = if_not_exists(#count, :zero) + :one, #ttl = :ttl',
+        ExpressionAttributeNames: {
+            '#count': 'count',
+            '#ttl': 'ttl',
+        },
+        ExpressionAttributeValues: {
+            ':zero': 0,
+            ':one': 1,
+            ':ttl': ttl,
+        },
+        ReturnValues: 'UPDATED_NEW',
+    }));
+    const currentCount = result.Attributes?.['count'] ?? 1;
+    const remaining = Math.max(0, limit - currentCount);
+    if (currentCount > limit) {
+        const windowEnd = (windowKey + 1) * WINDOW_SECONDS;
+        const retryAfter = Math.max(1, windowEnd - now);
+        return { allowed: false, remaining: 0, retryAfter };
+    }
+    return { allowed: true, remaining };
+}
+// Per-IP window sizes: LINK_CONFIRM uses 5-second windows, others use 1-second
+const IP_WINDOW_SECONDS = {
+    LINK_CONFIRM: 5,
+};
+/**
+ * Rate limit by source IP for unauthenticated endpoints (registration, contact).
+ * Default: 1 request per second per IP. LINK_CONFIRM: 1 request per 5 seconds.
+ */
+async function checkIpRateLimit(sourceIp, operation, ddb, tableName, limit = 1) {
+    const now = Math.floor(Date.now() / 1000);
+    const windowSec = IP_WINDOW_SECONDS[operation] ?? 1;
+    const windowKey = Math.floor(now / windowSec);
+    const ttl = now + 120;
+    const result = await ddb.send(new lib_dynamodb_1.UpdateCommand({
+        TableName: tableName,
+        Key: {
+            PK: `RATE#IP#${sourceIp}`,
+            SK: `${operation}#${windowKey}`,
+        },
+        UpdateExpression: 'SET #count = if_not_exists(#count, :zero) + :one, #ttl = :ttl',
+        ExpressionAttributeNames: {
+            '#count': 'count',
+            '#ttl': 'ttl',
+        },
+        ExpressionAttributeValues: {
+            ':zero': 0,
+            ':one': 1,
+            ':ttl': ttl,
+        },
+        ReturnValues: 'UPDATED_NEW',
+    }));
+    const currentCount = result.Attributes?.['count'] ?? 1;
+    if (currentCount > limit) {
+        const windowEnd = (windowKey + 1) * windowSec;
+        const retryAfter = Math.max(1, windowEnd - now);
+        return { allowed: false, remaining: 0, retryAfter };
+    }
+    return { allowed: true, remaining: Math.max(0, limit - currentCount) };
+}
+function rateLimitHeaders(result) {
+    const headers = {
+        'X-RateLimit-Remaining': String(result.remaining),
+    };
+    if (!result.allowed && result.retryAfter !== undefined) {
+        headers['Retry-After'] = String(result.retryAfter);
+    }
+    return headers;
+}
+//# sourceMappingURL=rate-limit.js.map