@efa-one/sdk 1.22.0 → 1.23.0

package/README.md

@@ -12,8 +12,8 @@ sub-paths — this keeps `express` out of the frontend and `react` out of the ba
 
 | Import | Runs in | Contains |
 |---|---|---|
-| `@efa-one/sdk/backend` | Node/Express | Auth + token exchange (`requireAuth`, `createExchangeRouter`, `requireInternalOrAuth` …), health router, service discovery + gateway client (`serviceClient`, `resolveService`), clients for audit/reporting/mail/notifications, permission resolution/registration (`getUserPermissions`, `registerPermissions`, `checkPermission`), capability registry (`registerApiMetadata`), backend i18n |
-| `@efa-one/sdk/frontend` | Browser/React | postMessage IPC (`registerAppInfo`, `sendAtStart`, `navigateToApp`, `notifyRouteChange` …), react-i18next factory (`initI18n`), `DevHeader` |
+| `@efa-one/sdk/backend` | Node/Express | Auth + token exchange (`requireAuth`, `createExchangeRouter`, `requireInternalOrAuth` …), health router, service discovery + gateway client (`serviceClient`, `resolveService`), clients for audit/reporting/mail/notifications, permission resolution/registration (`getUserPermissions`, `registerPermissions`, `checkPermission`), platform-admin check (`isPlatformAdmin` — top permission `efa-all`, legacy `converge-admin` accepted until Q1-2027; `requireAdmin`/`requireAdminOrPermission` use it), capability registry (`registerApiMetadata`), backend i18n |
+| `@efa-one/sdk/frontend` | Browser/React | postMessage IPC (`registerAppInfo`, `sendAtStart`, `navigateToApp`, `notifyRouteChange` …), react-i18next factory (`initI18n`), platform-admin check (`isPlatformAdmin`, `PLATFORM_ADMIN_PERMISSIONS`), `DevHeader` |
 | `@efa-one/sdk/frontend/ui` | Browser/React | The efa-one design-system kit: `Button`, `Input`, `Badge`, `Alert`, `Dialog`, `DropdownMenu`, `Tooltip`, `EmptyState`, `Skeleton`, `RecordDialog`, and the **`DataTable`** (sortable/filterable/groupable list with draggable, resizable columns, a per-user persisted view and CSV/Excel export of the current view; reflows to stacked cards below 640px). Also exports `useIsMobile` — the platform-wide 640px breakpoint hook. Ship its companion CSS once: `import '@efa-one/sdk/frontend/ui/styles.css'` |
 | `@efa-one/sdk/frontend/format` | Browser | Platform-wide date/time display — `formatDate` (`01.09.2026`), `formatDateTime` (`01.09.2026, 11:05`), `formatTime`, `formatFileStamp`, `localeForLanguage`. Always use these instead of `toLocaleDateString`/`toLocaleString`: without an options object those render `1.9.2026`, and without a locale argument they follow the browser language (`9/1/2026`) |
 | `@efa-one/sdk/frontend/viewPreferences` | Browser/React | Persistence seam for `DataTable` — `createViewPreferencesClient()` (standard `/api/view-preferences/:listId` adapter) + `useViewPreferences()` |
@@ -53,6 +53,10 @@ npm install @efa-one/sdk react i18next i18next-http-backend react-i18next
 
 The runtime libraries are **optional peer dependencies** — install only the ones
 matching the entry point you use. The SDK itself does not bundle them.
+`i18next-http-backend` requires **4.0.2 or later**: older releases are covered by
+published security advisories (`npm audit` reports GHSA-xvq9-wjp8-hwqf for every
+version below 4.0.2). The range stays open upwards like the other peers, so a new
+major does not need an SDK release first.
 
 ## Usage
 
@@ -239,6 +243,61 @@ exported for app-side use. CSV is CSV: Excel turns `01067` into `1067` and long
 strings into `1,23E+18`, and shows the `'` in front of `+49 …` — point users to the
 Excel export for such data. No backend or kernel change.
 
+**1.23.0 — Q4-2026 security bundle, `efa-all`.** Needs **Kernel ≥ v1.1.0**.
+- `efa-all` is the top permission (was `converge-admin`). `isPlatformAdmin(keys)`,
+  `PLATFORM_ADMIN_PERMISSION(S)` and the admin guards accept `efa-all` **or**
+  `converge-admin` until Q1-2027.
+- Exchange rejects purpose-bound tokens (`purpose`/`serviceKey`), `gw` other than
+  `'app'`, `forcePasswordChange` and `tenant !== 'default'` (`classifyPlatformToken`);
+  `gw: 'app'` only with gateway provenance for this app.
+- In production (`NODE_ENV=production`) `app_session` lives on `/apps/<SERVICE_KEY>/`
+  instead of `/`; the exchange removes an old `/` cookie unless the name is the generic
+  `app_session`. Apps still on the generic name set `APP_SESSION_COOKIE_NAME=<key>_app_session`.
+- `requireRegistryKey`/`requireInternalOrAuth`/`requireInternalOrAdminOrPermission` take
+  `{ allowedCallers }`, set `req.callerService`, accept provenance tokens for 60 s and only
+  once (`jti`).
+- `APP_SESSION_SECRET` missing or a placeholder aborts the start in production, shorter
+  than 32 bytes warns (`APP_SESSION_SECRET_STRICT=true` aborts).
+- `serviceClient` no longer retries 4xx (`ServiceClientError`), has `timeoutMs`;
+  permission lookups time out after 5 s. `isFromPlatformParent` also checks `event.origin`.
+- Peer range `i18next-http-backend >=4.0.2`; DataTable bulk bar says „Auswahl aufheben".
+
+**Next minor (planned 1.23.0, not yet released) — exchange, cookie and S2S hardening.**
+Needs a kernel with efaware/efa_kernel#106 and #107 first (gateway exchange token
+`gw: 'app'`, provenance `jti`, cookie filter). Then:
+
+- `POST /api/auth/exchange` rejects tokens with `purpose` or `serviceKey` (delegation,
+  RAG, run-as), with a `gw` other than `'app'`, with `forcePasswordChange: true` and with a
+  tenant other than `default` (`classifyPlatformToken`). The gateway exchange token
+  (`gw: 'app'`) is accepted only together with the gateway's provenance token for this app
+  (`sub=converge_kernel`, `aud=SERVICE_KEY`), so an app that received one cannot replay it
+  at another app. Kernel first: before efaware/efa_kernel#106 tokens carry no `gw`.
+- `app_session` lives on `/apps/<SERVICE_KEY>/` instead of `/` when `NODE_ENV=production`
+  (every app image sets it); `/` otherwise, `APP_SESSION_COOKIE_PATH` overrides (set it to
+  `/` to run a built image locally without the gateway). With an app-specific cookie name
+  the exchange deletes a legacy cookie on `/`; the generic `app_session` is left alone,
+  it may belong to another app.
+- `requireRegistryKey({ allowedCallers })`, `requireInternalOrAuth({ allowedCallers })`,
+  `requireInternalOrAdminOrPermission({ allowedCallers }, ...keys)`; the plain forms keep
+  working. `req.callerService` carries the verified caller. Provenance tokens older than
+  60 s are rejected, each `jti` is accepted once per app (in-memory, bounded); tokens
+  without `jti` (older kernel) still pass.
+- `APP_SESSION_SECRET`: missing or placeholder → `createExchangeRouter` throws at startup
+  in production (outside production it logs, so test suites that build the router before
+  setting env keep working); shorter than 32 bytes → warning, start abort with
+  `APP_SESSION_SECRET_STRICT=true`.
+- `requireInternalOrAdminOrPermission` throws when an options object is not the first
+  argument (it would otherwise be ignored silently).
+- `serviceClient` no longer retries 4xx (`ServiceClientError` with `status`), new
+  `call(…, body, { timeoutMs })`; permission lookups time out after 5 s.
+- `registerPermissions` no longer falls back to `CONVERGE_REGISTRY_URL` +
+  `/api/registry/services/:key/permissions` (that kernel route always answered 500 and is
+  removed in efaware/efa_kernel for efa #287); without `CONVERGE_GATEWAY_URL` it logs and
+  skips. `options.registryBaseUrl` is ignored.
+- `isFromPlatformParent` also checks `event.origin === window.location.origin`. The kernel
+  embeds SDK apps same-origin under `/apps/<key>/`; an app embedded from a foreign origin
+  no longer accepts platform messages.
+
 ## License
 
 [Apache-2.0](./LICENSE) — permissive with a patent grant, so customers and partners

package/backend/auth.d.ts

@@ -1,5 +1,7 @@
 import { Router, Request, Response, NextFunction } from 'express';
 import { Pool } from 'pg';
+import { type ProvenanceGuardOptions } from './serviceProvenance';
+export type { ProvenanceGuardOptions } from './serviceProvenance';
 export interface JwtPayload {
     sub: string;
     name: string;
@@ -10,6 +12,7 @@ export interface JwtPayload {
     exp: number;
     forcePasswordChange?: boolean;
     jti?: string;
+    gw?: string;
 }
 export interface SessionPayload {
     sub: string;
@@ -23,12 +26,48 @@ export interface SessionPayload {
 }
 export interface AuthRequest extends Request {
     user?: SessionPayload;
+    callerService?: string;
 }
+export declare const APP_SESSION_SECRET_MIN_BYTES = 32;
+export type SessionSecretVerdict = {
+    ok: true;
+} | {
+    ok: false;
+    level: 'error' | 'warn';
+    reason: 'missing' | 'placeholder' | 'too_short';
+    message: string;
+};
+export declare function checkSessionSecret(secret: string | undefined): SessionSecretVerdict;
+export declare function assertSessionSecret(): void;
+export declare function getSessionCookiePath(): string;
 export declare function requireAuth(req: AuthRequest, res: Response, next: NextFunction): void;
 export declare function requireAdmin(req: AuthRequest, res: Response, next: NextFunction): void;
 export declare function requirePermission(permission: string): (req: AuthRequest, res: Response, next: NextFunction) => void;
 export declare function requireAdminOrPermission(...permissionKeys: string[]): (req: AuthRequest, res: Response, next: NextFunction) => void;
+type Guard = (req: AuthRequest, res: Response, next: NextFunction) => void;
+export declare function requireRegistryKey(options: ProvenanceGuardOptions): Guard;
 export declare function requireRegistryKey(req: Request, res: Response, next: NextFunction): void;
+export declare function requireInternalOrAuth(options: ProvenanceGuardOptions): Guard;
 export declare function requireInternalOrAuth(req: AuthRequest, res: Response, next: NextFunction): void;
-export declare function requireInternalOrAdminOrPermission(...permissionKeys: string[]): (req: AuthRequest, res: Response, next: NextFunction) => void;
+export declare function requireInternalOrAdminOrPermission(...permissionKeys: string[]): Guard;
+export declare function requireInternalOrAdminOrPermission(options: ProvenanceGuardOptions, ...permissionKeys: string[]): Guard;
+export type PlatformTokenVerdict = {
+    ok: true;
+} | {
+    ok: false;
+    status: 401;
+    error: string;
+    code: 'delegation_token_not_accepted';
+} | {
+    ok: false;
+    status: 403;
+    error: 'Password change required';
+    code: 'FORCE_PASSWORD_CHANGE';
+} | {
+    ok: false;
+    status: 403;
+    error: 'tenant_not_supported';
+    code: 'tenant_not_supported';
+};
+export declare function classifyPlatformToken(payload: Record<string, unknown>): PlatformTokenVerdict;
 export declare function createExchangeRouter(pool: Pool): Router;

package/backend/auth.js

@@ -3,6 +3,10 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.APP_SESSION_SECRET_MIN_BYTES = void 0;
+exports.checkSessionSecret = checkSessionSecret;
+exports.assertSessionSecret = assertSessionSecret;
+exports.getSessionCookiePath = getSessionCookiePath;
 exports.requireAuth = requireAuth;
 exports.requireAdmin = requireAdmin;
 exports.requirePermission = requirePermission;
@@ -10,42 +14,106 @@ exports.requireAdminOrPermission = requireAdminOrPermission;
 exports.requireRegistryKey = requireRegistryKey;
 exports.requireInternalOrAuth = requireInternalOrAuth;
 exports.requireInternalOrAdminOrPermission = requireInternalOrAdminOrPermission;
+exports.classifyPlatformToken = classifyPlatformToken;
 exports.createExchangeRouter = createExchangeRouter;
 const express_1 = require("express");
 const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
 const permissionClient_1 = require("./permissionClient");
 const sessionStatusClient_1 = require("./sessionStatusClient");
+const platformAdmin_1 = require("./platformAdmin");
+const serviceProvenance_1 = require("./serviceProvenance");
 const JWT_ISSUER = 'converge';
 const JWT_AUDIENCE = 'converge';
 const KERNEL_JTI_RE = /^[A-Za-z0-9._:-]{1,128}$/;
 const KERNEL_SUB_RE = /^[A-Za-z0-9._:@-]{1,128}$/;
-function getPlatformPublicKey() {
-    const s = process.env.JWT_PUBLIC_KEY;
-    if (!s)
-        throw new Error('JWT_PUBLIC_KEY environment variable is required');
-    return Buffer.from(s, 'base64').toString('utf8');
-}
 function getSessionSecret() {
     const s = process.env.APP_SESSION_SECRET;
     if (!s)
         throw new Error('APP_SESSION_SECRET environment variable is required');
     return s;
 }
+exports.APP_SESSION_SECRET_MIN_BYTES = 32;
+const SESSION_SECRET_PLACEHOLDER_PREFIXES = ['changeme', 'change-me', 'change_me', 'please_change', 'replace_me', 'your-'];
+const SESSION_SECRET_PLACEHOLDERS = new Set(['secret', 'password', 'test', 'dev', 'development', 'app_session_secret']);
+function checkSessionSecret(secret) {
+    if (!secret) {
+        return { ok: false, level: 'error', reason: 'missing', message: 'APP_SESSION_SECRET ist nicht gesetzt. Erzeugen mit: openssl rand -hex 32' };
+    }
+    const lower = secret.trim().toLowerCase();
+    if (SESSION_SECRET_PLACEHOLDERS.has(lower) || SESSION_SECRET_PLACEHOLDER_PREFIXES.some((p) => lower.startsWith(p))) {
+        return {
+            ok: false,
+            level: 'error',
+            reason: 'placeholder',
+            message: 'APP_SESSION_SECRET ist ein Platzhalter aus einer Beispiel-Konfiguration. Echten Wert setzen: openssl rand -hex 32',
+        };
+    }
+    const bytes = Buffer.byteLength(secret, 'utf8');
+    if (bytes < exports.APP_SESSION_SECRET_MIN_BYTES) {
+        return {
+            ok: false,
+            level: (0, serviceProvenance_1.isTruthyEnv)(process.env.APP_SESSION_SECRET_STRICT) ? 'error' : 'warn',
+            reason: 'too_short',
+            message: `APP_SESSION_SECRET ist ${bytes} Byte lang, verlangt sind mindestens ${exports.APP_SESSION_SECRET_MIN_BYTES}. Neu erzeugen mit: openssl rand -hex 32`,
+        };
+    }
+    return { ok: true };
+}
+function assertSessionSecret() {
+    const verdict = checkSessionSecret(process.env.APP_SESSION_SECRET);
+    if (verdict.ok)
+        return;
+    const fatal = verdict.level === 'error'
+        && (process.env.NODE_ENV === 'production' || (0, serviceProvenance_1.isTruthyEnv)(process.env.APP_SESSION_SECRET_STRICT));
+    if (fatal)
+        throw new Error(verdict.message);
+    const level = verdict.level === 'error' ? 'error' : 'warn';
+    console[level](JSON.stringify({ level, msg: verdict.message, reason: verdict.reason }));
+}
+const DEFAULT_COOKIE_NAME = 'app_session';
 function getCookieName() {
-    return process.env.APP_SESSION_COOKIE_NAME || 'app_session';
+    return process.env.APP_SESSION_COOKIE_NAME || DEFAULT_COOKIE_NAME;
 }
-function setSessionCookie(res, token, maxAgeMs) {
-    const secure = process.env.COOKIE_SECURE
-        ? ['1', 'true', 'yes', 'on'].includes(process.env.COOKIE_SECURE.toLowerCase())
+function getSessionCookiePath() {
+    const explicit = process.env.APP_SESSION_COOKIE_PATH?.trim();
+    if (explicit)
+        return explicit;
+    if (process.env.NODE_ENV !== 'production')
+        return '/';
+    const serviceKey = process.env.SERVICE_KEY;
+    if (serviceKey && serviceProvenance_1.SERVICE_KEY_RE.test(serviceKey))
+        return `/apps/${serviceKey}/`;
+    return '/';
+}
+function assertSessionCookiePath() {
+    const path = getSessionCookiePath();
+    if (!path.startsWith('/') || /[;,\s]/.test(path)) {
+        throw new Error(`APP_SESSION_COOKIE_PATH ungültig: ${JSON.stringify(path)} (muss mit / beginnen, ohne ; , oder Leerzeichen)`);
+    }
+}
+function isSecureCookie() {
+    return process.env.COOKIE_SECURE
+        ? (0, serviceProvenance_1.isTruthyEnv)(process.env.COOKIE_SECURE)
         : process.env.NODE_ENV === 'production';
+}
+function setSessionCookie(res, token, maxAgeMs) {
     res.cookie(getCookieName(), token, {
         httpOnly: true,
         sameSite: 'lax',
         maxAge: maxAgeMs,
-        secure,
-        path: '/',
+        secure: isSecureCookie(),
+        path: getSessionCookiePath(),
     });
 }
+function clearLegacySessionCookie(req, res) {
+    if (getSessionCookiePath() === '/')
+        return;
+    if (getCookieName() === DEFAULT_COOKIE_NAME)
+        return;
+    if (req.cookies?.[getCookieName()] === undefined)
+        return;
+    res.clearCookie(getCookieName(), { httpOnly: true, sameSite: 'lax', secure: isSecureCookie(), path: '/' });
+}
 function requireAuth(req, res, next) {
     const token = req.cookies?.[getCookieName()];
     if (!token) {
@@ -87,7 +155,7 @@ function requireAdmin(req, res, next) {
     requireAuth(req, res, () => {
         (0, permissionClient_1.getUserPermissions)(req.user.convergeId)
             .then((keys) => {
-            if (!keys.includes('converge-admin')) {
+            if (!(0, platformAdmin_1.isPlatformAdmin)(keys)) {
                 res.status(403).json({ error: 'Admin access required' });
                 return;
             }
@@ -104,7 +172,10 @@ function requirePermission(permission) {
         requireAuth(req, res, () => {
             (0, permissionClient_1.getUserPermissions)(req.user.convergeId)
                 .then((keys) => {
-                if (!keys.includes(permission)) {
+                const granted = (0, platformAdmin_1.isPlatformAdminPermission)(permission)
+                    ? (0, platformAdmin_1.isPlatformAdmin)(keys)
+                    : keys.includes(permission);
+                if (!granted) {
                     res.status(403).json({ error: `Permission required: ${permission}` });
                     return;
                 }
@@ -122,7 +193,7 @@ function requireAdminOrPermission(...permissionKeys) {
         requireAuth(req, res, () => {
             (0, permissionClient_1.getUserPermissions)(req.user.convergeId)
                 .then((keys) => {
-                if (keys.includes('converge-admin')) {
+                if ((0, platformAdmin_1.isPlatformAdmin)(keys)) {
                     next();
                     return;
                 }
@@ -139,50 +210,99 @@ function requireAdminOrPermission(...permissionKeys) {
         });
     };
 }
-const PROVENANCE_ISSUER = 'converge-gateway';
-function hasValidServiceProvenance(req) {
-    const token = req.headers['x-service-token'];
-    if (!token)
-        return false;
-    const audience = process.env.SERVICE_KEY;
-    if (!audience)
-        return false;
-    try {
-        jsonwebtoken_1.default.verify(token, getPlatformPublicKey(), {
-            algorithms: ['RS256'],
-            issuer: PROVENANCE_ISSUER,
-            audience,
-        });
-        return true;
-    }
-    catch {
-        return false;
-    }
+function isMiddlewareCall(res, next) {
+    return res !== undefined && typeof next === 'function';
 }
-function requireRegistryKey(req, res, next) {
-    if (hasValidServiceProvenance(req)) {
-        next();
+function rejectProvenance(res, result) {
+    if (!result.ok && result.reason === 'caller_not_allowed') {
+        res.status(403).json({ error: 'Service caller not allowed' });
         return;
     }
     res.status(401).json({ error: 'Service provenance token required' });
 }
-function requireInternalOrAuth(req, res, next) {
-    if (hasValidServiceProvenance(req)) {
-        next();
+function registryKeyGuard(options) {
+    return (req, res, next) => {
+        const result = (0, serviceProvenance_1.verifyServiceProvenance)(req, options);
+        if (result.ok) {
+            next();
+            return;
+        }
+        rejectProvenance(res, result);
+    };
+}
+function internalOrAuthGuard(options) {
+    return (req, res, next) => {
+        if ((0, serviceProvenance_1.verifyServiceProvenance)(req, options).ok) {
+            next();
+            return;
+        }
+        requireAuth(req, res, next);
+    };
+}
+function dualGuard(factory, a, res, next) {
+    if (isMiddlewareCall(res, next)) {
+        factory({})(a, res, next);
         return;
     }
-    requireAuth(req, res, next);
+    const options = (a ?? {});
+    (0, serviceProvenance_1.assertProvenanceOptions)(options);
+    return factory(options);
+}
+function requireRegistryKey(a, res, next) {
+    return dualGuard(registryKeyGuard, a, res, next);
+}
+function requireInternalOrAuth(a, res, next) {
+    return dualGuard(internalOrAuthGuard, a, res, next);
 }
-function requireInternalOrAdminOrPermission(...permissionKeys) {
+function requireInternalOrAdminOrPermission(...args) {
+    const [first, ...rest] = args;
+    const options = typeof first === 'object' && first !== null ? first : {};
+    const keys = typeof first === 'string' ? args : rest;
+    if (!keys.every((a) => typeof a === 'string')) {
+        throw new Error('requireInternalOrAdminOrPermission: Optionen nur als erstes Argument, danach Permission-Keys');
+    }
+    const permissionKeys = keys;
+    (0, serviceProvenance_1.assertProvenanceOptions)(options);
+    const userGuard = requireAdminOrPermission(...permissionKeys);
     return (req, res, next) => {
-        if (hasValidServiceProvenance(req)) {
+        if ((0, serviceProvenance_1.verifyServiceProvenance)(req, options).ok) {
             next();
             return;
         }
-        requireAdminOrPermission(...permissionKeys)(req, res, next);
+        userGuard(req, res, next);
     };
 }
+const PLATFORM_TENANT = 'default';
+const GATEWAY_EXCHANGE_CALLER = 'converge_kernel';
+function classifyPlatformToken(payload) {
+    const serviceKey = payload.serviceKey;
+    if (serviceKey !== undefined && serviceKey !== null && serviceKey !== '') {
+        return { ok: false, status: 401, error: 'Service-Token begründet keine Sitzung', code: 'delegation_token_not_accepted' };
+    }
+    const purpose = payload.purpose;
+    if (purpose !== undefined && purpose !== null && purpose !== '') {
+        const label = typeof purpose === 'string' ? purpose.slice(0, 64) : typeof purpose;
+        return {
+            ok: false,
+            status: 401,
+            error: `Zweckgebundenes Token (purpose=${label}) begründet keine Sitzung`,
+            code: 'delegation_token_not_accepted',
+        };
+    }
+    if (payload.gw !== undefined && payload.gw !== 'app') {
+        return { ok: false, status: 401, error: 'Gateway-Token für ein anderes Ziel begründet keine Sitzung', code: 'delegation_token_not_accepted' };
+    }
+    if (payload.forcePasswordChange === true) {
+        return { ok: false, status: 403, error: 'Password change required', code: 'FORCE_PASSWORD_CHANGE' };
+    }
+    if (payload.tenant !== PLATFORM_TENANT) {
+        return { ok: false, status: 403, error: 'tenant_not_supported', code: 'tenant_not_supported' };
+    }
+    return { ok: true };
+}
 function createExchangeRouter(pool) {
+    assertSessionSecret();
+    assertSessionCookiePath();
     const router = (0, express_1.Router)();
     router.post('/exchange', async (req, res) => {
         const { token } = req.body;
@@ -192,7 +312,7 @@ function createExchangeRouter(pool) {
         }
         let convergePayload;
         try {
-            convergePayload = jsonwebtoken_1.default.verify(token, getPlatformPublicKey(), {
+            convergePayload = jsonwebtoken_1.default.verify(token, (0, serviceProvenance_1.getPlatformPublicKey)(), {
                 algorithms: ['RS256'],
                 issuer: JWT_ISSUER,
                 audience: JWT_AUDIENCE,
@@ -202,6 +322,29 @@ function createExchangeRouter(pool) {
             res.status(401).json({ error: 'Invalid or expired platform token' });
             return;
         }
+        const verdict = classifyPlatformToken(convergePayload);
+        if (!verdict.ok) {
+            console.warn(JSON.stringify({
+                level: 'warn',
+                msg: 'Token-Exchange abgelehnt',
+                code: verdict.code,
+                sub: typeof convergePayload.sub === 'string' ? convergePayload.sub : null,
+            }));
+            res.status(verdict.status).json({ error: verdict.error, code: verdict.code });
+            return;
+        }
+        if (convergePayload.gw === 'app') {
+            const provenance = (0, serviceProvenance_1.verifyServiceProvenance)(req, { allowedCallers: [GATEWAY_EXCHANGE_CALLER] });
+            if (!provenance.ok) {
+                console.warn(JSON.stringify({
+                    level: 'warn',
+                    msg: 'Token-Exchange abgelehnt: Gateway-Tausch-Token ohne Herkunftsnachweis',
+                    reason: provenance.reason,
+                }));
+                res.status(401).json({ error: 'Gateway-Tausch-Token nur auf dem Tausch-Aufruf des Gateways', code: 'gateway_provenance_required' });
+                return;
+            }
+        }
         if (typeof convergePayload.jti !== 'string' || !KERNEL_JTI_RE.test(convergePayload.jti) ||
             typeof convergePayload.sub !== 'string' || !KERNEL_SUB_RE.test(convergePayload.sub) ||
             !Number.isInteger(convergePayload.iat) || !Number.isInteger(convergePayload.exp)) {
@@ -238,6 +381,7 @@ function createExchangeRouter(pool) {
             };
             const sessionToken = jsonwebtoken_1.default.sign(sessionPayload, getSessionSecret(), { algorithm: 'HS256', expiresIn: remainingSec });
             setSessionCookie(res, sessionToken, remainingSec * 1000);
+            clearLegacySessionCookie(req, res);
             res.json({
                 user: {
                     id: appUser.id,
@@ -254,7 +398,11 @@ function createExchangeRouter(pool) {
         }
     });
     router.post('/logout', (_req, res) => {
-        res.clearCookie(getCookieName());
+        const opts = { httpOnly: true, sameSite: 'lax', secure: isSecureCookie() };
+        res.clearCookie(getCookieName(), { ...opts, path: getSessionCookiePath() });
+        if (getSessionCookiePath() !== '/' && getCookieName() !== DEFAULT_COOKIE_NAME) {
+            res.clearCookie(getCookieName(), { ...opts, path: '/' });
+        }
         res.json({ ok: true });
     });
     router.get('/permissions', requireAuth, async (req, res) => {

package/backend/index.d.ts

@@ -8,8 +8,10 @@ export * from './permissions';
 export * from './permissionClient';
 export * from './sessionStatusClient';
 export * from './permissionCheck';
+export * from './platformAdmin';
 export * from './customPermissions';
 export * from './serviceClient';
 export * from './serviceDiscovery';
 export * from './apiRegistry';
 export * from './i18n-backend';
+export * from './serviceProvenance';

package/backend/index.js

@@ -24,8 +24,10 @@ __exportStar(require("./permissions"), exports);
 __exportStar(require("./permissionClient"), exports);
 __exportStar(require("./sessionStatusClient"), exports);
 __exportStar(require("./permissionCheck"), exports);
+__exportStar(require("./platformAdmin"), exports);
 __exportStar(require("./customPermissions"), exports);
 __exportStar(require("./serviceClient"), exports);
 __exportStar(require("./serviceDiscovery"), exports);
 __exportStar(require("./apiRegistry"), exports);
 __exportStar(require("./i18n-backend"), exports);
+__exportStar(require("./serviceProvenance"), exports);

package/backend/permissionCheck.js

@@ -2,11 +2,12 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.checkPermission = checkPermission;
 const serviceClient_1 = require("./serviceClient");
+const permissionClient_1 = require("./permissionClient");
 async function checkPermission(convergeId, key, sourceApp) {
     if (!convergeId)
         throw new Error('checkPermission: convergeId required');
     if (!key)
         throw new Error('checkPermission: key required');
-    const { granted } = await serviceClient_1.serviceClient.call('converge_access', 'POST', '/api/internal/check-permission', { convergeId, key, sourceApp: sourceApp ?? process.env.APP_NAME ?? null });
+    const { granted } = await serviceClient_1.serviceClient.call('converge_access', 'POST', '/api/internal/check-permission', { convergeId, key, sourceApp: sourceApp ?? process.env.APP_NAME ?? null }, { timeoutMs: permissionClient_1.PERMISSION_LOOKUP_TIMEOUT_MS });
     return Boolean(granted);
 }

package/backend/permissionClient.d.ts

@@ -1 +1,2 @@
+export declare const PERMISSION_LOOKUP_TIMEOUT_MS = 5000;
 export declare function getUserPermissions(convergeId: string): Promise<string[]>;

package/backend/permissionClient.js

@@ -1,11 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.PERMISSION_LOOKUP_TIMEOUT_MS = void 0;
 exports.getUserPermissions = getUserPermissions;
 const serviceClient_1 = require("./serviceClient");
+exports.PERMISSION_LOOKUP_TIMEOUT_MS = 5000;
 async function getUserPermissions(convergeId) {
     if (!convergeId) {
         throw new Error('getUserPermissions: convergeId required');
     }
-    const { keys } = await serviceClient_1.serviceClient.call('converge_access', 'GET', `/api/internal/users/${encodeURIComponent(convergeId)}/permissions`);
+    const { keys } = await serviceClient_1.serviceClient.call('converge_access', 'GET', `/api/internal/users/${encodeURIComponent(convergeId)}/permissions`, undefined, { timeoutMs: exports.PERMISSION_LOOKUP_TIMEOUT_MS });
     return keys ?? [];
 }

package/backend/permissions.js

@@ -8,18 +8,11 @@ async function registerPermissions(serviceKey, permissions, options) {
     if (permissions.length === 0)
         return;
     const gatewayUrl = (process.env.CONVERGE_GATEWAY_URL ?? '').replace(/\/$/, '');
-    const legacyUrl = (options?.registryBaseUrl ?? process.env.CONVERGE_REGISTRY_URL ?? '').replace(/\/$/, '');
-    let url;
-    if (gatewayUrl) {
-        url = `${gatewayUrl}/api/gateway/converge_access/api/internal/register`;
-    }
-    else if (legacyUrl) {
-        url = `${legacyUrl}/api/registry/services/${encodeURIComponent(serviceKey)}/permissions`;
-    }
-    else {
-        log('warn', 'registerPermissions: Weder CONVERGE_GATEWAY_URL noch CONVERGE_REGISTRY_URL gesetzt – übersprungen');
+    if (!gatewayUrl) {
+        log('warn', 'registerPermissions: CONVERGE_GATEWAY_URL nicht gesetzt – übersprungen');
         return;
     }
+    const url = `${gatewayUrl}/api/gateway/converge_access/api/internal/register`;
     const maxRetries = options?.retries ?? 3;
     const retryDelay = options?.retryDelayMs ?? 5000;
     const fetchImpl = options?.fetchImpl ?? fetch;

package/backend/platformAdmin.d.ts

@@ -0,0 +1,4 @@
+export declare const PLATFORM_ADMIN_PERMISSION = "efa-all";
+export declare const PLATFORM_ADMIN_PERMISSIONS: readonly string[];
+export declare function isPlatformAdminPermission(key: string): boolean;
+export declare function isPlatformAdmin(permissionKeys: readonly string[] | null | undefined): boolean;

package/backend/platformAdmin.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PLATFORM_ADMIN_PERMISSIONS = exports.PLATFORM_ADMIN_PERMISSION = void 0;
+exports.isPlatformAdminPermission = isPlatformAdminPermission;
+exports.isPlatformAdmin = isPlatformAdmin;
+exports.PLATFORM_ADMIN_PERMISSION = 'efa-all';
+exports.PLATFORM_ADMIN_PERMISSIONS = Object.freeze([
+    exports.PLATFORM_ADMIN_PERMISSION,
+    'converge-admin',
+]);
+function isPlatformAdminPermission(key) {
+    return exports.PLATFORM_ADMIN_PERMISSIONS.includes(key);
+}
+function isPlatformAdmin(permissionKeys) {
+    return !!permissionKeys && permissionKeys.some(isPlatformAdminPermission);
+}

package/backend/serviceClient.d.ts

@@ -5,6 +5,15 @@ export interface ServiceClientOptions {
     retries?: number;
     retryDelayMs?: number;
 }
+export interface ServiceCallOptions {
+    timeoutMs?: number;
+}
+export declare class ServiceClientError extends Error {
+    readonly status: number | null;
+    readonly serviceKey: string;
+    readonly timedOut: boolean;
+    constructor(message: string, serviceKey: string, status: number | null, timedOut?: boolean);
+}
 export declare class ServiceClient {
     private gatewayUrl;
     private registryKey;
@@ -12,6 +21,6 @@ export declare class ServiceClient {
     private retries;
     private retryDelay;
     constructor(options?: ServiceClientOptions);
-    call<T = unknown>(serviceKey: string, method: string, path: string, body?: unknown): Promise<T>;
+    call<T = unknown>(serviceKey: string, method: string, path: string, body?: unknown, options?: ServiceCallOptions): Promise<T>;
 }
 export declare const serviceClient: ServiceClient;

package/backend/serviceClient.js

@@ -1,9 +1,23 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.serviceClient = exports.ServiceClient = void 0;
+exports.serviceClient = exports.ServiceClient = exports.ServiceClientError = void 0;
 function log(level, msg, extra) {
     console.log(JSON.stringify({ level, msg, timestamp: new Date().toISOString(), ...extra }));
 }
+class ServiceClientError extends Error {
+    constructor(message, serviceKey, status, timedOut = false) {
+        super(message);
+        this.name = 'ServiceClientError';
+        this.serviceKey = serviceKey;
+        this.status = status;
+        this.timedOut = timedOut;
+    }
+}
+exports.ServiceClientError = ServiceClientError;
+function isAbortError(err) {
+    const name = err?.name;
+    return name === 'AbortError' || name === 'TimeoutError';
+}
 class ServiceClient {
     constructor(options) {
         this.gatewayUrl = (options?.gatewayUrl ?? process.env.CONVERGE_GATEWAY_URL ?? '').replace(/\/$/, '');
@@ -12,7 +26,7 @@ class ServiceClient {
         this.retries = options?.retries ?? 2;
         this.retryDelay = options?.retryDelayMs ?? 1000;
     }
-    async call(serviceKey, method, path, body) {
+    async call(serviceKey, method, path, body, options = {}) {
         if (!this.gatewayUrl) {
             throw new Error('ServiceClient: CONVERGE_GATEWAY_URL nicht gesetzt');
         }
@@ -29,44 +43,63 @@ class ServiceClient {
         if (body !== undefined && method !== 'GET' && method !== 'HEAD') {
             fetchOptions.body = JSON.stringify(body);
         }
+        if (options.timeoutMs !== undefined && options.timeoutMs > 0) {
+            fetchOptions.signal = AbortSignal.timeout(options.timeoutMs);
+        }
+        const timedOut = () => new ServiceClientError(`ServiceClient: ${serviceKey} ${method} ${path} → Timeout nach ${options.timeoutMs} ms`, serviceKey, null, true);
         for (let attempt = 1; attempt <= this.retries + 1; attempt++) {
+            let res;
             try {
-                const res = await this.fetchImpl(url, fetchOptions);
-                if (res.status === 204) {
-                    return undefined;
+                res = await this.fetchImpl(url, fetchOptions);
+            }
+            catch (err) {
+                if (isAbortError(err) || fetchOptions.signal?.aborted)
+                    throw timedOut();
+                if (attempt <= this.retries) {
+                    log('warn', 'ServiceClient: Netzwerkfehler, Retry', {
+                        serviceKey, method, path, err: String(err), attempt,
+                    });
+                    await new Promise((r) => setTimeout(r, this.retryDelay));
+                    if (fetchOptions.signal?.aborted)
+                        throw timedOut();
+                    continue;
                 }
-                if (!res.ok) {
-                    let errorMessage = `ServiceClient: ${serviceKey} ${method} ${path} → ${res.status}`;
-                    try {
-                        const errBody = await res.json();
-                        if (errBody.error)
-                            errorMessage = errBody.error;
-                    }
-                    catch { }
-                    if (res.status >= 400 && res.status < 500) {
-                        throw new Error(errorMessage);
-                    }
-                    if (attempt <= this.retries) {
-                        log('warn', 'ServiceClient: Retry nach Server-Fehler', {
-                            serviceKey, method, path, status: res.status, attempt,
-                        });
-                        await new Promise((r) => setTimeout(r, this.retryDelay));
-                        continue;
-                    }
-                    throw new Error(errorMessage);
+                throw err;
+            }
+            if (res.status === 204) {
+                return undefined;
+            }
+            if (!res.ok) {
+                let errorMessage = `ServiceClient: ${serviceKey} ${method} ${path} → ${res.status}`;
+                try {
+                    const errBody = await res.json();
+                    if (errBody.error)
+                        errorMessage = errBody.error;
+                }
+                catch (err) {
+                    if (isAbortError(err))
+                        throw timedOut();
+                }
+                if (res.status >= 400 && res.status < 500) {
+                    throw new ServiceClientError(errorMessage, serviceKey, res.status);
+                }
+                if (attempt <= this.retries) {
+                    log('warn', 'ServiceClient: Retry nach Server-Fehler', {
+                        serviceKey, method, path, status: res.status, attempt,
+                    });
+                    await new Promise((r) => setTimeout(r, this.retryDelay));
+                    if (fetchOptions.signal?.aborted)
+                        throw timedOut();
+                    continue;
                 }
-                return res.json();
+                throw new ServiceClientError(errorMessage, serviceKey, res.status);
+            }
+            try {
+                return await res.json();
             }
             catch (err) {
-                if (err instanceof Error && !err.message.startsWith('ServiceClient:')) {
-                    if (attempt <= this.retries) {
-                        log('warn', 'ServiceClient: Netzwerkfehler, Retry', {
-                            serviceKey, method, path, err: String(err), attempt,
-                        });
-                        await new Promise((r) => setTimeout(r, this.retryDelay));
-                        continue;
-                    }
-                }
+                if (isAbortError(err))
+                    throw timedOut();
                 throw err;
             }
         }

package/backend/serviceProvenance.d.ts

@@ -0,0 +1,31 @@
+import type { Request } from 'express';
+export declare const PROVENANCE_ISSUER = "converge-gateway";
+export declare const PROVENANCE_MAX_AGE_SEC = 60;
+export declare const SERVICE_KEY_RE: RegExp;
+export declare const PROVENANCE_REPLAY_CACHE_MAX = 20000;
+export interface ProvenanceGuardOptions {
+    allowedCallers?: readonly string[];
+}
+export type ProvenanceResult = {
+    ok: true;
+    caller: string;
+} | {
+    ok: false;
+    reason: 'missing';
+} | {
+    ok: false;
+    reason: 'invalid';
+} | {
+    ok: false;
+    reason: 'replayed';
+} | {
+    ok: false;
+    reason: 'caller_not_allowed';
+    caller: string;
+};
+export declare function getPlatformPublicKey(): string;
+export declare function isTruthyEnv(value: string | undefined): boolean;
+export declare function resetProvenanceReplayCache(max?: number): void;
+export declare function provenanceReplayCacheSize(): number;
+export declare function verifyServiceProvenance(req: Request, options?: ProvenanceGuardOptions): ProvenanceResult;
+export declare function assertProvenanceOptions(options: ProvenanceGuardOptions): void;

package/backend/serviceProvenance.js

@@ -0,0 +1,137 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PROVENANCE_REPLAY_CACHE_MAX = exports.SERVICE_KEY_RE = exports.PROVENANCE_MAX_AGE_SEC = exports.PROVENANCE_ISSUER = void 0;
+exports.getPlatformPublicKey = getPlatformPublicKey;
+exports.isTruthyEnv = isTruthyEnv;
+exports.resetProvenanceReplayCache = resetProvenanceReplayCache;
+exports.provenanceReplayCacheSize = provenanceReplayCacheSize;
+exports.verifyServiceProvenance = verifyServiceProvenance;
+exports.assertProvenanceOptions = assertProvenanceOptions;
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+exports.PROVENANCE_ISSUER = 'converge-gateway';
+exports.PROVENANCE_MAX_AGE_SEC = 60;
+const CLOCK_TOLERANCE_SEC = 5;
+exports.SERVICE_KEY_RE = /^[a-z][a-z0-9_]{1,63}$/;
+exports.PROVENANCE_REPLAY_CACHE_MAX = 20000;
+let decodedKey = null;
+function getPlatformPublicKey() {
+    const s = process.env.JWT_PUBLIC_KEY;
+    if (!s)
+        throw new Error('JWT_PUBLIC_KEY environment variable is required');
+    if (decodedKey?.b64 !== s)
+        decodedKey = { b64: s, pem: Buffer.from(s, 'base64').toString('utf8') };
+    return decodedKey.pem;
+}
+function isTruthyEnv(value) {
+    return !!value && ['1', 'true', 'yes', 'on'].includes(value.trim().toLowerCase());
+}
+const usedJtis = new Map();
+const SWEEP_INTERVAL_MS = 5000;
+let lastSweep = 0;
+let capacityWarned = false;
+let replayCacheMax = exports.PROVENANCE_REPLAY_CACHE_MAX;
+function consumeJti(jti, expSec) {
+    const now = Date.now();
+    if (now - lastSweep >= SWEEP_INTERVAL_MS) {
+        lastSweep = now;
+        for (const [k, exp] of usedJtis) {
+            if (exp >= now)
+                break;
+            usedJtis.delete(k);
+        }
+    }
+    if (usedJtis.has(jti))
+        return false;
+    while (usedJtis.size >= replayCacheMax) {
+        const oldest = usedJtis.keys().next().value;
+        usedJtis.delete(oldest);
+        if (!capacityWarned) {
+            capacityWarned = true;
+            console.warn(JSON.stringify({
+                level: 'warn',
+                msg: 'Provenance-Replay-Liste voll – älteste Einträge fallen heraus',
+                max: replayCacheMax,
+            }));
+        }
+    }
+    usedJtis.set(jti, (expSec + CLOCK_TOLERANCE_SEC) * 1000);
+    return true;
+}
+function resetProvenanceReplayCache(max = exports.PROVENANCE_REPLAY_CACHE_MAX) {
+    usedJtis.clear();
+    lastSweep = 0;
+    capacityWarned = false;
+    replayCacheMax = max;
+}
+function provenanceReplayCacheSize() {
+    return usedJtis.size;
+}
+const verifiedInRequest = new WeakMap();
+function readToken(req) {
+    const raw = req.headers?.['x-service-token'];
+    const token = Array.isArray(raw) ? raw[0] : raw;
+    return typeof token === 'string' && token ? token : undefined;
+}
+function verifyToken(req) {
+    const token = readToken(req);
+    if (!token)
+        return { ok: false, reason: 'missing' };
+    const memo = verifiedInRequest.get(req);
+    if (memo && memo.token === token)
+        return { ok: true, caller: memo.caller };
+    const audience = process.env.SERVICE_KEY;
+    if (!audience)
+        return { ok: false, reason: 'invalid' };
+    let payload;
+    try {
+        payload = jsonwebtoken_1.default.verify(token, getPlatformPublicKey(), {
+            algorithms: ['RS256'],
+            issuer: exports.PROVENANCE_ISSUER,
+            audience,
+            maxAge: exports.PROVENANCE_MAX_AGE_SEC,
+            clockTolerance: CLOCK_TOLERANCE_SEC,
+        });
+    }
+    catch {
+        return { ok: false, reason: 'invalid' };
+    }
+    const caller = payload.sub;
+    if (typeof caller !== 'string' || !exports.SERVICE_KEY_RE.test(caller))
+        return { ok: false, reason: 'invalid' };
+    if (payload.jti !== undefined) {
+        if (typeof payload.jti !== 'string' || !payload.jti || typeof payload.exp !== 'number') {
+            return { ok: false, reason: 'invalid' };
+        }
+        if (!consumeJti(payload.jti, payload.exp))
+            return { ok: false, reason: 'replayed' };
+    }
+    verifiedInRequest.set(req, { token, caller });
+    return { ok: true, caller };
+}
+function verifyServiceProvenance(req, options = {}) {
+    const result = verifyToken(req);
+    if (!result.ok)
+        return result;
+    if (options.allowedCallers && !options.allowedCallers.includes(result.caller)) {
+        delete req.callerService;
+        return { ok: false, reason: 'caller_not_allowed', caller: result.caller };
+    }
+    req.callerService = result.caller;
+    return result;
+}
+function assertProvenanceOptions(options) {
+    const callers = options.allowedCallers;
+    if (callers === undefined)
+        return;
+    if (!Array.isArray(callers) || callers.length === 0) {
+        throw new Error('allowedCallers: mindestens ein Service-Key angeben (leere Liste sperrt jeden Aufrufer)');
+    }
+    for (const c of callers) {
+        if (typeof c !== 'string' || !exports.SERVICE_KEY_RE.test(c)) {
+            throw new Error(`allowedCallers: ungültiger Service-Key ${JSON.stringify(c)}`);
+        }
+    }
+}

package/frontend/index.d.ts

@@ -1,5 +1,6 @@
 export * from './ipc.js';
 export * from './format.js';
+export * from './platformAdmin.js';
 export { useIsMobile, MOBILE_QUERY } from './useIsMobile.js';
 export * from './i18n.js';
 export { default as DevHeader } from './DevHeader.js';

package/frontend/index.js

@@ -1,5 +1,6 @@
 export * from './ipc.js';
 export * from './format.js';
+export * from './platformAdmin.js';
 export { useIsMobile, MOBILE_QUERY } from './useIsMobile.js';
 export * from './i18n.js';
 export { default as DevHeader } from './DevHeader.js';

package/frontend/ipc.js

@@ -15,7 +15,9 @@ export function getParentOrigin() {
     }
 }
 export function isFromPlatformParent(event) {
-    return event.source === window.parent;
+    if (event.source !== window.parent)
+        return false;
+    return event.origin === window.location.origin;
 }
 export function sendAtStart() {
     if (!isEmbedded())

package/frontend/platformAdmin.d.ts

@@ -0,0 +1,4 @@
+export declare const PLATFORM_ADMIN_PERMISSION = "efa-all";
+export declare const PLATFORM_ADMIN_PERMISSIONS: readonly string[];
+export declare function isPlatformAdminPermission(key: string): boolean;
+export declare function isPlatformAdmin(permissionKeys: readonly string[] | null | undefined): boolean;

package/frontend/platformAdmin.js

@@ -0,0 +1,11 @@
+export const PLATFORM_ADMIN_PERMISSION = 'efa-all';
+export const PLATFORM_ADMIN_PERMISSIONS = Object.freeze([
+    PLATFORM_ADMIN_PERMISSION,
+    'converge-admin',
+]);
+export function isPlatformAdminPermission(key) {
+    return PLATFORM_ADMIN_PERMISSIONS.includes(key);
+}
+export function isPlatformAdmin(permissionKeys) {
+    return !!permissionKeys && permissionKeys.some(isPlatformAdminPermission);
+}

package/frontend/ui/DataTable.js

@@ -433,7 +433,7 @@ export function DataTable({ listId, rows, columns, rowKey, onRowClick, selection
             hasColumns: visibleColumns.some((c) => c.exportable !== false),
             run: runExport,
         } : undefined, columns: columns, prefs: prefs, setColumnVisible: setColumnVisible, moveColumn: moveColumn, reset: reset, groupBy: groupBy, addGroupBy: addGroupBy, removeGroupBy: removeGroupBy, moveGroupBy: moveGroupBy, clearGroupBy: clearGroupBy }));
-    return (_jsxs("div", { ref: containerRef, className: "border border-[var(--color-border)] overflow-x-auto", style: { '--dt-cols': gridTemplate }, children: [selection && selection.selected.size > 0 && (_jsxs("div", { className: "flex items-center gap-2 px-3 py-2 text-sm border-b border-[var(--color-border)]", style: { background: 'var(--color-surface-raised)' }, children: [_jsxs("span", { children: [selection.selected.size, " ausgew\u00E4hlt"] }), _jsx("button", { type: "button", className: "text-xs underline text-[var(--color-text-muted)] hover:text-[var(--color-text-primary)]", onClick: () => selection.onChange(new Set()), children: "Auswahl l\u00F6schen" }), _jsx("div", { className: "flex-1" }), selection.bulkActions] })), isMobile ? (_jsxs("div", { className: "flex items-center gap-3 px-3 py-2 text-xs font-medium border-b border-[var(--color-border)]", style: { background: 'var(--color-surface-raised)' }, children: [selection && (_jsxs("label", { className: "flex items-center gap-2 py-2 pr-2 cursor-pointer", children: [_jsx("input", { type: "checkbox", className: "w-5 h-5", checked: allSelected, onChange: toggleAll, "aria-label": "Alle ausw\u00E4hlen" }), _jsx("span", { className: "text-[var(--color-text-muted)]", children: "Alle" })] })), _jsx("div", { className: "flex-1" }), gearButton] })) : (_jsxs("div", { className: "grid items-center min-w-min px-3 py-2 text-xs font-medium border-b border-[var(--color-border)]", style: { gridTemplateColumns: 'var(--dt-cols)', background: 'var(--color-surface-raised)' }, children: [selection && (_jsx("input", { type: "checkbox", checked: allSelected, onChange: toggleAll, "aria-label": "Alle ausw\u00E4hlen" })), visibleColumns.map((col) => {
+    return (_jsxs("div", { ref: containerRef, className: "border border-[var(--color-border)] overflow-x-auto", style: { '--dt-cols': gridTemplate }, children: [selection && selection.selected.size > 0 && (_jsxs("div", { className: "flex items-center gap-2 px-3 py-2 text-sm border-b border-[var(--color-border)]", style: { background: 'var(--color-surface-raised)' }, children: [_jsxs("span", { children: [selection.selected.size, " ausgew\u00E4hlt"] }), _jsx("button", { type: "button", className: "text-xs underline text-[var(--color-text-muted)] hover:text-[var(--color-text-primary)]", onClick: () => selection.onChange(new Set()), children: "Auswahl aufheben" }), _jsx("div", { className: "flex-1" }), selection.bulkActions] })), isMobile ? (_jsxs("div", { className: "flex items-center gap-3 px-3 py-2 text-xs font-medium border-b border-[var(--color-border)]", style: { background: 'var(--color-surface-raised)' }, children: [selection && (_jsxs("label", { className: "flex items-center gap-2 py-2 pr-2 cursor-pointer", children: [_jsx("input", { type: "checkbox", className: "w-5 h-5", checked: allSelected, onChange: toggleAll, "aria-label": "Alle ausw\u00E4hlen" }), _jsx("span", { className: "text-[var(--color-text-muted)]", children: "Alle" })] })), _jsx("div", { className: "flex-1" }), gearButton] })) : (_jsxs("div", { className: "grid items-center min-w-min px-3 py-2 text-xs font-medium border-b border-[var(--color-border)]", style: { gridTemplateColumns: 'var(--dt-cols)', background: 'var(--color-surface-raised)' }, children: [selection && (_jsx("input", { type: "checkbox", checked: allSelected, onChange: toggleAll, "aria-label": "Alle ausw\u00E4hlen" })), visibleColumns.map((col) => {
                         const activeSort = prefs.sort?.columnId === col.id ? prefs.sort.direction : null;
                         const filterValue = prefs.filters[col.id];
                         const isFiltered = filterValue != null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@efa-one/sdk",
-  "version": "1.22.0",
+  "version": "1.23.0",
   "description": "Offizielles SDK für efa-one-Apps: Auth/Session, Service-Discovery, Gateway-Client, Audit/Reporting/Mail/Notifications, Permission- und Capability-Registrierung sowie das Frontend-IPC-/i18n-Toolkit.",
   "license": "Apache-2.0",
   "type": "commonjs",
@@ -58,7 +58,7 @@
     "@radix-ui/react-tooltip": ">=1",
     "express": ">=4",
     "i18next": ">=23",
-    "i18next-http-backend": ">=2",
+    "i18next-http-backend": ">=4.0.2",
     "jsonwebtoken": ">=9",
     "lucide-react": ">=0.400.0",
     "pg": ">=8",
@@ -111,12 +111,12 @@
     "@radix-ui/react-tooltip": "^1.1.6",
     "@types/express": "^4.17.21",
     "@types/jsonwebtoken": "^9.0.6",
-    "@types/node": "^20.14.0",
+    "@types/node": "^22.20.5",
     "@types/pg": "^8.11.0",
     "@types/react": "^18.2.46",
     "@types/react-dom": "^18.2.0",
     "@types/supertest": "^7.2.0",
-    "@vitest/coverage-v8": "^4.1.11",
+    "@vitest/coverage-v8": "^5.0.5",
     "cookie-parser": "^1.4.6",
     "eslint": "^10.9.1",
     "eslint-plugin-react-hooks": "^7.1.1",
@@ -132,7 +132,7 @@
     "supertest": "^7.2.2",
     "typescript": "6.0.3",
     "typescript-eslint": "^8.67.0",
-    "vitest": "^4.1.4"
+    "vitest": "^5.0.5"
   },
   "engines": {
     "node": ">=20"