@efa-one/sdk 1.21.0 → 1.23.0

package/README.md

@@ -12,9 +12,9 @@ sub-paths — this keeps `express` out of the frontend and `react` out of the ba
 
 | Import | Runs in | Contains |
 |---|---|---|
-| `@efa-one/sdk/backend` | Node/Express | Auth + token exchange (`requireAuth`, `createExchangeRouter`, `requireInternalOrAuth` …), health router, service discovery + gateway client (`serviceClient`, `resolveService`), clients for audit/reporting/mail/notifications, permission resolution/registration (`getUserPermissions`, `registerPermissions`, `checkPermission`), capability registry (`registerApiMetadata`), backend i18n |
-| `@efa-one/sdk/frontend` | Browser/React | postMessage IPC (`registerAppInfo`, `sendAtStart`, `navigateToApp`, `notifyRouteChange` …), react-i18next factory (`initI18n`), `DevHeader` |
-| `@efa-one/sdk/frontend/ui` | Browser/React | The efa-one design-system kit: `Button`, `Input`, `Badge`, `Alert`, `Dialog`, `DropdownMenu`, `Tooltip`, `EmptyState`, `Skeleton`, `RecordDialog`, and the **`DataTable`** (sortable/filterable/groupable list with draggable, resizable columns and a per-user persisted view; reflows to stacked cards below 640px). Also exports `useIsMobile` — the platform-wide 640px breakpoint hook. Ship its companion CSS once: `import '@efa-one/sdk/frontend/ui/styles.css'` |
+| `@efa-one/sdk/backend` | Node/Express | Auth + token exchange (`requireAuth`, `createExchangeRouter`, `requireInternalOrAuth` …), health router, service discovery + gateway client (`serviceClient`, `resolveService`), clients for audit/reporting/mail/notifications, permission resolution/registration (`getUserPermissions`, `registerPermissions`, `checkPermission`), platform-admin check (`isPlatformAdmin` — top permission `efa-all`, legacy `converge-admin` accepted until Q1-2027; `requireAdmin`/`requireAdminOrPermission` use it), capability registry (`registerApiMetadata`), backend i18n |
+| `@efa-one/sdk/frontend` | Browser/React | postMessage IPC (`registerAppInfo`, `sendAtStart`, `navigateToApp`, `notifyRouteChange` …), react-i18next factory (`initI18n`), platform-admin check (`isPlatformAdmin`, `PLATFORM_ADMIN_PERMISSIONS`), `DevHeader` |
+| `@efa-one/sdk/frontend/ui` | Browser/React | The efa-one design-system kit: `Button`, `Input`, `Badge`, `Alert`, `Dialog`, `DropdownMenu`, `Tooltip`, `EmptyState`, `Skeleton`, `RecordDialog`, and the **`DataTable`** (sortable/filterable/groupable list with draggable, resizable columns, a per-user persisted view and CSV/Excel export of the current view; reflows to stacked cards below 640px). Also exports `useIsMobile` — the platform-wide 640px breakpoint hook. Ship its companion CSS once: `import '@efa-one/sdk/frontend/ui/styles.css'` |
 | `@efa-one/sdk/frontend/format` | Browser | Platform-wide date/time display — `formatDate` (`01.09.2026`), `formatDateTime` (`01.09.2026, 11:05`), `formatTime`, `formatFileStamp`, `localeForLanguage`. Always use these instead of `toLocaleDateString`/`toLocaleString`: without an options object those render `1.9.2026`, and without a locale argument they follow the browser language (`9/1/2026`) |
 | `@efa-one/sdk/frontend/viewPreferences` | Browser/React | Persistence seam for `DataTable` — `createViewPreferencesClient()` (standard `/api/view-preferences/:listId` adapter) + `useViewPreferences()` |
 
@@ -53,6 +53,10 @@ npm install @efa-one/sdk react i18next i18next-http-backend react-i18next
 
 The runtime libraries are **optional peer dependencies** — install only the ones
 matching the entry point you use. The SDK itself does not bundle them.
+`i18next-http-backend` requires **4.0.2 or later**: older releases are covered by
+published security advisories (`npm audit` reports GHSA-xvq9-wjp8-hwqf for every
+version below 4.0.2). The range stays open upwards like the other peers, so a new
+major does not need an SDK release first.
 
 ## Usage
 
@@ -223,6 +227,77 @@ before, it was missing until the user reset the view. New prop `groupsDefaultExp
 groups start expanded; groups the user collapses stay collapsed. No backend or kernel
 change.
 
+**1.22.0 — export the current view.** The DataTable's gear menu now has „Excel" and
+„CSV" buttons. Both export exactly what the user sees: filtered and sorted rows (in
+group order when grouped, collapsed groups included), visible columns in their order.
+CSV uses `;` as separator, `,` as decimal mark and a UTF-8 BOM, so German Excel opens
+it by double-click; text that starts like a formula is prefixed with `'`. The .xlsx is
+written without a dependency (stored ZIP): bold, light-grey header row with thin
+borders, frozen, with autofilter; numbers and dates are real Excel values
+(`dd.mm.yyyy`). Values come from `accessor`, not from `cell`; multi-select filter
+codes are exported as their labels. New `ColumnDef` fields `exportValue` (own export
+value) and `exportable: false` (leave out, e.g. action columns), new props
+`exportFileName` (default: `listId`, plus a timestamp) and `exportable={false}` (hide
+the export, e.g. without an export permission). `toCsv`/`toXlsx`/`downloadFile` are
+exported for app-side use. CSV is CSV: Excel turns `01067` into `1067` and long digit
+strings into `1,23E+18`, and shows the `'` in front of `+49 …` — point users to the
+Excel export for such data. No backend or kernel change.
+
+**1.23.0 — Q4-2026 security bundle, `efa-all`.** Needs **Kernel ≥ v1.1.0**.
+- `efa-all` is the top permission (was `converge-admin`). `isPlatformAdmin(keys)`,
+  `PLATFORM_ADMIN_PERMISSION(S)` and the admin guards accept `efa-all` **or**
+  `converge-admin` until Q1-2027.
+- Exchange rejects purpose-bound tokens (`purpose`/`serviceKey`), `gw` other than
+  `'app'`, `forcePasswordChange` and `tenant !== 'default'` (`classifyPlatformToken`);
+  `gw: 'app'` only with gateway provenance for this app.
+- In production (`NODE_ENV=production`) `app_session` lives on `/apps/<SERVICE_KEY>/`
+  instead of `/`; the exchange removes an old `/` cookie unless the name is the generic
+  `app_session`. Apps still on the generic name set `APP_SESSION_COOKIE_NAME=<key>_app_session`.
+- `requireRegistryKey`/`requireInternalOrAuth`/`requireInternalOrAdminOrPermission` take
+  `{ allowedCallers }`, set `req.callerService`, accept provenance tokens for 60 s and only
+  once (`jti`).
+- `APP_SESSION_SECRET` missing or a placeholder aborts the start in production, shorter
+  than 32 bytes warns (`APP_SESSION_SECRET_STRICT=true` aborts).
+- `serviceClient` no longer retries 4xx (`ServiceClientError`), has `timeoutMs`;
+  permission lookups time out after 5 s. `isFromPlatformParent` also checks `event.origin`.
+- Peer range `i18next-http-backend >=4.0.2`; DataTable bulk bar says „Auswahl aufheben".
+
+**Next minor (planned 1.23.0, not yet released) — exchange, cookie and S2S hardening.**
+Needs a kernel with efaware/efa_kernel#106 and #107 first (gateway exchange token
+`gw: 'app'`, provenance `jti`, cookie filter). Then:
+
+- `POST /api/auth/exchange` rejects tokens with `purpose` or `serviceKey` (delegation,
+  RAG, run-as), with a `gw` other than `'app'`, with `forcePasswordChange: true` and with a
+  tenant other than `default` (`classifyPlatformToken`). The gateway exchange token
+  (`gw: 'app'`) is accepted only together with the gateway's provenance token for this app
+  (`sub=converge_kernel`, `aud=SERVICE_KEY`), so an app that received one cannot replay it
+  at another app. Kernel first: before efaware/efa_kernel#106 tokens carry no `gw`.
+- `app_session` lives on `/apps/<SERVICE_KEY>/` instead of `/` when `NODE_ENV=production`
+  (every app image sets it); `/` otherwise, `APP_SESSION_COOKIE_PATH` overrides (set it to
+  `/` to run a built image locally without the gateway). With an app-specific cookie name
+  the exchange deletes a legacy cookie on `/`; the generic `app_session` is left alone,
+  it may belong to another app.
+- `requireRegistryKey({ allowedCallers })`, `requireInternalOrAuth({ allowedCallers })`,
+  `requireInternalOrAdminOrPermission({ allowedCallers }, ...keys)`; the plain forms keep
+  working. `req.callerService` carries the verified caller. Provenance tokens older than
+  60 s are rejected, each `jti` is accepted once per app (in-memory, bounded); tokens
+  without `jti` (older kernel) still pass.
+- `APP_SESSION_SECRET`: missing or placeholder → `createExchangeRouter` throws at startup
+  in production (outside production it logs, so test suites that build the router before
+  setting env keep working); shorter than 32 bytes → warning, start abort with
+  `APP_SESSION_SECRET_STRICT=true`.
+- `requireInternalOrAdminOrPermission` throws when an options object is not the first
+  argument (it would otherwise be ignored silently).
+- `serviceClient` no longer retries 4xx (`ServiceClientError` with `status`), new
+  `call(…, body, { timeoutMs })`; permission lookups time out after 5 s.
+- `registerPermissions` no longer falls back to `CONVERGE_REGISTRY_URL` +
+  `/api/registry/services/:key/permissions` (that kernel route always answered 500 and is
+  removed in efaware/efa_kernel for efa #287); without `CONVERGE_GATEWAY_URL` it logs and
+  skips. `options.registryBaseUrl` is ignored.
+- `isFromPlatformParent` also checks `event.origin === window.location.origin`. The kernel
+  embeds SDK apps same-origin under `/apps/<key>/`; an app embedded from a foreign origin
+  no longer accepts platform messages.
+
 ## License
 
 [Apache-2.0](./LICENSE) — permissive with a patent grant, so customers and partners

package/backend/auth.d.ts

@@ -1,5 +1,7 @@
 import { Router, Request, Response, NextFunction } from 'express';
 import { Pool } from 'pg';
+import { type ProvenanceGuardOptions } from './serviceProvenance';
+export type { ProvenanceGuardOptions } from './serviceProvenance';
 export interface JwtPayload {
     sub: string;
     name: string;
@@ -10,6 +12,7 @@ export interface JwtPayload {
     exp: number;
     forcePasswordChange?: boolean;
     jti?: string;
+    gw?: string;
 }
 export interface SessionPayload {
     sub: string;
@@ -23,12 +26,48 @@ export interface SessionPayload {
 }
 export interface AuthRequest extends Request {
     user?: SessionPayload;
+    callerService?: string;
 }
+export declare const APP_SESSION_SECRET_MIN_BYTES = 32;
+export type SessionSecretVerdict = {
+    ok: true;
+} | {
+    ok: false;
+    level: 'error' | 'warn';
+    reason: 'missing' | 'placeholder' | 'too_short';
+    message: string;
+};
+export declare function checkSessionSecret(secret: string | undefined): SessionSecretVerdict;
+export declare function assertSessionSecret(): void;
+export declare function getSessionCookiePath(): string;
 export declare function requireAuth(req: AuthRequest, res: Response, next: NextFunction): void;
 export declare function requireAdmin(req: AuthRequest, res: Response, next: NextFunction): void;
 export declare function requirePermission(permission: string): (req: AuthRequest, res: Response, next: NextFunction) => void;
 export declare function requireAdminOrPermission(...permissionKeys: string[]): (req: AuthRequest, res: Response, next: NextFunction) => void;
+type Guard = (req: AuthRequest, res: Response, next: NextFunction) => void;
+export declare function requireRegistryKey(options: ProvenanceGuardOptions): Guard;
 export declare function requireRegistryKey(req: Request, res: Response, next: NextFunction): void;
+export declare function requireInternalOrAuth(options: ProvenanceGuardOptions): Guard;
 export declare function requireInternalOrAuth(req: AuthRequest, res: Response, next: NextFunction): void;
-export declare function requireInternalOrAdminOrPermission(...permissionKeys: string[]): (req: AuthRequest, res: Response, next: NextFunction) => void;
+export declare function requireInternalOrAdminOrPermission(...permissionKeys: string[]): Guard;
+export declare function requireInternalOrAdminOrPermission(options: ProvenanceGuardOptions, ...permissionKeys: string[]): Guard;
+export type PlatformTokenVerdict = {
+    ok: true;
+} | {
+    ok: false;
+    status: 401;
+    error: string;
+    code: 'delegation_token_not_accepted';
+} | {
+    ok: false;
+    status: 403;
+    error: 'Password change required';
+    code: 'FORCE_PASSWORD_CHANGE';
+} | {
+    ok: false;
+    status: 403;
+    error: 'tenant_not_supported';
+    code: 'tenant_not_supported';
+};
+export declare function classifyPlatformToken(payload: Record<string, unknown>): PlatformTokenVerdict;
 export declare function createExchangeRouter(pool: Pool): Router;

package/backend/auth.js

@@ -3,6 +3,10 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.APP_SESSION_SECRET_MIN_BYTES = void 0;
+exports.checkSessionSecret = checkSessionSecret;
+exports.assertSessionSecret = assertSessionSecret;
+exports.getSessionCookiePath = getSessionCookiePath;
 exports.requireAuth = requireAuth;
 exports.requireAdmin = requireAdmin;
 exports.requirePermission = requirePermission;
@@ -10,42 +14,106 @@ exports.requireAdminOrPermission = requireAdminOrPermission;
 exports.requireRegistryKey = requireRegistryKey;
 exports.requireInternalOrAuth = requireInternalOrAuth;
 exports.requireInternalOrAdminOrPermission = requireInternalOrAdminOrPermission;
+exports.classifyPlatformToken = classifyPlatformToken;
 exports.createExchangeRouter = createExchangeRouter;
 const express_1 = require("express");
 const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
 const permissionClient_1 = require("./permissionClient");
 const sessionStatusClient_1 = require("./sessionStatusClient");
+const platformAdmin_1 = require("./platformAdmin");
+const serviceProvenance_1 = require("./serviceProvenance");
 const JWT_ISSUER = 'converge';
 const JWT_AUDIENCE = 'converge';
 const KERNEL_JTI_RE = /^[A-Za-z0-9._:-]{1,128}$/;
 const KERNEL_SUB_RE = /^[A-Za-z0-9._:@-]{1,128}$/;
-function getPlatformPublicKey() {
-    const s = process.env.JWT_PUBLIC_KEY;
-    if (!s)
-        throw new Error('JWT_PUBLIC_KEY environment variable is required');
-    return Buffer.from(s, 'base64').toString('utf8');
-}
 function getSessionSecret() {
     const s = process.env.APP_SESSION_SECRET;
     if (!s)
         throw new Error('APP_SESSION_SECRET environment variable is required');
     return s;
 }
+exports.APP_SESSION_SECRET_MIN_BYTES = 32;
+const SESSION_SECRET_PLACEHOLDER_PREFIXES = ['changeme', 'change-me', 'change_me', 'please_change', 'replace_me', 'your-'];
+const SESSION_SECRET_PLACEHOLDERS = new Set(['secret', 'password', 'test', 'dev', 'development', 'app_session_secret']);
+function checkSessionSecret(secret) {
+    if (!secret) {
+        return { ok: false, level: 'error', reason: 'missing', message: 'APP_SESSION_SECRET ist nicht gesetzt. Erzeugen mit: openssl rand -hex 32' };
+    }
+    const lower = secret.trim().toLowerCase();
+    if (SESSION_SECRET_PLACEHOLDERS.has(lower) || SESSION_SECRET_PLACEHOLDER_PREFIXES.some((p) => lower.startsWith(p))) {
+        return {
+            ok: false,
+            level: 'error',
+            reason: 'placeholder',
+            message: 'APP_SESSION_SECRET ist ein Platzhalter aus einer Beispiel-Konfiguration. Echten Wert setzen: openssl rand -hex 32',
+        };
+    }
+    const bytes = Buffer.byteLength(secret, 'utf8');
+    if (bytes < exports.APP_SESSION_SECRET_MIN_BYTES) {
+        return {
+            ok: false,
+            level: (0, serviceProvenance_1.isTruthyEnv)(process.env.APP_SESSION_SECRET_STRICT) ? 'error' : 'warn',
+            reason: 'too_short',
+            message: `APP_SESSION_SECRET ist ${bytes} Byte lang, verlangt sind mindestens ${exports.APP_SESSION_SECRET_MIN_BYTES}. Neu erzeugen mit: openssl rand -hex 32`,
+        };
+    }
+    return { ok: true };
+}
+function assertSessionSecret() {
+    const verdict = checkSessionSecret(process.env.APP_SESSION_SECRET);
+    if (verdict.ok)
+        return;
+    const fatal = verdict.level === 'error'
+        && (process.env.NODE_ENV === 'production' || (0, serviceProvenance_1.isTruthyEnv)(process.env.APP_SESSION_SECRET_STRICT));
+    if (fatal)
+        throw new Error(verdict.message);
+    const level = verdict.level === 'error' ? 'error' : 'warn';
+    console[level](JSON.stringify({ level, msg: verdict.message, reason: verdict.reason }));
+}
+const DEFAULT_COOKIE_NAME = 'app_session';
 function getCookieName() {
-    return process.env.APP_SESSION_COOKIE_NAME || 'app_session';
+    return process.env.APP_SESSION_COOKIE_NAME || DEFAULT_COOKIE_NAME;
 }
-function setSessionCookie(res, token, maxAgeMs) {
-    const secure = process.env.COOKIE_SECURE
-        ? ['1', 'true', 'yes', 'on'].includes(process.env.COOKIE_SECURE.toLowerCase())
+function getSessionCookiePath() {
+    const explicit = process.env.APP_SESSION_COOKIE_PATH?.trim();
+    if (explicit)
+        return explicit;
+    if (process.env.NODE_ENV !== 'production')
+        return '/';
+    const serviceKey = process.env.SERVICE_KEY;
+    if (serviceKey && serviceProvenance_1.SERVICE_KEY_RE.test(serviceKey))
+        return `/apps/${serviceKey}/`;
+    return '/';
+}
+function assertSessionCookiePath() {
+    const path = getSessionCookiePath();
+    if (!path.startsWith('/') || /[;,\s]/.test(path)) {
+        throw new Error(`APP_SESSION_COOKIE_PATH ungültig: ${JSON.stringify(path)} (muss mit / beginnen, ohne ; , oder Leerzeichen)`);
+    }
+}
+function isSecureCookie() {
+    return process.env.COOKIE_SECURE
+        ? (0, serviceProvenance_1.isTruthyEnv)(process.env.COOKIE_SECURE)
         : process.env.NODE_ENV === 'production';
+}
+function setSessionCookie(res, token, maxAgeMs) {
     res.cookie(getCookieName(), token, {
         httpOnly: true,
         sameSite: 'lax',
         maxAge: maxAgeMs,
-        secure,
-        path: '/',
+        secure: isSecureCookie(),
+        path: getSessionCookiePath(),
     });
 }
+function clearLegacySessionCookie(req, res) {
+    if (getSessionCookiePath() === '/')
+        return;
+    if (getCookieName() === DEFAULT_COOKIE_NAME)
+        return;
+    if (req.cookies?.[getCookieName()] === undefined)
+        return;
+    res.clearCookie(getCookieName(), { httpOnly: true, sameSite: 'lax', secure: isSecureCookie(), path: '/' });
+}
 function requireAuth(req, res, next) {
     const token = req.cookies?.[getCookieName()];
     if (!token) {
@@ -87,7 +155,7 @@ function requireAdmin(req, res, next) {
     requireAuth(req, res, () => {
         (0, permissionClient_1.getUserPermissions)(req.user.convergeId)
             .then((keys) => {
-            if (!keys.includes('converge-admin')) {
+            if (!(0, platformAdmin_1.isPlatformAdmin)(keys)) {
                 res.status(403).json({ error: 'Admin access required' });
                 return;
             }
@@ -104,7 +172,10 @@ function requirePermission(permission) {
         requireAuth(req, res, () => {
             (0, permissionClient_1.getUserPermissions)(req.user.convergeId)
                 .then((keys) => {
-                if (!keys.includes(permission)) {
+                const granted = (0, platformAdmin_1.isPlatformAdminPermission)(permission)
+                    ? (0, platformAdmin_1.isPlatformAdmin)(keys)
+                    : keys.includes(permission);
+                if (!granted) {
                     res.status(403).json({ error: `Permission required: ${permission}` });
                     return;
                 }
@@ -122,7 +193,7 @@ function requireAdminOrPermission(...permissionKeys) {
         requireAuth(req, res, () => {
             (0, permissionClient_1.getUserPermissions)(req.user.convergeId)
                 .then((keys) => {
-                if (keys.includes('converge-admin')) {
+                if ((0, platformAdmin_1.isPlatformAdmin)(keys)) {
                     next();
                     return;
                 }
@@ -139,50 +210,99 @@ function requireAdminOrPermission(...permissionKeys) {
         });
     };
 }
-const PROVENANCE_ISSUER = 'converge-gateway';
-function hasValidServiceProvenance(req) {
-    const token = req.headers['x-service-token'];
-    if (!token)
-        return false;
-    const audience = process.env.SERVICE_KEY;
-    if (!audience)
-        return false;
-    try {
-        jsonwebtoken_1.default.verify(token, getPlatformPublicKey(), {
-            algorithms: ['RS256'],
-            issuer: PROVENANCE_ISSUER,
-            audience,
-        });
-        return true;
-    }
-    catch {
-        return false;
-    }
+function isMiddlewareCall(res, next) {
+    return res !== undefined && typeof next === 'function';
 }
-function requireRegistryKey(req, res, next) {
-    if (hasValidServiceProvenance(req)) {
-        next();
+function rejectProvenance(res, result) {
+    if (!result.ok && result.reason === 'caller_not_allowed') {
+        res.status(403).json({ error: 'Service caller not allowed' });
         return;
     }
     res.status(401).json({ error: 'Service provenance token required' });
 }
-function requireInternalOrAuth(req, res, next) {
-    if (hasValidServiceProvenance(req)) {
-        next();
+function registryKeyGuard(options) {
+    return (req, res, next) => {
+        const result = (0, serviceProvenance_1.verifyServiceProvenance)(req, options);
+        if (result.ok) {
+            next();
+            return;
+        }
+        rejectProvenance(res, result);
+    };
+}
+function internalOrAuthGuard(options) {
+    return (req, res, next) => {
+        if ((0, serviceProvenance_1.verifyServiceProvenance)(req, options).ok) {
+            next();
+            return;
+        }
+        requireAuth(req, res, next);
+    };
+}
+function dualGuard(factory, a, res, next) {
+    if (isMiddlewareCall(res, next)) {
+        factory({})(a, res, next);
         return;
     }
-    requireAuth(req, res, next);
+    const options = (a ?? {});
+    (0, serviceProvenance_1.assertProvenanceOptions)(options);
+    return factory(options);
+}
+function requireRegistryKey(a, res, next) {
+    return dualGuard(registryKeyGuard, a, res, next);
+}
+function requireInternalOrAuth(a, res, next) {
+    return dualGuard(internalOrAuthGuard, a, res, next);
 }
-function requireInternalOrAdminOrPermission(...permissionKeys) {
+function requireInternalOrAdminOrPermission(...args) {
+    const [first, ...rest] = args;
+    const options = typeof first === 'object' && first !== null ? first : {};
+    const keys = typeof first === 'string' ? args : rest;
+    if (!keys.every((a) => typeof a === 'string')) {
+        throw new Error('requireInternalOrAdminOrPermission: Optionen nur als erstes Argument, danach Permission-Keys');
+    }
+    const permissionKeys = keys;
+    (0, serviceProvenance_1.assertProvenanceOptions)(options);
+    const userGuard = requireAdminOrPermission(...permissionKeys);
     return (req, res, next) => {
-        if (hasValidServiceProvenance(req)) {
+        if ((0, serviceProvenance_1.verifyServiceProvenance)(req, options).ok) {
             next();
             return;
         }
-        requireAdminOrPermission(...permissionKeys)(req, res, next);
+        userGuard(req, res, next);
     };
 }
+const PLATFORM_TENANT = 'default';
+const GATEWAY_EXCHANGE_CALLER = 'converge_kernel';
+function classifyPlatformToken(payload) {
+    const serviceKey = payload.serviceKey;
+    if (serviceKey !== undefined && serviceKey !== null && serviceKey !== '') {
+        return { ok: false, status: 401, error: 'Service-Token begründet keine Sitzung', code: 'delegation_token_not_accepted' };
+    }
+    const purpose = payload.purpose;
+    if (purpose !== undefined && purpose !== null && purpose !== '') {
+        const label = typeof purpose === 'string' ? purpose.slice(0, 64) : typeof purpose;
+        return {
+            ok: false,
+            status: 401,
+            error: `Zweckgebundenes Token (purpose=${label}) begründet keine Sitzung`,
+            code: 'delegation_token_not_accepted',
+        };
+    }
+    if (payload.gw !== undefined && payload.gw !== 'app') {
+        return { ok: false, status: 401, error: 'Gateway-Token für ein anderes Ziel begründet keine Sitzung', code: 'delegation_token_not_accepted' };
+    }
+    if (payload.forcePasswordChange === true) {
+        return { ok: false, status: 403, error: 'Password change required', code: 'FORCE_PASSWORD_CHANGE' };
+    }
+    if (payload.tenant !== PLATFORM_TENANT) {
+        return { ok: false, status: 403, error: 'tenant_not_supported', code: 'tenant_not_supported' };
+    }
+    return { ok: true };
+}
 function createExchangeRouter(pool) {
+    assertSessionSecret();
+    assertSessionCookiePath();
     const router = (0, express_1.Router)();
     router.post('/exchange', async (req, res) => {
         const { token } = req.body;
@@ -192,7 +312,7 @@ function createExchangeRouter(pool) {
         }
         let convergePayload;
         try {
-            convergePayload = jsonwebtoken_1.default.verify(token, getPlatformPublicKey(), {
+            convergePayload = jsonwebtoken_1.default.verify(token, (0, serviceProvenance_1.getPlatformPublicKey)(), {
                 algorithms: ['RS256'],
                 issuer: JWT_ISSUER,
                 audience: JWT_AUDIENCE,
@@ -202,6 +322,29 @@ function createExchangeRouter(pool) {
             res.status(401).json({ error: 'Invalid or expired platform token' });
             return;
         }
+        const verdict = classifyPlatformToken(convergePayload);
+        if (!verdict.ok) {
+            console.warn(JSON.stringify({
+                level: 'warn',
+                msg: 'Token-Exchange abgelehnt',
+                code: verdict.code,
+                sub: typeof convergePayload.sub === 'string' ? convergePayload.sub : null,
+            }));
+            res.status(verdict.status).json({ error: verdict.error, code: verdict.code });
+            return;
+        }
+        if (convergePayload.gw === 'app') {
+            const provenance = (0, serviceProvenance_1.verifyServiceProvenance)(req, { allowedCallers: [GATEWAY_EXCHANGE_CALLER] });
+            if (!provenance.ok) {
+                console.warn(JSON.stringify({
+                    level: 'warn',
+                    msg: 'Token-Exchange abgelehnt: Gateway-Tausch-Token ohne Herkunftsnachweis',
+                    reason: provenance.reason,
+                }));
+                res.status(401).json({ error: 'Gateway-Tausch-Token nur auf dem Tausch-Aufruf des Gateways', code: 'gateway_provenance_required' });
+                return;
+            }
+        }
         if (typeof convergePayload.jti !== 'string' || !KERNEL_JTI_RE.test(convergePayload.jti) ||
             typeof convergePayload.sub !== 'string' || !KERNEL_SUB_RE.test(convergePayload.sub) ||
             !Number.isInteger(convergePayload.iat) || !Number.isInteger(convergePayload.exp)) {
@@ -238,6 +381,7 @@ function createExchangeRouter(pool) {
             };
             const sessionToken = jsonwebtoken_1.default.sign(sessionPayload, getSessionSecret(), { algorithm: 'HS256', expiresIn: remainingSec });
             setSessionCookie(res, sessionToken, remainingSec * 1000);
+            clearLegacySessionCookie(req, res);
             res.json({
                 user: {
                     id: appUser.id,
@@ -254,7 +398,11 @@ function createExchangeRouter(pool) {
         }
     });
     router.post('/logout', (_req, res) => {
-        res.clearCookie(getCookieName());
+        const opts = { httpOnly: true, sameSite: 'lax', secure: isSecureCookie() };
+        res.clearCookie(getCookieName(), { ...opts, path: getSessionCookiePath() });
+        if (getSessionCookiePath() !== '/' && getCookieName() !== DEFAULT_COOKIE_NAME) {
+            res.clearCookie(getCookieName(), { ...opts, path: '/' });
+        }
         res.json({ ok: true });
     });
     router.get('/permissions', requireAuth, async (req, res) => {

package/backend/index.d.ts

@@ -8,8 +8,10 @@ export * from './permissions';
 export * from './permissionClient';
 export * from './sessionStatusClient';
 export * from './permissionCheck';
+export * from './platformAdmin';
 export * from './customPermissions';
 export * from './serviceClient';
 export * from './serviceDiscovery';
 export * from './apiRegistry';
 export * from './i18n-backend';
+export * from './serviceProvenance';

package/backend/index.js

@@ -24,8 +24,10 @@ __exportStar(require("./permissions"), exports);
 __exportStar(require("./permissionClient"), exports);
 __exportStar(require("./sessionStatusClient"), exports);
 __exportStar(require("./permissionCheck"), exports);
+__exportStar(require("./platformAdmin"), exports);
 __exportStar(require("./customPermissions"), exports);
 __exportStar(require("./serviceClient"), exports);
 __exportStar(require("./serviceDiscovery"), exports);
 __exportStar(require("./apiRegistry"), exports);
 __exportStar(require("./i18n-backend"), exports);
+__exportStar(require("./serviceProvenance"), exports);

package/backend/permissionCheck.js

@@ -2,11 +2,12 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.checkPermission = checkPermission;
 const serviceClient_1 = require("./serviceClient");
+const permissionClient_1 = require("./permissionClient");
 async function checkPermission(convergeId, key, sourceApp) {
     if (!convergeId)
         throw new Error('checkPermission: convergeId required');
     if (!key)
         throw new Error('checkPermission: key required');
-    const { granted } = await serviceClient_1.serviceClient.call('converge_access', 'POST', '/api/internal/check-permission', { convergeId, key, sourceApp: sourceApp ?? process.env.APP_NAME ?? null });
+    const { granted } = await serviceClient_1.serviceClient.call('converge_access', 'POST', '/api/internal/check-permission', { convergeId, key, sourceApp: sourceApp ?? process.env.APP_NAME ?? null }, { timeoutMs: permissionClient_1.PERMISSION_LOOKUP_TIMEOUT_MS });
     return Boolean(granted);
 }

package/backend/permissionClient.d.ts

@@ -1 +1,2 @@
+export declare const PERMISSION_LOOKUP_TIMEOUT_MS = 5000;
 export declare function getUserPermissions(convergeId: string): Promise<string[]>;

package/backend/permissionClient.js

@@ -1,11 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.PERMISSION_LOOKUP_TIMEOUT_MS = void 0;
 exports.getUserPermissions = getUserPermissions;
 const serviceClient_1 = require("./serviceClient");
+exports.PERMISSION_LOOKUP_TIMEOUT_MS = 5000;
 async function getUserPermissions(convergeId) {
     if (!convergeId) {
         throw new Error('getUserPermissions: convergeId required');
     }
-    const { keys } = await serviceClient_1.serviceClient.call('converge_access', 'GET', `/api/internal/users/${encodeURIComponent(convergeId)}/permissions`);
+    const { keys } = await serviceClient_1.serviceClient.call('converge_access', 'GET', `/api/internal/users/${encodeURIComponent(convergeId)}/permissions`, undefined, { timeoutMs: exports.PERMISSION_LOOKUP_TIMEOUT_MS });
     return keys ?? [];
 }

package/backend/permissions.js

@@ -8,18 +8,11 @@ async function registerPermissions(serviceKey, permissions, options) {
     if (permissions.length === 0)
         return;
     const gatewayUrl = (process.env.CONVERGE_GATEWAY_URL ?? '').replace(/\/$/, '');
-    const legacyUrl = (options?.registryBaseUrl ?? process.env.CONVERGE_REGISTRY_URL ?? '').replace(/\/$/, '');
-    let url;
-    if (gatewayUrl) {
-        url = `${gatewayUrl}/api/gateway/converge_access/api/internal/register`;
-    }
-    else if (legacyUrl) {
-        url = `${legacyUrl}/api/registry/services/${encodeURIComponent(serviceKey)}/permissions`;
-    }
-    else {
-        log('warn', 'registerPermissions: Weder CONVERGE_GATEWAY_URL noch CONVERGE_REGISTRY_URL gesetzt – übersprungen');
+    if (!gatewayUrl) {
+        log('warn', 'registerPermissions: CONVERGE_GATEWAY_URL nicht gesetzt – übersprungen');
         return;
     }
+    const url = `${gatewayUrl}/api/gateway/converge_access/api/internal/register`;
     const maxRetries = options?.retries ?? 3;
     const retryDelay = options?.retryDelayMs ?? 5000;
     const fetchImpl = options?.fetchImpl ?? fetch;

package/backend/platformAdmin.d.ts

@@ -0,0 +1,4 @@
+export declare const PLATFORM_ADMIN_PERMISSION = "efa-all";
+export declare const PLATFORM_ADMIN_PERMISSIONS: readonly string[];
+export declare function isPlatformAdminPermission(key: string): boolean;
+export declare function isPlatformAdmin(permissionKeys: readonly string[] | null | undefined): boolean;

package/backend/platformAdmin.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PLATFORM_ADMIN_PERMISSIONS = exports.PLATFORM_ADMIN_PERMISSION = void 0;
+exports.isPlatformAdminPermission = isPlatformAdminPermission;
+exports.isPlatformAdmin = isPlatformAdmin;
+exports.PLATFORM_ADMIN_PERMISSION = 'efa-all';
+exports.PLATFORM_ADMIN_PERMISSIONS = Object.freeze([
+    exports.PLATFORM_ADMIN_PERMISSION,
+    'converge-admin',
+]);
+function isPlatformAdminPermission(key) {
+    return exports.PLATFORM_ADMIN_PERMISSIONS.includes(key);
+}
+function isPlatformAdmin(permissionKeys) {
+    return !!permissionKeys && permissionKeys.some(isPlatformAdminPermission);
+}

package/backend/serviceClient.d.ts

@@ -5,6 +5,15 @@ export interface ServiceClientOptions {
     retries?: number;
     retryDelayMs?: number;
 }
+export interface ServiceCallOptions {
+    timeoutMs?: number;
+}
+export declare class ServiceClientError extends Error {
+    readonly status: number | null;
+    readonly serviceKey: string;
+    readonly timedOut: boolean;
+    constructor(message: string, serviceKey: string, status: number | null, timedOut?: boolean);
+}
 export declare class ServiceClient {
     private gatewayUrl;
     private registryKey;
@@ -12,6 +21,6 @@ export declare class ServiceClient {
     private retries;
     private retryDelay;
     constructor(options?: ServiceClientOptions);
-    call<T = unknown>(serviceKey: string, method: string, path: string, body?: unknown): Promise<T>;
+    call<T = unknown>(serviceKey: string, method: string, path: string, body?: unknown, options?: ServiceCallOptions): Promise<T>;
 }
 export declare const serviceClient: ServiceClient;