@de-otio/trellis 0.6.1 → 0.7.0

package/dist/lib/routes/agent-sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-sessions.js","sourceRoot":"","sources":["../../../src/lib/routes/agent-sessions.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AA6BH,kEAEC;AAED,sEAEC;AAjCD,kEAMoC;AACpC,6DAAyD;AACzD,wCAAkD;AAClD,gGAGmD;AACnD,iCAAwC;AACxC,8CAA+D;AAC/D,gEAA2D;AAC3D,0DAAsD;AACtD,qCAA8D;AAQ9D,IAAI,IAAI,GAAqB,EAAE,CAAC;AAEhC,SAAgB,2BAA2B,CAAC,CAAmB;IAC7D,IAAI,GAAG,CAAC,CAAC;AACX,CAAC;AAED,SAAgB,6BAA6B;IAC3C,IAAI,GAAG,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,UAAU;IACjB,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC;IACtC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,WAAW,CAAC;IACnF,MAAM,MAAM,GAAG,IAAI,gEAA6B,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7D,OAAO;QACL,KAAK,CAAC,aAAa,CAAC,KAAK;YACvB,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,gEAA6B,CAAC;gBAChC,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,QAAQ,EAAE,KAAK,CAAC,eAAe;aAChC,CAAC,CACH,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ;IACf,OAAO,IAAI,CAAC,YAAY,IAAI,IAAI,wBAAiB,EAAE,CAAC;AACtD,CAAC;AAED,SAAS,WAAW,CAAC,GAAuB;IAC1C,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,SAAS;QACjB,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI;QAClC,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI;QAC9B,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QACvD,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QACzD,MAAM,EAAE,GAAG,CAAC,MAAM;KACnB,CAAC;AACJ,CAAC;AAED,MAAM,SAAS,GAAG,qDAAqD,CAAC;AAE3D,QAAA,mBAAmB,GAAY;IAC1C;QACE,IAAI,EAAE,8BAA8B;QACpC,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;YAC9B,MAAM,GAAG,GAAG,IAAI,kCAAe,CAAC,GAAG,CAAC,CAAC;YACrC,MAAM,IAAI,GAAG,MAAM,IAAA,gCAAc,EAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAChD,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAA,0BAAiB,EAAC,GAAG,CAAC,CAAC;YAEzC,MAAM,QAAQ,GAAG,MAAM,IAAA,qCAAiB,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtD,OAAO,GAAG,CAAC,oBAAoB,CAC7B,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,EACvD,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;QACJ,CAAC;QACD,UAAU,EAAE,CAAC,IAAA,2BAAc,GAAE,CAAC;QAC9B,WAAW,EAAE,iDAAiD;KAC/D;IAED;QACE,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;YAC5C,MAAM,GAAG,GAAG,IAAI,kCAAe,CAAC,GAAG,CAAC,CAAC;YACrC,MAAM,IAAI,GAAG,MAAM,IAAA,gCAAc,EAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAChD,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAA,0BAAiB,EAAC,GAAG,CAAC,CAAC;YAEzC,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACjD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,IAAA,wBAAe,EAAC,GAAG,EAAE;oBAC1B,KAAK,EAAE,iBAAiB;oBACxB,OAAO,EAAE,yBAAyB;oBAClC,WAAW,EAAE,oDAAoD;iBAClE,EAAE,GAAG,CAAC,CAAC;YACV,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,IAAA,mCAAe,EAAC,SAAS,CAAC,CAAC;YACjD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC/C,2CAA2C;gBAC3C,OAAO,IAAA,wBAAe,EAAC,GAAG,EAAE;oBAC1B,KAAK,EAAE,WAAW;oBAClB,OAAO,EAAE,0BAA0B;oBACnC,WAAW,EAAE,8DAA8D;iBAC5E,EAAE,GAAG,CAAC,CAAC;YACV,CAAC;YAED,MAAM,UAAU,GAAG,GAAG,CAAC,oBAAoB,CAAC;YAC5C,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,GAAG,CAAC,oBAAoB,CAC7B,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,EAC3C,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;YACzB,mEAAmE;YACnE,MAAM,MAAM,GAAG,IAAA,iBAAY,EAAC,GAAG,CAAC,CAAC;YAEjC,MAAM,IAAA,sCAAkB,EAAC;gBACvB,SAAS;gBACT,UAAU;gBACV,eAAe,EAAE,OAAO,CAAC,UAAU;gBACnC,OAAO;gBACP,KAAK,EAAE;oBACL,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAc,EAAE,MAAe,CAAC;iBACnE;gBACD,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,WAAW,EAAE,IAAI,CAAC,MAAM;gBACxB,QAAQ,EAAE,IAAA,mCAAe,EAAC,OAAO,EAAE,GAAG,CAAC;aACxC,CAAC,CAAC;YAEH,OAAO,GAAG,CAAC,oBAAoB,CAC7B,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EACrC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;QACJ,CAAC;QACD,UAAU,EAAE,CAAC,IAAA,2BAAc,GAAE,EAAE,IAAA,2BAAc,GAAE,CAAC;QAChD,WAAW,EAAE,yBAAyB;KACvC;CACF,CAAC"}

package/dist/lib/routes/agent-surface.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Agent-Surface Routes  (T9b-a)
+ *
+ * Public, unauthenticated discovery endpoints for AI agents and tooling:
+ *
+ *   GET /llms.txt           — setup contract for AI agents (llmstxt.org convention)
+ *   GET /openapi.json       — OpenAPI 3.1 document auto-generated from route registry
+ *   GET /security.txt       — RFC 9116 security contact
+ *
+ * All three are rate-limited at the API Gateway / WAF layer (120 req/min per IP).
+ * No session required.
+ */
+import type { Route } from "./types";
+/**
+ * Build the agent-surface routes, injecting the full route list so the
+ * OpenAPI generator can introspect the registry.
+ *
+ * Usage in routes/index.ts:
+ *   import { buildAgentSurfaceRoutes } from "./agent-surface";
+ *   // after all routes are collected:
+ *   const agentSurface = buildAgentSurfaceRoutes(coreRoutes);
+ *
+ * Because we need the full route list for OpenAPI generation but the route
+ * list includes these routes themselves, we expose a plain `agentSurfaceRoutes`
+ * export that uses a deferred getter — the first HTTP request triggers
+ * generation using whatever has been registered by then.
+ */
+export declare function buildAgentSurfaceRoutes(getAllRoutes: () => Route[]): Route[];
+/**
+ * Static export for the route registry.
+ *
+ * These routes have no dependency on the full route list (llms.txt and
+ * security.txt are static; openapi.json generates lazily on first request).
+ * Import and spread into coreRoutes in routes/index.ts.
+ */
+export declare const agentSurfaceRoutes: Route[];
+//# sourceMappingURL=agent-surface.d.ts.map

package/dist/lib/routes/agent-surface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-surface.d.ts","sourceRoot":"","sources":["../../../src/lib/routes/agent-surface.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAgHrC;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CAAC,YAAY,EAAE,MAAM,KAAK,EAAE,GAAG,KAAK,EAAE,CAiE5E;AAED;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,EAAE,KAAK,EAAsC,CAAC"}

package/dist/lib/routes/agent-surface.js

@@ -0,0 +1,208 @@
+"use strict";
+/**
+ * Agent-Surface Routes  (T9b-a)
+ *
+ * Public, unauthenticated discovery endpoints for AI agents and tooling:
+ *
+ *   GET /llms.txt           — setup contract for AI agents (llmstxt.org convention)
+ *   GET /openapi.json       — OpenAPI 3.1 document auto-generated from route registry
+ *   GET /security.txt       — RFC 9116 security contact
+ *
+ * All three are rate-limited at the API Gateway / WAF layer (120 req/min per IP).
+ * No session required.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.agentSurfaceRoutes = void 0;
+exports.buildAgentSurfaceRoutes = buildAgentSurfaceRoutes;
+const middleware_1 = require("../middleware");
+const generator_1 = require("../openapi/generator");
+// ── Constants ─────────────────────────────────────────────────────────────────
+const SECURITY_CONTACT = "security@skybber.com";
+const SECURITY_POLICY_URL = "https://skybber.com/security/policy";
+const SECURITY_CANONICAL_URL = "https://api.skybber.com/security.txt";
+// ── llms.txt content ──────────────────────────────────────────────────────────
+const LLMS_TXT_CONTENT = `# Trellis / Skybber — Agent Setup Contract
+
+> Skybber is a social platform for dog fans with a B2B multi-tenant identity
+> federation layer. This file tells an AI agent everything it needs to drive
+> tenant onboarding end-to-end.
+
+## Persona scenario
+
+An IT engineer at a customer org says: "Help me set up Skybber for my company."
+The agent should be able to:
+1. Discover what Skybber is and what setup involves (this file).
+2. Ask the engineer for the few inputs only a human can supply (Entra admin
+   consent, role-mapping decisions).
+3. Drive every other step via HTTP API or tools the agent already has
+   (Microsoft Graph, Route53/Cloudflare DNS, etc.).
+4. Verify the result.
+5. Hand the engineer back a working tenant with a one-paragraph summary.
+
+## Authentication
+
+Agents authenticate via OIDC — no static API tokens are issued.
+Two flows are supported:
+
+- **PKCE + localhost-listener** (interactive agent on engineer's machine):
+  Redirect to \`https://auth.skybber.com/oauth2/authorize\` with
+  \`response_type=code&client_id=skybber-agent-cli&code_challenge=...\`
+  and catch the code on \`http://127.0.0.1:{ephemeral-port}/cb\`.
+
+- **Device authorization grant** (headless / CI agent):
+  POST /oauth2/device_authorization → get device_code + user_code →
+  engineer approves at https://app.skybber.com/agents/authorize →
+  agent polls POST /oauth2/token.
+
+Tokens are short-lived (~1 h). Refresh tokens are single-use and rotated.
+The engineer can revoke any agent session at any time via GET/POST
+/api/users/me/agent-sessions.
+
+## Key endpoints
+
+| Endpoint | Method | Purpose |
+|---|---|---|
+| /api/tenants/{id}/setup-status | GET | Current onboarding progress + nextStep hint |
+| /api/tenants/{id}/domains | POST | Add a domain for verification |
+| /api/tenants/{id}/domains/{domainId}/verify | POST | Trigger DNS TXT check |
+| /api/tenants/{id}/identity-provider | POST | Connect OIDC/SAML IdP |
+| /api/tenants/{id}/identity-provider/test-sign-in | POST | Validate IdP round-trip |
+| /api/tenants/{id}/role-mappings | POST | Map IdP group → Skybber role |
+| /api/tenants/{id}/audit | GET | Audit log of tenant events |
+| /api/auth/discover | POST | Pre-login: resolve email → IdP redirect or password |
+| /openapi.json | GET | Full OpenAPI 3.1 spec (this server) |
+| /.well-known/compliance.json | GET | Tenant compliance bundle |
+
+## Error format
+
+Every 4xx response from federation endpoints is JSON:
+\`\`\`json
+{
+  "error": "ERROR_CODE",
+  "message": "Human-readable description.",
+  "remediation": "Exact next step or 'ask the engineer X'.",
+  "field": "fieldName"
+}
+\`\`\`
+
+## Idempotency
+
+Every federation POST accepts an \`Idempotency-Key\` header. Same key + same
+body within 24 h returns the original 2xx response without side-effects.
+
+## Safety
+
+- Client secrets are write-only. GET /api/tenants/{id}/identity-provider
+  returns \`null\` for \`clientSecret\`. Never echo secrets in conversation.
+- Destructive operations require \`?confirm=true\`. A call without it returns
+  400 with a remediation explaining the risk.
+- Agents should request minimal scopes: domain.*, idp.*, role_mapping.*.
+
+## Further reading
+
+- Full spec: GET /openapi.json
+- Compliance bundle: GET /.well-known/compliance.json (per-tenant, auth required)
+- Security contact: GET /security.txt
+`;
+// ── Route definitions ─────────────────────────────────────────────────────────
+/**
+ * Build a lazy-caching OpenAPI JSON getter scoped to a specific route-list getter.
+ * The cache is per-getter closure so multiple `buildAgentSurfaceRoutes` calls
+ * (e.g. in tests) each get an independent cache.
+ */
+function makeOpenApiGetter(getAllRoutes) {
+    let cached = null;
+    return () => {
+        if (cached === null) {
+            const doc = (0, generator_1.generateOpenApiDoc)(getAllRoutes());
+            cached = JSON.stringify(doc, null, 2);
+        }
+        return cached;
+    };
+}
+/**
+ * Build the agent-surface routes, injecting the full route list so the
+ * OpenAPI generator can introspect the registry.
+ *
+ * Usage in routes/index.ts:
+ *   import { buildAgentSurfaceRoutes } from "./agent-surface";
+ *   // after all routes are collected:
+ *   const agentSurface = buildAgentSurfaceRoutes(coreRoutes);
+ *
+ * Because we need the full route list for OpenAPI generation but the route
+ * list includes these routes themselves, we expose a plain `agentSurfaceRoutes`
+ * export that uses a deferred getter — the first HTTP request triggers
+ * generation using whatever has been registered by then.
+ */
+function buildAgentSurfaceRoutes(getAllRoutes) {
+    const getOpenApiJson = makeOpenApiGetter(getAllRoutes);
+    return [
+        // ── GET /llms.txt ────────────────────────────────────────────────────────
+        {
+            path: "/llms.txt",
+            method: "GET",
+            handler: async (_request, _env) => {
+                return new Response(LLMS_TXT_CONTENT, {
+                    status: 200,
+                    headers: {
+                        "content-type": "text/plain; charset=utf-8",
+                        "cache-control": "public, max-age=3600",
+                    },
+                });
+            },
+            middleware: [(0, middleware_1.corsMiddleware)()],
+            description: "Agent setup contract (llmstxt.org convention)",
+        },
+        // ── GET /openapi.json ────────────────────────────────────────────────────
+        {
+            path: "/openapi.json",
+            method: "GET",
+            handler: async (_request, _env) => {
+                const json = getOpenApiJson();
+                return new Response(json, {
+                    status: 200,
+                    headers: {
+                        "content-type": "application/json; charset=utf-8",
+                        "cache-control": "public, max-age=300",
+                    },
+                });
+            },
+            middleware: [(0, middleware_1.corsMiddleware)()],
+            description: "OpenAPI 3.1 document (auto-generated from route registry)",
+        },
+        // ── GET /security.txt ────────────────────────────────────────────────────
+        {
+            path: "/security.txt",
+            method: "GET",
+            handler: async (_request, _env) => {
+                const expires = new Date(Date.now() + 365 * 24 * 60 * 60 * 1000).toISOString();
+                const body = [
+                    `Contact: mailto:${SECURITY_CONTACT}`,
+                    `Expires: ${expires}`,
+                    `Preferred-Languages: en`,
+                    `Canonical: ${SECURITY_CANONICAL_URL}`,
+                    `Policy: ${SECURITY_POLICY_URL}`,
+                    "",
+                ].join("\n");
+                return new Response(body, {
+                    status: 200,
+                    headers: {
+                        "content-type": "text/plain; charset=utf-8",
+                        "cache-control": "public, max-age=86400",
+                    },
+                });
+            },
+            middleware: [(0, middleware_1.corsMiddleware)()],
+            description: "RFC 9116 security contact",
+        },
+    ];
+}
+/**
+ * Static export for the route registry.
+ *
+ * These routes have no dependency on the full route list (llms.txt and
+ * security.txt are static; openapi.json generates lazily on first request).
+ * Import and spread into coreRoutes in routes/index.ts.
+ */
+exports.agentSurfaceRoutes = buildAgentSurfaceRoutes(() => []);
+//# sourceMappingURL=agent-surface.js.map

package/dist/lib/routes/agent-surface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-surface.js","sourceRoot":"","sources":["../../../src/lib/routes/agent-surface.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;AAkIH,0DAiEC;AAjMD,8CAA+C;AAC/C,oDAA0D;AAG1D,iFAAiF;AAEjF,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;AAChD,MAAM,mBAAmB,GAAG,qCAAqC,CAAC;AAClE,MAAM,sBAAsB,GAAG,sCAAsC,CAAC;AAEtE,iFAAiF;AAEjF,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkFxB,CAAC;AAEF,iFAAiF;AAEjF;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,YAA2B;IACpD,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,OAAO,GAAG,EAAE;QACV,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,GAAG,GAAG,IAAA,8BAAkB,EAAC,YAAY,EAAE,CAAC,CAAC;YAC/C,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAgB,uBAAuB,CAAC,YAA2B;IACjE,MAAM,cAAc,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;IACvD,OAAO;QACL,4EAA4E;QAC5E;YACE,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;gBAChC,OAAO,IAAI,QAAQ,CAAC,gBAAgB,EAAE;oBACpC,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE;wBACP,cAAc,EAAE,2BAA2B;wBAC3C,eAAe,EAAE,sBAAsB;qBACxC;iBACF,CAAC,CAAC;YACL,CAAC;YACD,UAAU,EAAE,CAAC,IAAA,2BAAc,GAAE,CAAC;YAC9B,WAAW,EAAE,+CAA+C;SAC7D;QAED,4EAA4E;QAC5E;YACE,IAAI,EAAE,eAAe;YACrB,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;gBAChC,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;gBAC9B,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;oBACxB,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE;wBACP,cAAc,EAAE,iCAAiC;wBACjD,eAAe,EAAE,qBAAqB;qBACvC;iBACF,CAAC,CAAC;YACL,CAAC;YACD,UAAU,EAAE,CAAC,IAAA,2BAAc,GAAE,CAAC;YAC9B,WAAW,EAAE,2DAA2D;SACzE;QAED,4EAA4E;QAC5E;YACE,IAAI,EAAE,eAAe;YACrB,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;gBAChC,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;gBAC/E,MAAM,IAAI,GAAG;oBACX,mBAAmB,gBAAgB,EAAE;oBACrC,YAAY,OAAO,EAAE;oBACrB,yBAAyB;oBACzB,cAAc,sBAAsB,EAAE;oBACtC,WAAW,mBAAmB,EAAE;oBAChC,EAAE;iBACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAEb,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;oBACxB,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE;wBACP,cAAc,EAAE,2BAA2B;wBAC3C,eAAe,EAAE,uBAAuB;qBACzC;iBACF,CAAC,CAAC;YACL,CAAC;YACD,UAAU,EAAE,CAAC,IAAA,2BAAc,GAAE,CAAC;YAC9B,WAAW,EAAE,2BAA2B;SACzC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACU,QAAA,kBAAkB,GAAY,uBAAuB,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC"}

package/dist/lib/routes/auth-discover.d.ts

@@ -0,0 +1,18 @@
+/**
+ * POST /api/auth/discover
+ *
+ * Pre-login sign-in discovery. Accepts an email address and returns either:
+ *   - { method: "idp", idpRedirect: "...", tenantSlug: "..." }  — federated tenant
+ *   - { method: "password" }                                     — everything else
+ *
+ * Security properties:
+ *  - No auth required (pre-login endpoint).
+ *  - Never leaks whether a domain is claimed but with a disabled IdP.
+ *  - Rate-limited 30 req/min per source IP (DynamoDB token bucket via RATE_LIMIT_KV).
+ *  - Timing-safe: always performs the DB query; pads short-circuit paths to a
+ *    fixed minimum elapsed time so response-time analysis cannot distinguish
+ *    federated from non-federated domains.
+ */
+import type { Route } from "./types";
+export declare const authDiscoverRoutes: Route[];
+//# sourceMappingURL=auth-discover.d.ts.map

package/dist/lib/routes/auth-discover.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-discover.d.ts","sourceRoot":"","sources":["../../../src/lib/routes/auth-discover.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAqJrC,eAAO,MAAM,kBAAkB,EAAE,KAAK,EAYrC,CAAC"}

package/dist/lib/routes/auth-discover.js

@@ -0,0 +1,177 @@
+"use strict";
+/**
+ * POST /api/auth/discover
+ *
+ * Pre-login sign-in discovery. Accepts an email address and returns either:
+ *   - { method: "idp", idpRedirect: "...", tenantSlug: "..." }  — federated tenant
+ *   - { method: "password" }                                     — everything else
+ *
+ * Security properties:
+ *  - No auth required (pre-login endpoint).
+ *  - Never leaks whether a domain is claimed but with a disabled IdP.
+ *  - Rate-limited 30 req/min per source IP (DynamoDB token bucket via RATE_LIMIT_KV).
+ *  - Timing-safe: always performs the DB query; pads short-circuit paths to a
+ *    fixed minimum elapsed time so response-time analysis cannot distinguish
+ *    federated from non-federated domains.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authDiscoverRoutes = void 0;
+const middleware_1 = require("../middleware");
+const security_headers_1 = require("../security-headers");
+const derive_domain_1 = require("../tenant/derive-domain");
+const idp_redirect_builder_1 = require("../auth/idp-redirect-builder");
+const idp_name_1 = require("../tenant/idp-name");
+const rate_limit_1 = require("../rate-limit");
+const errors_1 = require("./errors");
+const RATE_LIMIT_PER_MIN = 30;
+const WINDOW_SECONDS = 60;
+const MIN_RESPONSE_MS = 80;
+function passwordResponse() {
+    return new Response(JSON.stringify({ method: "password" }), { status: 200, headers: { "content-type": "application/json" } });
+}
+function tooManyRequests(retryAfter) {
+    const r = (0, errors_1.structuredError)(429, {
+        error: "RATE_LIMIT_EXCEEDED",
+        message: "Too many sign-in discovery requests. Please slow down.",
+        remediation: `Wait ${retryAfter} seconds before retrying.`,
+    });
+    // Attach Retry-After without re-constructing the body.
+    const headers = new Headers(r.headers);
+    headers.set("Retry-After", String(retryAfter));
+    return new Response(r.body, { status: 429, headers });
+}
+async function padToMinimum(startMs) {
+    const elapsed = Date.now() - startMs;
+    if (elapsed < MIN_RESPONSE_MS) {
+        await new Promise((resolve) => setTimeout(resolve, MIN_RESPONSE_MS - elapsed));
+    }
+}
+async function discoverHandler(request, env) {
+    const startMs = Date.now();
+    const rateLimiter = new rate_limit_1.RateLimiter();
+    const ip = request.headers.get("CF-Connecting-IP") ||
+        request.headers.get("X-Forwarded-For")?.split(",")[0]?.trim() ||
+        "unknown";
+    const rateLimitResult = await rateLimiter.checkRateLimitKV(env, request, "auth-discover", RATE_LIMIT_PER_MIN, WINDOW_SECONDS);
+    if (!rateLimitResult.allowed) {
+        const retryAfter = Math.ceil((rateLimitResult.resetAt - Date.now()) / 1000);
+        await padToMinimum(startMs);
+        return tooManyRequests(retryAfter);
+    }
+    let body;
+    try {
+        body = await request.json();
+    }
+    catch {
+        await padToMinimum(startMs);
+        return (0, errors_1.structuredError)(400, {
+            error: "INVALID_JSON",
+            message: "Request body must be valid JSON.",
+            remediation: "Ensure the request body is well-formed JSON with an 'email' field.",
+        });
+    }
+    const { z } = await Promise.resolve().then(() => __importStar(require("zod")));
+    const schema = z.object({ email: z.string() });
+    const parsed = schema.safeParse(body);
+    const emailDomain = parsed.success ? (0, derive_domain_1.deriveEmailDomain)(parsed.data.email) : null;
+    if (!emailDomain) {
+        await padToMinimum(startMs);
+        return (0, errors_1.structuredError)(400, {
+            error: "INVALID_EMAIL",
+            message: "A valid email address is required.",
+            remediation: "Provide a well-formed email address in the 'email' field.",
+            field: "email",
+        });
+    }
+    const { createPrisma } = await Promise.resolve().then(() => __importStar(require("../../db")));
+    const db = createPrisma(env);
+    try {
+        const row = await db.tenantDomain.findFirst({
+            where: {
+                domain: emailDomain,
+                verifiedAt: { not: null },
+                tenant: {
+                    identityProvider: {
+                        status: "ACTIVE",
+                    },
+                },
+            },
+            select: {
+                tenant: {
+                    select: {
+                        id: true,
+                        slug: true,
+                        identityProvider: {
+                            select: {
+                                cognitoIdpName: true,
+                            },
+                        },
+                    },
+                },
+            },
+        });
+        await padToMinimum(startMs);
+        if (!row?.tenant?.identityProvider) {
+            return passwordResponse();
+        }
+        const { tenant } = row;
+        const idpName = tenant.identityProvider.cognitoIdpName ?? (0, idp_name_1.cognitoIdpName)(tenant.id);
+        const config = (0, idp_redirect_builder_1.getIdpRedirectConfig)(env);
+        const idpRedirect = (0, idp_redirect_builder_1.buildIdpRedirectUrl)(config, {
+            cognitoIdpName: idpName,
+            tenantSlug: tenant.slug,
+        });
+        return new Response(JSON.stringify({ method: "idp", idpRedirect, tenantSlug: tenant.slug }), { status: 200, headers: { "content-type": "application/json" } });
+    }
+    catch (err) {
+        await padToMinimum(startMs);
+        throw err;
+    }
+}
+exports.authDiscoverRoutes = [
+    {
+        path: "/api/auth/discover",
+        method: "POST",
+        handler: async (request, env) => {
+            const securityHeaders = new security_headers_1.SecurityHeaders(env);
+            const response = await discoverHandler(request, env);
+            return securityHeaders.addSecurityHeaders(response);
+        },
+        middleware: [(0, middleware_1.corsMiddleware)()],
+        description: "Sign-in discovery: returns idp redirect or password fallback",
+    },
+];
+//# sourceMappingURL=auth-discover.js.map

package/dist/lib/routes/auth-discover.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-discover.js","sourceRoot":"","sources":["../../../src/lib/routes/auth-discover.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAGH,8CAA+C;AAC/C,0DAAsD;AACtD,2DAA4D;AAC5D,uEAGsC;AACtC,iDAAoD;AACpD,8CAA4C;AAC5C,qCAA2C;AAG3C,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B,SAAS,gBAAgB;IACvB,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,EACtC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,UAAkB;IACzC,MAAM,CAAC,GAAG,IAAA,wBAAe,EAAC,GAAG,EAAE;QAC7B,KAAK,EAAE,qBAAqB;QAC5B,OAAO,EAAE,wDAAwD;QACjE,WAAW,EAAE,QAAQ,UAAU,2BAA2B;KAC3D,CAAC,CAAC;IACH,uDAAuD;IACvD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IAC/C,OAAO,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,OAAe;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;IACrC,IAAI,OAAO,GAAG,eAAe,EAAE,CAAC;QAC9B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,CAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,OAAgB,EAAE,GAAQ;IACvD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE3B,MAAM,WAAW,GAAG,IAAI,wBAAW,EAAE,CAAC;IACtC,MAAM,EAAE,GACN,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QACvC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;QAC7D,SAAS,CAAC;IAEZ,MAAM,eAAe,GAAG,MAAM,WAAW,CAAC,gBAAgB,CACxD,GAAG,EACH,OAAO,EACP,eAAe,EACf,kBAAkB,EAClB,cAAc,CACf,CAAC;IAEF,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,eAAe,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QAC5E,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;QAC5B,OAAO,eAAe,CAAC,UAAU,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;QAC5B,OAAO,IAAA,wBAAe,EAAC,GAAG,EAAE;YAC1B,KAAK,EAAE,cAAc;YACrB,OAAO,EAAE,kCAAkC;YAC3C,WAAW,EAAE,oEAAoE;SAClF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,EAAE,CAAC,EAAE,GAAG,wDAAa,KAAK,GAAC,CAAC;IAClC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAEtC,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAA,iCAAiB,EAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEjF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;QAC5B,OAAO,IAAA,wBAAe,EAAC,GAAG,EAAE;YAC1B,KAAK,EAAE,eAAe;YACtB,OAAO,EAAE,oCAAoC;YAC7C,WAAW,EAAE,2DAA2D;YACxE,KAAK,EAAE,OAAO;SACf,CAAC,CAAC;IACL,CAAC;IAED,MAAM,EAAE,YAAY,EAAE,GAAG,wDAAa,UAAU,GAAC,CAAC;IAClD,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAE7B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC;YAC1C,KAAK,EAAE;gBACL,MAAM,EAAE,WAAW;gBACnB,UAAU,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE;gBACzB,MAAM,EAAE;oBACN,gBAAgB,EAAE;wBAChB,MAAM,EAAE,QAAQ;qBACjB;iBACF;aACF;YACD,MAAM,EAAE;gBACN,MAAM,EAAE;oBACN,MAAM,EAAE;wBACN,EAAE,EAAE,IAAI;wBACR,IAAI,EAAE,IAAI;wBACV,gBAAgB,EAAE;4BAChB,MAAM,EAAE;gCACN,cAAc,EAAE,IAAI;6BACrB;yBACF;qBACF;iBACF;aACF;SACF,CAAC,CAAC;QAEH,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;QAE5B,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;YACnC,OAAO,gBAAgB,EAAE,CAAC;QAC5B,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;QACvB,MAAM,OAAO,GACX,MAAM,CAAC,gBAAiB,CAAC,cAAc,IAAI,IAAA,yBAAc,EAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAEvE,MAAM,MAAM,GAAG,IAAA,2CAAoB,EAAC,GAAG,CAAC,CAAC;QACzC,MAAM,WAAW,GAAG,IAAA,0CAAmB,EAAC,MAAM,EAAE;YAC9C,cAAc,EAAE,OAAO;YACvB,UAAU,EAAE,MAAM,CAAC,IAAI;SACxB,CAAC,CAAC;QAEH,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,EACvE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;QAC5B,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAEY,QAAA,kBAAkB,GAAY;IACzC;QACE,IAAI,EAAE,oBAAoB;QAC1B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;YAC9B,MAAM,eAAe,GAAG,IAAI,kCAAe,CAAC,GAAG,CAAC,CAAC;YACjD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACrD,OAAO,eAAe,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACtD,CAAC;QACD,UAAU,EAAE,CAAC,IAAA,2BAAc,GAAE,CAAC;QAC9B,WAAW,EAAE,8DAA8D;KAC5E;CACF,CAAC"}

package/dist/lib/routes/comments.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"comments.d.ts","sourceRoot":"","sources":["../../../src/lib/routes/comments.ts"],"names":[],"mappings":"AAAA;;GAEG;AAWH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAErC,eAAO,MAAM,cAAc,EAAE,KAAK,EA8WjC,CAAC"}
+{"version":3,"file":"comments.d.ts","sourceRoot":"","sources":["../../../src/lib/routes/comments.ts"],"names":[],"mappings":"AAAA;;GAEG;AAYH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAErC,eAAO,MAAM,cAAc,EAAE,KAAK,EA6ajC,CAAC"}

package/dist/lib/routes/comments.js

@@ -5,6 +5,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.commentsRoutes = void 0;
 const comment_handler_1 = require("../comment-handler");
+const auth_middleware_1 = require("../auth/auth-middleware");
 const logger_1 = require("../logger");
 const middleware_1 = require("../middleware");
 const schemas_1 = require("../schemas");
@@ -27,12 +28,16 @@ exports.commentsRoutes = [
             if (!session) {
                 return securityHeaders.createSecureResponse(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "content-type": "application/json" } });
             }
+            const auth = await (0, auth_middleware_1.authMiddleware)(request, env);
+            if (!auth || !auth.activeTenantId) {
+                return securityHeaders.createSecureResponse(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "content-type": "application/json" } });
+            }
             try {
                 if (!requestContext) {
                     return securityHeaders.createSecureResponse(JSON.stringify({ error: "Request context not available" }), { status: 500, headers: { "content-type": "application/json" } });
                 }
                 const postId = pathname.split("/api/posts/")[1].split("/comments")[0];
-                const response = await commentHandler.createComment(postId, request, session, env, requestContext);
+                const response = await commentHandler.createComment(postId, request, session, env, requestContext, auth.activeTenantId);
                 return securityHeaders.addSecurityHeaders(response);
             }
             catch (error) {
@@ -56,6 +61,10 @@ exports.commentsRoutes = [
             if (!session) {
                 return securityHeaders.createSecureResponse(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "content-type": "application/json" } });
             }
+            const auth = await (0, auth_middleware_1.authMiddleware)(request, env);
+            if (!auth || !auth.activeTenantId) {
+                return securityHeaders.createSecureResponse(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "content-type": "application/json" } });
+            }
             try {
                 if (!requestContext) {
                     return securityHeaders.createSecureResponse(JSON.stringify({ error: "Request context not available" }), { status: 500, headers: { "content-type": "application/json" } });
@@ -66,7 +75,7 @@ exports.commentsRoutes = [
                     return securityHeaders.addSecurityHeaders(queryValidation.error);
                 }
                 const { limit, cursor } = queryValidation.data;
-                const response = await commentHandler.getComments(postId, request, session, { limit, cursor }, env, requestContext);
+                const response = await commentHandler.getComments(postId, request, session, { limit, cursor }, env, requestContext, auth.activeTenantId);
                 return securityHeaders.addSecurityHeaders(response);
             }
             catch (error) {
@@ -90,12 +99,16 @@ exports.commentsRoutes = [
             if (!session) {
                 return securityHeaders.createSecureResponse(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "content-type": "application/json" } });
             }
+            const auth = await (0, auth_middleware_1.authMiddleware)(request, env);
+            if (!auth || !auth.activeTenantId) {
+                return securityHeaders.createSecureResponse(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "content-type": "application/json" } });
+            }
             try {
                 if (!requestContext) {
                     return securityHeaders.createSecureResponse(JSON.stringify({ error: "Request context not available" }), { status: 500, headers: { "content-type": "application/json" } });
                 }
                 const commentId = pathname.split("/api/comments/")[1].split("/hide")[0];
-                const response = await commentHandler.hideComment(commentId, request, session, env, requestContext);
+                const response = await commentHandler.hideComment(commentId, request, session, env, requestContext, auth.activeTenantId);
                 return securityHeaders.addSecurityHeaders(response);
             }
             catch (error) {
@@ -119,6 +132,10 @@ exports.commentsRoutes = [
             if (!session) {
                 return securityHeaders.createSecureResponse(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "content-type": "application/json" } });
             }
+            const auth = await (0, auth_middleware_1.authMiddleware)(request, env);
+            if (!auth || !auth.activeTenantId) {
+                return securityHeaders.createSecureResponse(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "content-type": "application/json" } });
+            }
             try {
                 if (!requestContext) {
                     return securityHeaders.createSecureResponse(JSON.stringify({ error: "Request context not available" }), { status: 500, headers: { "content-type": "application/json" } });
@@ -126,7 +143,7 @@ exports.commentsRoutes = [
                 const commentId = pathname
                     .split("/api/comments/")[1]
                     .split("/unhide")[0];
-                const response = await commentHandler.unhideComment(commentId, request, session, env, requestContext);
+                const response = await commentHandler.unhideComment(commentId, request, session, env, requestContext, auth.activeTenantId);
                 return securityHeaders.addSecurityHeaders(response);
             }
             catch (error) {
@@ -150,12 +167,16 @@ exports.commentsRoutes = [
             if (!session) {
                 return securityHeaders.createSecureResponse(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "content-type": "application/json" } });
             }
+            const auth = await (0, auth_middleware_1.authMiddleware)(request, env);
+            if (!auth || !auth.activeTenantId) {
+                return securityHeaders.createSecureResponse(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "content-type": "application/json" } });
+            }
             try {
                 if (!requestContext) {
                     return securityHeaders.createSecureResponse(JSON.stringify({ error: "Request context not available" }), { status: 500, headers: { "content-type": "application/json" } });
                 }
                 const commentId = pathname.split("/api/comments/")[1];
-                const response = await commentHandler.editComment(commentId, request, session, env, requestContext);
+                const response = await commentHandler.editComment(commentId, request, session, env, requestContext, auth.activeTenantId);
                 return securityHeaders.addSecurityHeaders(response);
             }
             catch (error) {
@@ -179,12 +200,16 @@ exports.commentsRoutes = [
             if (!session) {
                 return securityHeaders.createSecureResponse(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "content-type": "application/json" } });
             }
+            const auth = await (0, auth_middleware_1.authMiddleware)(request, env);
+            if (!auth || !auth.activeTenantId) {
+                return securityHeaders.createSecureResponse(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "content-type": "application/json" } });
+            }
             try {
                 if (!requestContext) {
                     return securityHeaders.createSecureResponse(JSON.stringify({ error: "Request context not available" }), { status: 500, headers: { "content-type": "application/json" } });
                 }
                 const commentId = pathname.split("/api/comments/")[1];
-                const response = await commentHandler.deleteComment(commentId, request, session, env, requestContext);
+                const response = await commentHandler.deleteComment(commentId, request, session, env, requestContext, auth.activeTenantId);
                 return securityHeaders.addSecurityHeaders(response);
             }
             catch (error) {
@@ -208,12 +233,16 @@ exports.commentsRoutes = [
             if (!session) {
                 return securityHeaders.createSecureResponse(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "content-type": "application/json" } });
             }
+            const auth = await (0, auth_middleware_1.authMiddleware)(request, env);
+            if (!auth || !auth.activeTenantId) {
+                return securityHeaders.createSecureResponse(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "content-type": "application/json" } });
+            }
             try {
                 if (!requestContext) {
                     return securityHeaders.createSecureResponse(JSON.stringify({ error: "Request context not available" }), { status: 500, headers: { "content-type": "application/json" } });
                 }
                 const parentCommentId = pathname.split("/api/comments/")[1].split("/replies")[0];
-                const response = await commentHandler.createReply(parentCommentId, request, session, env, requestContext);
+                const response = await commentHandler.createReply(parentCommentId, request, session, env, requestContext, auth.activeTenantId);
                 return securityHeaders.addSecurityHeaders(response);
             }
             catch (error) {