@de-otio/trellis 0.6.1 → 0.7.0

package/dist/lib/cognito/issuer-probe.js

@@ -0,0 +1,319 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isPrivateIPv4 = isPrivateIPv4;
+exports.isPrivateIPv6 = isPrivateIPv6;
+exports.probeOidcIssuer = probeOidcIssuer;
+/**
+ * OIDC issuer probe.
+ *
+ * Before registering an OIDC IdP with Cognito, GET the issuer's well-known
+ * configuration to confirm the URL points at a working OIDC provider.
+ *
+ * Security constraints (T5 — issuer probe is the trellis HTTP egress surface
+ * most exposed to admin-supplied URLs):
+ *  - HTTPS only.
+ *  - Hostname must resolve to a non-private, non-loopback, non-link-local IP
+ *    (RFC 6890). Both IPv4 and IPv6 are checked.
+ *  - HTTP redirects are rejected (`redirect: "manual"`); we never follow.
+ *  - Response body is capped at 1 MiB.
+ *  - Timeout 5 s.
+ *  - Body must be JSON with the required OIDC discovery fields.
+ */
+const node_dns_1 = require("node:dns");
+const node_net_1 = require("node:net");
+const undici_1 = require("undici");
+const PROBE_TIMEOUT_MS = 5000;
+const MAX_BODY_BYTES = 1024 * 1024;
+const MAX_ISSUER_URL_LENGTH = 2048;
+const WELL_KNOWN_PATH = "/.well-known/openid-configuration";
+function fail(reason, message) {
+    return { ok: false, reason, message };
+}
+function defaultResolve(hostname) {
+    return node_dns_1.promises.lookup(hostname, { all: true, verbatim: true })
+        .then((addrs) => addrs.map((a) => a.address));
+}
+/**
+ * Returns true if the IPv4 address is in any RFC 6890 special-purpose range
+ * we want to refuse: loopback, private, link-local, broadcast, etc.
+ */
+function isPrivateIPv4(ip) {
+    const m = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(ip);
+    if (!m)
+        return false;
+    const o = m.slice(1, 5).map((s) => Number(s));
+    if (o.some((x) => x < 0 || x > 255))
+        return true;
+    const [a, b] = [o[0], o[1]];
+    if (a === 0)
+        return true;
+    if (a === 10)
+        return true;
+    if (a === 127)
+        return true;
+    if (a === 169 && b === 254)
+        return true;
+    if (a === 172 && b >= 16 && b <= 31)
+        return true;
+    if (a === 192 && b === 0)
+        return true;
+    if (a === 192 && b === 168)
+        return true;
+    if (a === 198 && (b === 18 || b === 19))
+        return true;
+    if (a === 100 && b >= 64 && b <= 127)
+        return true;
+    if (a >= 224)
+        return true;
+    return false;
+}
+/**
+ * Returns true if the IPv6 address is in a private/loopback/link-local/etc.
+ * range. Performs a normalized prefix comparison; we expand `::` and ignore
+ * zone identifiers.
+ */
+function isPrivateIPv6(ip) {
+    if (!ip.includes(":"))
+        return false;
+    const stripped = ip.split("%")[0].toLowerCase();
+    if (stripped === "::1" || stripped === "::")
+        return true;
+    const segs = expandIPv6(stripped);
+    if (!segs)
+        return true;
+    if (segs[0] === 0 && segs.slice(0, 7).every((s) => s === 0) && segs[7] === 1)
+        return true;
+    if ((segs[0] & 0xfe00) === 0xfc00)
+        return true;
+    if ((segs[0] & 0xffc0) === 0xfe80)
+        return true;
+    if ((segs[0] & 0xff00) === 0xff00)
+        return true;
+    // 2001:db8::/32 — RFC 3849 documentation prefix; not routable, must not
+    // be reachable from the issuer probe.
+    if (segs[0] === 0x2001 && segs[1] === 0x0db8)
+        return true;
+    if (segs[0] === 0 &&
+        segs[1] === 0 &&
+        segs[2] === 0 &&
+        segs[3] === 0 &&
+        segs[4] === 0 &&
+        segs[5] === 0xffff) {
+        const v4 = `${(segs[6] >> 8) & 0xff}.${segs[6] & 0xff}.${(segs[7] >> 8) & 0xff}.${segs[7] & 0xff}`;
+        return isPrivateIPv4(v4);
+    }
+    return false;
+}
+function expandIPv6(ip) {
+    let work = ip;
+    let v4Tail = null;
+    const v4Match = /([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})$/.exec(work);
+    if (v4Match) {
+        const o = v4Match[1].split(".").map((s) => Number(s));
+        if (o.some((x) => Number.isNaN(x) || x < 0 || x > 255))
+            return null;
+        v4Tail = [(o[0] << 8) | o[1], (o[2] << 8) | o[3]];
+        work = work.slice(0, work.length - v4Match[1].length).replace(/:$/, "");
+    }
+    const parts = work.split("::");
+    if (parts.length > 2)
+        return null;
+    const head = parts[0] ? parts[0].split(":") : [];
+    const tail = parts.length === 2 && parts[1] ? parts[1].split(":") : [];
+    const totalAfterHeadTail = head.length + tail.length + (v4Tail ? 2 : 0);
+    const missing = 8 - totalAfterHeadTail;
+    if (parts.length === 2) {
+        if (missing < 0)
+            return null;
+    }
+    else if (missing !== 0) {
+        return null;
+    }
+    const fill = parts.length === 2 ? new Array(missing).fill("0") : [];
+    const filled = [...head, ...fill, ...tail];
+    const out = [];
+    for (const s of filled) {
+        if (!/^[0-9a-f]{0,4}$/.test(s))
+            return null;
+        out.push(parseInt(s || "0", 16));
+    }
+    if (v4Tail)
+        out.push(v4Tail[0], v4Tail[1]);
+    if (out.length !== 8)
+        return null;
+    return out;
+}
+/**
+ * Probe an OIDC issuer's well-known configuration. Returns a discriminated
+ * result; callers map failures onto 422 with a remediation message.
+ */
+async function probeOidcIssuer(issuerUrl, options = {}) {
+    const timeoutMs = options.timeoutMs ?? PROBE_TIMEOUT_MS;
+    if (issuerUrl.length > MAX_ISSUER_URL_LENGTH) {
+        return fail("INVALID_URL", "issuerUrl exceeds maximum length");
+    }
+    let url;
+    try {
+        url = new URL(issuerUrl);
+    }
+    catch {
+        return fail("INVALID_URL", "issuerUrl must be a valid absolute URL");
+    }
+    if (url.protocol !== "https:") {
+        return fail("INSECURE_SCHEME", "issuerUrl must use https://");
+    }
+    if (url.username || url.password) {
+        return fail("INVALID_URL", "issuerUrl must not include credentials");
+    }
+    const hostname = url.hostname.replace(/^\[|\]$/g, "");
+    const resolve = options.resolveHostname ?? defaultResolve;
+    let addresses;
+    try {
+        addresses = await resolve(hostname);
+    }
+    catch {
+        return fail("DNS_ERROR", "Could not resolve issuerUrl hostname");
+    }
+    if (addresses.length === 0) {
+        return fail("DNS_ERROR", "Could not resolve issuerUrl hostname");
+    }
+    for (const addr of addresses) {
+        if (addr.includes(":")) {
+            if (isPrivateIPv6(addr)) {
+                return fail("PRIVATE_HOST", "issuerUrl resolves to a private or loopback IP");
+            }
+        }
+        else {
+            if (isPrivateIPv4(addr)) {
+                return fail("PRIVATE_HOST", "issuerUrl resolves to a private or loopback IP");
+            }
+        }
+    }
+    // Pin the connect step to the IP we just validated. Without this, Node's
+    // fetch performs its own DNS lookup at request time, which lets a TTL=0
+    // attacker swap the public IP for a private one between validate and
+    // connect (DNS-rebinding TOCTOU).
+    const validatedIp = addresses[0];
+    const validatedFamily = (0, node_net_1.isIP)(validatedIp);
+    const baseHref = url.toString().endsWith("/") ? url.toString() : url.toString() + "/";
+    const probeUrl = baseHref + ".well-known/openid-configuration";
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    const factory = options.dispatcherFactory ?? defaultPinnedDispatcher;
+    let pinnedDispatcher;
+    if (validatedFamily === 4 || validatedFamily === 6) {
+        pinnedDispatcher = factory(validatedIp, validatedFamily);
+    }
+    try {
+        return await runProbe(probeUrl, fetchImpl, controller, timer, pinnedDispatcher);
+    }
+    finally {
+        if (pinnedDispatcher && typeof pinnedDispatcher.close === "function") {
+            await pinnedDispatcher
+                .close()
+                .catch(() => undefined);
+        }
+    }
+}
+function defaultPinnedDispatcher(validatedIp, family) {
+    return new undici_1.Agent({
+        connect: {
+            lookup: (_hostname, _opts, cb) => cb(null, validatedIp, family),
+        },
+    });
+}
+async function runProbe(probeUrl, fetchImpl, controller, timer, pinnedDispatcher) {
+    let response;
+    try {
+        const init = {
+            method: "GET",
+            redirect: "manual",
+            headers: { accept: "application/json" },
+            signal: controller.signal,
+        };
+        if (pinnedDispatcher) {
+            init.dispatcher = pinnedDispatcher;
+        }
+        response = await fetchImpl(probeUrl, init);
+    }
+    catch (err) {
+        clearTimeout(timer);
+        if (err.name === "AbortError") {
+            return fail("TIMEOUT", "Probe timed out");
+        }
+        return fail("NETWORK_ERROR", "Could not reach issuerUrl");
+    }
+    clearTimeout(timer);
+    if (response.status >= 300 && response.status < 400) {
+        return fail("REDIRECT_BLOCKED", "issuerUrl responded with a redirect; redirects are not followed");
+    }
+    if (!response.ok) {
+        return fail("HTTP_ERROR", `Issuer returned HTTP ${response.status}`);
+    }
+    const reader = response.body?.getReader();
+    if (!reader) {
+        return fail("NETWORK_ERROR", "Empty response body");
+    }
+    const chunks = [];
+    let total = 0;
+    try {
+        for (;;) {
+            const { value, done } = await reader.read();
+            if (done)
+                break;
+            if (value) {
+                total += value.length;
+                if (total > MAX_BODY_BYTES) {
+                    await reader.cancel().catch(() => { });
+                    return fail("BODY_TOO_LARGE", "Issuer response exceeded 1 MiB");
+                }
+                chunks.push(value);
+            }
+        }
+    }
+    catch {
+        return fail("NETWORK_ERROR", "Failed reading issuer response");
+    }
+    const body = new TextDecoder("utf-8").decode(concat(chunks));
+    let json;
+    try {
+        json = JSON.parse(body);
+    }
+    catch {
+        return fail("INVALID_JSON", "Issuer response was not valid JSON");
+    }
+    if (typeof json !== "object" || json === null || Array.isArray(json)) {
+        return fail("INVALID_JSON", "Issuer response was not a JSON object");
+    }
+    const conf = json;
+    const issuer = typeof conf.issuer === "string" ? conf.issuer : "";
+    const authorizationEndpoint = typeof conf.authorization_endpoint === "string" ? conf.authorization_endpoint : "";
+    const tokenEndpoint = typeof conf.token_endpoint === "string" ? conf.token_endpoint : "";
+    const jwksUri = typeof conf.jwks_uri === "string" ? conf.jwks_uri : "";
+    const userinfoEndpoint = typeof conf.userinfo_endpoint === "string" ? conf.userinfo_endpoint : undefined;
+    if (!issuer || !authorizationEndpoint || !tokenEndpoint || !jwksUri) {
+        return fail("MISSING_ENDPOINTS", "Issuer well-known is missing one of: issuer, authorization_endpoint, token_endpoint, jwks_uri");
+    }
+    return {
+        ok: true,
+        issuer,
+        authorizationEndpoint,
+        tokenEndpoint,
+        jwksUri,
+        ...(userinfoEndpoint ? { userinfoEndpoint } : {}),
+    };
+}
+function concat(chunks) {
+    let total = 0;
+    for (const c of chunks)
+        total += c.length;
+    const out = new Uint8Array(total);
+    let off = 0;
+    for (const c of chunks) {
+        out.set(c, off);
+        off += c.length;
+    }
+    return out;
+}
+//# sourceMappingURL=issuer-probe.js.map

package/dist/lib/cognito/issuer-probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"issuer-probe.js","sourceRoot":"","sources":["../../../src/lib/cognito/issuer-probe.ts"],"names":[],"mappings":";;AAoFA,sCAiBC;AAOD,sCAkCC;AAuCD,0CA8EC;AAnQD;;;;;;;;;;;;;;;GAeG;AACH,uCAA2C;AAC3C,uCAAgC;AAChC,mCAA+B;AAE/B,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAC9B,MAAM,cAAc,GAAG,IAAI,GAAG,IAAI,CAAC;AACnC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AACnC,MAAM,eAAe,GAAG,mCAAmC,CAAC;AAgD5D,SAAS,IAAI,CAAC,MAAgC,EAAE,OAAe;IAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACtC,OAAO,mBAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;SACvD,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,SAAgB,aAAa,CAAC,EAAU;IACtC,MAAM,CAAC,GAAG,8CAA8C,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClE,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAAC,EAAU;IACtC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,QAAQ,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC;IAEjD,IAAI,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEzD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1F,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,GAAG,MAAM,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAEhD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,GAAG,MAAM,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAEhD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,GAAG,MAAM,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAEhD,wEAAwE;IACxE,sCAAsC;IACtC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAE1D,IACE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QACb,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QACb,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QACb,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QACb,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QACb,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,EAClB,CAAC;QACD,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,CAAC,CAAE,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,CAAC,CAAE,GAAG,IAAI,EAAE,CAAC;QACvG,OAAO,aAAa,CAAC,EAAE,CAAC,CAAC;IAC3B,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,EAAU;IAC5B,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,MAAM,GAA4B,IAAI,CAAC;IAC3C,MAAM,OAAO,GAAG,mDAAmD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/E,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACpE,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;QACtD,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,MAAM,kBAAkB,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,CAAC,GAAG,kBAAkB,CAAC;IACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,IAAI,OAAO,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IAC/B,CAAC;SAAM,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAS,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5C,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,MAAM;QAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,eAAe,CACnC,SAAiB,EACjB,UAA8B,EAAE;IAEhC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,gBAAgB,CAAC;IAExD,IAAI,SAAS,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC,aAAa,EAAE,kCAAkC,CAAC,CAAC;IACjE,CAAC;IAED,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,aAAa,EAAE,wCAAwC,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC,iBAAiB,EAAE,6BAA6B,CAAC,CAAC;IAChE,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,aAAa,EAAE,wCAAwC,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,OAAO,CAAC,eAAe,IAAI,cAAc,CAAC;IAE1D,IAAI,SAAmB,CAAC;IACxB,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,WAAW,EAAE,sCAAsC,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC,WAAW,EAAE,sCAAsC,CAAC,CAAC;IACnE,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxB,OAAO,IAAI,CAAC,cAAc,EAAE,gDAAgD,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxB,OAAO,IAAI,CAAC,cAAc,EAAE,gDAAgD,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,wEAAwE;IACxE,qEAAqE;IACrE,kCAAkC;IAClC,MAAM,WAAW,GAAG,SAAS,CAAC,CAAC,CAAE,CAAC;IAClC,MAAM,eAAe,GAAG,IAAA,eAAI,EAAC,WAAW,CAAC,CAAC;IAE1C,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,GAAG,CAAC;IACtF,MAAM,QAAQ,GAAG,QAAQ,GAAG,kCAAkC,CAAC;IAE/D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAE9D,MAAM,OAAO,GAAG,OAAO,CAAC,iBAAiB,IAAI,uBAAuB,CAAC;IACrE,IAAI,gBAAyB,CAAC;IAC9B,IAAI,eAAe,KAAK,CAAC,IAAI,eAAe,KAAK,CAAC,EAAE,CAAC;QACnD,gBAAgB,GAAG,OAAO,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;IAC3D,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;IAClF,CAAC;YAAS,CAAC;QACT,IAAI,gBAAgB,IAAI,OAAQ,gBAAoD,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YAC1G,MAAO,gBAAmD;iBACvD,KAAK,EAAE;iBACP,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,WAAmB,EAAE,MAAa;IACjE,OAAO,IAAI,cAAK,CAAC;QACf,OAAO,EAAE;YACP,MAAM,EAAE,CACN,SAAiB,EACjB,KAAc,EACd,EAAgF,EAChF,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC;SACnC;KACF,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,QAAgB,EAChB,SAAuB,EACvB,UAA2B,EAC3B,KAAqB,EACrB,gBAAyB;IAEzB,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,IAAI,GAA2C;YACnD,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC;QACF,IAAI,gBAAgB,EAAE,CAAC;YACrB,IAAI,CAAC,UAAU,GAAG,gBAAgB,CAAC;QACrC,CAAC;QACD,QAAQ,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,IAAK,GAAyB,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,IAAI,CAAC,eAAe,EAAE,2BAA2B,CAAC,CAAC;IAC5D,CAAC;IACD,YAAY,CAAC,KAAK,CAAC,CAAC;IAEpB,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC,kBAAkB,EAAE,iEAAiE,CAAC,CAAC;IACrG,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC,YAAY,EAAE,wBAAwB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,IAAI,KAAK,EAAE,CAAC;gBACV,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;gBACtB,IAAI,KAAK,GAAG,cAAc,EAAE,CAAC;oBAC3B,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;oBACtC,OAAO,IAAI,CAAC,gBAAgB,EAAE,gCAAgC,CAAC,CAAC;gBAClE,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,eAAe,EAAE,gCAAgC,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7D,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,cAAc,EAAE,oCAAoC,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,OAAO,IAAI,CAAC,cAAc,EAAE,uCAAuC,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,IAAI,GAAG,IAA+B,CAAC;IAC7C,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,MAAM,qBAAqB,GACzB,OAAO,IAAI,CAAC,sBAAsB,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,CAAC;IACrF,MAAM,aAAa,GAAG,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;IACzF,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,MAAM,gBAAgB,GACpB,OAAO,IAAI,CAAC,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;IAElF,IAAI,CAAC,MAAM,IAAI,CAAC,qBAAqB,IAAI,CAAC,aAAa,IAAI,CAAC,OAAO,EAAE,CAAC;QACpE,OAAO,IAAI,CACT,mBAAmB,EACnB,+FAA+F,CAChG,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM;QACN,qBAAqB;QACrB,aAAa;QACb,OAAO;QACP,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,MAAoB;IAClC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAChB,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC;IAClB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/lib/comment-handler.d.ts

@@ -29,12 +29,12 @@ export declare class CommentHandler {
      *
      * PREPARATORY: Uses DataRouter for region-aware operations.
      */
-    createComment(postId: string, request: Request, session: Session, env: Env, requestContext: RequestContext, parentCommentId?: string): Promise<Response>;
+    createComment(postId: string, request: Request, session: Session, env: Env, requestContext: RequestContext, activeTenantId: string, parentCommentId?: string): Promise<Response>;
     /**
      * Create a reply to an existing comment
      * Uses the existing createComment() logic with parentCommentId
      */
-    createReply(parentCommentId: string, request: Request, session: Session, env: Env, requestContext: RequestContext): Promise<Response>;
+    createReply(parentCommentId: string, request: Request, session: Session, env: Env, requestContext: RequestContext, activeTenantId: string): Promise<Response>;
     /**
      * Get comments for a post
      *
@@ -43,32 +43,32 @@ export declare class CommentHandler {
     getComments(postId: string, request: Request, session: Session, options: {
         limit?: number;
         cursor?: string;
-    }, env: Env, requestContext: RequestContext): Promise<Response>;
+    }, env: Env, requestContext: RequestContext, activeTenantId: string): Promise<Response>;
     /**
      * Hide a comment
      *
      * PREPARATORY: Uses DataRouter for region-aware operations.
      */
-    hideComment(commentId: string, request: Request, session: Session, env: Env, requestContext: RequestContext): Promise<Response>;
+    hideComment(commentId: string, request: Request, session: Session, env: Env, requestContext: RequestContext, activeTenantId: string): Promise<Response>;
     /**
      * Unhide a comment
      *
      * PREPARATORY: Uses DataRouter for region-aware operations.
      */
-    unhideComment(commentId: string, request: Request, session: Session, env: Env, requestContext: RequestContext): Promise<Response>;
+    unhideComment(commentId: string, request: Request, session: Session, env: Env, requestContext: RequestContext, activeTenantId: string): Promise<Response>;
     /**
      * Edit a comment (15-minute window)
      *
      * PREPARATORY: Uses DataRouter for region-aware operations.
      */
-    editComment(commentId: string, request: Request, session: Session, env: Env, requestContext: RequestContext): Promise<Response>;
+    editComment(commentId: string, request: Request, session: Session, env: Env, requestContext: RequestContext, activeTenantId: string): Promise<Response>;
     /**
      * Delete a comment (soft delete)
      *
      * Author or post owner can delete.
      * PREPARATORY: Uses DataRouter for region-aware operations.
      */
-    deleteComment(commentId: string, request: Request, session: Session, env: Env, requestContext: RequestContext): Promise<Response>;
+    deleteComment(commentId: string, request: Request, session: Session, env: Env, requestContext: RequestContext, activeTenantId: string): Promise<Response>;
     /**
      * Invalidate comment cache
      */

package/dist/lib/comment-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"comment-handler.d.ts","sourceRoot":"","sources":["../../src/lib/comment-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAA6B,MAAM,4BAA4B,CAAC;AAczF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,WAAW,GAAG;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mBAAmB,CAAC,EAAE,WAAW,CAAC;IAClC,aAAa,CAAC,EAAE,WAAW,CAAC;IAC5B,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,gBAAgB,CAAC,EAAE,GAAG,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,KAAK,CAAC;QACZ,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAClB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC,CAAC;CACJ;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,iBAAiB,CAAoB;;IAO7C;;;;OAIG;IACG,aAAa,CACjB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,cAAc,EAAE,cAAc,EAC9B,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,QAAQ,CAAC;IAqepB;;;OAGG;IACG,WAAW,CACf,eAAe,EAAE,MAAM,EACvB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,cAAc,EAAE,cAAc,GAC7B,OAAO,CAAC,QAAQ,CAAC;IAkEpB;;;;OAIG;IACG,WAAW,CACf,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,EAC5C,GAAG,EAAE,GAAG,EACR,cAAc,EAAE,cAAc,GAC7B,OAAO,CAAC,QAAQ,CAAC;IAyLpB;;;;OAIG;IACG,WAAW,CACf,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,cAAc,EAAE,cAAc,GAC7B,OAAO,CAAC,QAAQ,CAAC;IAoGpB;;;;OAIG;IACG,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,cAAc,EAAE,cAAc,GAC7B,OAAO,CAAC,QAAQ,CAAC;IAoGpB;;;;OAIG;IACG,WAAW,CACf,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,cAAc,EAAE,cAAc,GAC7B,OAAO,CAAC,QAAQ,CAAC;IAqKpB;;;;;OAKG;IACG,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,cAAc,EAAE,cAAc,GAC7B,OAAO,CAAC,QAAQ,CAAC;IA4GpB;;OAEG;YACW,sBAAsB;CAgBrC"}
+{"version":3,"file":"comment-handler.d.ts","sourceRoot":"","sources":["../../src/lib/comment-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAA6B,MAAM,4BAA4B,CAAC;AAczF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,WAAW,GAAG;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mBAAmB,CAAC,EAAE,WAAW,CAAC;IAClC,aAAa,CAAC,EAAE,WAAW,CAAC;IAC5B,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,gBAAgB,CAAC,EAAE,GAAG,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,KAAK,CAAC;QACZ,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAClB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC,CAAC;CACJ;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,iBAAiB,CAAoB;;IAO7C;;;;OAIG;IACG,aAAa,CACjB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,cAAc,EAAE,cAAc,EAC9B,cAAc,EAAE,MAAM,EACtB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,QAAQ,CAAC;IAuepB;;;OAGG;IACG,WAAW,CACf,eAAe,EAAE,MAAM,EACvB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,cAAc,EAAE,cAAc,EAC9B,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,QAAQ,CAAC;IAmEpB;;;;OAIG;IACG,WAAW,CACf,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,EAC5C,GAAG,EAAE,GAAG,EACR,cAAc,EAAE,cAAc,EAC9B,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,QAAQ,CAAC;IA0LpB;;;;OAIG;IACG,WAAW,CACf,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,cAAc,EAAE,cAAc,EAC9B,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,QAAQ,CAAC;IAoGpB;;;;OAIG;IACG,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,cAAc,EAAE,cAAc,EAC9B,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,QAAQ,CAAC;IAoGpB;;;;OAIG;IACG,WAAW,CACf,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,cAAc,EAAE,cAAc,EAC9B,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,QAAQ,CAAC;IAqKpB;;;;;OAKG;IACG,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,cAAc,EAAE,cAAc,EAC9B,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,QAAQ,CAAC;IA4GpB;;OAEG;YACW,sBAAsB;CAgBrC"}

package/dist/lib/comment-handler.js

@@ -56,7 +56,7 @@ class CommentHandler {
      *
      * PREPARATORY: Uses DataRouter for region-aware operations.
      */
-    async createComment(postId, request, session, env, requestContext, parentCommentId) {
+    async createComment(postId, request, session, env, requestContext, activeTenantId, parentCommentId) {
         try {
             // Validate request body with Zod schema
             const { validateRequest } = await Promise.resolve().then(() => __importStar(require("./validate-request")));
@@ -179,8 +179,8 @@ class CommentHandler {
             if (parentCommentId) {
                 // Fetch parent comment to get thread context
                 const parentComment = await withQueryTimeoutAndRetry(sharedDatabaseConnectionManager, region, env, async (db) => {
-                    return await db.postComment.findUnique({
-                        where: { id: parentCommentId },
+                    return await db.postComment.findFirst({
+                        where: { id: parentCommentId, tenantId: activeTenantId },
                         select: {
                             id: true,
                             postId: true,
@@ -226,6 +226,7 @@ class CommentHandler {
                 return await db.postComment.findFirst({
                     where: {
                         postId: post.id,
+                        tenantId: activeTenantId,
                         authorId: session.userId,
                         text: sanitizedText.trim(),
                         createdAt: { gte: fiveMinutesAgo },
@@ -278,6 +279,7 @@ class CommentHandler {
                         hasBlockedLinks: hasBlockedLinks,
                         rootUri: rootUri,
                         replyToUri: replyToUri,
+                        tenantId: activeTenantId,
                     },
                 });
             }, {
@@ -404,15 +406,15 @@ class CommentHandler {
      * Create a reply to an existing comment
      * Uses the existing createComment() logic with parentCommentId
      */
-    async createReply(parentCommentId, request, session, env, requestContext) {
+    async createReply(parentCommentId, request, session, env, requestContext, activeTenantId) {
         try {
             // Fetch parent comment to get postId and validate it exists
             const { sharedDatabaseConnectionManager } = await Promise.resolve().then(() => __importStar(require("./database-connection-manager")));
             const { withQueryTimeoutAndRetry, QueryTimeoutPresets } = await Promise.resolve().then(() => __importStar(require("./db-query-helper")));
             const region = requestContext.region;
             const parentComment = await withQueryTimeoutAndRetry(sharedDatabaseConnectionManager, region, env, async (db) => {
-                return await db.postComment.findUnique({
-                    where: { id: parentCommentId },
+                return await db.postComment.findFirst({
+                    where: { id: parentCommentId, tenantId: activeTenantId },
                     select: { postId: true, deletedAt: true },
                 });
             }, {
@@ -432,7 +434,7 @@ class CommentHandler {
                 return new Response(JSON.stringify({ error: "Cannot reply to deleted comment" }), { status: 400, headers: { "content-type": "application/json" } });
             }
             // Delegate to createComment() with parentCommentId
-            return this.createComment(parentComment.postId, request, session, env, requestContext, parentCommentId);
+            return this.createComment(parentComment.postId, request, session, env, requestContext, activeTenantId, parentCommentId);
         }
         catch (error) {
             const { Logger } = await Promise.resolve().then(() => __importStar(require("./logger")));
@@ -445,7 +447,7 @@ class CommentHandler {
      *
      * PREPARATORY: Uses DataRouter for region-aware operations.
      */
-    async getComments(postId, request, session, options, env, requestContext) {
+    async getComments(postId, request, session, options, env, requestContext, activeTenantId) {
         try {
             // PREPARATORY: Use DataRouter to get region-specific database
             const region = requestContext.region;
@@ -468,6 +470,7 @@ class CommentHandler {
                 return await db.postComment.findMany({
                     where: {
                         postId,
+                        tenantId: activeTenantId,
                         hiddenByPostOwner: false,
                         deletedAt: null, // Filter out soft-deleted comments
                         ...(cursor && { createdAt: { lt: cursor } }),
@@ -585,7 +588,7 @@ class CommentHandler {
      *
      * PREPARATORY: Uses DataRouter for region-aware operations.
      */
-    async hideComment(commentId, request, session, env, requestContext) {
+    async hideComment(commentId, request, session, env, requestContext, activeTenantId) {
         try {
             // PREPARATORY: Use DataRouter to get region-specific database
             const region = requestContext.region;
@@ -593,8 +596,8 @@ class CommentHandler {
             const { sharedDatabaseConnectionManager } = await Promise.resolve().then(() => __importStar(require("./database-connection-manager")));
             const { withQueryTimeoutAndRetry, QueryTimeoutPresets } = await Promise.resolve().then(() => __importStar(require("./db-query-helper")));
             const comment = await withQueryTimeoutAndRetry(sharedDatabaseConnectionManager, region, env, async (db) => {
-                return await db.postComment.findUnique({
-                    where: { id: commentId },
+                return await db.postComment.findFirst({
+                    where: { id: commentId, tenantId: activeTenantId },
                     include: { post: true },
                 });
             }, {
@@ -662,7 +665,7 @@ class CommentHandler {
      *
      * PREPARATORY: Uses DataRouter for region-aware operations.
      */
-    async unhideComment(commentId, request, session, env, requestContext) {
+    async unhideComment(commentId, request, session, env, requestContext, activeTenantId) {
         try {
             // PREPARATORY: Use DataRouter to get region-specific database
             const region = requestContext.region;
@@ -670,8 +673,8 @@ class CommentHandler {
             const { sharedDatabaseConnectionManager } = await Promise.resolve().then(() => __importStar(require("./database-connection-manager")));
             const { withQueryTimeoutAndRetry, QueryTimeoutPresets } = await Promise.resolve().then(() => __importStar(require("./db-query-helper")));
             const comment = await withQueryTimeoutAndRetry(sharedDatabaseConnectionManager, region, env, async (db) => {
-                return await db.postComment.findUnique({
-                    where: { id: commentId },
+                return await db.postComment.findFirst({
+                    where: { id: commentId, tenantId: activeTenantId },
                     include: { post: true },
                 });
             }, {
@@ -736,7 +739,7 @@ class CommentHandler {
      *
      * PREPARATORY: Uses DataRouter for region-aware operations.
      */
-    async editComment(commentId, request, session, env, requestContext) {
+    async editComment(commentId, request, session, env, requestContext, activeTenantId) {
         try {
             // Validate request body
             const { validateRequest } = await Promise.resolve().then(() => __importStar(require("./validate-request")));
@@ -754,8 +757,8 @@ class CommentHandler {
             const { withQueryTimeoutAndRetry, QueryTimeoutPresets } = await Promise.resolve().then(() => __importStar(require("./db-query-helper")));
             // Get comment with post info
             const comment = await withQueryTimeoutAndRetry(sharedDatabaseConnectionManager, region, env, async (db) => {
-                return await db.postComment.findUnique({
-                    where: { id: commentId },
+                return await db.postComment.findFirst({
+                    where: { id: commentId, tenantId: activeTenantId },
                     include: { post: { select: { id: true, authorId: true } } },
                 });
             }, {
@@ -859,15 +862,15 @@ class CommentHandler {
      * Author or post owner can delete.
      * PREPARATORY: Uses DataRouter for region-aware operations.
      */
-    async deleteComment(commentId, request, session, env, requestContext) {
+    async deleteComment(commentId, request, session, env, requestContext, activeTenantId) {
         try {
             const region = requestContext.region;
             const { sharedDatabaseConnectionManager } = await Promise.resolve().then(() => __importStar(require("./database-connection-manager")));
             const { withQueryTimeoutAndRetry, QueryTimeoutPresets } = await Promise.resolve().then(() => __importStar(require("./db-query-helper")));
             // Get comment with post info
             const comment = await withQueryTimeoutAndRetry(sharedDatabaseConnectionManager, region, env, async (db) => {
-                return await db.postComment.findUnique({
-                    where: { id: commentId },
+                return await db.postComment.findFirst({
+                    where: { id: commentId, tenantId: activeTenantId },
                     include: {
                         post: { select: { id: true, authorId: true } },
                     },