@fonoster/identity 0.26.0 → 0.30.0

package/dist/utils/signInThrottle.js

@@ -0,0 +1,90 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tooManySignInAttempts = void 0;
+exports.createSignInThrottle = createSignInThrottle;
+/**
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+const grpc_js_1 = require("@grpc/grpc-js");
+const constants_1 = require("../constants");
+const rateLimiter_1 = require("./rateLimiter");
+/**
+ * Slows down password and code guessing on sign-in. Failed attempts are
+ * counted per email and per client IP; once either reaches its limit, sign-in
+ * for that email (or from that IP) is refused for one window, right or wrong.
+ * Only failures count, so someone who knows an email can't lock its owner out
+ * by signing in successfully elsewhere, and a user who signs in fine is never
+ * slowed down.
+ *
+ * Kept in this process's memory, like the other Identity limits: with several
+ * replicas each enforces its own limit.
+ */
+function createSignInThrottle(limits = constants_1.SIGN_IN_FAILURE_LIMITS) {
+    const { perEmail, perIp, windowMs } = limits;
+    // tryConsume refuses the use after `limit`, so `limit - 1` makes the
+    // limit-th failure the one that blocks.
+    const emailFailures = (0, rateLimiter_1.createRateLimiter)({
+        limit: Math.max(perEmail - 1, 0),
+        windowMs
+    });
+    const ipFailures = (0, rateLimiter_1.createRateLimiter)({
+        limit: Math.max(perIp - 1, 0),
+        windowMs
+    });
+    const blockedUntil = new Map();
+    const emailKey = (email) => `email:${email.trim().toLowerCase()}`;
+    const ipKey = (ip) => `ip:${ip}`;
+    const isBlocked = (key, now) => {
+        const until = blockedUntil.get(key);
+        if (until === undefined)
+            return false;
+        if (now >= until) {
+            blockedUntil.delete(key);
+            return false;
+        }
+        return true;
+    };
+    const block = (key, now) => {
+        blockedUntil.set(key, now + windowMs);
+        // Keep the map from growing without bound.
+        if (blockedUntil.size > 10000) {
+            blockedUntil.forEach((until, k) => {
+                if (now >= until)
+                    blockedUntil.delete(k);
+            });
+        }
+    };
+    return {
+        /** True while sign-in for this email, or from this IP, is refused. */
+        isBlocked(email, ip, now = Date.now()) {
+            return isBlocked(ipKey(ip), now) || isBlocked(emailKey(email), now);
+        },
+        /** Counts one failed sign-in for the email and the IP. */
+        recordFailure(email, ip, now = Date.now()) {
+            if (!ipFailures(ipKey(ip), now))
+                block(ipKey(ip), now);
+            if (!emailFailures(emailKey(email), now))
+                block(emailKey(email), now);
+        }
+    };
+}
+const tooManySignInAttempts = {
+    code: grpc_js_1.status.RESOURCE_EXHAUSTED,
+    message: "Too many sign-in attempts; try again later"
+};
+exports.tooManySignInAttempts = tooManySignInAttempts;

package/dist/utils/userPasswords.d.ts

@@ -0,0 +1,25 @@
+import { Prisma } from "../db";
+type UserWithPassword = {
+    ref: string;
+    password?: string | null;
+    passwordDigest?: string | null;
+};
+/**
+ * Columns to write when setting a password: the digest only, clearing the
+ * legacy encrypted value.
+ */
+declare function passwordColumns(password: string): Promise<{
+    passwordDigest: string;
+    password: any;
+}>;
+/**
+ * Verifies a user's password. Users from before digests existed are checked
+ * against their decrypted legacy password, then migrated to a digest.
+ */
+declare function createVerifyUserPassword(prisma: Prisma): (user: UserWithPassword, password: string) => Promise<boolean>;
+/**
+ * Moves every remaining legacy password to a digest. Batched and idempotent:
+ * only users with a legacy value and no digest are touched.
+ */
+declare function backfillPasswordDigests(prisma: Prisma): Promise<number>;
+export { backfillPasswordDigests, createVerifyUserPassword, passwordColumns };

package/dist/utils/userPasswords.js

@@ -0,0 +1,98 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.backfillPasswordDigests = backfillPasswordDigests;
+exports.createVerifyUserPassword = createVerifyUserPassword;
+exports.passwordColumns = passwordColumns;
+/**
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+const logger_1 = require("@fonoster/logger");
+const passwords_1 = require("./passwords");
+const logger = (0, logger_1.getLogger)({ service: "identity", filePath: __filename });
+const BACKFILL_BATCH_SIZE = 500;
+/**
+ * Columns to write when setting a password: the digest only, clearing the
+ * legacy encrypted value.
+ */
+function passwordColumns(password) {
+    return __awaiter(this, void 0, void 0, function* () {
+        return { passwordDigest: yield (0, passwords_1.hashPassword)(password), password: null };
+    });
+}
+/**
+ * Verifies a user's password. Users from before digests existed are checked
+ * against their decrypted legacy password, then migrated to a digest.
+ */
+function createVerifyUserPassword(prisma) {
+    return (user, password) => __awaiter(this, void 0, void 0, function* () {
+        if (!password) {
+            return false;
+        }
+        if (user.passwordDigest) {
+            return (0, passwords_1.verifyPasswordDigest)(password, user.passwordDigest);
+        }
+        if (!user.password || !(0, passwords_1.equalsInConstantTime)(user.password, password)) {
+            return false;
+        }
+        yield prisma.user.update({
+            where: { ref: user.ref },
+            data: yield passwordColumns(password)
+        });
+        return true;
+    });
+}
+/**
+ * Moves every remaining legacy password to a digest. Batched and idempotent:
+ * only users with a legacy value and no digest are touched.
+ */
+function backfillPasswordDigests(prisma) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const migrateBatch = () => __awaiter(this, void 0, void 0, function* () {
+            const users = yield prisma.user.findMany({
+                where: { passwordDigest: null, password: { not: null } },
+                select: { ref: true, password: true },
+                take: BACKFILL_BATCH_SIZE
+            });
+            if (users.length === 0) {
+                return 0;
+            }
+            // One at a time: each scrypt derivation holds ~32 MiB.
+            yield users.reduce((previous, user) => previous.then(() => __awaiter(this, void 0, void 0, function* () {
+                yield prisma.user.update({
+                    where: { ref: user.ref },
+                    data: yield passwordColumns(user.password)
+                });
+            })), Promise.resolve());
+            return users.length + (yield migrateBatch());
+        });
+        const migrated = yield migrateBatch();
+        if (migrated > 0) {
+            logger.info("moved legacy passwords to digests", { users: migrated });
+        }
+        return migrated;
+    });
+}

package/dist/verification/createSendVerificationCode.js

@@ -30,19 +30,45 @@ exports.createSendVerificationCode = createSendVerificationCode;
  */
 const common_1 = require("@fonoster/common");
 const logger_1 = require("@fonoster/logger");
+const grpc_js_1 = require("@grpc/grpc-js");
+const constants_1 = require("../constants");
+const clientAddress_1 = require("../utils/clientAddress");
 const createGenerateVerificationCode_1 = require("../utils/createGenerateVerificationCode");
+const createSendEmail_1 = require("../utils/createSendEmail");
+const rateLimiter_1 = require("../utils/rateLimiter");
 const sendVerificationEmail_1 = require("./sendVerificationEmail");
 const sendVerificationMessage_1 = require("./sendVerificationMessage");
 const types_1 = require("./types");
 const logger = (0, logger_1.getLogger)({ service: "identity", filePath: __filename });
+const tooManyRequests = {
+    code: grpc_js_1.status.RESOURCE_EXHAUSTED,
+    message: "Too many verification codes requested; try again later"
+};
 function createSendVerificationCode(prisma, identityConfig) {
     const sendSms = (0, common_1.createSendSmsTwilioImpl)(identityConfig.twilioSmsConfig);
-    const sendEmail = (0, common_1.createSendEmail)(identityConfig.smtpConfig);
+    const sendEmail = (0, createSendEmail_1.createSendEmail)(identityConfig);
     const generateVerificationCode = (0, createGenerateVerificationCode_1.createGenerateVerificationCode)(prisma);
+    const { perEmail, perIp, windowMs } = constants_1.VERIFICATION_CODE_SEND_LIMITS;
+    const withinContactLimit = (0, rateLimiter_1.createSharedRateLimiter)(prisma, {
+        name: "verification:contact",
+        limit: perEmail,
+        windowMs
+    });
+    const withinIpLimit = (0, rateLimiter_1.createSharedRateLimiter)(prisma, {
+        name: "verification:ip",
+        limit: perIp,
+        windowMs
+    });
+    // The response never says whether the contact belongs to an account.
     const fn = (call, callback) => __awaiter(this, void 0, void 0, function* () {
         var _a;
         const { request } = call;
         const actualContactType = (_a = request.contactType) !== null && _a !== void 0 ? _a : types_1.ContactType.EMAIL;
+        const contact = `${actualContactType}:${request.value.toLowerCase()}`;
+        if (!(yield withinIpLimit((0, clientAddress_1.clientAddress)(call))) ||
+            !(yield withinContactLimit(contact))) {
+            return callback(tooManyRequests);
+        }
         const verificationCode = yield generateVerificationCode({
             type: actualContactType,
             value: request.value

package/dist/verification/createVerifyCode.js

@@ -38,6 +38,16 @@ function createVerifyCode(prisma) {
         const { request } = call;
         const { username, contactType, value, verificationCode } = request;
         const actualContactType = contactType !== null && contactType !== void 0 ? contactType : types_1.ContactType.EMAIL;
+        const sameEmail = (a, b) => (a !== null && a !== void 0 ? a : "").trim().toLowerCase() === (b !== null && b !== void 0 ? b : "").trim().toLowerCase();
+        // A code proves only the address it was sent to: an email code verifies
+        // the account with that email, never another one (M2).
+        if (actualContactType === types_1.ContactType.EMAIL &&
+            !sameEmail(value, username)) {
+            return callback({
+                code: grpc_js_1.status.PERMISSION_DENIED,
+                message: "Invalid verification code"
+            });
+        }
         const isValid = yield isValidVerificationCode({
             type: actualContactType,
             value,

package/dist/workspaces/createCreateWorkspace.d.ts

@@ -18,7 +18,13 @@
  */
 import { GrpcErrorMessage } from "@fonoster/common";
 import { Prisma } from "../db";
-declare function createCreateWorkspace(prisma: Prisma): (call: {
+import { WorkspaceRegionHooks } from "../exchanges/types";
+/**
+ * Creates a workspace in one region, for its whole life (add-private-regions PR-1, PR-15): an
+ * offered public region id (default `default`) or one of the caller's private regions (by id or
+ * ref). Private regions are created at the user level, never here.
+ */
+declare function createCreateWorkspace(prisma: Prisma, regions?: WorkspaceRegionHooks): (call: {
     request: unknown;
 }, callback: (error?: import("@fonoster/common").GrpcErrorMessage, response?: unknown) => void) => Promise<void>;
 export { createCreateWorkspace };

package/dist/workspaces/createCreateWorkspace.js

@@ -30,26 +30,62 @@ exports.createCreateWorkspace = createCreateWorkspace;
  */
 const common_1 = require("@fonoster/common");
 const logger_1 = require("@fonoster/logger");
+const grpc_js_1 = require("@grpc/grpc-js");
 const generateAccessKeyId_1 = require("../utils/generateAccessKeyId");
 const getUserRefFromToken_1 = require("../utils/getUserRefFromToken");
 const logger = (0, logger_1.getLogger)({ service: "identity", filePath: __filename });
-function createCreateWorkspace(prisma) {
+const DEFAULT_REGION = "default";
+/**
+ * Creates a workspace in one region, for its whole life (add-private-regions PR-1, PR-15): an
+ * offered public region id (default `default`) or one of the caller's private regions (by id or
+ * ref). Private regions are created at the user level, never here.
+ */
+function createCreateWorkspace(prisma, regions) {
     const createWorkspace = (call, callback) => __awaiter(this, void 0, void 0, function* () {
         const { request } = call;
         const { name } = request;
+        const requested = request.region || undefined;
         const token = (0, common_1.getTokenFromCall)(call);
         const ownerRef = (0, getUserRefFromToken_1.getUserRefFromToken)(token);
         const accessKeyId = (0, generateAccessKeyId_1.generateAccessKeyId)(generateAccessKeyId_1.AccessKeyIdType.WORKSPACE);
-        logger.verbose("call to createWorkspace", { name, ownerRef });
+        logger.verbose("call to createWorkspace", {
+            name,
+            ownerRef,
+            region: requested
+        });
+        let region;
+        if (regions) {
+            try {
+                region = (yield regions.resolveRegion(ownerRef, requested)).region;
+            }
+            catch (e) {
+                callback({
+                    code: grpc_js_1.status.INVALID_ARGUMENT,
+                    message: e.message
+                });
+                return;
+            }
+        }
+        else {
+            region = requested !== null && requested !== void 0 ? requested : DEFAULT_REGION;
+            if (region !== DEFAULT_REGION) {
+                callback({
+                    code: grpc_js_1.status.INVALID_ARGUMENT,
+                    message: `region must be ${DEFAULT_REGION}`
+                });
+                return;
+            }
+        }
         const workspace = yield prisma.workspace.create({
             data: {
                 name,
                 accessKeyId,
-                ownerRef
+                ownerRef,
+                region
             }
         });
-        const { ref } = workspace;
-        callback(null, { ref });
+        regions === null || regions === void 0 ? void 0 : regions.workspaceChanged({ accessKeyId, region });
+        callback(null, { ref: workspace.ref, region });
     });
     return (0, common_1.withErrorHandlingAndValidation)(createWorkspace, common_1.Validators.createWorkspaceRequestSchema);
 }

package/dist/workspaces/createDeleteWorkspace.d.ts

@@ -18,7 +18,8 @@
  */
 import { GrpcErrorMessage } from "@fonoster/common";
 import { Prisma } from "../db";
-declare function createDeleteWorkspace(prisma: Prisma): (call: {
+import { WorkspaceRegionHooks } from "../exchanges/types";
+declare function createDeleteWorkspace(prisma: Prisma, regions?: WorkspaceRegionHooks): (call: {
     request: unknown;
 }, callback: (error?: import("@fonoster/common").GrpcErrorMessage, response?: unknown) => void) => Promise<void>;
 export { createDeleteWorkspace };

package/dist/workspaces/createDeleteWorkspace.js

@@ -32,19 +32,33 @@ const common_1 = require("@fonoster/common");
 const logger_1 = require("@fonoster/logger");
 const getUserRefFromToken_1 = require("../utils/getUserRefFromToken");
 const logger = (0, logger_1.getLogger)({ service: "identity", filePath: __filename });
-function createDeleteWorkspace(prisma) {
+function createDeleteWorkspace(prisma, regions) {
     const deleteWorkspace = (call, callback) => __awaiter(this, void 0, void 0, function* () {
         const { request } = call;
         const { ref } = request;
         const token = (0, common_1.getTokenFromCall)(call);
         const ownerRef = (0, getUserRefFromToken_1.getUserRefFromToken)(token);
         logger.verbose("deleting workspace from the system", { ref, ownerRef });
-        yield prisma.workspace.delete({
+        const deleted = yield prisma.workspace.delete({
             where: {
                 ref,
                 ownerRef
             }
         });
+        // The region stays (it belongs to the user, PR-14); it stops serving this workspace.
+        if (deleted === null || deleted === void 0 ? void 0 : deleted.region)
+            try {
+                regions === null || regions === void 0 ? void 0 : regions.workspaceChanged({
+                    accessKeyId: deleted.accessKeyId,
+                    region: deleted.region
+                });
+            }
+            catch (e) {
+                logger.error("could not resync the workspace's region", {
+                    ref,
+                    error: e.message
+                });
+            }
         callback(null, { ref });
     });
     return (0, common_1.withErrorHandlingAndValidation)(deleteWorkspace, common_1.Validators.emptySchema);

package/dist/workspaces/createInviteUserToWorkspace.js

@@ -32,10 +32,12 @@ const common_1 = require("@fonoster/common");
 const logger_1 = require("@fonoster/logger");
 const types_1 = require("@fonoster/types");
 const grpc_js_1 = require("@grpc/grpc-js");
-const nanoid_1 = require("nanoid");
 const utils_1 = require("../utils");
+const authMethods_1 = require("../utils/authMethods");
 const createGenerateWorkspaceInviteToken_1 = require("../utils/createGenerateWorkspaceInviteToken");
+const generateOneTimePassword_1 = require("../utils/generateOneTimePassword");
 const getUserRefFromToken_1 = require("../utils/getUserRefFromToken");
+const userPasswords_1 = require("../utils/userPasswords");
 const createIsAdminMember_1 = require("./createIsAdminMember");
 const createIsWorkspaceMember_1 = require("./createIsWorkspaceMember");
 const logger = (0, logger_1.getLogger)({ service: "identity", filePath: __filename });
@@ -54,17 +56,19 @@ const findUserByEmail = (prisma, email) => __awaiter(void 0, void 0, void 0, fun
         }
     });
 });
+/**
+ * Creates the invitee. With password sign-in they get a one-time password
+ * they must replace after signing in; otherwise they sign in by email code or
+ * GitHub and have no password.
+ */
 const createCreateUser = (prisma) => {
-    return function createUser(request) {
+    return function createUser(request, oneTimePassword) {
         return __awaiter(this, void 0, void 0, function* () {
-            const { name, email, password } = request;
+            const { name, email } = request;
             return yield prisma.user.create({
-                data: {
-                    name,
-                    email,
-                    accessKeyId: (0, utils_1.generateAccessKeyId)(utils_1.AccessKeyIdType.USER),
-                    password
-                }
+                data: Object.assign({ name,
+                    email, accessKeyId: (0, utils_1.generateAccessKeyId)(utils_1.AccessKeyIdType.USER) }, (oneTimePassword
+                    ? Object.assign(Object.assign({}, (yield (0, userPasswords_1.passwordColumns)(oneTimePassword))), { mustChangePassword: true }) : {}))
             });
         });
     };
@@ -96,16 +100,13 @@ function createInviteUserToWorkspace(prisma, identityConfig, sendInvite) {
         if (isMember) {
             return callback(userIsMemberError);
         }
-        const oneTimePassword = (0, nanoid_1.customAlphabet)("1234567890abcdef", 10)();
+        const oneTimePassword = (0, authMethods_1.isMethodEnabled)(identityConfig, "password")
+            ? (0, generateOneTimePassword_1.generateOneTimePassword)()
+            : undefined;
         let isExistingUser = true;
         if (!user) {
             isExistingUser = false;
-            user = yield createCreateUser(prisma)({
-                name,
-                email,
-                password: oneTimePassword,
-                role
-            });
+            user = yield createCreateUser(prisma)({ name, email }, oneTimePassword);
         }
         const newMember = yield prisma.workspaceMember.create({
             data: {
@@ -128,7 +129,8 @@ function createInviteUserToWorkspace(prisma, identityConfig, sendInvite) {
             recipient: email,
             oneTimePassword,
             workspaceName: newMember.workspace.name,
-            isExistingUser,
+            // Without a one-time password the "existing user" email (a link) fits.
+            isExistingUser: isExistingUser || !oneTimePassword,
             inviteUrl: `${identityConfig.workspaceInviteUrl}?token=${inviteeToken}`
         });
         callback(null, {

package/dist/workspaces/createResendWorkspaceMembershipInvitation.js

@@ -32,8 +32,11 @@ const common_1 = require("@fonoster/common");
 const logger_1 = require("@fonoster/logger");
 const grpc_js_1 = require("@grpc/grpc-js");
 const utils_1 = require("../utils");
+const authMethods_1 = require("../utils/authMethods");
 const createGenerateWorkspaceInviteToken_1 = require("../utils/createGenerateWorkspaceInviteToken");
+const generateOneTimePassword_1 = require("../utils/generateOneTimePassword");
 const getUserRefFromToken_1 = require("../utils/getUserRefFromToken");
+const userPasswords_1 = require("../utils/userPasswords");
 const createIsAdminMember_1 = require("./createIsAdminMember");
 const logger = (0, logger_1.getLogger)({ service: "identity", filePath: __filename });
 function createResendWorkspaceMembershipInvitation(prisma, identityConfig, sendInvite) {
@@ -83,11 +86,23 @@ function createResendWorkspaceMembershipInvitation(prisma, identityConfig, sendI
             accessKeyId: member.user.accessKeyId,
             expiresIn: identityConfig.workspaceInviteExpiration
         });
+        // Stored passwords can't be read back (they are digests). An invitee who
+        // never replaced their one-time password gets a new one.
+        const oneTimePassword = member.user.mustChangePassword &&
+            (0, authMethods_1.isMethodEnabled)(identityConfig, "password")
+            ? (0, generateOneTimePassword_1.generateOneTimePassword)()
+            : undefined;
+        if (oneTimePassword) {
+            yield prisma.user.update({
+                where: { ref: member.user.ref },
+                data: yield (0, userPasswords_1.passwordColumns)(oneTimePassword)
+            });
+        }
         yield sendInvite((0, utils_1.createSendEmail)(identityConfig), {
             recipient: member.user.email,
-            oneTimePassword: member.user.password,
+            oneTimePassword,
             workspaceName: member.workspace.name,
-            isExistingUser: true,
+            isExistingUser: !oneTimePassword,
             inviteUrl: `${identityConfig.workspaceInviteUrl}?token=${inviteeToken}`
         });
         callback(null, {

package/dist/workspaces/createUpdateWorkspace.js

@@ -32,7 +32,7 @@ const common_1 = require("@fonoster/common");
 const logger_1 = require("@fonoster/logger");
 const grpc_js_1 = require("@grpc/grpc-js");
 const getUserRefFromToken_1 = require("../utils/getUserRefFromToken");
-const createIsWorkspaceMember_1 = require("./createIsWorkspaceMember");
+const createIsAdminMember_1 = require("./createIsAdminMember");
 const logger = (0, logger_1.getLogger)({ service: "identity", filePath: __filename });
 function createUpdateWorkspace(prisma) {
     const updateWorkspace = (call, callback) => __awaiter(this, void 0, void 0, function* () {
@@ -40,13 +40,27 @@ function createUpdateWorkspace(prisma) {
         const userRef = (0, getUserRefFromToken_1.getUserRefFromToken)(token);
         const { request } = call;
         const { ref, name } = request;
+        const region = request.region;
         logger.verbose("call to updateWorkspace", { ref, userRef });
-        const isMember = yield (0, createIsWorkspaceMember_1.createIsWorkspaceMember)(prisma)(ref, userRef);
-        if (!isMember) {
+        // The owner and admins rename a workspace; members only use it.
+        const isAdmin = yield (0, createIsAdminMember_1.createIsAdminMember)(prisma)(ref, userRef);
+        if (!isAdmin) {
             callback({
                 code: grpc_js_1.status.PERMISSION_DENIED,
-                message: "User is not a member of the workspace"
+                message: "Only the workspace owner or an admin can update it"
             });
+            return;
+        }
+        // The region is fixed at creation (add-private-regions PR-1).
+        if (region) {
+            const current = yield prisma.workspace.findUnique({ where: { ref } });
+            if (current && current.region !== region) {
+                callback({
+                    code: grpc_js_1.status.FAILED_PRECONDITION,
+                    message: "region_immutable: a workspace's region cannot change"
+                });
+                return;
+            }
         }
         yield prisma.workspace.update({
             where: {

package/dist/workspaces/createWorkspaceDirectory.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { Prisma } from "../db";
+import { RegionWorkspace } from "../exchanges/types";
+/**
+ * Read access to workspaces for the control plane's regions code (add-private-regions PR-14):
+ * which workspaces a region serves and who owns a workspace. Identity has its own database.
+ */
+declare function createWorkspaceDirectory(prisma: Prisma): {
+    workspace(accessKeyId: string): Promise<RegionWorkspace>;
+    inRegion(region: string): Promise<RegionWorkspace[]>;
+};
+export { createWorkspaceDirectory };

package/dist/workspaces/createWorkspaceDirectory.js

@@ -0,0 +1,42 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createWorkspaceDirectory = createWorkspaceDirectory;
+const pick = (w) => ({
+    ref: w.ref,
+    accessKeyId: w.accessKeyId,
+    name: w.name,
+    ownerRef: w.ownerRef,
+    region: w.region
+});
+/**
+ * Read access to workspaces for the control plane's regions code (add-private-regions PR-14):
+ * which workspaces a region serves and who owns a workspace. Identity has its own database.
+ */
+function createWorkspaceDirectory(prisma) {
+    return {
+        workspace(accessKeyId) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const w = yield prisma.workspace.findUnique({ where: { accessKeyId } });
+                return w ? pick(w) : undefined;
+            });
+        },
+        inRegion(region) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const rows = yield prisma.workspace.findMany({
+                    where: { region },
+                    orderBy: { createdAt: "asc" }
+                });
+                return rows.map(pick);
+            });
+        }
+    };
+}

package/dist/workspaces/index.d.ts

@@ -25,3 +25,4 @@ export * from "./createListWorkspaceMembers";
 export * from "./createRemoveUserFromWorkspace";
 export * from "./createResendWorkspaceMembershipInvitation";
 export * from "./createUpdateWorkspace";
+export * from "./createWorkspaceDirectory";

package/dist/workspaces/index.js

@@ -41,3 +41,4 @@ __exportStar(require("./createListWorkspaceMembers"), exports);
 __exportStar(require("./createRemoveUserFromWorkspace"), exports);
 __exportStar(require("./createResendWorkspaceMembershipInvitation"), exports);
 __exportStar(require("./createUpdateWorkspace"), exports);
+__exportStar(require("./createWorkspaceDirectory"), exports);