@de-otio/trellis 0.7.1 → 0.10.0

package/dist/lib/audit-composer.js

@@ -0,0 +1,421 @@
+/**
+ * Audit composer (phase 1.C.2).
+ *
+ * Trellis-side facade over `@de-otio/saas-foundation/audit`. Replaces
+ * the old `AuditLogger` (data lifecycle) and `AuditEventEmitter`
+ * (tenant / IdP) with a single composition point that:
+ *
+ *   1. Applies trellis's default-DENY allowlist (`filterPayload`) +
+ *      IP anonymisation (`anonymizeIp`) to event metadata BEFORE the
+ *      event reaches foundation. (LOCKED: keep the allowlist.)
+ *   2. Hands the scrubbed event to foundation's `AuditLog`, which is
+ *      configured with foundation's `PiiFilter` (denylist) as a
+ *      SECOND, additive layer. (LOCKED: denylist is additive, not a
+ *      replacement.)
+ *   3. Persists via `PostgresAuditStore` over a region-resolved Prisma
+ *      client. Retention tiers: info=30, warning=90, error=365 days.
+ *      (LOCKED.)
+ *
+ * Frozen-type crossing: this module is the first trellis consumer of
+ * the frozen `AuditEvent` / `AuditAction` vocabulary. Future changes to
+ * the emitted shape go through the frozen-type RFC process.
+ *
+ * Severity collapse (trellis 4-tier -> foundation 3-tier):
+ *   low + medium -> info     (30d)
+ *   high         -> warning  (90d)
+ *   critical     -> error    (365d)
+ *
+ * ── SECURITY-SENSITIVE READ CONVENTION ───────────────────────────────
+ *
+ * Any BULK, CROSS-USER, or EXPORT read of user data MUST emit an audit
+ * event. An audit trail cannot be backfilled — if the read is not
+ * recorded at the time it occurs, it is permanently invisible to
+ * compliance reviews.
+ *
+ * Worked example — admin bulk-export of user records:
+ *
+ *   await auditLogger.logDataAccess({
+ *     action: DATA_READ,
+ *     resource:    "user",
+ *     resourceId:  `bulk:${requestedCount}`,
+ *     userId:      session.userId,          // the requesting admin's ID
+ *     region:      detectedRegion,
+ *     success:     true,
+ *     metadata: {
+ *       targetType: "user_export",
+ *       reason:     "compliance_request",
+ *     },
+ *   }, env);
+ *
+ * Scope of the rule:
+ *   - Covered NOW:  mutations (data.create / update / delete), auth,
+ *     feature_toggle.changed, tenant / IdP events.
+ *   - Deferred:     individual single-user reads (low priority).
+ *   - IN SCOPE for the research platform: any research.query,
+ *     research.extract, experiment.assign operation.
+ *
+ * See doc/02-technical/development/audit-and-toggle-conventions.md for
+ * naming conventions, prefix rules, and the research.query PII rule.
+ */
+import { AuditLog, PiiFilter } from "@de-otio/saas-foundation/audit";
+import { PostgresAuditStore } from "@de-otio/saas-foundation/audit/prisma";
+import { createPrismaForRegion } from "../db.js";
+import { getLogger } from "./logger.js";
+import { isValidRegion } from "./region-detection.js";
+import { filterPayload, anonymizeIp } from "./audit/pii-filter.js";
+import { DATA_READ, DATA_CREATE, DATA_UPDATE, DATA_DELETE, AUTHZ_DENIED, } from "./audit-actions.js";
+/** Retention tiers (LOCKED): collapse trellis intent onto foundation's. */
+const RETENTION_DAYS = { info: 30, warning: 90, error: 365 };
+function mapSeverity(severity) {
+    switch (severity) {
+        case "low":
+        case "medium":
+            return "info";
+        case "high":
+            return "warning";
+        case "critical":
+            return "error";
+    }
+}
+function toJsonSafe(value) {
+    if (value === null || value === undefined)
+        return null;
+    const t = typeof value;
+    if (t === "string" || t === "number" || t === "boolean")
+        return value;
+    if (Array.isArray(value))
+        return value.map(toJsonSafe);
+    if (t === "object") {
+        const out = {};
+        for (const [k, v] of Object.entries(value)) {
+            out[k] = toJsonSafe(v);
+        }
+        return out;
+    }
+    return String(value);
+}
+/**
+ * Apply trellis's allowlist to a raw metadata object and coerce to a
+ * JSON-safe record. Returns `undefined` for an empty input so we don't
+ * emit an empty `metadata: {}`.
+ */
+function scrubMetadata(metadata) {
+    if (!metadata || Object.keys(metadata).length === 0)
+        return undefined;
+    const { filtered } = filterPayload(metadata);
+    const out = {};
+    for (const [k, v] of Object.entries(filtered)) {
+        out[k] = toJsonSafe(v);
+    }
+    return out;
+}
+// ── AuditLog cache (per region-resolved Prisma client) ────────────────
+// One AuditLog per Prisma client. The DatabaseConnectionManager already
+// caches the underlying pool per region, so this just avoids rebuilding
+// the foundation wrapper on every emit.
+const auditLogByClient = new WeakMap();
+function getAuditLog(prisma) {
+    const existing = auditLogByClient.get(prisma);
+    if (existing)
+        return existing;
+    const log = new AuditLog(new PostgresAuditStore(prisma), {
+        retentionDays: RETENTION_DAYS,
+        // Foundation's denylist as the additive second PII layer.
+        piiFilter: new PiiFilter(),
+    });
+    auditLogByClient.set(prisma, log);
+    return log;
+}
+/**
+ * Map a trellis event `type` to a frozen `AuditAction`. The trellis
+ * `action` string (e.g. "user_accessed") is preserved in metadata; the
+ * coarse foundation action keeps the open-union dotted convention.
+ */
+function actionFor(type) {
+    switch (type) {
+        case "data_access":
+            return DATA_READ;
+        case "data_create":
+            return DATA_CREATE;
+        case "data_update":
+            return DATA_UPDATE;
+        case "data_delete":
+            return DATA_DELETE;
+        case "region_change":
+            return "system.region_change";
+        case "authentication":
+            return "auth.login";
+        case "authorization":
+            return AUTHZ_DENIED;
+        case "user_action":
+            return DATA_UPDATE;
+    }
+}
+/**
+ * `TrellisAuditLogger` — drop-in for the old `AuditLogger`. Region-aware
+ * (resolves a Prisma client per region), best-effort (never throws into
+ * the caller), and validates region before emitting (invalid-region
+ * events are dropped, as before).
+ */
+export class TrellisAuditLogger {
+    requestId;
+    // Constructor kept signature-compatible with old `new AuditLogger(env)`
+    // / `new AuditLogger(env, requestId)`; env is unused (region drives the
+    // client) but accepted so call sites don't change.
+    constructor(_env, requestId) {
+        this.requestId = requestId;
+    }
+    withRequestId(requestId) {
+        return new TrellisAuditLogger(undefined, requestId);
+    }
+    async logDataAccess(event, env) {
+        return this.emit({ ...event, type: event.type ?? "data_access", severity: event.severity ?? "low" }, env);
+    }
+    async logUserAction(event, env) {
+        return this.emit({ ...event, type: event.type ?? "user_action", severity: event.severity ?? "medium" }, env);
+    }
+    async logAuthentication(event, env) {
+        return this.emit({
+            ...event,
+            resource: event.resource || "user",
+            type: event.type ?? "authentication",
+            severity: event.severity ?? (event.success ? "low" : "high"),
+        }, env);
+    }
+    async logAuthorization(event, env) {
+        return this.emit({
+            ...event,
+            type: event.type ?? "authorization",
+            severity: event.severity ?? (event.success ? "low" : "high"),
+        }, env);
+    }
+    /** Generic entry point — accepts a full trellis event. */
+    async log(event, env) {
+        const type = event.type ?? "user_action";
+        const defaultSeverity = type === "authentication" || type === "authorization"
+            ? event.success
+                ? "low"
+                : "high"
+            : type === "data_access"
+                ? "low"
+                : "medium";
+        return this.emit({ ...event, type, severity: event.severity ?? defaultSeverity }, env);
+    }
+    /**
+     * Emit a system-level event where the `action` string is passed directly
+     * to the foundation audit log (bypassing the coarse `actionFor()` mapping).
+     *
+     * Use for platform-control actions like `feature_toggle.changed`,
+     * `consent.changed`, `experiment.assign` that have their own dedicated
+     * action constant and should not be collapsed to a coarse `data.*` label.
+     *
+     * The `action` parameter MUST be a known `AuditAction` constant from
+     * `audit-actions.ts`; do not pass free-form strings.
+     *
+     * Best-effort — never throws into the caller.
+     */
+    async logSystemAction(action, event, env) {
+        return this.emitDirect(action, { ...event, severity: event.severity ?? "medium" }, env);
+    }
+    async emitDirect(action, event, env) {
+        const logger = getLogger();
+        try {
+            if (!isValidRegion(event.region)) {
+                logger.error("[Audit] Invalid region in system audit event", {
+                    region: event.region,
+                    action,
+                });
+                return;
+            }
+            const severity = mapSeverity(event.severity);
+            const rawMetadata = {
+                action,
+                resource: event.resource,
+                ...(event.region !== undefined && { region: event.region }),
+                ...(event.dataRegion !== undefined && { dataRegion: event.dataRegion }),
+                ...event.metadata,
+            };
+            const metadata = scrubMetadata(rawMetadata);
+            const anonIp = event.ipAddress ? anonymizeIp(event.ipAddress) : undefined;
+            const prisma = createPrismaForRegion(event.region, env);
+            const auditLog = getAuditLog(prisma);
+            await auditLog.emitAwait({
+                actor: event.userId
+                    ? { kind: "user", userSub: event.userId }
+                    : { kind: "anonymous" },
+                action,
+                ...(event.resource && event.resourceId
+                    ? { resource: { kind: event.resource, id: event.resourceId } }
+                    : {}),
+                outcome: event.success ? "success" : "failure",
+                severity,
+                ...(this.requestId !== undefined && { requestId: this.requestId }),
+                ...(anonIp !== undefined && { ipAddress: anonIp }),
+                ...(event.userAgent !== undefined && { userAgent: event.userAgent }),
+                ...(metadata !== undefined && { metadata }),
+            });
+            logger.info(`[Audit] ${String(action)} on ${event.resource}${event.resourceId ? ` (${event.resourceId})` : ""} in region ${event.region}`, {
+                action,
+                resource: event.resource,
+                region: event.region,
+                userId: event.userId,
+            });
+        }
+        catch (error) {
+            // Best-effort: never block the in-flight request.
+            // eslint-disable-next-line no-console -- audit-fallback line for ops grep
+            console.error(JSON.stringify({
+                auditEmitFailure: true,
+                action: String(action),
+                resource: event.resource,
+                userId: event.userId,
+                error: error instanceof Error ? error.message : String(error),
+            }));
+            logger.error("[Audit] Failed to emit system audit event", {
+                error,
+                action,
+                resource: event.resource,
+            });
+        }
+    }
+    async emit(event, env) {
+        const logger = getLogger();
+        try {
+            // Region validation — drop invalid-region events (preserved).
+            if (!isValidRegion(event.region)) {
+                logger.error("[Audit] Invalid region in audit event", {
+                    region: event.region,
+                    action: event.action,
+                });
+                return;
+            }
+            const type = event.type ?? "user_action";
+            const severity = mapSeverity(event.severity ?? "low");
+            // Build the metadata: carry the trellis action / resource /
+            // region context, then scrub through the allowlist. The IP is
+            // anonymised and lives on the frozen `ipAddress` field (not
+            // metadata) so foundation persists it verbatim.
+            const rawMetadata = {
+                action: event.action,
+                resource: event.resource,
+                ...(event.region !== undefined && { region: event.region }),
+                ...(event.dataRegion !== undefined && { dataRegion: event.dataRegion }),
+                ...event.metadata,
+            };
+            const metadata = scrubMetadata(rawMetadata);
+            const anonIp = event.ipAddress ? anonymizeIp(event.ipAddress) : undefined;
+            const prisma = createPrismaForRegion(event.region, env);
+            const auditLog = getAuditLog(prisma);
+            const failureReason = !event.success && typeof event.metadata?.error === "string"
+                ? event.metadata.error
+                : undefined;
+            await auditLog.emitAwait({
+                actor: event.userId
+                    ? { kind: "user", userSub: event.userId }
+                    : { kind: "anonymous" },
+                action: actionFor(type),
+                ...(event.resource && event.resourceId
+                    ? { resource: { kind: event.resource, id: event.resourceId } }
+                    : {}),
+                outcome: event.success ? "success" : "failure",
+                ...(failureReason !== undefined && { failureReason }),
+                severity,
+                ...(this.requestId !== undefined && { requestId: this.requestId }),
+                ...(anonIp !== undefined && { ipAddress: anonIp }),
+                ...(event.userAgent !== undefined && { userAgent: event.userAgent }),
+                ...(metadata !== undefined && { metadata }),
+            });
+            // Operator-facing audit line (preserved contract).
+            const message = `[Audit] ${event.action} on ${event.resource}${event.resourceId ? ` (${event.resourceId})` : ""} in region ${event.region}${event.dataRegion ? ` (dataRegion: ${event.dataRegion})` : ""}`;
+            const logFields = {
+                type,
+                action: event.action,
+                resource: event.resource,
+                region: event.region,
+                dataRegion: event.dataRegion,
+                userId: event.userId,
+            };
+            if (event.success) {
+                logger.info(message, logFields);
+            }
+            else {
+                logger.warn(message, { ...logFields, error: event.metadata?.error });
+            }
+        }
+        catch (error) {
+            // Best-effort: never block the in-flight request on an audit
+            // failure. Emit a structured stderr line so the event is
+            // recoverable by a compliance grep. Full durable (SQS
+            // at-least-once) delivery is a deferred follow-up.
+            // eslint-disable-next-line no-console -- audit-fallback line for ops grep
+            console.error(JSON.stringify({
+                auditEmitFailure: true,
+                action: event.action,
+                resource: event.resource,
+                userId: event.userId,
+                error: error instanceof Error ? error.message : String(error),
+            }));
+            logger.error("[Audit] Failed to log audit event", {
+                error,
+                action: event.action,
+                resource: event.resource,
+            });
+        }
+    }
+}
+/** Factory — drop-in for the old `createAuditLogger`. */
+export function createAuditLogger(env, requestId) {
+    return new TrellisAuditLogger(env, requestId);
+}
+/**
+ * `TenantAuditEmitter` — replaces the CloudWatch+Postgres
+ * `AuditEventEmitter`. CloudWatch is dropped (foundation owns the sink);
+ * the Postgres write now goes through foundation's `AuditLog` /
+ * `PostgresAuditStore`. Signature `emit(input, prismaClient)` is
+ * preserved so the four consumers change only their import.
+ *
+ * Tenant/IdP events are tenant-scoped (`actor.kind = "user"`,
+ * `tenantId` set) and default to `info` severity (matching the old
+ * "medium" -> info collapse).
+ */
+export class TenantAuditEmitter {
+    async emit(input, prisma) {
+        try {
+            const auditLog = getAuditLog(prisma);
+            const anonIp = input.sourceIp ? anonymizeIp(input.sourceIp) : "unknown";
+            const rawMetadata = {
+                ...input.payload,
+                tenantId: input.tenantId,
+                actorUserId: input.actorUserId,
+                sourceIp: anonIp,
+                ...(input.agentSessionId ? { agentSessionId: input.agentSessionId } : {}),
+            };
+            const metadata = scrubMetadata(rawMetadata);
+            await auditLog.emitAwait({
+                // `tenantId` is validated against `TenantIdSchema` inside
+                // foundation's `AuditLog.emit`; cast to the branded type to
+                // satisfy `EmitInput` (runtime check is the source of truth).
+                tenantId: input.tenantId,
+                actor: { kind: "user", userSub: input.actorUserId },
+                action: input.type,
+                outcome: "success",
+                severity: "info",
+                ...(anonIp !== "unknown" ? { ipAddress: anonIp } : {}),
+                ...(metadata !== undefined && { metadata }),
+            });
+        }
+        catch (err) {
+            // Best-effort: audit failures must not block the mutation.
+            // eslint-disable-next-line no-console -- audit-fallback line for ops grep
+            console.error(JSON.stringify({
+                level: "error",
+                tag: "audit-fallback",
+                type: input.type,
+                tenantId: input.tenantId,
+                actorUserId: input.actorUserId,
+                error: err instanceof Error ? err.message : String(err),
+            }));
+        }
+    }
+}
+//# sourceMappingURL=audit-composer.js.map

package/dist/lib/audit-composer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-composer.js","sourceRoot":"","sources":["../../src/lib/audit-composer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AAEH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAErE,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAI3E,OAAO,EAAE,qBAAqB,EAAkB,MAAM,UAAU,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,aAAa,EAAe,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EACL,SAAS,EACT,WAAW,EACX,WAAW,EACX,WAAW,EACX,YAAY,GACb,MAAM,oBAAoB,CAAC;AAE5B,2EAA2E;AAC3E,MAAM,cAAc,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAW,CAAC;AAMtE,SAAS,WAAW,CAAC,QAAyB;IAC5C,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,KAAK,CAAC;QACX,KAAK,QAAQ;YACX,OAAO,MAAM,CAAC;QAChB,KAAK,MAAM;YACT,OAAO,SAAS,CAAC;QACnB,KAAK,UAAU;YACb,OAAO,OAAO,CAAC;IACnB,CAAC;AACH,CAAC;AAUD,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,CAAC,GAAG,OAAO,KAAK,CAAC;IACvB,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,KAAiB,CAAC;IAClF,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACvD,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;QACnB,MAAM,GAAG,GAA8B,EAAE,CAAC;QAC1C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CACpB,QAA6C;IAE7C,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACtE,MAAM,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC7C,MAAM,GAAG,GAA6B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAgBD,yEAAyE;AACzE,wEAAwE;AACxE,wEAAwE;AACxE,wCAAwC;AACxC,MAAM,gBAAgB,GAAG,IAAI,OAAO,EAAoB,CAAC;AAEzD,SAAS,WAAW,CAAC,MAA6B;IAChD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,IAAI,kBAAkB,CAAC,MAAsC,CAAC,EAAE;QACvF,aAAa,EAAE,cAAc;QAC7B,0DAA0D;QAC1D,SAAS,EAAE,IAAI,SAAS,EAAE;KAC3B,CAAC,CAAC;IACH,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAClC,OAAO,GAAG,CAAC;AACb,CAAC;AAgCD;;;;GAIG;AACH,SAAS,SAAS,CAAC,IAA2B;IAC5C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,aAAa;YAChB,OAAO,SAAS,CAAC;QACnB,KAAK,aAAa;YAChB,OAAO,WAAW,CAAC;QACrB,KAAK,aAAa;YAChB,OAAO,WAAW,CAAC;QACrB,KAAK,aAAa;YAChB,OAAO,WAAW,CAAC;QACrB,KAAK,eAAe;YAClB,OAAO,sBAAsB,CAAC;QAChC,KAAK,gBAAgB;YACnB,OAAO,YAAY,CAAC;QACtB,KAAK,eAAe;YAClB,OAAO,YAAY,CAAC;QACtB,KAAK,aAAa;YAChB,OAAO,WAAW,CAAC;IACvB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,kBAAkB;IAMV;IALnB,wEAAwE;IACxE,wEAAwE;IACxE,mDAAmD;IACnD,YACE,IAA4B,EACX,SAAkB;QAAlB,cAAS,GAAT,SAAS,CAAS;IAClC,CAAC;IAEG,aAAa,CAAC,SAAiB;QACpC,OAAO,IAAI,kBAAkB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACtD,CAAC;IAEM,KAAK,CAAC,aAAa,CACxB,KAGC,EACD,GAA0B;QAE1B,OAAO,IAAI,CAAC,IAAI,CACd,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,aAAa,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,KAAK,EAAE,EAClF,GAAG,CACJ,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,aAAa,CACxB,KAGC,EACD,GAA0B;QAE1B,OAAO,IAAI,CAAC,IAAI,CACd,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,aAAa,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,QAAQ,EAAE,EACrF,GAAG,CACJ,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,iBAAiB,CAC5B,KAGC,EACD,GAA0B;QAE1B,OAAO,IAAI,CAAC,IAAI,CACd;YACE,GAAG,KAAK;YACR,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,MAAM;YAClC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,gBAAgB;YACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;SAC7D,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,gBAAgB,CAC3B,KAGC,EACD,GAA0B;QAE1B,OAAO,IAAI,CAAC,IAAI,CACd;YACE,GAAG,KAAK;YACR,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,eAAe;YACnC,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;SAC7D,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,0DAA0D;IACnD,KAAK,CAAC,GAAG,CACd,KAA2E,EAC3E,GAA0B;QAE1B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,aAAa,CAAC;QACzC,MAAM,eAAe,GACnB,IAAI,KAAK,gBAAgB,IAAI,IAAI,KAAK,eAAe;YACnD,CAAC,CAAC,KAAK,CAAC,OAAO;gBACb,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,MAAM;YACV,CAAC,CAAC,IAAI,KAAK,aAAa;gBACtB,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,QAAQ,CAAC;QACjB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,eAAe,EAAE,EAAE,GAAG,CAAC,CAAC;IACzF,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,KAAK,CAAC,eAAe,CAC1B,MAAmB,EACnB,KAEC,EACD,GAA0B;QAE1B,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;IAC1F,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,MAAmB,EACnB,KAAiF,EACjF,GAA0B;QAE1B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjC,MAAM,CAAC,KAAK,CAAC,8CAA8C,EAAE;oBAC3D,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,MAAM;iBACP,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC7C,MAAM,WAAW,GAA4B;gBAC3C,MAAM;gBACN,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC3D,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;gBACvE,GAAG,KAAK,CAAC,QAAQ;aAClB,CAAC;YACF,MAAM,QAAQ,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAE1E,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAA0B,CAAC;YACjF,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;YAErC,MAAM,QAAQ,CAAC,SAAS,CAAC;gBACvB,KAAK,EAAE,KAAK,CAAC,MAAM;oBACjB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE;oBACzC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE;gBACzB,MAAM;gBACN,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,UAAU;oBACpC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,EAAE,KAAK,CAAC,UAAU,EAAE,EAAE;oBAC9D,CAAC,CAAC,EAAE,CAAC;gBACP,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;gBAC9C,QAAQ;gBACR,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;gBAClE,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;gBAClD,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;gBACpE,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,CAAC;aAC5C,CAAC,CAAC;YAEH,MAAM,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,MAAM,CAAC,OAAO,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,cAAc,KAAK,CAAC,MAAM,EAAE,EAAE;gBACzI,MAAM;gBACN,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,kDAAkD;YAClD,0EAA0E;YAC1E,OAAO,CAAC,KAAK,CACX,IAAI,CAAC,SAAS,CAAC;gBACb,gBAAgB,EAAE,IAAI;gBACtB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;gBACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CACH,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE;gBACxD,KAAK;gBACL,MAAM;gBACN,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,KAAwB,EAAE,GAA0B;QACrE,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,8DAA8D;YAC9D,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjC,MAAM,CAAC,KAAK,CAAC,uCAAuC,EAAE;oBACpD,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;iBACrB,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,aAAa,CAAC;YACzC,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,CAAC;YAEtD,4DAA4D;YAC5D,8DAA8D;YAC9D,4DAA4D;YAC5D,gDAAgD;YAChD,MAAM,WAAW,GAA4B;gBAC3C,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC3D,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;gBACvE,GAAG,KAAK,CAAC,QAAQ;aAClB,CAAC;YACF,MAAM,QAAQ,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAE1E,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAA0B,CAAC;YACjF,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;YAErC,MAAM,aAAa,GACjB,CAAC,KAAK,CAAC,OAAO,IAAI,OAAO,KAAK,CAAC,QAAQ,EAAE,KAAK,KAAK,QAAQ;gBACzD,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK;gBACtB,CAAC,CAAC,SAAS,CAAC;YAEhB,MAAM,QAAQ,CAAC,SAAS,CAAC;gBACvB,KAAK,EAAE,KAAK,CAAC,MAAM;oBACjB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE;oBACzC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE;gBACzB,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC;gBACvB,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,UAAU;oBACpC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,EAAE,KAAK,CAAC,UAAU,EAAE,EAAE;oBAC9D,CAAC,CAAC,EAAE,CAAC;gBACP,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;gBAC9C,GAAG,CAAC,aAAa,KAAK,SAAS,IAAI,EAAE,aAAa,EAAE,CAAC;gBACrD,QAAQ;gBACR,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;gBAClE,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;gBAClD,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;gBACpE,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,CAAC;aAC5C,CAAC,CAAC;YAEH,mDAAmD;YACnD,MAAM,OAAO,GAAG,WAAW,KAAK,CAAC,MAAM,OAAO,KAAK,CAAC,QAAQ,GAC1D,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,EAChD,cAAc,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,iBAAiB,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAC5F,MAAM,SAAS,GAAG;gBAChB,IAAI;gBACJ,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC;YACF,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;gBAClB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YAClC,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,6DAA6D;YAC7D,yDAAyD;YACzD,sDAAsD;YACtD,mDAAmD;YACnD,0EAA0E;YAC1E,OAAO,CAAC,KAAK,CACX,IAAI,CAAC,SAAS,CAAC;gBACb,gBAAgB,EAAE,IAAI;gBACtB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CACH,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE;gBAChD,KAAK;gBACL,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF;AAED,yDAAyD;AACzD,MAAM,UAAU,iBAAiB,CAC/B,GAA2B,EAC3B,SAAkB;IAElB,OAAO,IAAI,kBAAkB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;AAChD,CAAC;AAgBD;;;;;;;;;;GAUG;AACH,MAAM,OAAO,kBAAkB;IACtB,KAAK,CAAC,IAAI,CAAC,KAA2B,EAAE,MAA6B;QAC1E,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;YACrC,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAExE,MAAM,WAAW,GAA4B;gBAC3C,GAAG,KAAK,CAAC,OAAO;gBAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,QAAQ,EAAE,MAAM;gBAChB,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1E,CAAC;YACF,MAAM,QAAQ,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;YAE5C,MAAM,QAAQ,CAAC,SAAS,CAAC;gBACvB,0DAA0D;gBAC1D,4DAA4D;gBAC5D,8DAA8D;gBAC9D,QAAQ,EAAE,KAAK,CAAC,QAAoB;gBACpC,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE;gBACnD,MAAM,EAAE,KAAK,CAAC,IAAI;gBAClB,OAAO,EAAE,SAAS;gBAClB,QAAQ,EAAE,MAAM;gBAChB,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtD,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,CAAC;aAC5C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,2DAA2D;YAC3D,0EAA0E;YAC1E,OAAO,CAAC,KAAK,CACX,IAAI,CAAC,SAAS,CAAC;gBACb,KAAK,EAAE,OAAO;gBACd,GAAG,EAAE,gBAAgB;gBACrB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/lib/auth/auth-context.d.ts

@@ -10,7 +10,7 @@ import type { TenantRole, UserRole, TenantMember, Tenant } from "@prisma/client"
 export interface AuthContext {
     /** Cognito user pool sub (UUID). Stable identifier used for cache keys. */
     cognitoSub: string;
-    /** Skybber `User.id` (cuid). */
+    /** Trellis `User.id` (cuid). */
     userId: string;
     /** Platform-wide role from `users.role`. */
     globalRole: UserRole;

package/dist/lib/auth/auth-context.js

@@ -1,4 +1,3 @@
-"use strict";
 /**
  * AuthContext — the resolved identity for one authenticated request.
  *
@@ -6,5 +5,5 @@
  * handler that needs auth information receives this rather than the raw
  * token payload.
  */
-Object.defineProperty(exports, "__esModule", { value: true });
+export {};
 //# sourceMappingURL=auth-context.js.map

package/dist/lib/auth/auth-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-context.js","sourceRoot":"","sources":["../../../src/lib/auth/auth-context.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG"}
+{"version":3,"file":"auth-context.js","sourceRoot":"","sources":["../../../src/lib/auth/auth-context.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}

package/dist/lib/auth/auth-middleware.d.ts

@@ -6,8 +6,8 @@
  *
  * Requires COGNITO_USER_POOL_ID and COGNITO_APP_CLIENT_ID in env.
  */
-import type { Env } from "../../env";
-import type { AuthContext } from "./auth-context";
+import type { Env } from "../../env.js";
+import type { AuthContext } from "./auth-context.js";
 /**
  * Extract and verify the Bearer token from the request, then assemble an
  * AuthContext from the JWT claims written by the pre-token-generation Lambda.
@@ -18,6 +18,20 @@ import type { AuthContext } from "./auth-context";
  * - Required claims are missing (userId, activeTenantId).
  */
 export declare function authMiddleware(request: Request, env: Env): Promise<AuthContext | null>;
+/**
+ * Extract and verify the active tenant id from a request's Bearer token,
+ * returning the validated cuid or `null` (no/invalid token, missing/malformed
+ * claim). Used by the tenant-context middleware (WS1, doc/14) to establish the
+ * ambient tenant via `runWithTenantContext` — which propagates through the
+ * whole downstream, unlike setting it from inside the per-handler
+ * `authMiddleware` (whose `enterWith` would not survive the `await` back to the
+ * caller).
+ *
+ * This re-verifies the JWT; it runs only when TENANT_SCOPE_MODE != "off", so
+ * there is no cost on the default path. (A future optimization can verify once
+ * and share the claims with `authMiddleware`.)
+ */
+export declare function extractVerifiedTenantId(request: Request, _env: Env): Promise<string | null>;
 /**
  * Assert that the caller's active tenant matches the tenant referenced by
  * the path parameter.

package/dist/lib/auth/auth-middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-middleware.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/auth-middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAOlD;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAsD7B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,WAAW,EACjB,gBAAgB,EAAE,MAAM,GACvB,QAAQ,GAAG,IAAI,CAOjB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,WAAW,EACjB,gBAAgB,EAAE,MAAM,GACvB,QAAQ,GAAG,IAAI,CAOjB"}
+{"version":3,"file":"auth-middleware.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/auth-middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAOrD;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAsD7B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,GAAG,GACR,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAcxB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,WAAW,EACjB,gBAAgB,EAAE,MAAM,GACvB,QAAQ,GAAG,IAAI,CAOjB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,WAAW,EACjB,gBAAgB,EAAE,MAAM,GACvB,QAAQ,GAAG,IAAI,CAOjB"}

package/dist/lib/auth/auth-middleware.js

@@ -1,4 +1,3 @@
-"use strict";
 /**
  * Auth Middleware
  *
@@ -7,44 +6,7 @@
  *
  * Requires COGNITO_USER_POOL_ID and COGNITO_APP_CLIENT_ID in env.
  */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.authMiddleware = authMiddleware;
-exports.requireActiveTenant = requireActiveTenant;
-exports.requireOwnTenant = requireOwnTenant;
-const cognito_jwt_1 = require("./cognito-jwt");
+import { extractBearerToken, verifyCognitoJwt } from "./cognito-jwt.js";
 // cuid v1 is `c[a-z0-9]{24}`. Allow up to 40 chars to absorb future widening
 // and any cuid v2 / nanoid variants without re-issuing every JWT.
 const CUID_RE = /^c[a-z0-9]{24,40}$/;
@@ -57,13 +19,13 @@ const CUID_RE = /^c[a-z0-9]{24,40}$/;
  * - The token fails verification (expired, bad signature, wrong pool/client).
  * - Required claims are missing (userId, activeTenantId).
  */
-async function authMiddleware(request, env) {
-    const token = (0, cognito_jwt_1.extractBearerToken)(request.headers.get("Authorization"));
+export async function authMiddleware(request, env) {
+    const token = extractBearerToken(request.headers.get("Authorization"));
     if (!token)
         return null;
     let claims;
     try {
-        claims = await (0, cognito_jwt_1.verifyCognitoJwt)(token);
+        claims = await verifyCognitoJwt(token);
     }
     catch {
         return null;
@@ -90,7 +52,7 @@ async function authMiddleware(request, env) {
     const membershipsLoader = async () => {
         if (membershipsCache)
             return membershipsCache;
-        const { createPrisma } = await Promise.resolve().then(() => __importStar(require("../../db")));
+        const { createPrisma } = await import("../../db.js");
         const db = createPrisma(env);
         membershipsCache = await db.tenantMember.findMany({
             where: { userId, status: "ACTIVE" },
@@ -109,6 +71,35 @@ async function authMiddleware(request, env) {
         membershipsLoader,
     };
 }
+/**
+ * Extract and verify the active tenant id from a request's Bearer token,
+ * returning the validated cuid or `null` (no/invalid token, missing/malformed
+ * claim). Used by the tenant-context middleware (WS1, doc/14) to establish the
+ * ambient tenant via `runWithTenantContext` — which propagates through the
+ * whole downstream, unlike setting it from inside the per-handler
+ * `authMiddleware` (whose `enterWith` would not survive the `await` back to the
+ * caller).
+ *
+ * This re-verifies the JWT; it runs only when TENANT_SCOPE_MODE != "off", so
+ * there is no cost on the default path. (A future optimization can verify once
+ * and share the claims with `authMiddleware`.)
+ */
+export async function extractVerifiedTenantId(request, _env) {
+    const token = extractBearerToken(request.headers.get("Authorization"));
+    if (!token)
+        return null;
+    let claims;
+    try {
+        claims = await verifyCognitoJwt(token);
+    }
+    catch {
+        return null;
+    }
+    const activeTenantId = claims["custom:activeTenantId"];
+    if (!activeTenantId || !CUID_RE.test(activeTenantId))
+        return null;
+    return activeTenantId;
+}
 /**
  * Assert that the caller's active tenant matches the tenant referenced by
  * the path parameter.
@@ -130,7 +121,7 @@ async function authMiddleware(request, env) {
  * tenant reads should use `requireOwnTenant` (404 for both conditions)
  * instead.
  */
-function requireActiveTenant(auth, tenantIdFromPath) {
+export function requireActiveTenant(auth, tenantIdFromPath) {
     if (auth.globalRole === "SUPER_ADMIN")
         return null;
     if (auth.activeTenantId === tenantIdFromPath)
@@ -143,7 +134,7 @@ function requireActiveTenant(auth, tenantIdFromPath) {
  * does not exist". Use this for DATA endpoints (GET /api/tenants/:id and
  * any cross-tenant resource lookup) where existence-leak is the concern.
  */
-function requireOwnTenant(auth, tenantIdFromPath) {
+export function requireOwnTenant(auth, tenantIdFromPath) {
     if (auth.globalRole === "SUPER_ADMIN")
         return null;
     if (auth.activeTenantId === tenantIdFromPath)

package/dist/lib/auth/auth-middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-middleware.js","sourceRoot":"","sources":["../../../src/lib/auth/auth-middleware.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoBH,wCAyDC;AAuBD,kDAUC;AAQD,4CAUC;AA3HD,+CAAqE;AAErE,6EAA6E;AAC7E,kEAAkE;AAClE,MAAM,OAAO,GAAG,oBAAoB,CAAC;AAErC;;;;;;;;GAQG;AACI,KAAK,UAAU,cAAc,CAClC,OAAgB,EAChB,GAAQ;IAER,MAAM,KAAK,GAAG,IAAA,gCAAkB,EAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;IACvE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAA,8BAAgB,EAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;IACvC,MAAM,cAAc,GAAG,MAAM,CAAC,uBAAuB,CAAC,CAAC;IAEvD,qEAAqE;IACrE,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IAE5C,wEAAwE;IACxE,sEAAsE;IACtE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC;QAAE,OAAO,IAAI,CAAC;IAExE,gFAAgF;IAChF,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,IAAI,MAAM,CAAC,aAAa,CAAC,IAAI,UAAU,CAAa,CAAC;IACpG,2EAA2E;IAC3E,mEAAmE;IACnE,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,IAAI,OAAO,CAAe,CAAC;IAC1E,MAAM,UAAU,GAAG,MAAM,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC;IACrD,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;IAC7C,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC;IAE9B,0EAA0E;IAC1E,IAAI,gBAAgB,GAAiD,IAAI,CAAC;IAE1E,MAAM,iBAAiB,GAAG,KAAK,IAAoD,EAAE;QACnF,IAAI,gBAAgB;YAAE,OAAO,gBAAgB,CAAC;QAC9C,MAAM,EAAE,YAAY,EAAE,GAAG,wDAAa,UAAU,GAAC,CAAC;QAClD,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAC7B,gBAAgB,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC;YAChD,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE;YACnC,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;SAC1B,CAA0C,CAAC;QAC5C,OAAO,gBAAgB,CAAC;IAC1B,CAAC,CAAC;IAEF,OAAO;QACL,UAAU;QACV,MAAM;QACN,UAAU;QACV,cAAc;QACd,UAAU;QACV,UAAU;QACV,MAAM;QACN,iBAAiB;KAClB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAgB,mBAAmB,CACjC,IAAiB,EACjB,gBAAwB;IAExB,IAAI,IAAI,CAAC,UAAU,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,IAAI,CAAC,cAAc,KAAK,gBAAgB;QAAE,OAAO,IAAI,CAAC;IAC1D,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,iDAAiD,EAAE,CAAC,EAClG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,gBAAgB,CAC9B,IAAiB,EACjB,gBAAwB;IAExB,IAAI,IAAI,CAAC,UAAU,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,IAAI,CAAC,cAAc,KAAK,gBAAgB;QAAE,OAAO,IAAI,CAAC;IAC1D,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,EACnE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"auth-middleware.js","sourceRoot":"","sources":["../../../src/lib/auth/auth-middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAExE,6EAA6E;AAC7E,kEAAkE;AAClE,MAAM,OAAO,GAAG,oBAAoB,CAAC;AAErC;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAgB,EAChB,GAAQ;IAER,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;IACvE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;IACvC,MAAM,cAAc,GAAG,MAAM,CAAC,uBAAuB,CAAC,CAAC;IAEvD,qEAAqE;IACrE,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IAE5C,wEAAwE;IACxE,sEAAsE;IACtE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC;QAAE,OAAO,IAAI,CAAC;IAExE,gFAAgF;IAChF,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,IAAI,MAAM,CAAC,aAAa,CAAC,IAAI,UAAU,CAAa,CAAC;IACpG,2EAA2E;IAC3E,mEAAmE;IACnE,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,IAAI,OAAO,CAAe,CAAC;IAC1E,MAAM,UAAU,GAAG,MAAM,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC;IACrD,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;IAC7C,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC;IAE9B,0EAA0E;IAC1E,IAAI,gBAAgB,GAAiD,IAAI,CAAC;IAE1E,MAAM,iBAAiB,GAAG,KAAK,IAAoD,EAAE;QACnF,IAAI,gBAAgB;YAAE,OAAO,gBAAgB,CAAC;QAC9C,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACrD,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAC7B,gBAAgB,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC;YAChD,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE;YACnC,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;SAC1B,CAA0C,CAAC;QAC5C,OAAO,gBAAgB,CAAC;IAC1B,CAAC,CAAC;IAEF,OAAO;QACL,UAAU;QACV,MAAM;QACN,UAAU;QACV,cAAc;QACd,UAAU;QACV,UAAU;QACV,MAAM;QACN,iBAAiB;KAClB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAgB,EAChB,IAAS;IAET,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;IACvE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,CAAC,uBAAuB,CAAC,CAAC;IACvD,IAAI,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC;QAAE,OAAO,IAAI,CAAC;IAClE,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAiB,EACjB,gBAAwB;IAExB,IAAI,IAAI,CAAC,UAAU,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,IAAI,CAAC,cAAc,KAAK,gBAAgB;QAAE,OAAO,IAAI,CAAC;IAC1D,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,iDAAiD,EAAE,CAAC,EAClG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAiB,EACjB,gBAAwB;IAExB,IAAI,IAAI,CAAC,UAAU,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,IAAI,CAAC,cAAc,KAAK,gBAAgB;QAAE,OAAO,IAAI,CAAC;IAC1D,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,EACnE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;AACJ,CAAC"}