@fitzzero/quickdraw-core 3.5.0 → 3.7.0

package/dist/server/index.js

@@ -2,6 +2,7 @@ import express from 'express';
 import { createServer } from 'http';
 import { Server } from 'socket.io';
 import * as jose from 'jose';
+import { randomBytes, createCipheriv, createDecipheriv } from 'crypto';
 import * as readline from 'readline';
 import * as fs from 'fs';
 import * as path from 'path';
@@ -16,18 +17,8 @@ var consoleLogger = {
 };
 
 // src/server/utils/zodToAdminFields.ts
-var NON_EDITABLE_FIELDS = /* @__PURE__ */ new Set([
-  "id",
-  "createdAt",
-  "updatedAt",
-  "created_at",
-  "updated_at"
-]);
-var DEFAULT_HIDDEN_FIELDS = /* @__PURE__ */ new Set([
-  "acl",
-  "serviceAccess",
-  "service_access"
-]);
+var NON_EDITABLE_FIELDS = /* @__PURE__ */ new Set(["id", "createdAt", "updatedAt", "created_at", "updated_at"]);
+var DEFAULT_HIDDEN_FIELDS = /* @__PURE__ */ new Set(["acl", "serviceAccess", "service_access"]);
 function toLabel(fieldName) {
   return fieldName.replace(/([a-z])([A-Z])/g, "$1 $2").replace(/_/g, " ").replace(/\b\w/g, (c) => c.toUpperCase());
 }
@@ -68,9 +59,7 @@ function getEnumValues(zodType) {
   }
   if (typeName === "ZodNativeEnum") {
     const enumObj = zodType._def.values;
-    return Object.values(enumObj).filter(
-      (v) => typeof v === "string"
-    );
+    return Object.values(enumObj).filter((v) => typeof v === "string");
   }
   return void 0;
 }
@@ -167,13 +156,9 @@ function getDefaultEntityFields() {
 }
 function mergeWithDefaultFields(schemaFields, options = {}) {
   const { includeDefaults = ["id", "createdAt"] } = options;
-  const defaultFields = getDefaultEntityFields().filter(
-    (f) => includeDefaults.includes(f.name)
-  );
+  const defaultFields = getDefaultEntityFields().filter((f) => includeDefaults.includes(f.name));
   const defaultNames = new Set(defaultFields.map((f) => f.name));
-  const filteredSchemaFields = schemaFields.filter(
-    (f) => !defaultNames.has(f.name)
-  );
+  const filteredSchemaFields = schemaFields.filter((f) => !defaultNames.has(f.name));
   return [...defaultFields, ...filteredSchemaFields];
 }
 
@@ -258,9 +243,7 @@ var BaseService = class {
     this.subscribers.get(entryId).add(socket);
     const roomName = this.getRoomName(entryId);
     void socket.join(roomName);
-    this.logger.debug(
-      `User ${socket.userId} subscribed to ${entryId} (room: ${roomName})`
-    );
+    this.logger.debug(`User ${socket.userId} subscribed to ${entryId} (room: ${roomName})`);
     const entity = await this.findById(entryId);
     if (!entity) return null;
     return this.filterEntityForSubscriber(entity, socket, entryId);
@@ -303,11 +286,7 @@ var BaseService = class {
         results[entryId] = null;
         continue;
       }
-      results[entryId] = this.filterEntityForSubscriber(
-        entity,
-        socket,
-        entryId
-      );
+      results[entryId] = this.filterEntityForSubscriber(entity, socket, entryId);
     }
     this.logger.debug(
       `User ${socket.userId} batch-subscribed to ${allowedIds.length}/${entryIds.length} entities`
@@ -325,12 +304,7 @@ var BaseService = class {
     const results = /* @__PURE__ */ new Map();
     await Promise.all(
       entryIds.map(async (id) => {
-        const allowed = await this.checkSubscriptionAccess(
-          userId,
-          id,
-          requiredLevel,
-          socket
-        );
+        const allowed = await this.checkSubscriptionAccess(userId, id, requiredLevel, socket);
         results.set(id, allowed);
       })
     );
@@ -344,9 +318,7 @@ var BaseService = class {
    * Default: fetches each entity individually in parallel.
    */
   async findByIds(ids) {
-    const results = await Promise.all(
-      ids.map((id) => this.findById(id))
-    );
+    const results = await Promise.all(ids.map((id) => this.findById(id)));
     return results.filter((e) => e !== null);
   }
   /**
@@ -410,9 +382,7 @@ var BaseService = class {
       return;
     }
     anySocket.to(roomName).emit(eventName, data);
-    this.logger.debug(
-      `Emitted ${eventName} to room ${roomName} (via socket fallback)`
-    );
+    this.logger.debug(`Emitted ${eventName} to room ${roomName} (via socket fallback)`);
   }
   /**
    * Emit a custom event to a specific user's room.
@@ -689,10 +659,7 @@ var BaseService = class {
       schema: options?.schema,
       resolveEntryId: options?.resolveEntryId
     };
-    this.publicMethods.set(
-      name,
-      definition
-    );
+    this.publicMethods.set(name, definition);
     return definition;
   }
   /**
@@ -725,9 +692,7 @@ var BaseService = class {
       }
     }
     if (missing.length > 0) {
-      throw new Error(
-        `${this.serviceName}: Missing method implementations: ${missing.join(", ")}`
-      );
+      throw new Error(`${this.serviceName}: Missing method implementations: ${missing.join(", ")}`);
     }
   }
   // ===========================================================================
@@ -758,15 +723,7 @@ var BaseService = class {
    * ```
    */
   installAdminMethods(options) {
-    const {
-      expose,
-      access,
-      schema,
-      displayName,
-      tableColumns,
-      hiddenFields,
-      fieldOverrides
-    } = options;
+    const { expose, access, schema, displayName, tableColumns, hiddenFields, fieldOverrides } = options;
     if (schema) {
       const schemaFields = zodToAdminFields(schema, {
         hiddenFields,
@@ -820,9 +777,7 @@ var BaseService = class {
         name: "adminCreate",
         access: access.create,
         handler: async (payload, _context) => {
-          return await this.adminCreate(
-            payload.data
-          );
+          return await this.adminCreate(payload.data);
         }
       });
     }
@@ -862,9 +817,7 @@ var BaseService = class {
         name: "adminGetSubscribers",
         access: access.getSubscribers,
         handler: async (payload, _context) => {
-          return this.adminGetSubscribers(
-            payload.entryId
-          );
+          return this.adminGetSubscribers(payload.entryId);
         },
         resolveEntryId: (payload) => payload.entryId
       });
@@ -874,9 +827,7 @@ var BaseService = class {
         name: "adminReemit",
         access: access.reemit,
         handler: async (payload, _context) => {
-          return await this.adminReemit(
-            payload.entryId
-          );
+          return await this.adminReemit(payload.entryId);
         },
         resolveEntryId: (payload) => payload.entryId
       });
@@ -886,16 +837,12 @@ var BaseService = class {
         name: "adminUnsubscribeAll",
         access: access.unsubscribeAll,
         handler: async (payload, _context) => {
-          return this.adminUnsubscribeAll(
-            payload.entryId
-          );
+          return this.adminUnsubscribeAll(payload.entryId);
         },
         resolveEntryId: (payload) => payload.entryId
       });
     }
-    const installedMethods = Object.keys(expose).filter(
-      (k) => expose[k]
-    );
+    const installedMethods = Object.keys(expose).filter((k) => expose[k]);
     if (shouldExposeMeta) installedMethods.push("meta");
     this.logger.info(`Installed admin methods: ${installedMethods.join(", ")}`);
   }
@@ -1091,21 +1038,9 @@ var ServiceRegistry = class {
       this.registerMethodListener(socket, eventName, method, service);
     }
     for (const [serviceName, service] of this.services) {
-      this.registerSubscriptionListener(
-        socket,
-        `${serviceName}:subscribe`,
-        service
-      );
-      this.registerBatchSubscriptionListener(
-        socket,
-        `${serviceName}:batchSubscribe`,
-        service
-      );
-      this.registerUnsubscriptionListener(
-        socket,
-        `${serviceName}:unsubscribe`,
-        service
-      );
+      this.registerSubscriptionListener(socket, `${serviceName}:subscribe`, service);
+      this.registerBatchSubscriptionListener(socket, `${serviceName}:batchSubscribe`, service);
+      this.registerUnsubscriptionListener(socket, `${serviceName}:unsubscribe`, service);
     }
   }
   /**
@@ -1238,10 +1173,7 @@ var ServiceRegistry = class {
           if (this.logPayloads) {
             logContext.payload = payload;
           }
-          this.logger.error(
-            `User ${userIdShort} ${serviceName}.${methodName} -> fail`,
-            logContext
-          );
+          this.logger.error(`User ${userIdShort} ${serviceName}.${methodName} -> fail`, logContext);
           const errorResponse = {
             success: false,
             error: error instanceof Error ? error.message : "Internal error",
@@ -1437,9 +1369,7 @@ function createQuickdrawServer(options) {
   });
   httpServer.listen(options.port, "0.0.0.0", () => {
     serverLogger.info(`Server listening on port ${options.port}`);
-    serverLogger.info(
-      `Registered services: ${registry.getServices().join(", ")}`
-    );
+    serverLogger.info(`Registered services: ${registry.getServices().join(", ")}`);
   });
   const shutdown = async (signal) => {
     serverLogger.info(`Received ${signal}, starting graceful shutdown...`);
@@ -1475,13 +1405,7 @@ function createQuickdrawServer(options) {
 // src/server/redis.ts
 async function setupRedisAdapter(io, options = {}) {
   const logger = options.logger?.child({ service: "RedisAdapter" }) ?? consoleLogger.child({ service: "RedisAdapter" });
-  const {
-    host = "localhost",
-    port = 6379,
-    password,
-    db = 0,
-    keyPrefix = "socket.io"
-  } = options;
+  const { host = "localhost", port = 6379, password, db = 0, keyPrefix = "socket.io" } = options;
   try {
     const dynamicImport = new Function("specifier", "return import(specifier)");
     const [redisAdapterModule, redisModule] = await Promise.all([
@@ -1497,7 +1421,9 @@ async function setupRedisAdapter(io, options = {}) {
     });
     const subClient = pubClient.duplicate();
     await Promise.all([pubClient.connect(), subClient.connect()]);
-    io.adapter(createAdapter(pubClient, subClient, { key: keyPrefix }));
+    io.adapter(
+      createAdapter(pubClient, subClient, { key: keyPrefix })
+    );
     logger.info(`Redis adapter connected to ${host}:${port}`);
     const cleanup = async () => {
       try {
@@ -1529,10 +1455,7 @@ async function setupRedisAdapter(io, options = {}) {
 async function isRedisAdapterAvailable() {
   try {
     const dynamicImport = new Function("specifier", "return import(specifier)");
-    await Promise.all([
-      dynamicImport("@socket.io/redis-adapter"),
-      dynamicImport("redis")
-    ]);
+    await Promise.all([dynamicImport("@socket.io/redis-adapter"), dynamicImport("redis")]);
     return true;
   } catch {
     return false;
@@ -1541,11 +1464,7 @@ async function isRedisAdapterAvailable() {
 
 // src/server/rateLimit.ts
 function createRateLimiter(options = {}) {
-  const {
-    windowMs = 6e4,
-    maxRequests = 100,
-    excludeEvents = []
-  } = options;
+  const { windowMs = 6e4, maxRequests = 100, excludeEvents = [] } = options;
   const entries = /* @__PURE__ */ new Map();
   const cleanupInterval = setInterval(() => {
     const now = Date.now();
@@ -1769,6 +1688,13 @@ var discordProvider = {
     };
   }
 };
+function getDiscordAvatarUrl(user) {
+  if (user.avatar) {
+    return `https://cdn.discordapp.com/avatars/${user.id}/${user.avatar}.png`;
+  }
+  const index = user.discriminator !== "0" ? parseInt(user.discriminator, 10) % 5 : (BigInt(user.id) >> BigInt(22)) % BigInt(6);
+  return `https://cdn.discordapp.com/embed/avatars/${index}.png`;
+}
 
 // src/server/auth/google.ts
 var googleProvider = {
@@ -1789,6 +1715,306 @@ var googleProvider = {
   }
 };
 
+// src/server/auth/validateOrigin.ts
+var OAUTH_RETURN_ORIGIN_COOKIE = "oauth_return_origin";
+var CODESPACE_REGEX = /^https:\/\/[a-z0-9-]+-[a-z0-9-]+-\d+\.app\.github\.dev$/;
+var LOCALHOST_REGEX = /^http:\/\/localhost:\d+$/;
+function envExtraOrigins() {
+  const raw = process.env.EXTRA_ALLOWED_ORIGINS;
+  if (!raw) return [];
+  return raw.split(",").map((s) => s.trim()).filter(Boolean);
+}
+function validateRedirectOrigin(origin, options = {}) {
+  if (!origin) return null;
+  const clientUrl = options.clientUrl ?? process.env.CLIENT_URL;
+  let parsedOrigin;
+  try {
+    parsedOrigin = new URL(origin);
+  } catch {
+    return null;
+  }
+  const cleanOrigin = parsedOrigin.origin;
+  if (clientUrl && cleanOrigin === clientUrl) {
+    return cleanOrigin;
+  }
+  const extra = options.extraAllowedOrigins ?? envExtraOrigins();
+  if (extra.includes(cleanOrigin)) {
+    return cleanOrigin;
+  }
+  if (options.allowedPatterns?.some((pattern) => pattern.test(cleanOrigin))) {
+    return cleanOrigin;
+  }
+  if ((options.allowCodespaces ?? true) && CODESPACE_REGEX.test(cleanOrigin)) {
+    return cleanOrigin;
+  }
+  if ((options.allowLocalhostInDev ?? true) && process.env.NODE_ENV !== "production" && LOCALHOST_REGEX.test(cleanOrigin)) {
+    return cleanOrigin;
+  }
+  return null;
+}
+
+// src/server/auth/mock.ts
+var DEFAULT_MOCK_PATH_PREFIX = "/auth/mock/provider";
+var CODE_TTL_MS = 5 * 60 * 1e3;
+var TOKEN_TTL_MS = 60 * 60 * 1e3;
+var DEV_PRIVATE_ORIGIN_REGEX = /^http:\/\/(?:localhost|127\.0\.0\.1|0\.0\.0\.0|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|172\.(?:1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}):\d+$/;
+function isMockOAuthEnabled() {
+  return process.env.ENABLE_MOCK_OAUTH === "true" && process.env.NODE_ENV !== "production";
+}
+function createMockOAuthProvider(apiBaseUrl, options = {}) {
+  const prefix = options.pathPrefix ?? DEFAULT_MOCK_PATH_PREFIX;
+  const publicBase = apiBaseUrl.replace(/\/$/, "");
+  const internalBase = (options.internalBaseUrl ?? apiBaseUrl).replace(/\/$/, "");
+  return {
+    name: "mock",
+    authorizationUrl: `${publicBase}${prefix}/authorize`,
+    tokenUrl: `${internalBase}${prefix}/token`,
+    userInfoUrl: `${internalBase}${prefix}/userinfo`,
+    scopes: ["openid", "email", "profile"],
+    parseUserInfo: (data) => {
+      const d = data;
+      return {
+        id: String(d.id),
+        email: String(d.email),
+        name: String(d.name),
+        picture: d.picture ? String(d.picture) : null,
+        verified_email: true
+      };
+    }
+  };
+}
+function getQueryParam(req, name) {
+  const fromQuery = req.query?.[name];
+  if (typeof fromQuery === "string") return fromQuery;
+  const url = req.originalUrl ?? req.url;
+  if (!url) return null;
+  const idx = url.indexOf("?");
+  if (idx === -1) return null;
+  return new URLSearchParams(url.slice(idx + 1)).get(name);
+}
+async function readBodyParams(req) {
+  if (typeof req.body === "string") return new URLSearchParams(req.body);
+  if (req.body && typeof req.body === "object" && Object.keys(req.body).length > 0) {
+    return new URLSearchParams(req.body);
+  }
+  const chunks = [];
+  for await (const chunk of req) {
+    chunks.push(Buffer.from(chunk));
+  }
+  return new URLSearchParams(Buffer.concat(chunks).toString("utf8"));
+}
+function escapeHtml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function isAllowedRedirectUri(uri, allowedOrigins) {
+  let parsed;
+  try {
+    parsed = new URL(uri);
+  } catch {
+    return false;
+  }
+  const origin = parsed.origin;
+  if (allowedOrigins.includes(origin)) return true;
+  if (DEV_PRIVATE_ORIGIN_REGEX.test(origin)) return true;
+  return validateRedirectOrigin(origin) !== null;
+}
+function renderPickerPage(users, authorizePath, redirectUri, state) {
+  const links = users.map((user) => {
+    const params = new URLSearchParams({ redirect_uri: redirectUri, email: user.email });
+    if (state) params.set("state", state);
+    const href = `${authorizePath}?${params.toString()}`;
+    return `<li><a href="${escapeHtml(href)}"><strong>${escapeHtml(user.name)}</strong><span>${escapeHtml(user.email)}</span></a></li>`;
+  }).join("\n");
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<title>Mock sign-in</title>
+<style>
+  body { font-family: system-ui, sans-serif; background: #111; color: #eee; display: flex; min-height: 100vh; align-items: center; justify-content: center; margin: 0; }
+  main { max-width: 420px; width: 100%; padding: 2rem; }
+  h1 { font-size: 1.25rem; }
+  p { color: #999; font-size: 0.875rem; }
+  ul { list-style: none; padding: 0; display: flex; flex-direction: column; gap: 0.5rem; }
+  a { display: flex; flex-direction: column; gap: 0.125rem; padding: 0.75rem 1rem; border: 1px solid #333; border-radius: 8px; text-decoration: none; color: inherit; }
+  a:hover { border-color: #888; background: #1a1a1a; }
+  a span { color: #999; font-size: 0.8125rem; }
+</style>
+</head>
+<body>
+<main>
+<h1>Mock sign-in</h1>
+<p>Development only \u2014 pick an account to continue. Run your seed script if this list is empty.</p>
+<ul>
+${links || "<li><em>No users found.</em></li>"}
+</ul>
+</main>
+</body>
+</html>`;
+}
+function registerMockOAuthProvider(router, options) {
+  const logger = options.logger ?? consoleLogger;
+  if (!isMockOAuthEnabled()) {
+    if (process.env.ENABLE_MOCK_OAUTH === "true") {
+      logger.error("Mock OAuth is enabled but NODE_ENV is production \u2014 refusing to mount routes");
+    }
+    return false;
+  }
+  const prefix = options.pathPrefix ?? DEFAULT_MOCK_PATH_PREFIX;
+  const allowedOrigins = options.allowedRedirectOrigins ?? [];
+  const codes = /* @__PURE__ */ new Map();
+  const tokens = /* @__PURE__ */ new Map();
+  function sweep(store) {
+    const now = Date.now();
+    for (const [key, entry] of store) {
+      if (entry.expiresAt < now) store.delete(key);
+    }
+  }
+  function guard(res) {
+    if (process.env.NODE_ENV === "production") {
+      res.status(404).json({ error: "Not found" });
+      return false;
+    }
+    return true;
+  }
+  router.get(`${prefix}/authorize`, async (req, res) => {
+    if (!guard(res)) return;
+    const redirectUri = getQueryParam(req, "redirect_uri");
+    const state = getQueryParam(req, "state");
+    const email = getQueryParam(req, "email");
+    if (!redirectUri || !isAllowedRedirectUri(redirectUri, allowedOrigins)) {
+      res.status(400).json({ error: "Invalid redirect_uri" });
+      return;
+    }
+    const users = await options.listUsers();
+    if (!email) {
+      res.status(200).send(renderPickerPage(users, `${prefix}/authorize`, redirectUri, state));
+      return;
+    }
+    const user = users.find((u) => u.email === email);
+    if (!user) {
+      res.status(400).json({ error: "Unknown mock user" });
+      return;
+    }
+    sweep(codes);
+    const code = randomBytes(24).toString("hex");
+    codes.set(code, { email: user.email, expiresAt: Date.now() + CODE_TTL_MS });
+    const params = new URLSearchParams({ code });
+    if (state) params.set("state", state);
+    res.redirect(`${redirectUri}${redirectUri.includes("?") ? "&" : "?"}${params.toString()}`);
+  });
+  router.post(`${prefix}/token`, async (req, res) => {
+    if (!guard(res)) return;
+    const body = await readBodyParams(req);
+    const code = body.get("code");
+    const entry = code ? codes.get(code) : void 0;
+    if (code) codes.delete(code);
+    if (!entry || entry.expiresAt < Date.now()) {
+      res.status(400).json({ error: "invalid_grant" });
+      return;
+    }
+    sweep(tokens);
+    const accessToken = randomBytes(24).toString("hex");
+    tokens.set(accessToken, { email: entry.email, expiresAt: Date.now() + TOKEN_TTL_MS });
+    res.status(200).json({
+      access_token: accessToken,
+      token_type: "Bearer",
+      expires_in: Math.floor(TOKEN_TTL_MS / 1e3),
+      scope: "openid email profile"
+    });
+  });
+  router.get(`${prefix}/userinfo`, async (req, res) => {
+    if (!guard(res)) return;
+    const auth = req.headers.authorization;
+    const accessToken = typeof auth === "string" && auth.startsWith("Bearer ") ? auth.slice(7) : null;
+    const entry = accessToken ? tokens.get(accessToken) : void 0;
+    if (!entry || entry.expiresAt < Date.now()) {
+      res.status(401).json({ error: "invalid_token" });
+      return;
+    }
+    const users = await options.listUsers();
+    const user = users.find((u) => u.email === entry.email);
+    if (!user) {
+      res.status(401).json({ error: "invalid_token" });
+      return;
+    }
+    res.status(200).json({
+      // providerAccountId = email: stable across re-seeds, unlike row ids.
+      id: user.email,
+      email: user.email,
+      name: user.name,
+      picture: user.picture ?? null,
+      verified_email: true
+    });
+  });
+  logger.info(`Mock OAuth provider mounted at ${prefix} (development only)`);
+  return true;
+}
+
+// src/server/auth/sessionCookie.ts
+var SESSION_COOKIE = "session";
+var DEFAULT_MAX_AGE_MS = 30 * 24 * 60 * 60 * 1e3;
+function cookieOptions(options) {
+  const isProd = process.env.NODE_ENV === "production";
+  const domain = options.domain ?? process.env.COOKIE_DOMAIN;
+  return {
+    httpOnly: true,
+    secure: isProd,
+    // SameSite=None (with Secure) lets the session cookie ride cross-site
+    // fetches, so a secondary web origin can hit the primary API host. The
+    // CORS allowlist (validateRedirectOrigin) is the actual origin gate. Dev
+    // keeps Lax — localhost is http-only and SameSite=None requires Secure.
+    sameSite: isProd ? "none" : "lax",
+    path: "/",
+    ...domain && { domain }
+  };
+}
+function setSessionCookie(res, jwt, options = {}) {
+  res.cookie(options.cookieName ?? SESSION_COOKIE, jwt, {
+    ...cookieOptions(options),
+    maxAge: options.maxAgeMs ?? DEFAULT_MAX_AGE_MS
+  });
+}
+function clearSessionCookie(res, options = {}) {
+  res.clearCookie(options.cookieName ?? SESSION_COOKIE, cookieOptions(options));
+}
+
+// src/server/auth/restMiddleware.ts
+function extractBearerOrCookieToken(req, cookieName = SESSION_COOKIE) {
+  const cookieToken = req.cookies?.[cookieName];
+  if (cookieToken) return cookieToken;
+  const authHeader = req.headers.authorization;
+  if (authHeader?.startsWith("Bearer ")) return authHeader.slice(7);
+  return null;
+}
+function createRequireAuth(options) {
+  return async (req, res, next) => {
+    const token = extractBearerOrCookieToken(req, options.cookieName);
+    if (!token) {
+      res.status(401).json({ error: "Missing or invalid authorization" });
+      return;
+    }
+    const secret = options.jwtSecret ?? process.env.JWT_SECRET;
+    if (!secret) {
+      res.status(401).json({ error: "Authentication is not configured" });
+      return;
+    }
+    const payload = await verifyJWT(token, secret);
+    if (!payload?.userId) {
+      res.status(401).json({ error: "Invalid or expired token" });
+      return;
+    }
+    const session = await options.getSession(token);
+    if (!session || session.expiresAt < /* @__PURE__ */ new Date()) {
+      res.status(401).json({ error: "Session expired or revoked" });
+      return;
+    }
+    req.userId = payload.userId;
+    next();
+  };
+}
+
 // src/server/utils/env.ts
 function validateEnv(options) {
   const result = checkEnv(options);
@@ -1797,7 +2023,11 @@ function validateEnv(options) {
   }
 }
 function checkEnv(options) {
-  const { required, productionOnly = true, errorPrefix = "Missing required environment variables" } = options;
+  const {
+    required,
+    productionOnly = true,
+    errorPrefix = "Missing required environment variables"
+  } = options;
   if (productionOnly && process.env.NODE_ENV !== "production") {
     return { success: true, missing: [] };
   }
@@ -1827,6 +2057,54 @@ function requireEnv(name, defaultValue) {
   }
   return value;
 }
+var ALGORITHM = "aes-256-gcm";
+var IV_LENGTH = 12;
+var AUTH_TAG_LENGTH = 16;
+function getKey() {
+  const hex = process.env.ENCRYPTION_KEY;
+  if (!hex || hex.length !== 64) {
+    throw new Error(
+      "ENCRYPTION_KEY must be set as a 64-character hex string (32 bytes). Check your environment configuration."
+    );
+  }
+  return Buffer.from(hex, "hex");
+}
+function encrypt(plaintext) {
+  const key = getKey();
+  const iv = randomBytes(IV_LENGTH);
+  const cipher = createCipheriv(ALGORITHM, key, iv, { authTagLength: AUTH_TAG_LENGTH });
+  const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+  const authTag = cipher.getAuthTag();
+  return `${iv.toString("hex")}:${authTag.toString("hex")}:${encrypted.toString("hex")}`;
+}
+function decrypt(ciphertext) {
+  const key = getKey();
+  const [ivHex, authTagHex, encryptedHex] = ciphertext.split(":");
+  if (!ivHex || !authTagHex || !encryptedHex) {
+    throw new Error("Invalid ciphertext format");
+  }
+  const iv = Buffer.from(ivHex, "hex");
+  const authTag = Buffer.from(authTagHex, "hex");
+  const encrypted = Buffer.from(encryptedHex, "hex");
+  const decipher = createDecipheriv(ALGORITHM, key, iv, { authTagLength: AUTH_TAG_LENGTH });
+  decipher.setAuthTag(authTag);
+  return decipher.update(encrypted) + decipher.final("utf8");
+}
+function isEncrypted(value) {
+  const parts = value.split(":");
+  return parts.length === 3 && parts.every((p) => /^[0-9a-f]+$/.test(p));
+}
+function decryptIfEncrypted(value) {
+  return isEncrypted(value) ? decrypt(value) : value;
+}
+function tryDecrypt(ciphertext, logger = consoleLogger) {
+  try {
+    return decryptIfEncrypted(ciphertext);
+  } catch {
+    logger.warn("Failed to decrypt stored token \u2014 likely stale or re-keyed");
+    return null;
+  }
+}
 
 // src/server/mcp/McpRegistry.ts
 var McpRegistry = class {
@@ -1863,7 +2141,9 @@ var McpRegistry = class {
   listTools(options) {
     const hasDefaultUser = !!options?.defaultUserId;
     if (this.customToolSpecs) {
-      return this.customToolSpecs.filter((s) => this.services.has(s.name)).map((svc) => this.buildToolDefinition(svc.name, svc.description, svc.methodNames, hasDefaultUser));
+      return this.customToolSpecs.filter((s) => this.services.has(s.name)).map(
+        (svc) => this.buildToolDefinition(svc.name, svc.description, svc.methodNames, hasDefaultUser)
+      );
     }
     const tools = [];
     for (const [serviceName] of this.services) {
@@ -1898,11 +2178,7 @@ var McpRegistry = class {
     const startTime = Date.now();
     try {
       const validatedPayload = this.validatePayload(method, payload);
-      await instance.ensureAccessForMethod(
-        method.access,
-        ctx,
-        entryId
-      );
+      await instance.ensureAccessForMethod(method.access, ctx, entryId);
       const result = await method.handler(validatedPayload, {
         userId,
         socketId: ctx.id,
@@ -1954,9 +2230,7 @@ var McpRegistry = class {
     if (method.schema) {
       const result = method.schema.safeParse(payload);
       if (!result.success) {
-        throw new Error(
-          `Validation error: ${result.error?.message ?? "invalid payload"}`
-        );
+        throw new Error(`Validation error: ${result.error?.message ?? "invalid payload"}`);
       }
       return result.data;
     }
@@ -2053,12 +2327,7 @@ function createMcpStdioServer(options) {
           }
           const userId = args?.userId ?? defaultUserId ?? process.env.MCP_USER_ID ?? "mcp-anonymous";
           const payload = args?.payload;
-          const result = await registry.invoke(
-            serviceName,
-            methodName,
-            payload,
-            userId
-          );
+          const result = await registry.invoke(serviceName, methodName, payload, userId);
           return {
             jsonrpc: "2.0",
             id,
@@ -2181,12 +2450,7 @@ function createMcpRoutes(router, options) {
         res.status(400).json({ error: "Missing service or method" });
         return;
       }
-      const result = await registry.invoke(
-        service,
-        method,
-        toolPayload,
-        tokenPayload.userId
-      );
+      const result = await registry.invoke(service, method, toolPayload, tokenPayload.userId);
       res.json({ success: true, data: result });
     } catch (error) {
       const message = error instanceof Error ? error.message : "Internal error";
@@ -2464,10 +2728,7 @@ function generateToolMetadata(options) {
     allServices.push(serviceInfo);
     if (docsOutputDir) {
       const doc = generateServiceDoc(serviceInfo);
-      const outputPath = path.join(
-        docsOutputDir,
-        `${serviceInfo.className}.md`
-      );
+      const outputPath = path.join(docsOutputDir, `${serviceInfo.className}.md`);
       fs.writeFileSync(outputPath, doc);
     }
   }
@@ -2488,15 +2749,12 @@ Auto-generated documentation for all services.
   }
   const toolsContent = generateToolsFileContent(allServices);
   fs.writeFileSync(toolsOutputPath, toolsContent);
-  const totalMethods = allServices.reduce(
-    (sum, s) => sum + s.methods.length,
-    0
-  );
+  const totalMethods = allServices.reduce((sum, s) => sum + s.methods.length, 0);
   console.log(
     `Generated ${allServices.length} service tools (${totalMethods} methods) -> ${toolsOutputPath}`
   );
 }
 
-export { BaseService, McpRegistry, ServiceRegistry, applyRateLimitMiddleware, bootstrapMcpServer, checkEnv, createJWT, createMcpRoutes, createMcpStdioServer, createOAuthURL, createQuickdrawServer, createRateLimiter, createTieredRateLimiter, discordProvider, exchangeOAuthCode, generateToolMetadata, getDefaultEntityFields, googleProvider, isRedisAdapterAvailable, mergeWithDefaultFields, requireEnv, setupRedisAdapter, validateEnv, verifyJWT, zodToAdminFields };
+export { BaseService, DEFAULT_MOCK_PATH_PREFIX, McpRegistry, OAUTH_RETURN_ORIGIN_COOKIE, SESSION_COOKIE, ServiceRegistry, applyRateLimitMiddleware, bootstrapMcpServer, checkEnv, clearSessionCookie, createJWT, createMcpRoutes, createMcpStdioServer, createMockOAuthProvider, createOAuthURL, createQuickdrawServer, createRateLimiter, createRequireAuth, createTieredRateLimiter, decrypt, decryptIfEncrypted, discordProvider, encrypt, exchangeOAuthCode, extractBearerOrCookieToken, generateToolMetadata, getDefaultEntityFields, getDiscordAvatarUrl, googleProvider, isEncrypted, isMockOAuthEnabled, isRedisAdapterAvailable, mergeWithDefaultFields, registerMockOAuthProvider, requireEnv, setSessionCookie, setupRedisAdapter, tryDecrypt, validateEnv, validateRedirectOrigin, verifyJWT, zodToAdminFields };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map