@endora-commerce/mod-auth 0.0.0-stage → 0.100.0

package/dist/backend/plugin.js

@@ -0,0 +1,164 @@
+import fastifyPlugin from 'fastify-plugin';
+import { SESSION_COOKIE_NAME, ADMIN_SESSION_COOKIE_NAME, } from '@endora-commerce/contracts';
+// The `declare module 'fastify'` block that puts `actor` and `adminActor` on
+// `FastifyRequest` is the platform's since T118b
+// (`packages/platform/src/http/request-actor.ts`), and this side-effect import
+// is what puts it in *this* module's program — the writes below are the reason
+// this file needs it, and they are the only writes in the tree.
+import '@endora-commerce/platform/http';
+/*
+ * Customer (storefront) sessions live in `b2b_session`; admin (Admin UI)
+ * sessions live in a **separate** `b2b_admin_session` cookie. Using two distinct
+ * cookie names lets a customer stay signed in on the storefront while an admin is
+ * signed in on the Admin UI in the same browser — on a shared host (e.g. all
+ * `localhost` ports) a single cookie name would clobber the other on every login.
+ *
+ * The two spellings moved to `@endora-commerce/contracts` in feature 075's Phase
+ * P. This file re-exported them for the consumers Phase C had not reached; that
+ * re-export is gone with the move to a package (T040b) because **there were
+ * none left** — every one of the five modules that set or clear the cookie
+ * already names the contracts package, which is what packaging them forced.
+ * Keeping it would also have put a `@endora-commerce/contracts` re-export on
+ * this package's `./backend` barrel, which `module-package-entity-surface.test.ts`
+ * refuses under D-168: it cannot follow the specifier, so whether a named entity
+ * class comes through it is unknown rather than false.
+ */
+/**
+ * If the request carries a valid admin session (resolved into `request.adminActor`
+ * by the auth plugin) but its ambient `request.actor` is not already an admin,
+ * promote the admin candidate. Admin guards call this so an admin route works
+ * even when a customer session is simultaneously present on the same request.
+ */
+export function promoteAdminActor(request) {
+    const r = request;
+    if (request.actor.kind !== 'admin' && r.adminActor) {
+        request.actor = r.adminActor;
+    }
+}
+async function authPluginImpl(app, opts) {
+    const cookieName = opts.cookieName ?? SESSION_COOKIE_NAME;
+    const adminCookieName = opts.adminCookieName ?? ADMIN_SESSION_COOKIE_NAME;
+    // Fastify 5 forbids reference-type defaults on decorateRequest (they'd be
+    // shared across requests). Use a getter / setter pair backed by a
+    // per-request symbol so each request gets its own slot; the onRequest
+    // hook below seeds the value.
+    const actorSlot = Symbol('b2b-auth.actor');
+    app.decorateRequest('actor', {
+        getter() {
+            const self = this;
+            return self[actorSlot] ?? { kind: 'anonymous' };
+        },
+        setter(value) {
+            this[actorSlot] = value;
+        },
+    });
+    // Admin session candidate, resolved from the admin cookie independently of the
+    // customer actor so both can coexist on one request.
+    const adminActorSlot = Symbol('b2b-auth.adminActor');
+    app.decorateRequest('adminActor', {
+        getter() {
+            const self = this;
+            return self[adminActorSlot] ?? null;
+        },
+        setter(value) {
+            this[adminActorSlot] = value;
+        },
+    });
+    app.addHook('onRequest', async (request) => {
+        // Initialise to anonymous; downstream branches may overwrite with a
+        // typed customer / admin / api_key actor.
+        request.actor = { kind: 'anonymous' };
+        request.adminActor = null;
+        // 1. API key (Bearer) beats cookie — integrations pass Authorization: Bearer ...
+        const authHeader = request.headers.authorization;
+        if (authHeader?.startsWith('Bearer ') && opts.apiKeyResolver) {
+            const token = authHeader.slice('Bearer '.length).trim();
+            const resolved = await opts.apiKeyResolver(token);
+            if (resolved) {
+                request.actor = { kind: 'api_key', ...resolved };
+                return;
+            }
+            // Unknown bearer token — leave as anonymous; route-level guards will reject.
+            return;
+        }
+        const cookies = request.cookies;
+        // 2a. Admin cookie → admin session candidate (kept separate so it can
+        // coexist with a customer session in the same browser).
+        const adminRaw = cookies?.[adminCookieName];
+        if (adminRaw) {
+            const resolvedAdmin = await opts.sessionService.loadSession(adminRaw);
+            if (resolvedAdmin?.kind === 'admin' && resolvedAdmin.session.adminUserId) {
+                request.adminActor = {
+                    kind: 'admin',
+                    adminUserId: resolvedAdmin.session.adminUserId,
+                };
+            }
+        }
+        // 2b. Customer cookie → the ambient actor for public + customer routes.
+        const raw = cookies?.[cookieName];
+        if (raw) {
+            const resolved = await opts.sessionService.loadSession(raw);
+            if (resolved) {
+                const session = resolved.session;
+                if (resolved.kind === 'impersonation' && session.customerAccountId) {
+                    const orgId = opts.customerOrgResolver
+                        ? (await opts.customerOrgResolver(session.customerAccountId)) ?? ''
+                        : '';
+                    request.actor = {
+                        kind: 'customer',
+                        customerAccountId: session.customerAccountId,
+                        organizationId: orgId,
+                        impersonatorAdminUserId: session.impersonatorAdminUserId ?? null,
+                    };
+                }
+                else if (resolved.kind === 'customer' && session.customerAccountId) {
+                    const orgId = opts.customerOrgResolver
+                        ? (await opts.customerOrgResolver(session.customerAccountId)) ?? ''
+                        : '';
+                    request.actor = {
+                        kind: 'customer',
+                        customerAccountId: session.customerAccountId,
+                        organizationId: orgId,
+                        impersonatorAdminUserId: null,
+                    };
+                }
+                // An admin-kind session in the customer cookie (legacy) is ignored;
+                // admins now authenticate via the dedicated admin cookie.
+                // Feature 040 — keep presence fresh: stamp `lastSeenAt` on every active
+                // customer request (throttled to once/minute inside the service via a
+                // Redis marker). Without this, the admin "online customers" view only
+                // reflects login time, so an actively-browsing buyer ages out of the
+                // freshness window and disappears. Fire-and-forget: never block or fail
+                // the request on a presence write.
+                if ((resolved.kind === 'customer' || resolved.kind === 'impersonation') &&
+                    session.customerAccountId) {
+                    void opts.sessionService.touchLastSeen(session.id).catch(() => undefined);
+                }
+            }
+        }
+        // 3. If no customer/anonymous identity was established but an admin session
+        // exists, expose it as the ambient actor too, so admin flows that read
+        // `request.actor` without first running an admin guard still resolve.
+        if (request.actor.kind === 'anonymous' && request.adminActor) {
+            request.actor = request.adminActor;
+        }
+    });
+}
+export const authPlugin = fastifyPlugin(authPluginImpl, {
+    name: 'b2b-auth',
+    fastify: '5.x',
+});
+/*
+ * Three `FastifyInstance` decorators lived here — `requireCustomer`,
+ * `requireAdmin`, `requireApiKey` — and were deleted with this module's
+ * conversion (feature 072, T078). **Nothing in `src/` or `test/` called any of
+ * them.**
+ *
+ * Worth recording rather than deleting silently, because the `requireAdmin` one
+ * read as a live authorisation hole: its body accepted any admin regardless of
+ * the permission code, under a comment promising the real check "in T188". It
+ * was not a hole — the guard every route actually uses is `createRequireAdmin`
+ * in `require-admin.ts`, which checks `permissionService.hasPermission`. The
+ * decorator was dead code that looked dangerous, which is its own kind of cost.
+ */
+//# sourceMappingURL=plugin.js.map

package/dist/backend/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../src/backend/plugin.ts"],"names":[],"mappings":"AACA,OAAO,aAAa,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EACL,mBAAmB,EACnB,yBAAyB,GAG1B,MAAM,4BAA4B,CAAC;AACpC,6EAA6E;AAC7E,iDAAiD;AACjD,+EAA+E;AAC/E,+EAA+E;AAC/E,gEAAgE;AAChE,OAAO,gCAAgC,CAAC;AAqDxC;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAuB;IACvD,MAAM,CAAC,GAAG,OAA8D,CAAC;IACzE,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;QACnD,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,GAAoB,EAAE,IAAuB;IACzE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAC1D,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,yBAAyB,CAAC;IAE1E,0EAA0E;IAC1E,kEAAkE;IAClE,sEAAsE;IACtE,8BAA8B;IAC9B,MAAM,SAAS,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC3C,GAAG,CAAC,eAAe,CAAC,OAAO,EAAE;QAC3B,MAAM;YACJ,MAAM,IAAI,GAAG,IAAoD,CAAC;YAClE,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QAClD,CAAC;QACD,MAAM,CAAC,KAAY;YAChB,IAAyC,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC;QAChE,CAAC;KACF,CAAC,CAAC;IAEH,+EAA+E;IAC/E,qDAAqD;IACrD,MAAM,cAAc,GAAG,MAAM,CAAC,qBAAqB,CAAC,CAAC;IACrD,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE;QAChC,MAAM;YACJ,MAAM,IAAI,GAAG,IAAgE,CAAC;YAC9E,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC;QACtC,CAAC;QACD,MAAM,CAAC,KAAwB;YAC5B,IAAqD,CAAC,cAAc,CAAC,GAAG,KAAK,CAAC;QACjF,CAAC;KACF,CAAC,CAAC;IAEH,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAuB,EAAE,EAAE;QACzD,oEAAoE;QACpE,0CAA0C;QAC1C,OAAO,CAAC,KAAK,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QACtC,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;QAE1B,iFAAiF;QACjF,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QACjD,IAAI,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC7D,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YACxD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAClD,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,CAAC;gBACjD,OAAO;YACT,CAAC;YACD,6EAA6E;YAC7E,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAI,OAA4D,CAAC,OAAO,CAAC;QAEtF,sEAAsE;QACtE,wDAAwD;QACxD,MAAM,QAAQ,GAAG,OAAO,EAAE,CAAC,eAAe,CAAC,CAAC;QAC5C,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;YACtE,IAAI,aAAa,EAAE,IAAI,KAAK,OAAO,IAAI,aAAa,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;gBACzE,OAAO,CAAC,UAAU,GAAG;oBACnB,IAAI,EAAE,OAAO;oBACb,WAAW,EAAE,aAAa,CAAC,OAAO,CAAC,WAAW;iBAC/C,CAAC;YACJ,CAAC;QACH,CAAC;QAED,wEAAwE;QACxE,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC;QAClC,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YAC5D,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;gBACjC,IAAI,QAAQ,CAAC,IAAI,KAAK,eAAe,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;oBACnE,MAAM,KAAK,GAAG,IAAI,CAAC,mBAAmB;wBACpC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,IAAI,EAAE;wBACnE,CAAC,CAAC,EAAE,CAAC;oBACP,OAAO,CAAC,KAAK,GAAG;wBACd,IAAI,EAAE,UAAU;wBAChB,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;wBAC5C,cAAc,EAAE,KAAK;wBACrB,uBAAuB,EAAE,OAAO,CAAC,uBAAuB,IAAI,IAAI;qBACjE,CAAC;gBACJ,CAAC;qBAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;oBACrE,MAAM,KAAK,GAAG,IAAI,CAAC,mBAAmB;wBACpC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,IAAI,EAAE;wBACnE,CAAC,CAAC,EAAE,CAAC;oBACP,OAAO,CAAC,KAAK,GAAG;wBACd,IAAI,EAAE,UAAU;wBAChB,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;wBAC5C,cAAc,EAAE,KAAK;wBACrB,uBAAuB,EAAE,IAAI;qBAC9B,CAAC;gBACJ,CAAC;gBACD,oEAAoE;gBACpE,0DAA0D;gBAE1D,wEAAwE;gBACxE,sEAAsE;gBACtE,sEAAsE;gBACtE,qEAAqE;gBACrE,wEAAwE;gBACxE,mCAAmC;gBACnC,IACE,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU,IAAI,QAAQ,CAAC,IAAI,KAAK,eAAe,CAAC;oBACnE,OAAO,CAAC,iBAAiB,EACzB,CAAC;oBACD,KAAK,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC5E,CAAC;YACH,CAAC;QACH,CAAC;QAED,4EAA4E;QAC5E,uEAAuE;QACvE,sEAAsE;QACtE,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YAC7D,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,CAAC;IACH,CAAC,CAAC,CAAC;AAEL,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,aAAa,CAAC,cAAc,EAAE;IACtD,IAAI,EAAE,UAAU;IAChB,OAAO,EAAE,KAAK;CACf,CAAC,CAAC;AAEH;;;;;;;;;;;;GAYG"}

package/dist/backend/require-admin.d.ts

@@ -0,0 +1,35 @@
+import type { AdminPermissionChecker, RequireAdminAnyFactory, RequireAdminFactory } from '@endora-commerce/platform/kernel';
+/**
+ * The admin guard (feature 072, D-32). **One implementation**, shared by
+ * production and the test harness.
+ *
+ * Before this file there were two. Production read `request.actor`, called
+ * `promoteAdminActor` and checked `permissionService.hasPermission`
+ * (`composition.ts`); the harness read `request.testActor` and took
+ * `permissionService` as **optional**, so omitting it silently disabled every
+ * permission check across 205 call sites in 60 modules. The harness happens to
+ * pass a `PermissionService` at all 28 of its wiring sites, so the checks did
+ * run — but nothing made them, and the two guards still differed in what they
+ * read and in whether an admin session riding alongside a customer session was
+ * promoted.
+ *
+ * `auth` owns this because promotion needs the auth plugin's per-request
+ * decorations, and the permission check needs `admin_roles` — which `auth`'s
+ * manifest now declares as a dependency. The kernel owns only the type.
+ */
+export interface RequireAdminDeps {
+    /** `admin_roles`' `PermissionService`, narrowed to what the guard uses. */
+    readonly permissionService: AdminPermissionChecker;
+}
+/** Gate a route on an admin session, optionally holding one permission code. */
+export declare function createRequireAdmin({ permissionService }: RequireAdminDeps): RequireAdminFactory;
+/**
+ * Gate a route on an admin session holding **any** of the listed codes.
+ *
+ * Lives here rather than in `http/` for the same reason as the single-code
+ * factory: it needs `promoteAdminActor` and a permission checker, so keeping it
+ * under `http/` made the HTTP layer import two domain modules — two of the five
+ * infrastructure→module edges this feature removes.
+ */
+export declare function createRequireAdminAny({ permissionService, }: RequireAdminDeps): RequireAdminAnyFactory;
+//# sourceMappingURL=require-admin.d.ts.map

package/dist/backend/require-admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-admin.d.ts","sourceRoot":"","sources":["../../src/backend/require-admin.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,sBAAsB,EACtB,sBAAsB,EACtB,mBAAmB,EACpB,MAAM,kCAAkC,CAAC;AAG1C;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,2EAA2E;IAC3E,QAAQ,CAAC,iBAAiB,EAAE,sBAAsB,CAAC;CACpD;AAkBD,gFAAgF;AAChF,wBAAgB,kBAAkB,CAAC,EAAE,iBAAiB,EAAE,EAAE,gBAAgB,GAAG,mBAAmB,CAa/F;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,EACpC,iBAAiB,GAClB,EAAE,gBAAgB,GAAG,sBAAsB,CAgB3C"}

package/dist/backend/require-admin.js

@@ -0,0 +1,50 @@
+import { ERROR_CODES } from '@endora-commerce/contracts';
+import { HttpError } from '@endora-commerce/platform/http';
+import { promoteAdminActor } from './plugin.js';
+function resolveAdminActor(request) {
+    // `promoteAdminActor` dereferences `request.actor`. In production it is a
+    // decorated getter that always answers; a composition root that mounts a
+    // route without an actor resolver would otherwise turn a 401 into a 500.
+    const carrier = request;
+    if (carrier.actor !== undefined)
+        promoteAdminActor(request);
+    const actor = carrier.actor;
+    return actor?.kind === 'admin' ? actor : null;
+}
+/** Gate a route on an admin session, optionally holding one permission code. */
+export function createRequireAdmin({ permissionService }) {
+    return (permission) => async (request) => {
+        const actor = resolveAdminActor(request);
+        if (!actor) {
+            throw new HttpError(401, ERROR_CODES.UNAUTHORIZED, 'Admin session required.');
+        }
+        if (!permission)
+            return;
+        const ok = await permissionService.hasPermission(actor.adminUserId, permission);
+        if (!ok) {
+            throw new HttpError(403, ERROR_CODES.FORBIDDEN, `Missing permission: ${permission}.`);
+        }
+    };
+}
+/**
+ * Gate a route on an admin session holding **any** of the listed codes.
+ *
+ * Lives here rather than in `http/` for the same reason as the single-code
+ * factory: it needs `promoteAdminActor` and a permission checker, so keeping it
+ * under `http/` made the HTTP layer import two domain modules — two of the five
+ * infrastructure→module edges this feature removes.
+ */
+export function createRequireAdminAny({ permissionService, }) {
+    return (codes) => async (request) => {
+        const actor = resolveAdminActor(request);
+        if (!actor) {
+            throw new HttpError(401, ERROR_CODES.UNAUTHORIZED, 'Admin session required.');
+        }
+        for (const code of codes) {
+            if (await permissionService.hasPermission(actor.adminUserId, code))
+                return;
+        }
+        throw new HttpError(403, ERROR_CODES.FORBIDDEN, `Missing permission: one of ${codes.join(', ')}.`);
+    };
+}
+//# sourceMappingURL=require-admin.js.map

package/dist/backend/require-admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-admin.js","sourceRoot":"","sources":["../../src/backend/require-admin.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAM3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAgChD,SAAS,iBAAiB,CAAC,OAAuB;IAChD,0EAA0E;IAC1E,yEAAyE;IACzE,yEAAyE;IACzE,MAAM,OAAO,GAAG,OAAuD,CAAC;IACxE,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;QAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,OAAO,KAAK,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,kBAAkB,CAAC,EAAE,iBAAiB,EAAoB;IACxE,OAAO,CAAC,UAAmB,EAAE,EAAE,CAC7B,KAAK,EAAE,OAAO,EAAiB,EAAE;QAC/B,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,YAAY,EAAE,yBAAyB,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,CAAC,UAAU;YAAE,OAAO;QACxB,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAChF,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,SAAS,EAAE,uBAAuB,UAAU,GAAG,CAAC,CAAC;QACxF,CAAC;IACH,CAAC,CAAC;AACN,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,EACpC,iBAAiB,GACA;IACjB,OAAO,CAAC,KAAK,EAAE,EAAE,CACf,KAAK,EAAE,OAAO,EAAiB,EAAE;QAC/B,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,YAAY,EAAE,yBAAyB,CAAC,CAAC;QAChF,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,MAAM,iBAAiB,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC;gBAAE,OAAO;QAC7E,CAAC;QACD,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,SAAS,EACrB,8BAA8B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAClD,CAAC;IACJ,CAAC,CAAC;AACN,CAAC"}

package/dist/backend/require-customer.d.ts

@@ -0,0 +1,4 @@
+import type { RequireCustomerGuard } from '@endora-commerce/platform/kernel';
+/** Gate a route on an authenticated Customer session. */
+export declare function createRequireCustomer(): RequireCustomerGuard;
+//# sourceMappingURL=require-customer.d.ts.map

package/dist/backend/require-customer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-customer.d.ts","sourceRoot":"","sources":["../../src/backend/require-customer.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAwC7E,yDAAyD;AACzD,wBAAgB,qBAAqB,IAAI,oBAAoB,CAW5D"}

package/dist/backend/require-customer.js

@@ -0,0 +1,16 @@
+import { ERROR_CODES } from '@endora-commerce/contracts';
+import { HttpError } from '@endora-commerce/platform/http';
+/** Gate a route on an authenticated Customer session. */
+export function createRequireCustomer() {
+    return async (request) => {
+        // In production `actor` is a decorated getter that always answers. A
+        // composition root that mounts a route without an actor resolver would
+        // otherwise turn a 401 into a 500 — the same guard `createRequireAdmin`
+        // puts in front of `promoteAdminActor`.
+        const actor = request.actor;
+        if (actor?.kind !== 'customer') {
+            throw new HttpError(401, ERROR_CODES.UNAUTHORIZED, 'Customer session required.');
+        }
+    };
+}
+//# sourceMappingURL=require-customer.js.map

package/dist/backend/require-customer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-customer.js","sourceRoot":"","sources":["../../src/backend/require-customer.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAyC3D,yDAAyD;AACzD,MAAM,UAAU,qBAAqB;IACnC,OAAO,KAAK,EAAE,OAAuB,EAAiB,EAAE;QACtD,qEAAqE;QACrE,uEAAuE;QACvE,wEAAwE;QACxE,wCAAwC;QACxC,MAAM,KAAK,GAAI,OAA2D,CAAC,KAAK,CAAC;QACjF,IAAI,KAAK,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,YAAY,EAAE,4BAA4B,CAAC,CAAC;QACnF,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/backend/services/session-port.d.ts

@@ -0,0 +1,30 @@
+import type { EntityManager } from '@mikro-orm/postgresql';
+import type { AuthCustomerLastSeen, AuthSessionKind, AuthSessionPort, AuthSessionReadPort, AuthSessionRecord } from '@endora-commerce/contracts';
+import { Session } from '../entities/session.entity.js';
+import type { SessionService } from './session-service.js';
+/**
+ * The published face of `auth`'s session machinery (feature 075, Phase P).
+ *
+ * `SessionService` is not itself the port, and the difference is one field:
+ * its `createSession` / `loadSession` hand back the `Session` **entity**, and
+ * an entity crossing a module boundary is the problem this feature exists to
+ * remove — publishing a port that hands one over would only rename it
+ * (contracts/port-publication.md §1.2). So the adapter below maps the row into
+ * `AuthSessionRecord`, which drops `tokenHash`: no consumer reads it, and it
+ * is the one field that must not travel.
+ *
+ * The adapter is additive. `sessionService` keeps its registration for the
+ * consumers Phase C has not reached yet.
+ */
+export declare function toAuthSessionRecord(session: Session, kind: AuthSessionKind): AuthSessionRecord;
+export declare function createAuthSessionPort(sessionService: SessionService): AuthSessionPort;
+/**
+ * The reporting half. `customers`' online-customers view is the only consumer,
+ * and it asks exactly one question: when was each of these accounts last seen?
+ */
+export declare class AuthSessionReadService implements AuthSessionReadPort {
+    private readonly emFactory;
+    constructor(emFactory: () => EntityManager);
+    lastSeenByCustomerAccount(customerAccountIds: readonly string[], since: Date): Promise<AuthCustomerLastSeen[]>;
+}
+//# sourceMappingURL=session-port.d.ts.map

package/dist/backend/services/session-port.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-port.d.ts","sourceRoot":"","sources":["../../../src/backend/services/session-port.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EACV,oBAAoB,EACpB,eAAe,EACf,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EAClB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,+BAA+B,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D;;;;;;;;;;;;;GAaG;AAEH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,GAAG,iBAAiB,CAc9F;AASD,wBAAgB,qBAAqB,CAAC,cAAc,EAAE,cAAc,GAAG,eAAe,CA0BrF;AAED;;;GAGG;AACH,qBAAa,sBAAuB,YAAW,mBAAmB;IACpD,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,MAAM,aAAa;IAErD,yBAAyB,CAC7B,kBAAkB,EAAE,SAAS,MAAM,EAAE,EACrC,KAAK,EAAE,IAAI,GACV,OAAO,CAAC,oBAAoB,EAAE,CAAC;CAmBnC"}

package/dist/backend/services/session-port.js

@@ -0,0 +1,93 @@
+import { Session } from '../entities/session.entity.js';
+/**
+ * The published face of `auth`'s session machinery (feature 075, Phase P).
+ *
+ * `SessionService` is not itself the port, and the difference is one field:
+ * its `createSession` / `loadSession` hand back the `Session` **entity**, and
+ * an entity crossing a module boundary is the problem this feature exists to
+ * remove — publishing a port that hands one over would only rename it
+ * (contracts/port-publication.md §1.2). So the adapter below maps the row into
+ * `AuthSessionRecord`, which drops `tokenHash`: no consumer reads it, and it
+ * is the one field that must not travel.
+ *
+ * The adapter is additive. `sessionService` keeps its registration for the
+ * consumers Phase C has not reached yet.
+ */
+export function toAuthSessionRecord(session, kind) {
+    return {
+        id: session.id,
+        kind,
+        customerAccountId: session.customerAccountId ?? null,
+        adminUserId: session.adminUserId ?? null,
+        impersonatorAdminUserId: session.impersonatorAdminUserId ?? null,
+        expiresAt: session.expiresAt,
+        createdAt: session.createdAt,
+        updatedAt: session.updatedAt,
+        lastSeenAt: session.lastSeenAt ?? null,
+        ipAddress: session.ipAddress ?? null,
+        userAgent: session.userAgent ?? null,
+    };
+}
+/** Same derivation `SessionService` applies internally, over the record's fields. */
+function kindOf(session) {
+    if (session.impersonatorAdminUserId)
+        return 'impersonation';
+    if (session.adminUserId)
+        return 'admin';
+    return 'customer';
+}
+export function createAuthSessionPort(sessionService) {
+    return {
+        async createSession(input) {
+            const created = await sessionService.createSession(input);
+            return {
+                cookieValue: created.cookieValue,
+                expiresAt: created.expiresAt,
+                session: toAuthSessionRecord(created.session, kindOf(created.session)),
+            };
+        },
+        async loadSession(cookieValue) {
+            const resolved = await sessionService.loadSession(cookieValue);
+            if (!resolved)
+                return null;
+            return {
+                kind: resolved.kind,
+                session: toAuthSessionRecord(resolved.session, resolved.kind),
+            };
+        },
+        destroySession: (sessionId) => sessionService.destroySession(sessionId),
+        destroyAllForCustomer: (customerAccountId) => sessionService.destroyAllForCustomer(customerAccountId),
+        destroyAllForAdmin: (adminUserId) => sessionService.destroyAllForAdmin(adminUserId),
+        touchLastSeen: (sessionId) => sessionService.touchLastSeen(sessionId),
+        listRecentlyActiveCustomers: (windowMinutes) => sessionService.listRecentlyActiveCustomers(windowMinutes),
+    };
+}
+/**
+ * The reporting half. `customers`' online-customers view is the only consumer,
+ * and it asks exactly one question: when was each of these accounts last seen?
+ */
+export class AuthSessionReadService {
+    emFactory;
+    constructor(emFactory) {
+        this.emFactory = emFactory;
+    }
+    async lastSeenByCustomerAccount(customerAccountIds, since) {
+        if (customerAccountIds.length === 0)
+            return [];
+        const em = this.emFactory();
+        const rows = await em.find(Session, { customerAccountId: { $in: [...customerAccountIds] }, lastSeenAt: { $gte: since } }, { fields: ['customerAccountId', 'lastSeenAt'] });
+        const newest = new Map();
+        for (const row of rows) {
+            if (!row.customerAccountId || !row.lastSeenAt)
+                continue;
+            const previous = newest.get(row.customerAccountId);
+            if (!previous || row.lastSeenAt > previous)
+                newest.set(row.customerAccountId, row.lastSeenAt);
+        }
+        return [...newest].map(([customerAccountId, lastSeenAt]) => ({
+            customerAccountId,
+            lastSeenAt,
+        }));
+    }
+}
+//# sourceMappingURL=session-port.js.map

package/dist/backend/services/session-port.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-port.js","sourceRoot":"","sources":["../../../src/backend/services/session-port.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,OAAO,EAAE,MAAM,+BAA+B,CAAC;AAGxD;;;;;;;;;;;;;GAaG;AAEH,MAAM,UAAU,mBAAmB,CAAC,OAAgB,EAAE,IAAqB;IACzE,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,IAAI;QACJ,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,IAAI;QACpD,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI;QACxC,uBAAuB,EAAE,OAAO,CAAC,uBAAuB,IAAI,IAAI;QAChE,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI;QACtC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;QACpC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;KACrC,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,SAAS,MAAM,CAAC,OAAgB;IAC9B,IAAI,OAAO,CAAC,uBAAuB;QAAE,OAAO,eAAe,CAAC;IAC5D,IAAI,OAAO,CAAC,WAAW;QAAE,OAAO,OAAO,CAAC;IACxC,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,cAA8B;IAClE,OAAO;QACL,KAAK,CAAC,aAAa,CAAC,KAAK;YACvB,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YAC1D,OAAO;gBACL,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,OAAO,EAAE,mBAAmB,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;aACvE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,WAAW;YAC3B,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;YAC/D,IAAI,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC3B,OAAO;gBACL,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,OAAO,EAAE,mBAAmB,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC;aAC9D,CAAC;QACJ,CAAC;QACD,cAAc,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,cAAc,CAAC,cAAc,CAAC,SAAS,CAAC;QACvE,qBAAqB,EAAE,CAAC,iBAAiB,EAAE,EAAE,CAC3C,cAAc,CAAC,qBAAqB,CAAC,iBAAiB,CAAC;QACzD,kBAAkB,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,cAAc,CAAC,kBAAkB,CAAC,WAAW,CAAC;QACnF,aAAa,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,cAAc,CAAC,aAAa,CAAC,SAAS,CAAC;QACrE,2BAA2B,EAAE,CAAC,aAAa,EAAE,EAAE,CAC7C,cAAc,CAAC,2BAA2B,CAAC,aAAa,CAAC;KAC5D,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,sBAAsB;IACJ;IAA7B,YAA6B,SAA8B;QAA9B,cAAS,GAAT,SAAS,CAAqB;IAAG,CAAC;IAE/D,KAAK,CAAC,yBAAyB,CAC7B,kBAAqC,EACrC,KAAW;QAEX,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAC/C,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CACxB,OAAO,EACP,EAAE,iBAAiB,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,kBAAkB,CAAC,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EACpF,EAAE,MAAM,EAAE,CAAC,mBAAmB,EAAE,YAAY,CAAC,EAAE,CAChD,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAgB,CAAC;QACvC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,GAAG,CAAC,iBAAiB,IAAI,CAAC,GAAG,CAAC,UAAU;gBAAE,SAAS;YACxD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;YACnD,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC,UAAU,GAAG,QAAQ;gBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;QAChG,CAAC;QACD,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,iBAAiB,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3D,iBAAiB;YACjB,UAAU;SACX,CAAC,CAAC,CAAC;IACN,CAAC;CACF"}

package/dist/backend/services/session-service.d.ts

@@ -0,0 +1,56 @@
+import type { EntityManager } from '@mikro-orm/postgresql';
+import type { Redis } from 'ioredis';
+import { Session } from '../entities/session.entity.js';
+export type SessionKind = 'customer' | 'admin' | 'impersonation';
+export interface CreateSessionInput {
+    kind: SessionKind;
+    customerAccountId?: string;
+    adminUserId?: string;
+    impersonatorAdminUserId?: string;
+    ipAddress?: string;
+    userAgent?: string;
+}
+export interface SessionCookiePayload {
+    cookieValue: string;
+    expiresAt: Date;
+    session: Session;
+}
+export interface ResolvedSession {
+    session: Session;
+    kind: SessionKind;
+}
+export declare class SessionService {
+    private readonly emFactory;
+    private readonly redis;
+    constructor(emFactory: () => EntityManager, redis: Redis);
+    createSession(input: CreateSessionInput): Promise<SessionCookiePayload>;
+    loadSession(cookieValue: string): Promise<ResolvedSession | null>;
+    destroySession(sessionId: string): Promise<void>;
+    /**
+     * Revoke every active session for a Customer — used when an account is
+     * blocked or soft-deleted so it loses access promptly (feature 040,
+     * FR-016/SC-002). Clears both the Postgres rows and their Redis caches.
+     */
+    destroyAllForCustomer(customerAccountId: string): Promise<void>;
+    /**
+     * Revoke every session an admin user holds — both the sessions they signed
+     * in with and the impersonations they started, which carry the admin id in
+     * `impersonatorAdminUserId` and a customer id in `customerAccountId`. Used
+     * when a peer resets their password (issue #252): a session that survives
+     * the reset is a credential the reset did not withdraw, which is exactly
+     * what the compromised-account case needs withdrawn.
+     */
+    destroyAllForAdmin(adminUserId: string): Promise<void>;
+    /**
+     * Feature 040 — stamp activity, throttled to at most once per minute per
+     * session (Redis marker) to avoid write amplification on every request.
+     */
+    touchLastSeen(sessionId: string): Promise<void>;
+    /**
+     * Feature 040 — distinct customer ids whose session was active within the
+     * freshness window, for the admin "online customers" view.
+     */
+    listRecentlyActiveCustomers(windowMinutes: number): Promise<string[]>;
+    private cache;
+}
+//# sourceMappingURL=session-service.d.ts.map

package/dist/backend/services/session-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-service.d.ts","sourceRoot":"","sources":["../../../src/backend/services/session-service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,+BAA+B,CAAC;AAaxD,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,OAAO,GAAG,eAAe,CAAC;AAEjE,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,WAAW,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,IAAI,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,WAAW,CAAC;CACnB;AAED,qBAAa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,KAAK;gBADL,SAAS,EAAE,MAAM,aAAa,EAC9B,KAAK,EAAE,KAAK;IAGzB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAgCvE,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IA2BjE,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWtD;;;;OAIG;IACG,qBAAqB,CAAC,iBAAiB,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYrE;;;;;;;OAOG;IACG,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAe5D;;;OAGG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUrD;;;OAGG;IACG,2BAA2B,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YAW7D,KAAK;CASpB"}