@de-otio/trellis 0.6.1 → 0.7.1

package/dist/lib/user-deprovisioning.js

@@ -12,6 +12,7 @@ const database_connection_manager_1 = require("./database-connection-manager");
 const db_query_helper_1 = require("./db-query-helper");
 const security_monitor_1 = require("./security-monitor");
 const logger_1 = require("./logger");
+const claims_cache_1 = require("./auth/claims-cache");
 /**
  * User Deprovisioning Handler
  */
@@ -29,6 +30,11 @@ class UserDeprovisioning {
     async suspendUser(userId, reason, env) {
         const db = (0, db_1.createPrisma)(env);
         try {
+            // Fetch cognitoSub before update so we can invalidate the claim cache.
+            const userRow = await db.user.findUnique({
+                where: { id: userId },
+                select: { cognitoSub: true },
+            });
             // Update user to suspended
             await db.user.update({
                 where: { id: userId },
@@ -38,6 +44,18 @@ class UserDeprovisioning {
                     suspendedReason: `${reason.type}: ${reason.description}`,
                 },
             });
+            // Invalidate DDB claim cache so the next token refresh reflects the suspension.
+            // Mitigation for G2 H3: suspended users that still have a cached token would
+            // bypass the suspension check for up to CACHE_TTL seconds without this call.
+            if (userRow?.cognitoSub) {
+                try {
+                    const cache = (0, claims_cache_1.createClaimsCacheFromEnv)();
+                    await cache.invalidate(userRow.cognitoSub);
+                }
+                catch {
+                    // Best-effort — don't block suspension if DDB is unavailable.
+                }
+            }
             // Log security event
             await this.securityMonitor.logSecurityEvent({
                 type: "suspicious_activity",
@@ -59,7 +77,17 @@ class UserDeprovisioning {
         }
     }
     /**
-     * Check if user is suspended
+     * Check if user is suspended.
+     *
+     * Fail-open is intentional and required: this is a best-effort hint used by
+     * non-critical paths (e.g. surfacing a banner to operators). The
+     * authoritative gate is the pre-token-generation Lambda, which already
+     * blocks token issuance for suspended users on the next refresh
+     * (see lambda/pre-token-generation.ts — the cache TTL bounds the
+     * window). Failing closed here would convert a transient RDS hiccup
+     * into a denial-of-service against legitimate users; the security
+     * properties hold via the pre-token path. Do not change to fail-closed
+     * without first moving the authoritative check off the RDS critical path.
      */
     async isUserSuspended(userId, env, region = "US") {
         try {
@@ -82,7 +110,8 @@ class UserDeprovisioning {
         }
         catch (error) {
             this.logger.error("[UserDeprovisioning] Failed to check suspension status:", error);
-            return false; // Fail open - don't block if check fails
+            // Fail open — see method-level docstring above for rationale.
+            return false;
         }
     }
     /**
@@ -91,6 +120,11 @@ class UserDeprovisioning {
     async restoreUser(userId, reason, initiatedBy, env) {
         const db = (0, db_1.createPrisma)(env);
         try {
+            // Fetch cognitoSub before update so we can invalidate the claim cache.
+            const userRow = await db.user.findUnique({
+                where: { id: userId },
+                select: { cognitoSub: true },
+            });
             await db.user.update({
                 where: { id: userId },
                 data: {
@@ -99,6 +133,16 @@ class UserDeprovisioning {
                     suspendedReason: null,
                 },
             });
+            // Invalidate DDB claim cache so the next token refresh can succeed with restored status.
+            if (userRow?.cognitoSub) {
+                try {
+                    const cache = (0, claims_cache_1.createClaimsCacheFromEnv)();
+                    await cache.invalidate(userRow.cognitoSub);
+                }
+                catch {
+                    // Best-effort.
+                }
+            }
             // Log security event
             await this.securityMonitor.logSecurityEvent({
                 type: "suspicious_activity",

package/dist/lib/user-deprovisioning.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-deprovisioning.js","sourceRoot":"","sources":["../../src/lib/user-deprovisioning.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAEH,8BAAqC;AACrC,+EAAgF;AAChF,uDAG2B;AAC3B,yDAAqD;AACrD,qCAAkD;AAalD;;GAEG;AACH,MAAa,kBAAkB;IACrB,eAAe,CAAkB;IACjC,MAAM,CAAS;IAEvB,YAAY,GAAe;QACzB,IAAI,CAAC,eAAe,GAAG,IAAI,kCAAe,EAAE,CAAC;QAC7C,IAAI,CAAC,MAAM,GAAG,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CACf,MAAc,EACd,MAAyB,EACzB,GAAQ;QAER,MAAM,EAAE,GAAG,IAAA,iBAAY,EAAC,GAAG,CAAC,CAAC;QAE7B,IAAI,CAAC;YACH,2BAA2B;YAC3B,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;gBACnB,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;gBACrB,IAAI,EAAE;oBACJ,SAAS,EAAE,IAAI;oBACf,WAAW,EAAE,IAAI,IAAI,EAAE;oBACvB,eAAe,EAAE,GAAG,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,WAAW,EAAE;iBACzD;aACF,CAAC,CAAC;YAEH,qBAAqB;YACrB,MAAM,IAAI,CAAC,eAAe,CAAC,gBAAgB,CACzC;gBACE,IAAI,EAAE,qBAAqB;gBAC3B,QAAQ,EAAE,MAAM;gBAChB,MAAM;gBACN,OAAO,EAAE,KAAK;gBACd,QAAQ,EAAE;oBACR,MAAM,EAAE,gBAAgB;oBACxB,MAAM,EAAE,MAAM,CAAC,IAAI;oBACnB,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,WAAW,EAAE,MAAM,CAAC,WAAW;iBAChC;aACF,EACD,GAAG,CACJ,CAAC;YAEF,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,6BAA6B,MAAM,eAAe,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,WAAW,EAAE,CACxF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8CAA8C,EAAE,KAAK,CAAC,CAAC;YACzE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CACnB,MAAc,EACd,GAAQ,EACR,SAAiB,IAAI;QAErB,IAAI,CAAC;YACH,qCAAqC;YACrC,MAAM,SAAS,GAAG,6DAA+B,CAAC;YAElD,MAAM,IAAI,GAAG,MAAM,IAAA,0CAAwB,EAGzC,SAAS,EACT,MAAM,EACN,GAAG,EACH,KAAK,EAAE,MAAM,EAAE,EAAE;gBACf,OAAO,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;oBAC5B,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;oBACrB,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;iBAC5B,CAAC,CAAC;YACL,CAAC,EACD;gBACE,GAAG,qCAAmB,CAAC,QAAQ,EAAE,6CAA6C;gBAC9E,YAAY,EAAE,IAAI,EAAE,8DAA8D;gBAClF,OAAO,EAAE;oBACP,SAAS,EAAE,iBAAiB;oBAC5B,MAAM;iBACP;aACF,CACF,CAAC;YAEF,OAAO,IAAI,IAAI,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;QAC9D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,yDAAyD,EACzD,KAAK,CACN,CAAC;YACF,OAAO,KAAK,CAAC,CAAC,yCAAyC;QACzD,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CACf,MAAc,EACd,MAAc,EACd,WAAmB,EACnB,GAAQ;QAER,MAAM,EAAE,GAAG,IAAA,iBAAY,EAAC,GAAG,CAAC,CAAC;QAE7B,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;gBACnB,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;gBACrB,IAAI,EAAE;oBACJ,SAAS,EAAE,KAAK;oBAChB,WAAW,EAAE,IAAI;oBACjB,eAAe,EAAE,IAAI;iBACtB;aACF,CAAC,CAAC;YAEH,qBAAqB;YACrB,MAAM,IAAI,CAAC,eAAe,CAAC,gBAAgB,CACzC;gBACE,IAAI,EAAE,qBAAqB;gBAC3B,QAAQ,EAAE,QAAQ;gBAClB,MAAM;gBACN,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE;oBACR,MAAM,EAAE,eAAe;oBACvB,MAAM;oBACN,WAAW;iBACZ;aACF,EACD,GAAG,CACJ,CAAC;YAEF,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,6BAA6B,MAAM,gBAAgB,WAAW,KAAK,MAAM,EAAE,CAC5E,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8CAA8C,EAAE,KAAK,CAAC,CAAC;YACzE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,oBAAoB,CACxB,MAAc,EACd,QAAgB,EAChB,GAAQ;QAER,+DAA+D;QAC/D,8DAA8D;QAC9D,sDAAsD;QAEtD,sEAAsE;QACtE,oCAAoC;QACpC,kDAAkD;QAClD,8DAA8D;QAC9D,4DAA4D;QAE5D,OAAO,IAAI,CAAC,CAAC,6BAA6B;IAC5C,CAAC;CACF;AAxKD,gDAwKC"}
+{"version":3,"file":"user-deprovisioning.js","sourceRoot":"","sources":["../../src/lib/user-deprovisioning.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAEH,8BAAqC;AACrC,+EAAgF;AAChF,uDAG2B;AAC3B,yDAAqD;AACrD,qCAAkD;AAClD,sDAA+D;AAa/D;;GAEG;AACH,MAAa,kBAAkB;IACrB,eAAe,CAAkB;IACjC,MAAM,CAAS;IAEvB,YAAY,GAAe;QACzB,IAAI,CAAC,eAAe,GAAG,IAAI,kCAAe,EAAE,CAAC;QAC7C,IAAI,CAAC,MAAM,GAAG,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CACf,MAAc,EACd,MAAyB,EACzB,GAAQ;QAER,MAAM,EAAE,GAAG,IAAA,iBAAY,EAAC,GAAG,CAAC,CAAC;QAE7B,IAAI,CAAC;YACH,uEAAuE;YACvE,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC;gBACvC,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;gBACrB,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;aAC7B,CAAC,CAAC;YAEH,2BAA2B;YAC3B,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;gBACnB,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;gBACrB,IAAI,EAAE;oBACJ,SAAS,EAAE,IAAI;oBACf,WAAW,EAAE,IAAI,IAAI,EAAE;oBACvB,eAAe,EAAE,GAAG,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,WAAW,EAAE;iBACzD;aACF,CAAC,CAAC;YAEH,gFAAgF;YAChF,6EAA6E;YAC7E,6EAA6E;YAC7E,IAAI,OAAO,EAAE,UAAU,EAAE,CAAC;gBACxB,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,IAAA,uCAAwB,GAAE,CAAC;oBACzC,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;gBAC7C,CAAC;gBAAC,MAAM,CAAC;oBACP,8DAA8D;gBAChE,CAAC;YACH,CAAC;YAED,qBAAqB;YACrB,MAAM,IAAI,CAAC,eAAe,CAAC,gBAAgB,CACzC;gBACE,IAAI,EAAE,qBAAqB;gBAC3B,QAAQ,EAAE,MAAM;gBAChB,MAAM;gBACN,OAAO,EAAE,KAAK;gBACd,QAAQ,EAAE;oBACR,MAAM,EAAE,gBAAgB;oBACxB,MAAM,EAAE,MAAM,CAAC,IAAI;oBACnB,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,WAAW,EAAE,MAAM,CAAC,WAAW;iBAChC;aACF,EACD,GAAG,CACJ,CAAC;YAEF,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,6BAA6B,MAAM,eAAe,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,WAAW,EAAE,CACxF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8CAA8C,EAAE,KAAK,CAAC,CAAC;YACzE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,eAAe,CACnB,MAAc,EACd,GAAQ,EACR,SAAiB,IAAI;QAErB,IAAI,CAAC;YACH,qCAAqC;YACrC,MAAM,SAAS,GAAG,6DAA+B,CAAC;YAElD,MAAM,IAAI,GAAG,MAAM,IAAA,0CAAwB,EAGzC,SAAS,EACT,MAAM,EACN,GAAG,EACH,KAAK,EAAE,MAAM,EAAE,EAAE;gBACf,OAAO,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;oBAC5B,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;oBACrB,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;iBAC5B,CAAC,CAAC;YACL,CAAC,EACD;gBACE,GAAG,qCAAmB,CAAC,QAAQ,EAAE,6CAA6C;gBAC9E,YAAY,EAAE,IAAI,EAAE,8DAA8D;gBAClF,OAAO,EAAE;oBACP,SAAS,EAAE,iBAAiB;oBAC5B,MAAM;iBACP;aACF,CACF,CAAC;YAEF,OAAO,IAAI,IAAI,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;QAC9D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,yDAAyD,EACzD,KAAK,CACN,CAAC;YACF,8DAA8D;YAC9D,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CACf,MAAc,EACd,MAAc,EACd,WAAmB,EACnB,GAAQ;QAER,MAAM,EAAE,GAAG,IAAA,iBAAY,EAAC,GAAG,CAAC,CAAC;QAE7B,IAAI,CAAC;YACH,uEAAuE;YACvE,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC;gBACvC,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;gBACrB,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;aAC7B,CAAC,CAAC;YAEH,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;gBACnB,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;gBACrB,IAAI,EAAE;oBACJ,SAAS,EAAE,KAAK;oBAChB,WAAW,EAAE,IAAI;oBACjB,eAAe,EAAE,IAAI;iBACtB;aACF,CAAC,CAAC;YAEH,yFAAyF;YACzF,IAAI,OAAO,EAAE,UAAU,EAAE,CAAC;gBACxB,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,IAAA,uCAAwB,GAAE,CAAC;oBACzC,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;gBAC7C,CAAC;gBAAC,MAAM,CAAC;oBACP,eAAe;gBACjB,CAAC;YACH,CAAC;YAED,qBAAqB;YACrB,MAAM,IAAI,CAAC,eAAe,CAAC,gBAAgB,CACzC;gBACE,IAAI,EAAE,qBAAqB;gBAC3B,QAAQ,EAAE,QAAQ;gBAClB,MAAM;gBACN,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE;oBACR,MAAM,EAAE,eAAe;oBACvB,MAAM;oBACN,WAAW;iBACZ;aACF,EACD,GAAG,CACJ,CAAC;YAEF,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,6BAA6B,MAAM,gBAAgB,WAAW,KAAK,MAAM,EAAE,CAC5E,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8CAA8C,EAAE,KAAK,CAAC,CAAC;YACzE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,oBAAoB,CACxB,MAAc,EACd,QAAgB,EAChB,GAAQ;QAER,+DAA+D;QAC/D,8DAA8D;QAC9D,sDAAsD;QAEtD,sEAAsE;QACtE,oCAAoC;QACpC,kDAAkD;QAClD,8DAA8D;QAC9D,4DAA4D;QAE5D,OAAO,IAAI,CAAC,CAAC,6BAA6B;IAC5C,CAAC;CACF;AArND,gDAqNC"}

package/dist/lib/validation/feature-toggle-schemas.d.ts

@@ -110,7 +110,7 @@ export declare const FeatureToggleStateConfigSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     region: "US" | "EU" | "CN";
     enabled: boolean;
-    state: "ENABLED" | "DISABLED" | "GRADUAL";
+    state: "DISABLED" | "ENABLED" | "GRADUAL";
     percentage: number;
     targeting?: {
         value: string;
@@ -120,7 +120,7 @@ export declare const FeatureToggleStateConfigSchema: z.ZodObject<{
 }, {
     region: "US" | "EU" | "CN";
     enabled: boolean;
-    state: "ENABLED" | "DISABLED" | "GRADUAL";
+    state: "DISABLED" | "ENABLED" | "GRADUAL";
     percentage: number;
     targeting?: {
         value: string;
@@ -166,7 +166,7 @@ export declare const CreateToggleSchema: z.ZodEffects<z.ZodObject<{
     }, "strip", z.ZodTypeAny, {
         region: "US" | "EU" | "CN";
         enabled: boolean;
-        state: "ENABLED" | "DISABLED" | "GRADUAL";
+        state: "DISABLED" | "ENABLED" | "GRADUAL";
         percentage: number;
         targeting?: {
             value: string;
@@ -176,7 +176,7 @@ export declare const CreateToggleSchema: z.ZodEffects<z.ZodObject<{
     }, {
         region: "US" | "EU" | "CN";
         enabled: boolean;
-        state: "ENABLED" | "DISABLED" | "GRADUAL";
+        state: "DISABLED" | "ENABLED" | "GRADUAL";
         percentage: number;
         targeting?: {
             value: string;
@@ -193,7 +193,7 @@ export declare const CreateToggleSchema: z.ZodEffects<z.ZodObject<{
     initialStates?: {
         region: "US" | "EU" | "CN";
         enabled: boolean;
-        state: "ENABLED" | "DISABLED" | "GRADUAL";
+        state: "DISABLED" | "ENABLED" | "GRADUAL";
         percentage: number;
         targeting?: {
             value: string;
@@ -210,7 +210,7 @@ export declare const CreateToggleSchema: z.ZodEffects<z.ZodObject<{
     initialStates?: {
         region: "US" | "EU" | "CN";
         enabled: boolean;
-        state: "ENABLED" | "DISABLED" | "GRADUAL";
+        state: "DISABLED" | "ENABLED" | "GRADUAL";
         percentage: number;
         targeting?: {
             value: string;
@@ -227,7 +227,7 @@ export declare const CreateToggleSchema: z.ZodEffects<z.ZodObject<{
     initialStates?: {
         region: "US" | "EU" | "CN";
         enabled: boolean;
-        state: "ENABLED" | "DISABLED" | "GRADUAL";
+        state: "DISABLED" | "ENABLED" | "GRADUAL";
         percentage: number;
         targeting?: {
             value: string;
@@ -244,7 +244,7 @@ export declare const CreateToggleSchema: z.ZodEffects<z.ZodObject<{
     initialStates?: {
         region: "US" | "EU" | "CN";
         enabled: boolean;
-        state: "ENABLED" | "DISABLED" | "GRADUAL";
+        state: "DISABLED" | "ENABLED" | "GRADUAL";
         percentage: number;
         targeting?: {
             value: string;
@@ -317,7 +317,7 @@ export declare const UpdateToggleStateSchema: z.ZodObject<{
     region: "US" | "EU" | "CN";
     reason?: string | undefined;
     enabled?: boolean | undefined;
-    state?: "ENABLED" | "DISABLED" | "GRADUAL" | undefined;
+    state?: "DISABLED" | "ENABLED" | "GRADUAL" | undefined;
     percentage?: number | undefined;
     targeting?: {
         value: string;
@@ -328,7 +328,7 @@ export declare const UpdateToggleStateSchema: z.ZodObject<{
     region: "US" | "EU" | "CN";
     reason?: string | undefined;
     enabled?: boolean | undefined;
-    state?: "ENABLED" | "DISABLED" | "GRADUAL" | undefined;
+    state?: "DISABLED" | "ENABLED" | "GRADUAL" | undefined;
     percentage?: number | undefined;
     targeting?: {
         value: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@de-otio/trellis",
-  "version": "0.6.1",
+  "version": "0.7.1",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "files": [
@@ -20,6 +20,7 @@
     "test:coverage": "vitest run --coverage",
     "test:integration": "vitest run --config vitest.integration.config.ts",
     "test:graph": "vitest run --config vitest.graph.config.ts",
+    "test:schema": "vitest run --config vitest.schema.config.ts",
     "test:e2e": "vitest run --config vitest.e2e.config.ts",
     "test:e2e:smoke": "E2E_SHARD=smoke vitest run --config vitest.e2e.smoke.config.ts",
     "test:e2e:crud": "E2E_SHARD=crud E2E_USER_COUNT=2 vitest run --config vitest.e2e.crud.config.ts",
@@ -39,6 +40,8 @@
   },
   "dependencies": {
     "@aws-sdk/client-cloudwatch": "^3.1014.0",
+    "@aws-sdk/client-cloudwatch-logs": "^3.0.0",
+    "@aws-sdk/client-cognito-identity-provider": "^3.1009.0",
     "@aws-sdk/client-dynamodb": "^3.0.0",
     "@aws-sdk/client-s3": "^3.0.0",
     "@aws-sdk/client-secrets-manager": "^3.0.0",
@@ -48,11 +51,11 @@
     "@aws-sdk/client-ssm": "^3.0.0",
     "@aws-sdk/s3-request-presigner": "^3.0.0",
     "@aws-sdk/util-dynamodb": "^3.0.0",
+    "@de-otio/trellis-extension-api": "^0.2.0",
     "@fedify/fedify": "^1.0.0",
     "@prisma/adapter-pg": "^6.0.0",
     "@prisma/client": "^6.0.0",
     "@prisma/extension-accelerate": "^1.0.0",
-    "@de-otio/trellis-extension-api": "^0.2.0",
     "aws-jwt-verify": "^4.0.0",
     "exifr": "^7.1.3",
     "isomorphic-dompurify": "^2.18.0",
@@ -66,9 +69,8 @@
     "schema": "../../prisma/schema.prisma"
   },
   "devDependencies": {
+    "@aws-lambda-powertools/parameters": "^2.32.0",
     "@aws-sdk/client-bedrock-agent-runtime": "^3.0.0",
-    "@aws-sdk/client-cloudwatch-logs": "^3.0.0",
-    "@aws-sdk/client-cognito-identity-provider": "^3.1009.0",
     "@aws-sdk/client-cost-explorer": "^3.0.0",
     "@aws-sdk/client-ecs": "^3.0.0",
     "@aws-sdk/client-lambda": "^3.0.0",
@@ -79,7 +81,7 @@
     "@types/sharp": "^0.31.0",
     "@vitest/coverage-v8": "^4.0.0",
     "@vitest/ui": "^4.0.0",
-    "@aws-lambda-powertools/parameters": "^2.32.0",
+    "aws-sdk-client-mock": "^4.1.0",
     "esbuild": "^0.27.0",
     "form-data": "^4.0.1",
     "mailparser": "^3.9.4",

package/prisma/migrations/20260502094501_add_tenancy_model/migration.sql

@@ -0,0 +1,334 @@
+-- CreateEnum
+CREATE TYPE "TenantType" AS ENUM ('PERSONAL', 'ORGANIZATION');
+
+-- CreateEnum
+CREATE TYPE "TenantStatus" AS ENUM ('ACTIVE', 'SUSPENDED', 'DELETING');
+
+-- CreateEnum
+CREATE TYPE "TenantRole" AS ENUM ('OWNER', 'ADMIN', 'MEMBER', 'GUEST');
+
+-- CreateEnum
+CREATE TYPE "TenantMemberStatus" AS ENUM ('INVITED', 'ACTIVE', 'SUSPENDED', 'REMOVED');
+
+-- CreateEnum
+CREATE TYPE "IdpKind" AS ENUM ('SAML', 'OIDC');
+
+-- CreateEnum
+CREATE TYPE "IdpStatus" AS ENUM ('PENDING', 'ACTIVE', 'DISABLED', 'ERROR');
+
+-- DropForeignKey
+ALTER TABLE "security_events" DROP CONSTRAINT "security_events_partnerId_fkey";
+
+-- DropForeignKey
+ALTER TABLE "users" DROP CONSTRAINT "users_partnerId_fkey";
+
+-- DropIndex
+DROP INDEX "security_events_partnerId_idx";
+
+-- DropIndex
+DROP INDEX "users_partnerId_idx";
+
+-- AlterTable
+ALTER TABLE "connection_code_redemptions" ADD COLUMN     "tenant_id" TEXT NOT NULL;
+
+-- AlterTable
+ALTER TABLE "connection_codes" ADD COLUMN     "tenant_id" TEXT NOT NULL;
+
+-- AlterTable
+ALTER TABLE "entities" ADD COLUMN     "tenant_id" TEXT NOT NULL;
+
+-- AlterTable
+ALTER TABLE "entity_ownerships" ADD COLUMN     "tenant_id" TEXT NOT NULL;
+
+-- AlterTable
+ALTER TABLE "group_members" ADD COLUMN     "tenant_id" TEXT NOT NULL;
+
+-- AlterTable
+ALTER TABLE "groups" ADD COLUMN     "tenant_id" TEXT NOT NULL;
+
+-- AlterTable
+ALTER TABLE "notifications" ADD COLUMN     "tenant_id" TEXT NOT NULL;
+
+-- AlterTable
+ALTER TABLE "post_comments" ADD COLUMN     "tenant_id" TEXT NOT NULL;
+
+-- AlterTable
+ALTER TABLE "posts" ADD COLUMN     "tenant_id" TEXT NOT NULL;
+
+-- AlterTable
+ALTER TABLE "security_events" DROP COLUMN "partnerId",
+ADD COLUMN     "tenant_id" TEXT;
+
+-- AlterTable
+ALTER TABLE "users" DROP COLUMN "partnerId",
+ADD COLUMN     "personal_tenant_id" TEXT;
+
+-- DropTable
+DROP TABLE "partners";
+
+-- CreateTable
+CREATE TABLE "tenants" (
+    "id" TEXT NOT NULL,
+    "slug" TEXT NOT NULL,
+    "display_name" TEXT NOT NULL,
+    "type" "TenantType" NOT NULL,
+    "status" "TenantStatus" NOT NULL DEFAULT 'ACTIVE',
+    "personal_owner_user_id" TEXT,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3) NOT NULL,
+    "suspended_at" TIMESTAMP(3),
+    "suspend_reason" TEXT,
+
+    CONSTRAINT "tenants_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "tenant_members" (
+    "id" TEXT NOT NULL,
+    "tenant_id" TEXT NOT NULL,
+    "user_id" TEXT NOT NULL,
+    "role" "TenantRole" NOT NULL,
+    "status" "TenantMemberStatus" NOT NULL DEFAULT 'ACTIVE',
+    "is_jit_provisioned" BOOLEAN NOT NULL DEFAULT false,
+    "invited_by_user_id" TEXT,
+    "invited_at" TIMESTAMP(3),
+    "joined_at" TIMESTAMP(3),
+    "removed_at" TIMESTAMP(3),
+    "last_active_at" TIMESTAMP(3),
+
+    CONSTRAINT "tenant_members_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "tenant_domains" (
+    "id" TEXT NOT NULL,
+    "tenant_id" TEXT NOT NULL,
+    "domain" TEXT NOT NULL,
+    "verification_token" TEXT NOT NULL,
+    "token_expires_at" TIMESTAMP(3) NOT NULL,
+    "verified_at" TIMESTAMP(3),
+    "verify_attempted_at" TIMESTAMP(3),
+    "verify_attempts" INTEGER NOT NULL DEFAULT 0,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "tenant_domains_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "tenant_identity_providers" (
+    "id" TEXT NOT NULL,
+    "tenant_id" TEXT NOT NULL,
+    "kind" "IdpKind" NOT NULL,
+    "cognito_idp_name" TEXT NOT NULL,
+    "metadata_url" TEXT,
+    "metadata_xml" TEXT,
+    "issuer_url" TEXT,
+    "client_id" TEXT,
+    "client_secret_arn" TEXT,
+    "scopes" TEXT NOT NULL DEFAULT 'openid email profile groups',
+    "attribute_mapping" JSONB NOT NULL DEFAULT '{}',
+    "default_role" "TenantRole",
+    "status" "IdpStatus" NOT NULL DEFAULT 'PENDING',
+    "enabled_at" TIMESTAMP(3),
+    "last_error" TEXT,
+    "last_error_at" TIMESTAMP(3),
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "tenant_identity_providers_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "tenant_role_mappings" (
+    "id" TEXT NOT NULL,
+    "tenant_id" TEXT NOT NULL,
+    "idp_group_name" TEXT NOT NULL,
+    "tenant_role" "TenantRole" NOT NULL,
+    "priority" INTEGER NOT NULL DEFAULT 100,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "tenant_role_mappings_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "tenant_invitations" (
+    "id" TEXT NOT NULL,
+    "tenant_id" TEXT NOT NULL,
+    "email" TEXT NOT NULL,
+    "role" "TenantRole" NOT NULL,
+    "token" TEXT NOT NULL,
+    "expires_at" TIMESTAMP(3) NOT NULL,
+    "accepted_at" TIMESTAMP(3),
+    "accepted_by_user_id" TEXT,
+    "invited_by_user_id" TEXT NOT NULL,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "tenant_invitations_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "tenants_slug_key" ON "tenants"("slug");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "tenants_personal_owner_user_id_key" ON "tenants"("personal_owner_user_id");
+
+-- CreateIndex
+CREATE INDEX "tenants_slug_idx" ON "tenants"("slug");
+
+-- CreateIndex
+CREATE INDEX "tenants_type_status_idx" ON "tenants"("type", "status");
+
+-- CreateIndex
+CREATE INDEX "tenant_members_user_id_idx" ON "tenant_members"("user_id");
+
+-- CreateIndex
+CREATE INDEX "tenant_members_tenant_id_status_idx" ON "tenant_members"("tenant_id", "status");
+
+-- CreateIndex
+CREATE INDEX "tenant_members_tenant_id_role_idx" ON "tenant_members"("tenant_id", "role");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "tenant_members_tenant_id_user_id_key" ON "tenant_members"("tenant_id", "user_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "tenant_domains_domain_key" ON "tenant_domains"("domain");
+
+-- CreateIndex
+CREATE INDEX "tenant_domains_tenant_id_idx" ON "tenant_domains"("tenant_id");
+
+-- CreateIndex
+CREATE INDEX "tenant_domains_verified_at_idx" ON "tenant_domains"("verified_at");
+
+-- CreateIndex
+CREATE INDEX "tenant_domains_token_expires_at_idx" ON "tenant_domains"("token_expires_at");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "tenant_identity_providers_tenant_id_key" ON "tenant_identity_providers"("tenant_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "tenant_identity_providers_cognito_idp_name_key" ON "tenant_identity_providers"("cognito_idp_name");
+
+-- CreateIndex
+CREATE INDEX "tenant_identity_providers_cognito_idp_name_idx" ON "tenant_identity_providers"("cognito_idp_name");
+
+-- CreateIndex
+CREATE INDEX "tenant_identity_providers_status_idx" ON "tenant_identity_providers"("status");
+
+-- CreateIndex
+CREATE INDEX "tenant_role_mappings_tenant_id_priority_idx" ON "tenant_role_mappings"("tenant_id", "priority");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "tenant_role_mappings_tenant_id_idp_group_name_key" ON "tenant_role_mappings"("tenant_id", "idp_group_name");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "tenant_invitations_token_key" ON "tenant_invitations"("token");
+
+-- CreateIndex
+CREATE INDEX "tenant_invitations_token_idx" ON "tenant_invitations"("token");
+
+-- CreateIndex
+CREATE INDEX "tenant_invitations_email_idx" ON "tenant_invitations"("email");
+
+-- CreateIndex
+CREATE INDEX "tenant_invitations_expires_at_idx" ON "tenant_invitations"("expires_at");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "tenant_invitations_tenant_id_email_key" ON "tenant_invitations"("tenant_id", "email");
+
+-- CreateIndex
+CREATE INDEX "connection_code_redemptions_tenant_id_idx" ON "connection_code_redemptions"("tenant_id");
+
+-- CreateIndex
+CREATE INDEX "connection_codes_tenant_id_idx" ON "connection_codes"("tenant_id");
+
+-- CreateIndex
+CREATE INDEX "entities_tenant_id_idx" ON "entities"("tenant_id");
+
+-- CreateIndex
+CREATE INDEX "entities_tenant_id_entity_type_status_idx" ON "entities"("tenant_id", "entity_type", "status");
+
+-- CreateIndex
+CREATE INDEX "entity_ownerships_tenant_id_idx" ON "entity_ownerships"("tenant_id");
+
+-- CreateIndex
+CREATE INDEX "group_members_tenant_id_idx" ON "group_members"("tenant_id");
+
+-- CreateIndex
+CREATE INDEX "groups_tenant_id_idx" ON "groups"("tenant_id");
+
+-- CreateIndex
+CREATE INDEX "notifications_tenant_id_user_id_read_created_at_idx" ON "notifications"("tenant_id", "user_id", "read", "created_at");
+
+-- CreateIndex
+CREATE INDEX "post_comments_tenant_id_idx" ON "post_comments"("tenant_id");
+
+-- CreateIndex
+CREATE INDEX "posts_tenant_id_created_at_idx" ON "posts"("tenant_id", "created_at");
+
+-- CreateIndex
+CREATE INDEX "security_events_tenant_id_idx" ON "security_events"("tenant_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "users_personal_tenant_id_key" ON "users"("personal_tenant_id");
+
+-- CreateIndex
+CREATE INDEX "users_personal_tenant_id_idx" ON "users"("personal_tenant_id");
+
+-- AddForeignKey
+ALTER TABLE "entities" ADD CONSTRAINT "entities_tenant_id_fkey" FOREIGN KEY ("tenant_id") REFERENCES "tenants"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "posts" ADD CONSTRAINT "posts_tenant_id_fkey" FOREIGN KEY ("tenant_id") REFERENCES "tenants"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "post_comments" ADD CONSTRAINT "post_comments_tenant_id_fkey" FOREIGN KEY ("tenant_id") REFERENCES "tenants"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "entity_ownerships" ADD CONSTRAINT "entity_ownerships_tenant_id_fkey" FOREIGN KEY ("tenant_id") REFERENCES "tenants"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "groups" ADD CONSTRAINT "groups_tenant_id_fkey" FOREIGN KEY ("tenant_id") REFERENCES "tenants"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "group_members" ADD CONSTRAINT "group_members_tenant_id_fkey" FOREIGN KEY ("tenant_id") REFERENCES "tenants"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "notifications" ADD CONSTRAINT "notifications_tenant_id_fkey" FOREIGN KEY ("tenant_id") REFERENCES "tenants"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "connection_codes" ADD CONSTRAINT "connection_codes_tenant_id_fkey" FOREIGN KEY ("tenant_id") REFERENCES "tenants"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "connection_code_redemptions" ADD CONSTRAINT "connection_code_redemptions_tenant_id_fkey" FOREIGN KEY ("tenant_id") REFERENCES "tenants"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "tenants" ADD CONSTRAINT "tenants_personal_owner_user_id_fkey" FOREIGN KEY ("personal_owner_user_id") REFERENCES "users"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "tenant_members" ADD CONSTRAINT "tenant_members_tenant_id_fkey" FOREIGN KEY ("tenant_id") REFERENCES "tenants"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "tenant_members" ADD CONSTRAINT "tenant_members_user_id_fkey" FOREIGN KEY ("user_id") REFERENCES "users"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "tenant_members" ADD CONSTRAINT "tenant_members_invited_by_user_id_fkey" FOREIGN KEY ("invited_by_user_id") REFERENCES "users"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "tenant_domains" ADD CONSTRAINT "tenant_domains_tenant_id_fkey" FOREIGN KEY ("tenant_id") REFERENCES "tenants"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "tenant_identity_providers" ADD CONSTRAINT "tenant_identity_providers_tenant_id_fkey" FOREIGN KEY ("tenant_id") REFERENCES "tenants"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "tenant_role_mappings" ADD CONSTRAINT "tenant_role_mappings_tenant_id_fkey" FOREIGN KEY ("tenant_id") REFERENCES "tenants"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "tenant_invitations" ADD CONSTRAINT "tenant_invitations_tenant_id_fkey" FOREIGN KEY ("tenant_id") REFERENCES "tenants"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "tenant_invitations" ADD CONSTRAINT "tenant_invitations_invited_by_user_id_fkey" FOREIGN KEY ("invited_by_user_id") REFERENCES "users"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "tenant_invitations" ADD CONSTRAINT "tenant_invitations_accepted_by_user_id_fkey" FOREIGN KEY ("accepted_by_user_id") REFERENCES "users"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+

package/prisma/migrations/20260503000000_add_tenant_region/migration.sql

@@ -0,0 +1,4 @@
+-- Add `region` column to `tenants`. Defaults to "EU" so all existing
+-- rows match the prior hardcoded value used by the compliance route.
+-- See G4 LOW-5 in the trellis v0.7 publish-gate review.
+ALTER TABLE "tenants" ADD COLUMN "region" TEXT NOT NULL DEFAULT 'EU';