@de-otio/trellis 0.4.0

package/dist/lib/audit-logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-logger.js","sourceRoot":"","sources":["../../src/lib/audit-logger.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqYH,8CAKC;AAxYD,qCAAqE;AAErE,yDAAgE;AA8ChE;;;;GAIG;AACH,MAAa,WAAW;IACd,MAAM,CAAS;IACf,SAAS,CAAU;IAE3B,YAAY,GAAe,EAAE,SAAkB;QAC7C,IAAI,CAAC,MAAM,GAAG,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,SAAiB;QAC7B,OAAO,IAAI,WAAW,CACpB,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,EAAe,EACrD,SAAS,CACV,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,aAAa,CACjB,KAGC,EACD,GAAmB;QAEnB,MAAM,UAAU,GAAe;YAC7B,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,aAAa;YACjC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,KAAK;YACjC,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,aAAa,CACjB,KAGC,EACD,GAAmB;QAEnB,MAAM,UAAU,GAAe;YAC7B,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,aAAa;YACjC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,QAAQ,EAAE,6CAA6C;YACnF,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,iBAAiB,CACrB,KAGC,EACD,GAAmB;QAEnB,MAAM,UAAU,GAAe;YAC7B,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,gBAAgB;YACpC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,MAAM;YAClC,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,+BAA+B;YAC7F,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,gBAAgB,CACpB,KAGC,EACD,GAAmB;QAEnB,MAAM,UAAU,GAAe;YAC7B,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,eAAe;YACnC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,gCAAgC;YAC9F,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,GAAG,CACP,KAAuE,EACvE,GAAmB;QAEnB,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,IAAI,aAAa,CAAC;QAE9C,QAAQ,SAAS,EAAE,CAAC;YAClB,KAAK,aAAa;gBAChB,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBACrC,MAAM;YACR,KAAK,aAAa;gBAChB,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBACrC,MAAM;YACR,KAAK,gBAAgB;gBACnB,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBACzC,MAAM;YACR,KAAK,eAAe;gBAClB,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBACxC,MAAM;YACR;gBACE,2CAA2C;gBAC3C,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,aAAa,CACzB,KAAiB,EACjB,GAAmB;QAEnB,IAAI,CAAC;YACH,2CAA2C;YAC3C,IAAI,CAAC,IAAA,gCAAa,EAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6CAA6C,EAAE;oBAC/D,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;iBACrB,CAAC,CAAC;gBACH,OAAO,CAAC,2BAA2B;YACrC,CAAC;YAED,6CAA6C;YAC7C,MAAM,cAAc,GAAG,IAAI,CAAC,uBAAuB,CACjD,KAAK,CAAC,QAAQ,IAAI,KAAK,CACxB,CAAC;YAEF,4CAA4C;YAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;gBAC7B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,GAAG,KAAK,CAAC,QAAQ;aAClB,CAAC,CAAC;YAEH,4FAA4F;YAC5F,yEAAyE;YACzE,iEAAiE;YACjE,uEAAuE;YACvE,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC;YACzC,IAAI,CAAC;gBACH,MAAM,EAAE,+BAA+B,EAAE,GAAG,wDAC1C,+BAA+B,GAChC,CAAC;gBACF,MAAM,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,GAAG,wDACxD,mBAAmB,GACpB,CAAC;gBAEF,MAAM,wBAAwB,CAC5B,+BAA+B,EAC/B,KAAK,CAAC,MAAM,EACZ,GAAG,EACH,KAAK,EAAE,EAAE,EAAE,EAAE;oBACX,OAAO,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC;wBACnC,IAAI,EAAE;4BACJ,IAAI,EAAE,SAAS,KAAK,CAAC,IAAI,EAAE,EAAE,2DAA2D;4BACxF,QAAQ,EAAE,QAAQ;4BAClB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;4BAC5B,SAAS,EAAE,IAAI,EAAE,wCAAwC;4BACzD,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;4BAClC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;4BAClC,OAAO,EAAE,OAAO;4BAChB,cAAc,EAAE,cAAc;yBAC/B;qBACF,CAAC,CAAC;gBACL,CAAC,EACD;oBACE,GAAG,mBAAmB,CAAC,UAAU,EAAE,wCAAwC;oBAC3E,UAAU,EAAE,CAAC;oBACb,WAAW,EAAE,GAAG;oBAChB,OAAO,EAAE;wBACP,SAAS,EAAE,WAAW;wBACtB,MAAM,EAAE,KAAK,CAAC,MAAM;wBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;qBACrB;iBACF,CACF,CAAC;YACJ,CAAC;YAAC,OAAO,OAAO,EAAE,CAAC;gBACjB,qDAAqD;gBACrD,0CAA0C;gBAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,+EAA+E,EAC/E,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CACzC,CAAC;YACJ,CAAC;YAED,uDAAuD;YACvD,MAAM,UAAU,GAAG,WAAW,KAAK,CAAC,MAAM,OAAO,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,cAAc,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,iBAAiB,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAE9M,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;gBAClB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE;oBAC3B,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;iBACrB,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE;oBAC3B,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK;iBAC7B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,gDAAgD;YAChD,mCAAmC;YACnC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,EAAE;gBAC3D,KAAK;gBACL,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACK,uBAAuB,CAAC,QAA4B;QAC1D,MAAM,aAAa,GAAuC;YACxD,QAAQ,EAAE,GAAG,EAAE,kCAAkC;YACjD,IAAI,EAAE,EAAE,EAAE,iCAAiC;YAC3C,MAAM,EAAE,EAAE,EAAE,0BAA0B;YACtC,GAAG,EAAE,CAAC,EAAE,sBAAsB;SAC/B,CAAC;QAEF,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AArUD,kCAqUC;AAED;;;;;;GAMG;AACH,SAAgB,iBAAiB,CAC/B,GAAe,EACf,SAAkB;IAElB,OAAO,IAAI,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;AACzC,CAAC"}

package/dist/lib/auth/cognito-jwt.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Cognito JWT Verification
+ *
+ * Validates Cognito-issued JWTs using the aws-jwt-verify library.
+ * Caches the JWKS locally to avoid network calls per request.
+ */
+/** Reset the verifier to force JWKS refresh on next call */
+export declare function resetVerifier(): void;
+export interface CognitoJwtClaims {
+    sub: string;
+    username: string;
+    email?: string;
+    "custom:userId"?: string;
+    "custom:role"?: string;
+    "custom:handle"?: string;
+    "custom:dataRegion"?: string;
+}
+export declare function verifyCognitoJwt(token: string): Promise<CognitoJwtClaims>;
+export declare function extractBearerToken(authHeader: string | null): string | null;
+//# sourceMappingURL=cognito-jwt.d.ts.map

package/dist/lib/auth/cognito-jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cognito-jwt.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/cognito-jwt.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AA2BH,4DAA4D;AAC5D,wBAAgB,aAAa,SAG5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAU/E;AAED,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAG3E"}

package/dist/lib/auth/cognito-jwt.js

@@ -0,0 +1,56 @@
+"use strict";
+/**
+ * Cognito JWT Verification
+ *
+ * Validates Cognito-issued JWTs using the aws-jwt-verify library.
+ * Caches the JWKS locally to avoid network calls per request.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resetVerifier = resetVerifier;
+exports.verifyCognitoJwt = verifyCognitoJwt;
+exports.extractBearerToken = extractBearerToken;
+const aws_jwt_verify_1 = require("aws-jwt-verify");
+let verifier = null;
+let lastCreated = 0;
+const VERIFIER_MAX_AGE_MS = 24 * 60 * 60 * 1000; // 24 hours
+function getVerifier() {
+    const now = Date.now();
+    // S1.5 — Recreate verifier if older than 24 hours to refresh JWKS
+    if (!verifier || (now - lastCreated > VERIFIER_MAX_AGE_MS)) {
+        const userPoolId = process.env.COGNITO_USER_POOL_ID;
+        const clientId = process.env.COGNITO_APP_CLIENT_ID;
+        if (!userPoolId || !clientId) {
+            throw new Error("COGNITO_USER_POOL_ID and COGNITO_APP_CLIENT_ID must be set");
+        }
+        verifier = aws_jwt_verify_1.CognitoJwtVerifier.create({
+            userPoolId,
+            tokenUse: "id",
+            clientId,
+        });
+        lastCreated = now;
+    }
+    return verifier;
+}
+/** Reset the verifier to force JWKS refresh on next call */
+function resetVerifier() {
+    verifier = null;
+    lastCreated = 0;
+}
+async function verifyCognitoJwt(token) {
+    try {
+        const payload = await getVerifier().verify(token);
+        return payload;
+    }
+    catch (err) {
+        // S1.5 — On verification failure, reset verifier to refresh JWKS and retry once
+        resetVerifier();
+        const payload = await getVerifier().verify(token);
+        return payload;
+    }
+}
+function extractBearerToken(authHeader) {
+    if (!authHeader?.startsWith("Bearer "))
+        return null;
+    return authHeader.slice(7);
+}
+//# sourceMappingURL=cognito-jwt.js.map

package/dist/lib/auth/cognito-jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cognito-jwt.js","sourceRoot":"","sources":["../../../src/lib/auth/cognito-jwt.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AA4BH,sCAGC;AAYD,4CAUC;AAED,gDAGC;AAxDD,mDAAoD;AAEpD,IAAI,QAAQ,GAAwD,IAAI,CAAC;AACzE,IAAI,WAAW,GAAG,CAAC,CAAC;AACpB,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW;AAE5D,SAAS,WAAW;IAClB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,kEAAkE;IAClE,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG,GAAG,WAAW,GAAG,mBAAmB,CAAC,EAAE,CAAC;QAC3D,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;QACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QACnD,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,CAAC;QACD,QAAQ,GAAG,mCAAkB,CAAC,MAAM,CAAC;YACnC,UAAU;YACV,QAAQ,EAAE,IAAI;YACd,QAAQ;SACT,CAAC,CAAC;QACH,WAAW,GAAG,GAAG,CAAC;IACpB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,4DAA4D;AAC5D,SAAgB,aAAa;IAC3B,QAAQ,GAAG,IAAI,CAAC;IAChB,WAAW,GAAG,CAAC,CAAC;AAClB,CAAC;AAYM,KAAK,UAAU,gBAAgB,CAAC,KAAa;IAClD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClD,OAAO,OAAsC,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,gFAAgF;QAChF,aAAa,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClD,OAAO,OAAsC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,SAAgB,kBAAkB,CAAC,UAAyB;IAC1D,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC"}

package/dist/lib/auth-context-manager.d.ts

@@ -0,0 +1,116 @@
+/**
+ * Authentication Context Manager
+ *
+ * PREPARATORY: Border Safety Mode - Multi-context authentication infrastructure
+ *
+ * Manages authentication contexts for users (primary vs decoy profiles).
+ * Currently dormant - returns single primary context for all users.
+ * This abstraction layer prepares for future dual-account support where users
+ * can have multiple authentication contexts with different data visibility.
+ *
+ * FUTURE USE: When Border Safety Mode is implemented, this class will:
+ * - Manage multiple contexts per user (primary, decoy)
+ * - Support different unlock methods per context (password, PIN, biometric, hardware key)
+ * - Track context creation and last access times
+ * - Validate context-specific credentials
+ *
+ * @see doc/01-business/features/b2c-features/border-safety-mode/preparatory-design-changes/01-authentication.md
+ */
+/**
+ * Authentication context for a user
+ *
+ * Represents a single authentication context (profile) that a user can access.
+ * In the future, users may have multiple contexts (e.g., primary and decoy profiles).
+ */
+export interface AuthContext {
+    /** Unique identifier for this context (e.g., 'primary', 'decoy-1') */
+    contextId: string;
+    /** Type of context: 'primary' (real profile) or 'decoy' (fake profile for border safety) */
+    contextType: "primary" | "decoy";
+    /** Unlock method used for this context */
+    unlockMethod: "password" | "pin" | "biometric" | "hardware_key";
+    /** When this context was created */
+    createdAt: Date;
+    /** When this context was last accessed */
+    lastAccessed: Date;
+}
+/**
+ * Authentication Context Manager
+ *
+ * Manages authentication contexts for users. Currently returns a single primary
+ * context for all users. This prepares for future multi-context support.
+ */
+export declare class AuthContextManager {
+    /**
+     * Get all available authentication contexts for a user
+     *
+     * PREPARATORY: Currently returns a single primary context for all users.
+     * This method prepares for future multi-context support where users can have
+     * multiple contexts (primary and decoy profiles).
+     *
+     * FUTURE USE: When Border Safety Mode is implemented, this will:
+     * - Query database for user's contexts
+     * - Return all available contexts (primary + any decoy contexts)
+     * - Filter contexts based on user permissions
+     *
+     * @param userId - User ID to get contexts for
+     * @returns Array of available authentication contexts (currently always single primary context)
+     * @throws Error if userId is invalid or empty
+     */
+    getContexts(userId: string): Promise<AuthContext[]>;
+    /**
+     * Get the default authentication context for a user
+     *
+     * PREPARATORY: Currently always returns 'primary' for all users.
+     * This method prepares for future support where users can have a custom default context.
+     *
+     * FUTURE USE: When Border Safety Mode is implemented, this will:
+     * - Check user's defaultContext preference in database
+     * - Return the user's preferred default context
+     * - Fall back to 'primary' if no preference is set
+     *
+     * @param userId - User ID to get default context for
+     * @returns Default context ID (currently always 'primary')
+     * @throws Error if userId is invalid or empty
+     */
+    getDefaultContext(userId: string): Promise<string>;
+    /**
+     * Create a new authentication context for a user
+     *
+     * PREPARATORY: Currently not implemented - throws error if called.
+     * This method prepares for future support where users can create decoy contexts.
+     *
+     * FUTURE USE: When Border Safety Mode is implemented, this will:
+     * - Create a new context in the database
+     * - Set up context-specific encryption keys
+     * - Initialize context with default settings
+     * - Return the new context ID
+     *
+     * @param userId - User ID to create context for
+     * @param contextType - Type of context to create ('primary' or 'decoy')
+     * @returns Promise that resolves to the new context ID
+     * @throws Error - Always throws error (not yet implemented)
+     */
+    createContext(userId: string, contextType: "primary" | "decoy"): Promise<string>;
+    /**
+     * Validate credentials for a specific authentication context
+     *
+     * PREPARATORY: Currently not implemented - throws error if called.
+     * This method prepares for future support where different contexts can have
+     * different unlock methods (password, PIN, biometric, hardware key).
+     *
+     * FUTURE USE: When Border Safety Mode is implemented, this will:
+     * - Validate credentials against context-specific unlock method
+     * - Check context-specific rate limits
+     * - Update lastAccessed timestamp
+     * - Return true if credentials are valid, false otherwise
+     *
+     * @param userId - User ID
+     * @param contextId - Context ID to validate credentials for
+     * @param credentials - Credentials to validate (format depends on unlock method)
+     * @returns Promise that resolves to true if credentials are valid
+     * @throws Error - Always throws error (not yet implemented)
+     */
+    validateContextCredentials(userId: string, contextId: string, credentials: unknown): Promise<boolean>;
+}
+//# sourceMappingURL=auth-context-manager.d.ts.map

package/dist/lib/auth-context-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-context-manager.d.ts","sourceRoot":"","sources":["../../src/lib/auth-context-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,sEAAsE;IACtE,SAAS,EAAE,MAAM,CAAC;IAElB,4FAA4F;IAC5F,WAAW,EAAE,SAAS,GAAG,OAAO,CAAC;IAEjC,0CAA0C;IAC1C,YAAY,EAAE,UAAU,GAAG,KAAK,GAAG,WAAW,GAAG,cAAc,CAAC;IAEhE,oCAAoC;IACpC,SAAS,EAAE,IAAI,CAAC;IAEhB,0CAA0C;IAC1C,YAAY,EAAE,IAAI,CAAC;CACpB;AAED;;;;;GAKG;AACH,qBAAa,kBAAkB;IAC7B;;;;;;;;;;;;;;;OAeG;IACG,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAkBzD;;;;;;;;;;;;;;OAcG;IACG,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAUxD;;;;;;;;;;;;;;;;OAgBG;IACG,aAAa,CACjB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,SAAS,GAAG,OAAO,GAC/B,OAAO,CAAC,MAAM,CAAC;IAOlB;;;;;;;;;;;;;;;;;;OAkBG;IACG,0BAA0B,CAC9B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC,OAAO,CAAC;CAMpB"}

package/dist/lib/auth-context-manager.js

@@ -0,0 +1,130 @@
+"use strict";
+/**
+ * Authentication Context Manager
+ *
+ * PREPARATORY: Border Safety Mode - Multi-context authentication infrastructure
+ *
+ * Manages authentication contexts for users (primary vs decoy profiles).
+ * Currently dormant - returns single primary context for all users.
+ * This abstraction layer prepares for future dual-account support where users
+ * can have multiple authentication contexts with different data visibility.
+ *
+ * FUTURE USE: When Border Safety Mode is implemented, this class will:
+ * - Manage multiple contexts per user (primary, decoy)
+ * - Support different unlock methods per context (password, PIN, biometric, hardware key)
+ * - Track context creation and last access times
+ * - Validate context-specific credentials
+ *
+ * @see doc/01-business/features/b2c-features/border-safety-mode/preparatory-design-changes/01-authentication.md
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthContextManager = void 0;
+/**
+ * Authentication Context Manager
+ *
+ * Manages authentication contexts for users. Currently returns a single primary
+ * context for all users. This prepares for future multi-context support.
+ */
+class AuthContextManager {
+    /**
+     * Get all available authentication contexts for a user
+     *
+     * PREPARATORY: Currently returns a single primary context for all users.
+     * This method prepares for future multi-context support where users can have
+     * multiple contexts (primary and decoy profiles).
+     *
+     * FUTURE USE: When Border Safety Mode is implemented, this will:
+     * - Query database for user's contexts
+     * - Return all available contexts (primary + any decoy contexts)
+     * - Filter contexts based on user permissions
+     *
+     * @param userId - User ID to get contexts for
+     * @returns Array of available authentication contexts (currently always single primary context)
+     * @throws Error if userId is invalid or empty
+     */
+    async getContexts(userId) {
+        if (!userId || typeof userId !== "string" || userId.trim().length === 0) {
+            throw new Error("Invalid userId: must be a non-empty string");
+        }
+        // PREPARATORY: Always return single primary context for now
+        // FUTURE: Query database for user's contexts when Border Safety Mode is implemented
+        return [
+            {
+                contextId: "primary",
+                contextType: "primary",
+                unlockMethod: "password",
+                createdAt: new Date(),
+                lastAccessed: new Date(),
+            },
+        ];
+    }
+    /**
+     * Get the default authentication context for a user
+     *
+     * PREPARATORY: Currently always returns 'primary' for all users.
+     * This method prepares for future support where users can have a custom default context.
+     *
+     * FUTURE USE: When Border Safety Mode is implemented, this will:
+     * - Check user's defaultContext preference in database
+     * - Return the user's preferred default context
+     * - Fall back to 'primary' if no preference is set
+     *
+     * @param userId - User ID to get default context for
+     * @returns Default context ID (currently always 'primary')
+     * @throws Error if userId is invalid or empty
+     */
+    async getDefaultContext(userId) {
+        if (!userId || typeof userId !== "string" || userId.trim().length === 0) {
+            throw new Error("Invalid userId: must be a non-empty string");
+        }
+        // PREPARATORY: Always return 'primary' for now
+        // FUTURE: Query database for user's defaultContext preference
+        return "primary";
+    }
+    /**
+     * Create a new authentication context for a user
+     *
+     * PREPARATORY: Currently not implemented - throws error if called.
+     * This method prepares for future support where users can create decoy contexts.
+     *
+     * FUTURE USE: When Border Safety Mode is implemented, this will:
+     * - Create a new context in the database
+     * - Set up context-specific encryption keys
+     * - Initialize context with default settings
+     * - Return the new context ID
+     *
+     * @param userId - User ID to create context for
+     * @param contextType - Type of context to create ('primary' or 'decoy')
+     * @returns Promise that resolves to the new context ID
+     * @throws Error - Always throws error (not yet implemented)
+     */
+    async createContext(userId, contextType) {
+        // PREPARATORY: Not yet implemented - throw error
+        throw new Error("createContext is not yet implemented. This feature will be available when Border Safety Mode is implemented.");
+    }
+    /**
+     * Validate credentials for a specific authentication context
+     *
+     * PREPARATORY: Currently not implemented - throws error if called.
+     * This method prepares for future support where different contexts can have
+     * different unlock methods (password, PIN, biometric, hardware key).
+     *
+     * FUTURE USE: When Border Safety Mode is implemented, this will:
+     * - Validate credentials against context-specific unlock method
+     * - Check context-specific rate limits
+     * - Update lastAccessed timestamp
+     * - Return true if credentials are valid, false otherwise
+     *
+     * @param userId - User ID
+     * @param contextId - Context ID to validate credentials for
+     * @param credentials - Credentials to validate (format depends on unlock method)
+     * @returns Promise that resolves to true if credentials are valid
+     * @throws Error - Always throws error (not yet implemented)
+     */
+    async validateContextCredentials(userId, contextId, credentials) {
+        // PREPARATORY: Not yet implemented - throw error
+        throw new Error("validateContextCredentials is not yet implemented. This feature will be available when Border Safety Mode is implemented.");
+    }
+}
+exports.AuthContextManager = AuthContextManager;
+//# sourceMappingURL=auth-context-manager.js.map

package/dist/lib/auth-context-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-context-manager.js","sourceRoot":"","sources":["../../src/lib/auth-context-manager.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;GAiBG;;;AAyBH;;;;;GAKG;AACH,MAAa,kBAAkB;IAC7B;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QAED,4DAA4D;QAC5D,oFAAoF;QACpF,OAAO;YACL;gBACE,SAAS,EAAE,SAAS;gBACpB,WAAW,EAAE,SAAS;gBACtB,YAAY,EAAE,UAAU;gBACxB,SAAS,EAAE,IAAI,IAAI,EAAE;gBACrB,YAAY,EAAE,IAAI,IAAI,EAAE;aACzB;SACF,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,iBAAiB,CAAC,MAAc;QACpC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QAED,+CAA+C;QAC/C,8DAA8D;QAC9D,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,aAAa,CACjB,MAAc,EACd,WAAgC;QAEhC,iDAAiD;QACjD,MAAM,IAAI,KAAK,CACb,8GAA8G,CAC/G,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,CAAC,0BAA0B,CAC9B,MAAc,EACd,SAAiB,EACjB,WAAoB;QAEpB,iDAAiD;QACjD,MAAM,IAAI,KAAK,CACb,2HAA2H,CAC5H,CAAC;IACJ,CAAC;CACF;AApHD,gDAoHC"}

package/dist/lib/auth-handler.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Auth Handler
+ *
+ * Handles authentication routes including magic link, SSO, and session management.
+ *
+ * PREPARATORY: Checks feature flags for authentication methods.
+ */
+import type { Env } from "../env";
+import type { RateLimiter } from "./rate-limit";
+import type { RequestContext } from "./request-context";
+import { SecurityHeaders } from "./security-headers";
+export declare class AuthHandler {
+    /**
+     * Auth routes — authentication is delegated to AWS Cognito + Amplify SDK.
+     * Only the reCAPTCHA site key endpoint remains active.
+     */
+    static handleAuthRoutes(request: Request, env: Env, url: URL, _rateLimiter: RateLimiter, securityHeaders: SecurityHeaders, _requestContext?: RequestContext): Promise<Response>;
+}
+//# sourceMappingURL=auth-handler.d.ts.map

package/dist/lib/auth-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-handler.d.ts","sourceRoot":"","sources":["../../src/lib/auth-handler.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAGlC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,qBAAa,WAAW;IACtB;;;OAGG;WACU,gBAAgB,CAC3B,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,GAAG,EACR,YAAY,EAAE,WAAW,EACzB,eAAe,EAAE,eAAe,EAChC,eAAe,CAAC,EAAE,cAAc,GAC/B,OAAO,CAAC,QAAQ,CAAC;CAqErB"}

package/dist/lib/auth-handler.js

@@ -0,0 +1,76 @@
+"use strict";
+/**
+ * Auth Handler
+ *
+ * Handles authentication routes including magic link, SSO, and session management.
+ *
+ * PREPARATORY: Checks feature flags for authentication methods.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthHandler = void 0;
+const cors_handler_1 = require("./cors-handler");
+const logger_1 = require("./logger");
+class AuthHandler {
+    /**
+     * Auth routes — authentication is delegated to AWS Cognito + Amplify SDK.
+     * Only the reCAPTCHA site key endpoint remains active.
+     */
+    static async handleAuthRoutes(request, env, url, _rateLimiter, securityHeaders, _requestContext) {
+        const pathname = url.pathname;
+        // Get allowed origin for CORS
+        const allowedOrigin = cors_handler_1.CorsHandler.getAllowedOrigin(request, env);
+        // CORS headers for auth endpoints
+        // Note: Access-Control-Allow-Origin must be the exact origin (not '*') when using credentials
+        const corsHeaders = {
+            "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, PATCH, OPTIONS",
+            "Access-Control-Allow-Headers": "Content-Type, Authorization, X-CSRF-Token, X-Retry-Count",
+            "Access-Control-Allow-Credentials": "true",
+        };
+        // Only set Access-Control-Allow-Origin if we have an allowed origin
+        // Browsers require exact origin match when credentials are involved
+        if (allowedOrigin) {
+            corsHeaders["Access-Control-Allow-Origin"] = allowedOrigin;
+        }
+        // Handle OPTIONS requests
+        if (request.method === "OPTIONS") {
+            return new Response(null, {
+                status: 204,
+                headers: corsHeaders,
+            });
+        }
+        try {
+            // Get reCAPTCHA site key (public endpoint)
+            if (pathname === "/auth/recaptcha-site-key" && request.method === "GET") {
+                const siteKey = env.RECAPTCHA_SITE_KEY || "";
+                const response = new Response(JSON.stringify({ siteKey }), {
+                    status: 200,
+                    headers: {
+                        "content-type": "application/json",
+                        ...corsHeaders,
+                    },
+                });
+                return securityHeaders.addSecurityHeaders(response);
+            }
+            // Authentication is handled by AWS Cognito + Amplify SDK in the Flutter client.
+            // Legacy Supabase auth routes are no longer available.
+            const deprecated = new Response(JSON.stringify({
+                error: "This auth endpoint has been deprecated.",
+                message: "Authentication is handled by AWS Cognito. Use the Amplify SDK in the client app.",
+            }), { status: 410, headers: { "content-type": "application/json", ...corsHeaders } });
+            return securityHeaders.addSecurityHeaders(deprecated);
+        }
+        catch (error) {
+            logger_1.Logger.getInstance(env).error("Auth route error:", error);
+            const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Internal server error" }), {
+                status: 500,
+                headers: { "content-type": "application/json", ...corsHeaders },
+            });
+            Object.entries(corsHeaders).forEach(([key, value]) => {
+                errorResponse.headers.set(key, value);
+            });
+            return errorResponse;
+        }
+    }
+}
+exports.AuthHandler = AuthHandler;
+//# sourceMappingURL=auth-handler.js.map

package/dist/lib/auth-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-handler.js","sourceRoot":"","sources":["../../src/lib/auth-handler.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AAGH,iDAA6C;AAC7C,qCAAkC;AAKlC,MAAa,WAAW;IACtB;;;OAGG;IACH,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAC3B,OAAgB,EAChB,GAAQ,EACR,GAAQ,EACR,YAAyB,EACzB,eAAgC,EAChC,eAAgC;QAEhC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;QAE9B,8BAA8B;QAC9B,MAAM,aAAa,GAAG,0BAAW,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAEjE,kCAAkC;QAClC,8FAA8F;QAC9F,MAAM,WAAW,GAA2B;YAC1C,8BAA8B,EAAE,wCAAwC;YACxE,8BAA8B,EAC5B,0DAA0D;YAC5D,kCAAkC,EAAE,MAAM;SAC3C,CAAC;QAEF,oEAAoE;QACpE,oEAAoE;QACpE,IAAI,aAAa,EAAE,CAAC;YAClB,WAAW,CAAC,6BAA6B,CAAC,GAAG,aAAa,CAAC;QAC7D,CAAC;QAED,0BAA0B;QAC1B,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;gBACxB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,WAAW;aACrB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC;YACH,2CAA2C;YAC3C,IAAI,QAAQ,KAAK,0BAA0B,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACxE,MAAM,OAAO,GAAG,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC;gBAC7C,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE;oBACzD,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE;wBACP,cAAc,EAAE,kBAAkB;wBAClC,GAAG,WAAW;qBACf;iBACF,CAAC,CAAC;gBACH,OAAO,eAAe,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YACtD,CAAC;YAED,gFAAgF;YAChF,uDAAuD;YACvD,MAAM,UAAU,GAAG,IAAI,QAAQ,CAC7B,IAAI,CAAC,SAAS,CAAC;gBACb,KAAK,EAAE,yCAAyC;gBAChD,OAAO,EACL,kFAAkF;aACrF,CAAC,EACF,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,WAAW,EAAE,EAAE,CACjF,CAAC;YACF,OAAO,eAAe,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;YAC1D,MAAM,aAAa,GAAG,eAAe,CAAC,oBAAoB,CACxD,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,EAClD;gBACE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,WAAW,EAAE;aAChE,CACF,CAAC;YACF,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;gBACnD,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACxC,CAAC,CAAC,CAAC;YACH,OAAO,aAAa,CAAC;QACvB,CAAC;IACH,CAAC;CACF;AAjFD,kCAiFC"}

package/dist/lib/badge-handler.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Badge Handler
+ *
+ * Handles user badge API endpoints.
+ * Badges are computed automatically based on verification status.
+ */
+import type { Env } from "../env";
+export declare class BadgeHandler {
+    /**
+     * GET /api/users/:userId/badges
+     * Get all badges for a user
+     */
+    handleGetUserBadges(request: Request, env: Env, userId: string): Promise<Response>;
+    /**
+     * PATCH /api/users/:userId/badges/display
+     * Toggle badge display preference
+     */
+    handleUpdateBadgeDisplay(request: Request, env: Env, userId: string): Promise<Response>;
+}
+//# sourceMappingURL=badge-handler.d.ts.map

package/dist/lib/badge-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"badge-handler.d.ts","sourceRoot":"","sources":["../../src/lib/badge-handler.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAMlC,qBAAa,YAAY;IACvB;;;OAGG;IACG,mBAAmB,CACvB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,QAAQ,CAAC;IAiDpB;;;OAGG;IACG,wBAAwB,CAC5B,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,QAAQ,CAAC;CA0DrB"}

package/dist/lib/badge-handler.js

@@ -0,0 +1,142 @@
+"use strict";
+/**
+ * Badge Handler
+ *
+ * Handles user badge API endpoints.
+ * Badges are computed automatically based on verification status.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BadgeHandler = void 0;
+const db_1 = require("../db");
+const logger_1 = require("./logger");
+const secret_resolver_1 = require("./secret-resolver");
+const session_manager_1 = require("./session-manager");
+const user_badge_1 = require("./user-badge");
+class BadgeHandler {
+    /**
+     * GET /api/users/:userId/badges
+     * Get all badges for a user
+     */
+    async handleGetUserBadges(request, env, userId) {
+        const db = (0, db_1.createPrisma)(env);
+        try {
+            // Get user from database
+            const user = await db.user.findUnique({
+                where: { id: userId },
+                select: {
+                    emailVerified: true,
+                    emailVerifiedAt: true,
+                    showVerifiedBadge: true,
+                    identityVerified: true,
+                    identityVerifiedAt: true,
+                    showIdentityVerifiedBadge: true,
+                    identityVerificationMethod: true,
+                },
+            });
+            if (!user) {
+                return new Response(JSON.stringify({ error: "User not found" }), {
+                    status: 404,
+                    headers: { "Content-Type": "application/json" },
+                });
+            }
+            // Compute badges
+            const badges = (0, user_badge_1.getUserBadges)(user);
+            return new Response(JSON.stringify({
+                badges,
+                count: badges.length,
+            }), {
+                headers: { "Content-Type": "application/json" },
+            });
+        }
+        catch (error) {
+            logger_1.Logger.getInstance(env).error("[BadgeHandler] Error getting user badges:", error);
+            return new Response(JSON.stringify({ error: "Internal server error" }), {
+                status: 500,
+                headers: { "Content-Type": "application/json" },
+            });
+        }
+    }
+    /**
+     * PATCH /api/users/:userId/badges/display
+     * Toggle badge display preference
+     */
+    async handleUpdateBadgeDisplay(request, env, userId) {
+        const sessionManager = new session_manager_1.SessionManager();
+        const sessionSecret = secret_resolver_1.Secrets.getSessionSecret(env);
+        const session = await sessionManager.getSession(request, sessionSecret, env);
+        if (!session) {
+            return new Response(JSON.stringify({ error: "Unauthorized" }), {
+                status: 401,
+                headers: { "Content-Type": "application/json" },
+            });
+        }
+        // Only user can update their own badge display
+        if (session.userId !== userId) {
+            return new Response(JSON.stringify({ error: "Forbidden" }), {
+                status: 403,
+                headers: { "Content-Type": "application/json" },
+            });
+        }
+        const db = (0, db_1.createPrisma)(env);
+        try {
+            // Validate request body with Zod schema
+            const { validateRequest } = await Promise.resolve().then(() => __importStar(require("./validate-request")));
+            const { badgeSchema } = await Promise.resolve().then(() => __importStar(require("./schemas")));
+            const validation = await validateRequest(request, badgeSchema);
+            if (!validation.success) {
+                return validation.error;
+            }
+            const { showVerifiedBadge } = validation.data;
+            // showVerifiedBadge is already validated by Zod schema (must be boolean)
+            await db.user.update({
+                where: { id: userId },
+                data: { showVerifiedBadge },
+            });
+            return new Response(JSON.stringify({ success: true }), {
+                headers: { "Content-Type": "application/json" },
+            });
+        }
+        catch (error) {
+            logger_1.Logger.getInstance(env).error("[BadgeHandler] Error updating badge display:", error);
+            return new Response(JSON.stringify({ error: "Internal server error" }), {
+                status: 500,
+                headers: { "Content-Type": "application/json" },
+            });
+        }
+    }
+}
+exports.BadgeHandler = BadgeHandler;
+//# sourceMappingURL=badge-handler.js.map

package/dist/lib/badge-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"badge-handler.js","sourceRoot":"","sources":["../../src/lib/badge-handler.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,8BAAqC;AAErC,qCAAkD;AAClD,uDAA4C;AAC5C,uDAAmD;AACnD,6CAA6C;AAE7C,MAAa,YAAY;IACvB;;;OAGG;IACH,KAAK,CAAC,mBAAmB,CACvB,OAAgB,EAChB,GAAQ,EACR,MAAc;QAEd,MAAM,EAAE,GAAG,IAAA,iBAAY,EAAC,GAAG,CAAC,CAAC;QAE7B,IAAI,CAAC;YACH,yBAAyB;YACzB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC;gBACpC,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;gBACrB,MAAM,EAAE;oBACN,aAAa,EAAE,IAAI;oBACnB,eAAe,EAAE,IAAI;oBACrB,iBAAiB,EAAE,IAAI;oBACvB,gBAAgB,EAAE,IAAI;oBACtB,kBAAkB,EAAE,IAAI;oBACxB,yBAAyB,EAAE,IAAI;oBAC/B,0BAA0B,EAAE,IAAI;iBACjC;aACF,CAAC,CAAC;YAEH,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,EAAE;oBAC/D,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;iBAChD,CAAC,CAAC;YACL,CAAC;YAED,iBAAiB;YACjB,MAAM,MAAM,GAAG,IAAA,0BAAa,EAAC,IAAI,CAAC,CAAC;YAEnC,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;gBACb,MAAM;gBACN,KAAK,EAAE,MAAM,CAAC,MAAM;aACrB,CAAC,EACF;gBACE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAC3B,2CAA2C,EAC3C,KAAK,CACN,CAAC;YACF,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,EAAE;gBACtE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,wBAAwB,CAC5B,OAAgB,EAChB,GAAQ,EACR,MAAc;QAEd,MAAM,cAAc,GAAG,IAAI,gCAAc,EAAE,CAAC;QAC5C,MAAM,aAAa,GAAG,yBAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,UAAU,CAC7C,OAAO,EACP,aAAa,EACb,GAAG,CACJ,CAAC;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,EAAE;gBAC7D,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CAAC,CAAC;QACL,CAAC;QAED,+CAA+C;QAC/C,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC9B,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,EAAE;gBAC1D,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE,GAAG,IAAA,iBAAY,EAAC,GAAG,CAAC,CAAC;QAE7B,IAAI,CAAC;YACH,wCAAwC;YACxC,MAAM,EAAE,eAAe,EAAE,GAAG,wDAAa,oBAAoB,GAAC,CAAC;YAC/D,MAAM,EAAE,WAAW,EAAE,GAAG,wDAAa,WAAW,GAAC,CAAC;YAElD,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAC/D,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;gBACxB,OAAO,UAAU,CAAC,KAAK,CAAC;YAC1B,CAAC;YACD,MAAM,EAAE,iBAAiB,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC;YAE9C,yEAAyE;YAEzE,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;gBACnB,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;gBACrB,IAAI,EAAE,EAAE,iBAAiB,EAAE;aAC5B,CAAC,CAAC;YAEH,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE;gBACrD,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAC3B,8CAA8C,EAC9C,KAAK,CACN,CAAC;YACF,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,EAAE;gBACtE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF;AA5HD,oCA4HC"}