@de-otio/trellis 0.6.1 → 0.7.1

package/dist/lib/auth/idp-redirect-builder.js

@@ -0,0 +1,48 @@
+"use strict";
+/**
+ * Builds the Cognito Hosted UI OAuth2 authorization URL for federated sign-in.
+ *
+ * The IdP name in Cognito follows the convention `tenant-{cuid}` (using the
+ * full tenant cuid, truncated to 25 chars to fit Cognito's 32-char provider-
+ * name quota). Sign-in discovery routes by the same convention, so the value
+ * passed in is what T5 provisioned.
+ *
+ * All URL parameters are server-derived; callers supply only the Prisma-loaded
+ * cognitoIdpName — no arbitrary IdP names accepted from request input.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.cognitoIdpName = void 0;
+exports.buildIdpRedirectUrl = buildIdpRedirectUrl;
+exports.getIdpRedirectConfig = getIdpRedirectConfig;
+var idp_name_1 = require("../tenant/idp-name");
+Object.defineProperty(exports, "cognitoIdpName", { enumerable: true, get: function () { return idp_name_1.cognitoIdpName; } });
+/**
+ * Builds the Cognito Hosted UI authorization URL.
+ *
+ * Scope is always `openid email profile` — no caller-supplied scope to prevent
+ * privilege escalation via scope injection.
+ */
+function buildIdpRedirectUrl(config, params) {
+    const base = `https://${config.hostedUiDomain}/oauth2/authorize`;
+    const qs = new URLSearchParams({
+        identity_provider: params.cognitoIdpName,
+        client_id: config.clientId,
+        redirect_uri: config.redirectUri,
+        response_type: "code",
+        scope: "openid email profile",
+    });
+    return `${base}?${qs.toString()}`;
+}
+/**
+ * Reads IdP redirect config from the environment.
+ * Env vars read here are defined in src/env.ts and must come from there —
+ * no direct process.env access outside buildEnv().
+ */
+function getIdpRedirectConfig(env) {
+    return {
+        hostedUiDomain: env.COGNITO_HOSTED_UI_DOMAIN ?? "auth.skybber.com",
+        clientId: env.COGNITO_APP_CLIENT_ID ?? "",
+        redirectUri: env.COGNITO_REDIRECT_URI ?? "",
+    };
+}
+//# sourceMappingURL=idp-redirect-builder.js.map

package/dist/lib/auth/idp-redirect-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"idp-redirect-builder.js","sourceRoot":"","sources":["../../../src/lib/auth/idp-redirect-builder.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AA0BH,kDAaC;AAOD,oDAUC;AAtDD,+CAAoD;AAA3C,0GAAA,cAAc,OAAA;AAkBvB;;;;;GAKG;AACH,SAAgB,mBAAmB,CACjC,MAAyB,EACzB,MAAyB;IAEzB,MAAM,IAAI,GAAG,WAAW,MAAM,CAAC,cAAc,mBAAmB,CAAC;IACjE,MAAM,EAAE,GAAG,IAAI,eAAe,CAAC;QAC7B,iBAAiB,EAAE,MAAM,CAAC,cAAc;QACxC,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,YAAY,EAAE,MAAM,CAAC,WAAW;QAChC,aAAa,EAAE,MAAM;QACrB,KAAK,EAAE,sBAAsB;KAC9B,CAAC,CAAC;IACH,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;AACpC,CAAC;AAED;;;;GAIG;AACH,SAAgB,oBAAoB,CAAC,GAIpC;IACC,OAAO;QACL,cAAc,EAAE,GAAG,CAAC,wBAAwB,IAAI,kBAAkB;QAClE,QAAQ,EAAE,GAAG,CAAC,qBAAqB,IAAI,EAAE;QACzC,WAAW,EAAE,GAAG,CAAC,oBAAoB,IAAI,EAAE;KAC5C,CAAC;AACJ,CAAC"}

package/dist/lib/auth/require.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Authorization helpers — role and capability gating.
+ *
+ * Layers:
+ *  1. `requireRole`            — coarse role-rank check (legacy; T3 uses it).
+ *  2. `requireCapability(cap)` — full capability matrix + resource scoping.
+ *
+ * SUPER_ADMIN bypasses every check (platform-wide override).
+ */
+import type { TenantRole } from "@prisma/client";
+import type { AuthContext } from "./auth-context";
+import { type CapabilityValue } from "./capabilities";
+export { Capability, type CapabilityValue } from "./capabilities";
+export { RoleGrants } from "./role-grants";
+/**
+ * Returns a 403 Response if the caller's tenant role is below `minRole`,
+ * or null if the check passes. SUPER_ADMIN bypasses.
+ */
+export declare function requireRole(auth: AuthContext, minRole: TenantRole): Response | null;
+/**
+ * Resource carrier for capability-scoped checks.
+ *
+ * `authorId` and `ownerUserId` are the two ownership signals we recognise:
+ *  - `authorId` for posts/comments
+ *  - `ownerUserId` for entities (via EntityOwnership)
+ *
+ * Either one matching `auth.userId` is sufficient for own-only verbs.
+ */
+export interface CapabilityResource {
+    authorId?: string | null;
+    ownerUserId?: string | null;
+}
+export interface RequireCapabilityOptions {
+    /** Resource being acted on; required for own-only capabilities. */
+    resource?: CapabilityResource;
+}
+/**
+ * Returns a 403 Response if the caller lacks `cap`, null on success.
+ *
+ * SUPER_ADMIN bypasses every check.
+ *
+ * For own-only capabilities (PostUpdate, PostDelete, EntityUpdate, EntityDelete):
+ *   1. The role must hold the base capability.
+ *   2. AND the resource must be owned by the caller, UNLESS the role also
+ *      holds the matching cross-user moderation capability (PostModerate).
+ *
+ * If `options.resource` is omitted for an own-only capability, the check is
+ * lenient (caps-only) — callers that load the resource must pass it through.
+ */
+export declare function requireCapability(auth: AuthContext, cap: CapabilityValue, options?: RequireCapabilityOptions): Response | null;
+//# sourceMappingURL=require.d.ts.map

package/dist/lib/auth/require.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"require.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/require.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAY,MAAM,gBAAgB,CAAC;AAC3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAc,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAGlE,OAAO,EAAE,UAAU,EAAE,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAoB3C;;;GAGG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,UAAU,GAClB,QAAQ,GAAG,IAAI,CAIjB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,wBAAwB;IACvC,mEAAmE;IACnE,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CAC/B;AA6BD;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,WAAW,EACjB,GAAG,EAAE,eAAe,EACpB,OAAO,GAAE,wBAA6B,GACrC,QAAQ,GAAG,IAAI,CAcjB"}

package/dist/lib/auth/require.js

@@ -0,0 +1,99 @@
+"use strict";
+/**
+ * Authorization helpers — role and capability gating.
+ *
+ * Layers:
+ *  1. `requireRole`            — coarse role-rank check (legacy; T3 uses it).
+ *  2. `requireCapability(cap)` — full capability matrix + resource scoping.
+ *
+ * SUPER_ADMIN bypasses every check (platform-wide override).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RoleGrants = exports.Capability = void 0;
+exports.requireRole = requireRole;
+exports.requireCapability = requireCapability;
+const capabilities_1 = require("./capabilities");
+const role_grants_1 = require("./role-grants");
+var capabilities_2 = require("./capabilities");
+Object.defineProperty(exports, "Capability", { enumerable: true, get: function () { return capabilities_2.Capability; } });
+var role_grants_2 = require("./role-grants");
+Object.defineProperty(exports, "RoleGrants", { enumerable: true, get: function () { return role_grants_2.RoleGrants; } });
+const ROLE_RANK = {
+    OWNER: 4,
+    ADMIN: 3,
+    MEMBER: 2,
+    GUEST: 1,
+};
+function isSuperAdmin(auth) {
+    return auth.globalRole === "SUPER_ADMIN";
+}
+function forbidden(message) {
+    return new Response(JSON.stringify({ error: "FORBIDDEN", message }), { status: 403, headers: { "content-type": "application/json" } });
+}
+/**
+ * Returns a 403 Response if the caller's tenant role is below `minRole`,
+ * or null if the check passes. SUPER_ADMIN bypasses.
+ */
+function requireRole(auth, minRole) {
+    if (isSuperAdmin(auth))
+        return null;
+    if (ROLE_RANK[auth.tenantRole] >= ROLE_RANK[minRole])
+        return null;
+    return forbidden(`Requires tenant role ${minRole} or higher`);
+}
+/**
+ * Resource-scoped capabilities — own-only by default, granted to all if the
+ * caller also holds the matching `*.moderate` capability.
+ *
+ * Per design (05-roles-and-permissions.md):
+ *  - `post.update` / `post.delete`: own posts; `post.moderate` is the cross-user variant.
+ *  - `entity.update` / `entity.delete`: own entities (via EntityOwnership);
+ *    ADMIN/OWNER hold these unconditionally because they also hold `post.moderate`
+ *    (cross-user takedown). MEMBER must own the entity.
+ */
+const OWN_ONLY_FALLBACK = {
+    [capabilities_1.Capability.PostUpdate]: capabilities_1.Capability.PostModerate,
+    [capabilities_1.Capability.PostDelete]: capabilities_1.Capability.PostModerate,
+    [capabilities_1.Capability.EntityUpdate]: capabilities_1.Capability.PostModerate,
+    [capabilities_1.Capability.EntityDelete]: capabilities_1.Capability.PostModerate,
+};
+function isOwnedBy(resource, userId) {
+    if (!resource)
+        return false;
+    if (resource.authorId && resource.authorId === userId)
+        return true;
+    if (resource.ownerUserId && resource.ownerUserId === userId)
+        return true;
+    return false;
+}
+/**
+ * Returns a 403 Response if the caller lacks `cap`, null on success.
+ *
+ * SUPER_ADMIN bypasses every check.
+ *
+ * For own-only capabilities (PostUpdate, PostDelete, EntityUpdate, EntityDelete):
+ *   1. The role must hold the base capability.
+ *   2. AND the resource must be owned by the caller, UNLESS the role also
+ *      holds the matching cross-user moderation capability (PostModerate).
+ *
+ * If `options.resource` is omitted for an own-only capability, the check is
+ * lenient (caps-only) — callers that load the resource must pass it through.
+ */
+function requireCapability(auth, cap, options = {}) {
+    if (isSuperAdmin(auth))
+        return null;
+    const grants = role_grants_1.RoleGrants[auth.tenantRole];
+    if (!grants.has(cap))
+        return forbidden(`Requires capability ${cap}`);
+    const moderationCap = OWN_ONLY_FALLBACK[cap];
+    if (!moderationCap)
+        return null;
+    if (grants.has(moderationCap))
+        return null;
+    if (options.resource === undefined)
+        return null;
+    if (isOwnedBy(options.resource, auth.userId))
+        return null;
+    return forbidden(`Requires ownership or ${moderationCap}`);
+}
+//# sourceMappingURL=require.js.map

package/dist/lib/auth/require.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"require.js","sourceRoot":"","sources":["../../../src/lib/auth/require.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;AAgCH,kCAOC;AA6DD,8CAkBC;AAlHD,iDAAkE;AAClE,+CAA2C;AAE3C,+CAAkE;AAAzD,0GAAA,UAAU,OAAA;AACnB,6CAA2C;AAAlC,yGAAA,UAAU,OAAA;AAEnB,MAAM,SAAS,GAA+B;IAC5C,KAAK,EAAE,CAAC;IACR,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,CAAC;IACT,KAAK,EAAE,CAAC;CACT,CAAC;AAEF,SAAS,YAAY,CAAC,IAAiB;IACrC,OAAO,IAAI,CAAC,UAAU,KAAM,aAA0B,CAAC;AACzD,CAAC;AAED,SAAS,SAAS,CAAC,OAAe;IAChC,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,EAC/C,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,WAAW,CACzB,IAAiB,EACjB,OAAmB;IAEnB,IAAI,YAAY,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAClE,OAAO,SAAS,CAAC,wBAAwB,OAAO,YAAY,CAAC,CAAC;AAChE,CAAC;AAqBD;;;;;;;;;GASG;AACH,MAAM,iBAAiB,GAAsD;IAC3E,CAAC,yBAAU,CAAC,UAAU,CAAC,EAAE,yBAAU,CAAC,YAAY;IAChD,CAAC,yBAAU,CAAC,UAAU,CAAC,EAAE,yBAAU,CAAC,YAAY;IAChD,CAAC,yBAAU,CAAC,YAAY,CAAC,EAAE,yBAAU,CAAC,YAAY;IAClD,CAAC,yBAAU,CAAC,YAAY,CAAC,EAAE,yBAAU,CAAC,YAAY;CACnD,CAAC;AAEF,SAAS,SAAS,CAChB,QAAwC,EACxC,MAAc;IAEd,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACnE,IAAI,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,WAAW,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACzE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAgB,iBAAiB,CAC/B,IAAiB,EACjB,GAAoB,EACpB,UAAoC,EAAE;IAEtC,IAAI,YAAY,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpC,MAAM,MAAM,GAAG,wBAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAC;IAErE,MAAM,aAAa,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAEhC,IAAI,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1D,OAAO,SAAS,CAAC,yBAAyB,aAAa,EAAE,CAAC,CAAC;AAC7D,CAAC"}

package/dist/lib/auth/role-grants.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Static default capability grants per `TenantRole`.
+ *
+ * The four canonical roles are:
+ *   GUEST  — read-only on public surfaces.
+ *   MEMBER — can post, update/delete own posts, manage own entities.
+ *   ADMIN  — manage tenant config, members, IdPs, domains, role mappings.
+ *   OWNER  — superset of ADMIN plus tenant.delete and tenant.suspend.
+ *
+ * Custom roles or per-tenant overrides are out of scope for MVP.
+ *
+ * Hierarchy invariant (asserted in tests):
+ *   GUEST ⊂ MEMBER ⊂ ADMIN ⊂ OWNER.
+ */
+import type { TenantRole } from "@prisma/client";
+import { type CapabilityValue } from "./capabilities";
+export declare const RoleGrants: Record<TenantRole, ReadonlySet<CapabilityValue>>;
+//# sourceMappingURL=role-grants.d.ts.map

package/dist/lib/auth/role-grants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-grants.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/role-grants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAc,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AA2ClE,eAAO,MAAM,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,eAAe,CAAC,CAKvE,CAAC"}

package/dist/lib/auth/role-grants.js

@@ -0,0 +1,62 @@
+"use strict";
+/**
+ * Static default capability grants per `TenantRole`.
+ *
+ * The four canonical roles are:
+ *   GUEST  — read-only on public surfaces.
+ *   MEMBER — can post, update/delete own posts, manage own entities.
+ *   ADMIN  — manage tenant config, members, IdPs, domains, role mappings.
+ *   OWNER  — superset of ADMIN plus tenant.delete and tenant.suspend.
+ *
+ * Custom roles or per-tenant overrides are out of scope for MVP.
+ *
+ * Hierarchy invariant (asserted in tests):
+ *   GUEST ⊂ MEMBER ⊂ ADMIN ⊂ OWNER.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RoleGrants = void 0;
+const capabilities_1 = require("./capabilities");
+const GuestGrants = new Set([
+    capabilities_1.Capability.DomainView,
+    capabilities_1.Capability.EntityView,
+    capabilities_1.Capability.PostView,
+]);
+const MemberGrants = new Set([
+    ...GuestGrants,
+    capabilities_1.Capability.MemberView,
+    capabilities_1.Capability.EntityCreate,
+    capabilities_1.Capability.EntityUpdate,
+    capabilities_1.Capability.EntityDelete,
+    capabilities_1.Capability.PostCreate,
+    capabilities_1.Capability.PostUpdate,
+    capabilities_1.Capability.PostDelete,
+]);
+const AdminGrants = new Set([
+    ...MemberGrants,
+    capabilities_1.Capability.TenantUpdate,
+    capabilities_1.Capability.MemberInvite,
+    capabilities_1.Capability.MemberRemove,
+    capabilities_1.Capability.MemberChangeRole,
+    capabilities_1.Capability.MemberSuspend,
+    capabilities_1.Capability.IdpConfigure,
+    capabilities_1.Capability.IdpView,
+    capabilities_1.Capability.RoleMappingEdit,
+    capabilities_1.Capability.DomainAdd,
+    capabilities_1.Capability.DomainVerify,
+    capabilities_1.Capability.DomainRemove,
+    capabilities_1.Capability.PostModerate,
+    capabilities_1.Capability.AuditView,
+    capabilities_1.Capability.ManageAgentSessions,
+]);
+const OwnerGrants = new Set([
+    ...AdminGrants,
+    capabilities_1.Capability.TenantDelete,
+    capabilities_1.Capability.TenantSuspend,
+]);
+exports.RoleGrants = {
+    OWNER: OwnerGrants,
+    ADMIN: AdminGrants,
+    MEMBER: MemberGrants,
+    GUEST: GuestGrants,
+};
+//# sourceMappingURL=role-grants.js.map

package/dist/lib/auth/role-grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-grants.js","sourceRoot":"","sources":["../../../src/lib/auth/role-grants.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;;AAGH,iDAAkE;AAElE,MAAM,WAAW,GAAiC,IAAI,GAAG,CAAkB;IACzE,yBAAU,CAAC,UAAU;IACrB,yBAAU,CAAC,UAAU;IACrB,yBAAU,CAAC,QAAQ;CACpB,CAAC,CAAC;AAEH,MAAM,YAAY,GAAiC,IAAI,GAAG,CAAkB;IAC1E,GAAG,WAAW;IACd,yBAAU,CAAC,UAAU;IACrB,yBAAU,CAAC,YAAY;IACvB,yBAAU,CAAC,YAAY;IACvB,yBAAU,CAAC,YAAY;IACvB,yBAAU,CAAC,UAAU;IACrB,yBAAU,CAAC,UAAU;IACrB,yBAAU,CAAC,UAAU;CACtB,CAAC,CAAC;AAEH,MAAM,WAAW,GAAiC,IAAI,GAAG,CAAkB;IACzE,GAAG,YAAY;IACf,yBAAU,CAAC,YAAY;IACvB,yBAAU,CAAC,YAAY;IACvB,yBAAU,CAAC,YAAY;IACvB,yBAAU,CAAC,gBAAgB;IAC3B,yBAAU,CAAC,aAAa;IACxB,yBAAU,CAAC,YAAY;IACvB,yBAAU,CAAC,OAAO;IAClB,yBAAU,CAAC,eAAe;IAC1B,yBAAU,CAAC,SAAS;IACpB,yBAAU,CAAC,YAAY;IACvB,yBAAU,CAAC,YAAY;IACvB,yBAAU,CAAC,YAAY;IACvB,yBAAU,CAAC,SAAS;IACpB,yBAAU,CAAC,mBAAmB;CAC/B,CAAC,CAAC;AAEH,MAAM,WAAW,GAAiC,IAAI,GAAG,CAAkB;IACzE,GAAG,WAAW;IACd,yBAAU,CAAC,YAAY;IACvB,yBAAU,CAAC,aAAa;CACzB,CAAC,CAAC;AAEU,QAAA,UAAU,GAAqD;IAC1E,KAAK,EAAE,WAAW;IAClB,KAAK,EAAE,WAAW;IAClB,MAAM,EAAE,YAAY;IACpB,KAAK,EAAE,WAAW;CACnB,CAAC"}

package/dist/lib/cognito/idp-sdk.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Cognito Identity Provider SDK wrapper.
+ *
+ * The route handler talks to Cognito only through this surface so the
+ * Cognito-shaped commands stay in one place and the rollback paths in
+ * the route are easier to reason about.
+ *
+ * Concurrency: `setSupportedIdentityProviders` performs a
+ * Describe → mutate → Update sequence which is racy across concurrent
+ * connect/disconnect calls. The route handler must wrap the call in a
+ * Postgres advisory lock keyed on the user pool id; the helper
+ * `withUserPoolClientLock` here implements that pattern.
+ */
+import { CognitoIdentityProviderClient } from "@aws-sdk/client-cognito-identity-provider";
+import type { TenantRole } from "@prisma/client";
+export interface OidcProviderDetails {
+    clientId: string;
+    clientSecret: string;
+    issuerUrl: string;
+    scopes?: string;
+}
+export interface IdpAttributeMapping {
+    email: string;
+    given_name?: string;
+    family_name?: string;
+    "custom:idpGroups"?: string;
+    [key: string]: string | undefined;
+}
+export interface CreateOidcProviderInput {
+    userPoolId: string;
+    providerName: string;
+    details: OidcProviderDetails;
+    attributeMapping: IdpAttributeMapping;
+    idpIdentifiers: string[];
+}
+export interface UpdateOidcProviderInput {
+    userPoolId: string;
+    providerName: string;
+    details?: Partial<OidcProviderDetails>;
+    attributeMapping?: IdpAttributeMapping;
+    idpIdentifiers?: string[];
+}
+/** Default attribute mapping per 04-cognito-federation.md §attribute-mapping. */
+export declare function defaultOidcAttributeMapping(): IdpAttributeMapping;
+export declare class CognitoIdpSdk {
+    private readonly client;
+    constructor(client: CognitoIdentityProviderClient);
+    createOidcProvider(input: CreateOidcProviderInput): Promise<void>;
+    updateOidcProvider(input: UpdateOidcProviderInput): Promise<void>;
+    deleteProvider(userPoolId: string, providerName: string): Promise<void>;
+    describeProvider(userPoolId: string, providerName: string): Promise<boolean>;
+    /**
+     * Read the app client's current `SupportedIdentityProviders`, mutate the
+     * list (add or remove `providerName`), and write it back. UpdateUserPoolClient
+     * is a full replace, so we carry the rest of the existing config through.
+     *
+     * NOT race-safe in isolation. The caller must hold an advisory lock
+     * keyed on (userPoolId, clientId).
+     */
+    setSupportedIdentityProvider(userPoolId: string, clientId: string, providerName: string, op: "add" | "remove"): Promise<void>;
+}
+/**
+ * Stable 64-bit advisory-lock key derived from the user pool id. Postgres
+ * `pg_advisory_xact_lock(bigint)` is used so the lock is auto-released at
+ * transaction end. We only need a single number — collisions on different
+ * pool ids would just mean false serialization, which is fine.
+ */
+export declare function userPoolAdvisoryLockKey(userPoolId: string): bigint;
+export interface AdvisoryLockClient {
+    $executeRaw(query: TemplateStringsArray, ...values: unknown[]): Promise<number>;
+}
+/**
+ * Run `fn` while holding a Postgres advisory lock keyed on the user pool id.
+ * Lock is released at the end of the wrapping transaction; the caller passes
+ * the inner `tx` from `prisma.$transaction((tx) => ...)`.
+ */
+export declare function withUserPoolClientLock<T>(tx: AdvisoryLockClient, userPoolId: string, fn: () => Promise<T>): Promise<T>;
+/** Mapper for tests; the route catalog references this for typing. */
+export type IdpDefaultRole = TenantRole | null;
+//# sourceMappingURL=idp-sdk.d.ts.map

package/dist/lib/cognito/idp-sdk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"idp-sdk.d.ts","sourceRoot":"","sources":["../../../src/lib/cognito/idp-sdk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EACL,6BAA6B,EAO9B,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,mBAAmB,CAAC;IAC7B,gBAAgB,EAAE,mBAAmB,CAAC;IACtC,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACvC,gBAAgB,CAAC,EAAE,mBAAmB,CAAC;IACvC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,iFAAiF;AACjF,wBAAgB,2BAA2B,IAAI,mBAAmB,CAOjE;AAaD,qBAAa,aAAa;IACZ,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,6BAA6B;IAE5D,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC;IAajE,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBjE,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASvE,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAgBlF;;;;;;;OAOG;IACG,4BAA4B,CAChC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,EAAE,EAAE,KAAK,GAAG,QAAQ,GACnB,OAAO,CAAC,IAAI,CAAC;CAwCjB;AAoBD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAUlE;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,CAAC,KAAK,EAAE,oBAAoB,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACjF;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAAC,CAAC,EAC5C,EAAE,EAAE,kBAAkB,EACtB,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACnB,OAAO,CAAC,CAAC,CAAC,CAIZ;AAED,sEAAsE;AACtE,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,IAAI,CAAC"}

package/dist/lib/cognito/idp-sdk.js

@@ -0,0 +1,186 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CognitoIdpSdk = void 0;
+exports.defaultOidcAttributeMapping = defaultOidcAttributeMapping;
+exports.userPoolAdvisoryLockKey = userPoolAdvisoryLockKey;
+exports.withUserPoolClientLock = withUserPoolClientLock;
+/**
+ * Cognito Identity Provider SDK wrapper.
+ *
+ * The route handler talks to Cognito only through this surface so the
+ * Cognito-shaped commands stay in one place and the rollback paths in
+ * the route are easier to reason about.
+ *
+ * Concurrency: `setSupportedIdentityProviders` performs a
+ * Describe → mutate → Update sequence which is racy across concurrent
+ * connect/disconnect calls. The route handler must wrap the call in a
+ * Postgres advisory lock keyed on the user pool id; the helper
+ * `withUserPoolClientLock` here implements that pattern.
+ */
+const client_cognito_identity_provider_1 = require("@aws-sdk/client-cognito-identity-provider");
+/** Default attribute mapping per 04-cognito-federation.md §attribute-mapping. */
+function defaultOidcAttributeMapping() {
+    return {
+        email: "email",
+        given_name: "given_name",
+        family_name: "family_name",
+        "custom:idpGroups": "groups",
+    };
+}
+function buildOidcProviderDetails(d) {
+    const out = {
+        client_id: d.clientId,
+        client_secret: d.clientSecret,
+        oidc_issuer: d.issuerUrl,
+        attributes_request_method: "GET",
+        authorize_scopes: d.scopes ?? "openid email profile groups",
+    };
+    return out;
+}
+class CognitoIdpSdk {
+    client;
+    constructor(client) {
+        this.client = client;
+    }
+    async createOidcProvider(input) {
+        await this.client.send(new client_cognito_identity_provider_1.CreateIdentityProviderCommand({
+            UserPoolId: input.userPoolId,
+            ProviderName: input.providerName,
+            ProviderType: "OIDC",
+            ProviderDetails: buildOidcProviderDetails(input.details),
+            AttributeMapping: stripUndefined(input.attributeMapping),
+            IdpIdentifiers: input.idpIdentifiers,
+        }));
+    }
+    async updateOidcProvider(input) {
+        const providerDetails = input.details
+            ? buildOidcProviderDetailsPartial(input.details)
+            : undefined;
+        await this.client.send(new client_cognito_identity_provider_1.UpdateIdentityProviderCommand({
+            UserPoolId: input.userPoolId,
+            ProviderName: input.providerName,
+            ...(providerDetails ? { ProviderDetails: providerDetails } : {}),
+            ...(input.attributeMapping
+                ? { AttributeMapping: stripUndefined(input.attributeMapping) }
+                : {}),
+            ...(input.idpIdentifiers ? { IdpIdentifiers: input.idpIdentifiers } : {}),
+        }));
+    }
+    async deleteProvider(userPoolId, providerName) {
+        await this.client.send(new client_cognito_identity_provider_1.DeleteIdentityProviderCommand({
+            UserPoolId: userPoolId,
+            ProviderName: providerName,
+        }));
+    }
+    async describeProvider(userPoolId, providerName) {
+        try {
+            await this.client.send(new client_cognito_identity_provider_1.DescribeIdentityProviderCommand({
+                UserPoolId: userPoolId,
+                ProviderName: providerName,
+            }));
+            return true;
+        }
+        catch (err) {
+            const name = err.name;
+            if (name === "ResourceNotFoundException")
+                return false;
+            throw err;
+        }
+    }
+    /**
+     * Read the app client's current `SupportedIdentityProviders`, mutate the
+     * list (add or remove `providerName`), and write it back. UpdateUserPoolClient
+     * is a full replace, so we carry the rest of the existing config through.
+     *
+     * NOT race-safe in isolation. The caller must hold an advisory lock
+     * keyed on (userPoolId, clientId).
+     */
+    async setSupportedIdentityProvider(userPoolId, clientId, providerName, op) {
+        const desc = await this.client.send(new client_cognito_identity_provider_1.DescribeUserPoolClientCommand({ UserPoolId: userPoolId, ClientId: clientId }));
+        const existing = desc.UserPoolClient;
+        if (!existing)
+            throw new Error("DescribeUserPoolClient returned no client");
+        const current = existing.SupportedIdentityProviders ?? [];
+        const set = new Set(current);
+        if (op === "add")
+            set.add(providerName);
+        else
+            set.delete(providerName);
+        const next = Array.from(set);
+        await this.client.send(new client_cognito_identity_provider_1.UpdateUserPoolClientCommand({
+            UserPoolId: userPoolId,
+            ClientId: clientId,
+            ClientName: existing.ClientName,
+            AccessTokenValidity: existing.AccessTokenValidity,
+            IdTokenValidity: existing.IdTokenValidity,
+            RefreshTokenValidity: existing.RefreshTokenValidity,
+            TokenValidityUnits: existing.TokenValidityUnits,
+            ReadAttributes: existing.ReadAttributes,
+            WriteAttributes: existing.WriteAttributes,
+            ExplicitAuthFlows: existing.ExplicitAuthFlows,
+            AllowedOAuthFlows: existing.AllowedOAuthFlows,
+            AllowedOAuthScopes: existing.AllowedOAuthScopes,
+            AllowedOAuthFlowsUserPoolClient: existing.AllowedOAuthFlowsUserPoolClient,
+            CallbackURLs: existing.CallbackURLs,
+            LogoutURLs: existing.LogoutURLs,
+            DefaultRedirectURI: existing.DefaultRedirectURI,
+            PreventUserExistenceErrors: existing.PreventUserExistenceErrors,
+            EnableTokenRevocation: existing.EnableTokenRevocation,
+            EnablePropagateAdditionalUserContextData: existing.EnablePropagateAdditionalUserContextData,
+            AuthSessionValidity: existing.AuthSessionValidity,
+            SupportedIdentityProviders: next,
+        }));
+    }
+}
+exports.CognitoIdpSdk = CognitoIdpSdk;
+function buildOidcProviderDetailsPartial(d) {
+    const out = {};
+    if (d.clientId)
+        out.client_id = d.clientId;
+    if (d.clientSecret)
+        out.client_secret = d.clientSecret;
+    if (d.issuerUrl)
+        out.oidc_issuer = d.issuerUrl;
+    if (d.scopes)
+        out.authorize_scopes = d.scopes;
+    if (Object.keys(out).length > 0)
+        out.attributes_request_method = "GET";
+    return out;
+}
+function stripUndefined(map) {
+    const out = {};
+    for (const [k, v] of Object.entries(map)) {
+        if (typeof v === "string")
+            out[k] = v;
+    }
+    return out;
+}
+/**
+ * Stable 64-bit advisory-lock key derived from the user pool id. Postgres
+ * `pg_advisory_xact_lock(bigint)` is used so the lock is auto-released at
+ * transaction end. We only need a single number — collisions on different
+ * pool ids would just mean false serialization, which is fine.
+ */
+function userPoolAdvisoryLockKey(userPoolId) {
+    let h = 0xcbf29ce484222325n;
+    const PRIME = 0x100000001b3n;
+    const MASK = 0xffffffffffffffffn;
+    for (let i = 0; i < userPoolId.length; i++) {
+        h = (h ^ BigInt(userPoolId.charCodeAt(i))) & MASK;
+        h = (h * PRIME) & MASK;
+    }
+    if (h >= 0x8000000000000000n)
+        h = h - 0x10000000000000000n;
+    return h;
+}
+/**
+ * Run `fn` while holding a Postgres advisory lock keyed on the user pool id.
+ * Lock is released at the end of the wrapping transaction; the caller passes
+ * the inner `tx` from `prisma.$transaction((tx) => ...)`.
+ */
+async function withUserPoolClientLock(tx, userPoolId, fn) {
+    const key = userPoolAdvisoryLockKey(userPoolId);
+    await tx.$executeRaw `SELECT pg_advisory_xact_lock(${key}::bigint)`;
+    return fn();
+}
+//# sourceMappingURL=idp-sdk.js.map

package/dist/lib/cognito/idp-sdk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"idp-sdk.js","sourceRoot":"","sources":["../../../src/lib/cognito/idp-sdk.ts"],"names":[],"mappings":";;;AAwDA,kEAOC;AAsJD,0DAUC;AAWD,wDAQC;AAlPD;;;;;;;;;;;;GAYG;AACH,gGAQmD;AAkCnD,iFAAiF;AACjF,SAAgB,2BAA2B;IACzC,OAAO;QACL,KAAK,EAAE,OAAO;QACd,UAAU,EAAE,YAAY;QACxB,WAAW,EAAE,aAAa;QAC1B,kBAAkB,EAAE,QAAQ;KAC7B,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,CAAsB;IACtD,MAAM,GAAG,GAA2B;QAClC,SAAS,EAAE,CAAC,CAAC,QAAQ;QACrB,aAAa,EAAE,CAAC,CAAC,YAAY;QAC7B,WAAW,EAAE,CAAC,CAAC,SAAS;QACxB,yBAAyB,EAAE,KAAK;QAChC,gBAAgB,EAAE,CAAC,CAAC,MAAM,IAAI,6BAA6B;KAC5D,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAa,aAAa;IACK;IAA7B,YAA6B,MAAqC;QAArC,WAAM,GAAN,MAAM,CAA+B;IAAG,CAAC;IAEtE,KAAK,CAAC,kBAAkB,CAAC,KAA8B;QACrD,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACpB,IAAI,gEAA6B,CAAC;YAChC,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,YAAY,EAAE,MAAM;YACpB,eAAe,EAAE,wBAAwB,CAAC,KAAK,CAAC,OAAO,CAAC;YACxD,gBAAgB,EAAE,cAAc,CAAC,KAAK,CAAC,gBAAgB,CAAC;YACxD,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,KAA8B;QACrD,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO;YACnC,CAAC,CAAC,+BAA+B,CAAC,KAAK,CAAC,OAAO,CAAC;YAChD,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACpB,IAAI,gEAA6B,CAAC;YAChC,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,KAAK,CAAC,gBAAgB;gBACxB,CAAC,CAAC,EAAE,gBAAgB,EAAE,cAAc,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE;gBAC9D,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1E,CAAC,CACH,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,UAAkB,EAAE,YAAoB;QAC3D,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACpB,IAAI,gEAA6B,CAAC;YAChC,UAAU,EAAE,UAAU;YACtB,YAAY,EAAE,YAAY;SAC3B,CAAC,CACH,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,UAAkB,EAAE,YAAoB;QAC7D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACpB,IAAI,kEAA+B,CAAC;gBAClC,UAAU,EAAE,UAAU;gBACtB,YAAY,EAAE,YAAY;aAC3B,CAAC,CACH,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAI,GAAyB,CAAC,IAAI,CAAC;YAC7C,IAAI,IAAI,KAAK,2BAA2B;gBAAE,OAAO,KAAK,CAAC;YACvD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,4BAA4B,CAChC,UAAkB,EAClB,QAAgB,EAChB,YAAoB,EACpB,EAAoB;QAEpB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACjC,IAAI,gEAA6B,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAClF,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC;QACrC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAE5E,MAAM,OAAO,GAAG,QAAQ,CAAC,0BAA0B,IAAI,EAAE,CAAC;QAC1D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,EAAE,KAAK,KAAK;YAAE,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;;YACnC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAE7B,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACpB,IAAI,8DAA2B,CAAC;YAC9B,UAAU,EAAE,UAAU;YACtB,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;YACjD,eAAe,EAAE,QAAQ,CAAC,eAAe;YACzC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;YACnD,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;YAC/C,cAAc,EAAE,QAAQ,CAAC,cAAc;YACvC,eAAe,EAAE,QAAQ,CAAC,eAAe;YACzC,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;YAC7C,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;YAC7C,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;YAC/C,+BAA+B,EAAE,QAAQ,CAAC,+BAA+B;YACzE,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;YAC/C,0BAA0B,EAAE,QAAQ,CAAC,0BAA0B;YAC/D,qBAAqB,EAAE,QAAQ,CAAC,qBAAqB;YACrD,wCAAwC,EACtC,QAAQ,CAAC,wCAAwC;YACnD,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;YACjD,0BAA0B,EAAE,IAAI;SACjC,CAAC,CACH,CAAC;IACJ,CAAC;CACF;AA/GD,sCA+GC;AAED,SAAS,+BAA+B,CAAC,CAA+B;IACtE,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,IAAI,CAAC,CAAC,QAAQ;QAAE,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC3C,IAAI,CAAC,CAAC,YAAY;QAAE,GAAG,CAAC,aAAa,GAAG,CAAC,CAAC,YAAY,CAAC;IACvD,IAAI,CAAC,CAAC,SAAS;QAAE,GAAG,CAAC,WAAW,GAAG,CAAC,CAAC,SAAS,CAAC;IAC/C,IAAI,CAAC,CAAC,MAAM;QAAE,GAAG,CAAC,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,yBAAyB,GAAG,KAAK,CAAC;IACvE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,cAAc,CAAC,GAAuC;IAC7D,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,SAAgB,uBAAuB,CAAC,UAAkB;IACxD,IAAI,CAAC,GAAG,mBAAmB,CAAC;IAC5B,MAAM,KAAK,GAAG,cAAc,CAAC;IAC7B,MAAM,IAAI,GAAG,mBAAmB,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,CAAC,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;QAClD,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC;IACzB,CAAC;IACD,IAAI,CAAC,IAAI,mBAAmB;QAAE,CAAC,GAAG,CAAC,GAAG,oBAAoB,CAAC;IAC3D,OAAO,CAAC,CAAC;AACX,CAAC;AAMD;;;;GAIG;AACI,KAAK,UAAU,sBAAsB,CAC1C,EAAsB,EACtB,UAAkB,EAClB,EAAoB;IAEpB,MAAM,GAAG,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,EAAE,CAAC,WAAW,CAAA,gCAAgC,GAAG,WAAW,CAAC;IACnE,OAAO,EAAE,EAAE,CAAC;AACd,CAAC"}

package/dist/lib/cognito/issuer-probe.d.ts

@@ -0,0 +1,47 @@
+export type IssuerProbeFailureReason = "INVALID_URL" | "INSECURE_SCHEME" | "PRIVATE_HOST" | "DNS_ERROR" | "REDIRECT_BLOCKED" | "HTTP_ERROR" | "BODY_TOO_LARGE" | "INVALID_JSON" | "MISSING_ENDPOINTS" | "TIMEOUT" | "NETWORK_ERROR";
+export interface IssuerProbeSuccess {
+    ok: true;
+    issuer: string;
+    authorizationEndpoint: string;
+    tokenEndpoint: string;
+    jwksUri: string;
+    userinfoEndpoint?: string;
+}
+export interface IssuerProbeFailure {
+    ok: false;
+    reason: IssuerProbeFailureReason;
+    message: string;
+}
+export type IssuerProbeResult = IssuerProbeSuccess | IssuerProbeFailure;
+export interface IssuerProbeOptions {
+    /** Override the fetch implementation (tests). */
+    fetchImpl?: typeof fetch;
+    /** Override the DNS resolver (tests). */
+    resolveHostname?: (hostname: string) => Promise<string[]>;
+    /** Override the timeout in ms. Defaults to 5000. */
+    timeoutMs?: number;
+    /**
+     * Override the pinned-dispatcher factory (tests). Production binds this to
+     * `defaultPinnedDispatcher`, which builds a undici Agent whose connect.lookup
+     * returns the validated IP — preventing DNS-rebinding TOCTOU between the
+     * private-IP check and the actual TCP connect.
+     */
+    dispatcherFactory?: (validatedIp: string, family: 4 | 6) => unknown;
+}
+/**
+ * Returns true if the IPv4 address is in any RFC 6890 special-purpose range
+ * we want to refuse: loopback, private, link-local, broadcast, etc.
+ */
+export declare function isPrivateIPv4(ip: string): boolean;
+/**
+ * Returns true if the IPv6 address is in a private/loopback/link-local/etc.
+ * range. Performs a normalized prefix comparison; we expand `::` and ignore
+ * zone identifiers.
+ */
+export declare function isPrivateIPv6(ip: string): boolean;
+/**
+ * Probe an OIDC issuer's well-known configuration. Returns a discriminated
+ * result; callers map failures onto 422 with a remediation message.
+ */
+export declare function probeOidcIssuer(issuerUrl: string, options?: IssuerProbeOptions): Promise<IssuerProbeResult>;
+//# sourceMappingURL=issuer-probe.d.ts.map

package/dist/lib/cognito/issuer-probe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"issuer-probe.d.ts","sourceRoot":"","sources":["../../../src/lib/cognito/issuer-probe.ts"],"names":[],"mappings":"AAyBA,MAAM,MAAM,wBAAwB,GAChC,aAAa,GACb,iBAAiB,GACjB,cAAc,GACd,WAAW,GACX,kBAAkB,GAClB,YAAY,GACZ,gBAAgB,GAChB,cAAc,GACd,mBAAmB,GACnB,SAAS,GACT,eAAe,CAAC;AAEpB,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,MAAM,CAAC;IACf,qBAAqB,EAAE,MAAM,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,wBAAwB,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,iBAAiB,GAAG,kBAAkB,GAAG,kBAAkB,CAAC;AAExE,MAAM,WAAW,kBAAkB;IACjC,iDAAiD;IACjD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,yCAAyC;IACzC,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1D,oDAAoD;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC;CACrE;AAWD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAiBjD;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAkCjD;AAmCD;;;GAGG;AACH,wBAAsB,eAAe,CACnC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,iBAAiB,CAAC,CA2E5B"}