@hilbras/keystone 1.1.0

package/dist/lib/errors.js

@@ -0,0 +1,78 @@
+import { config } from "../config.js";
+function isDevelopment() {
+    return config.NODE_ENV === "development";
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : undefined;
+}
+/**
+ * Map an internal error to a stable public OAuth-style code and HTTP status.
+ *
+ * The mapping is intentionally conservative: anything that could reveal
+ * implementation details or provider-specific behaviour collapses into a
+ * small set of opaque codes. Detailed diagnostics are written to server logs
+ * by the caller before this helper is invoked.
+ */
+export function classifyOAuthError(error) {
+    const message = errorMessage(error)?.toLowerCase() ?? "";
+    if (message.includes("state") || message.includes("denied") || message.includes("cancel")) {
+        return { code: "access_denied", statusCode: 400 };
+    }
+    if (message.includes("client") &&
+        (message.includes("unknown") || message.includes("invalid") || message.includes("not found"))) {
+        return { code: "invalid_client", statusCode: 400 };
+    }
+    if (message.includes("token exchange failed") ||
+        message.includes("pkce") ||
+        message.includes("authorization code") ||
+        message.includes("invalid grant") ||
+        message.includes("code verifier")) {
+        return { code: "invalid_grant", statusCode: 400 };
+    }
+    if (message.includes("not configured") || message.includes("missing required")) {
+        return { code: "server_error", statusCode: 500 };
+    }
+    if (message.includes("connector") ||
+        message.includes("federation") ||
+        message.includes("oidc") ||
+        message.includes("provider") ||
+        message.includes("userinfo") ||
+        message.includes("broker") ||
+        message.includes("idp")) {
+        return { code: "identity_broker_failure", statusCode: 502 };
+    }
+    return { code: "server_error", statusCode: 500 };
+}
+/**
+ * Build a redirect URL that carries only a sanitized error code (and, in
+ * development, an optional description). Any existing query parameters on
+ * `redirectUrl` are preserved.
+ */
+export function buildOAuthErrorRedirect(error, redirectUrl, options) {
+    const { code } = classifyOAuthError(error);
+    const url = new URL(redirectUrl);
+    url.searchParams.set("error", code);
+    const includeDescription = options?.includeDescription ?? isDevelopment();
+    const description = errorMessage(error);
+    if (includeDescription && description) {
+        url.searchParams.set("error_description", description);
+    }
+    if (options?.state) {
+        url.searchParams.set("state", options.state);
+    }
+    return url.toString();
+}
+/**
+ * Build a sanitized JSON error response for endpoints that do not redirect.
+ */
+export function buildOAuthErrorResponse(error, options) {
+    const { code, statusCode } = classifyOAuthError(error);
+    const body = { error: code };
+    const includeDescription = options?.includeDescription ?? isDevelopment();
+    const description = errorMessage(error);
+    if (includeDescription && description) {
+        body.error_description = description;
+    }
+    return { statusCode, body };
+}
+//# sourceMappingURL=errors.js.map

package/dist/lib/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/lib/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAuBtC,SAAS,aAAa;IACpB,OAAO,MAAM,CAAC,QAAQ,KAAK,aAAa,CAAC;AAC3C,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAEzD,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1F,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IACpD,CAAC;IAED,IACE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC1B,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,EAC7F,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IACrD,CAAC;IAED,IACE,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC;QACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;QACxB,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QACtC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;QACjC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,EACjC,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IACpD,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC/E,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IACnD,CAAC;IAED,IACE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC7B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;QACxB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC5B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC5B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC1B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EACvB,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,yBAAyB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IAC9D,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;AACnD,CAAC;AASD;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,KAAc,EACd,WAAmB,EACnB,OAA8B;IAE9B,MAAM,EAAE,IAAI,EAAE,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACjC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAEpC,MAAM,kBAAkB,GAAG,OAAO,EAAE,kBAAkB,IAAI,aAAa,EAAE,CAAC;IAC1E,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,kBAAkB,IAAI,WAAW,EAAE,CAAC;QACtC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,OAAO,EAAE,KAAK,EAAE,CAAC;QACnB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC;IAED,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAOD;;GAEG;AACH,MAAM,UAAU,uBAAuB,CACrC,KAAc,EACd,OAA8B;IAE9B,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACvD,MAAM,IAAI,GAA+B,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAEzD,MAAM,kBAAkB,GAAG,OAAO,EAAE,kBAAkB,IAAI,aAAa,EAAE,CAAC;IAC1E,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,kBAAkB,IAAI,WAAW,EAAE,CAAC;QACtC,IAAI,CAAC,iBAAiB,GAAG,WAAW,CAAC;IACvC,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AAC9B,CAAC"}

package/dist/lib/result.d.ts

@@ -0,0 +1,21 @@
+export interface KeystoneError {
+    code: string;
+    message: string;
+    statusCode?: number;
+    details?: Record<string, unknown>;
+}
+export type Result<T> = {
+    success: true;
+    data: T;
+    error?: undefined;
+} | {
+    success: false;
+    data?: undefined;
+    error: KeystoneError;
+};
+export declare function ok<T>(data: T): Result<T>;
+export declare function err<T>(error: KeystoneError): Result<T>;
+export declare function errFromMessage<T>(code: string, message: string, statusCode?: number, details?: Record<string, unknown>): Result<T>;
+export declare function mapResult<T, U>(result: Result<T>, fn: (data: T) => U): Result<U>;
+export declare function flatMapResult<T, U>(result: Result<T>, fn: (data: T) => Promise<Result<U>>): Promise<Result<U>>;
+//# sourceMappingURL=result.d.ts.map

package/dist/lib/result.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"result.d.ts","sourceRoot":"","sources":["../../src/lib/result.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,MAAM,MAAM,CAAC,CAAC,IAChB;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,CAAC,CAAC;IAAC,KAAK,CAAC,EAAE,SAAS,CAAA;CAAE,GAC7C;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,IAAI,CAAC,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,aAAa,CAAA;CAAE,CAAC;AAE/D,wBAAgB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAExC;AAED,wBAAgB,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC,CAEtD;AAED,wBAAgB,cAAc,CAAC,CAAC,EAC9B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,MAAM,CAAC,CAAC,CAAC,CAEX;AAED,wBAAgB,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAKhF;AAED,wBAAsB,aAAa,CAAC,CAAC,EAAE,CAAC,EACtC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EACjB,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAClC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAKpB"}

package/dist/lib/result.js

@@ -0,0 +1,22 @@
+export function ok(data) {
+    return { success: true, data };
+}
+export function err(error) {
+    return { success: false, error };
+}
+export function errFromMessage(code, message, statusCode, details) {
+    return err({ code, message, statusCode, details });
+}
+export function mapResult(result, fn) {
+    if (result.success) {
+        return ok(fn(result.data));
+    }
+    return err(result.error);
+}
+export async function flatMapResult(result, fn) {
+    if (result.success) {
+        return fn(result.data);
+    }
+    return err(result.error);
+}
+//# sourceMappingURL=result.js.map

package/dist/lib/result.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"result.js","sourceRoot":"","sources":["../../src/lib/result.ts"],"names":[],"mappings":"AAWA,MAAM,UAAU,EAAE,CAAI,IAAO;IAC3B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,GAAG,CAAI,KAAoB;IACzC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,OAAe,EACf,UAAmB,EACnB,OAAiC;IAEjC,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,SAAS,CAAO,MAAiB,EAAE,EAAkB;IACnE,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAiB,EACjB,EAAmC;IAEnC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC"}

package/dist/lib/webhookSignature.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Sign a webhook payload using HMAC-SHA256.
+ * Returns a signature string in the format "t=<timestamp>,v1=<hex>".
+ */
+export declare function signWebhookPayload(secret: string, payload: unknown): string;
+/**
+ * Verify a webhook signature.
+ * Returns true if the signature matches the payload and timestamp is within tolerance.
+ */
+export declare function verifyWebhookPayload(secret: string, signatureHeader: string, payload: unknown, toleranceSeconds?: number): boolean;
+//# sourceMappingURL=webhookSignature.d.ts.map

package/dist/lib/webhookSignature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhookSignature.d.ts","sourceRoot":"","sources":["../../src/lib/webhookSignature.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAM3E;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,EACvB,OAAO,EAAE,OAAO,EAChB,gBAAgB,SAAM,GACrB,OAAO,CAiBT"}

package/dist/lib/webhookSignature.js

@@ -0,0 +1,35 @@
+import crypto from "node:crypto";
+/**
+ * Sign a webhook payload using HMAC-SHA256.
+ * Returns a signature string in the format "t=<timestamp>,v1=<hex>".
+ */
+export function signWebhookPayload(secret, payload) {
+    const timestamp = Math.floor(Date.now() / 1000);
+    const body = JSON.stringify(payload);
+    const signedPayload = `${timestamp}.${body}`;
+    const signature = crypto.createHmac("sha256", secret).update(signedPayload).digest("hex");
+    return `t=${timestamp},v1=${signature}`;
+}
+/**
+ * Verify a webhook signature.
+ * Returns true if the signature matches the payload and timestamp is within tolerance.
+ */
+export function verifyWebhookPayload(secret, signatureHeader, payload, toleranceSeconds = 300) {
+    const parts = signatureHeader.split(",").reduce((acc, part) => {
+        const [key, value] = part.split("=");
+        if (key && value)
+            acc[key.trim()] = value.trim();
+        return acc;
+    }, {});
+    const timestamp = Number(parts.t);
+    const signature = parts.v1;
+    if (!timestamp || !signature)
+        return false;
+    const now = Math.floor(Date.now() / 1000);
+    if (Math.abs(now - timestamp) > toleranceSeconds)
+        return false;
+    const body = JSON.stringify(payload);
+    const expected = crypto.createHmac("sha256", secret).update(`${timestamp}.${body}`).digest("hex");
+    return crypto.timingSafeEqual(Buffer.from(signature, "hex"), Buffer.from(expected, "hex"));
+}
+//# sourceMappingURL=webhookSignature.js.map

package/dist/lib/webhookSignature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhookSignature.js","sourceRoot":"","sources":["../../src/lib/webhookSignature.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,OAAgB;IACjE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,aAAa,GAAG,GAAG,SAAS,IAAI,IAAI,EAAE,CAAC;IAC7C,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1F,OAAO,KAAK,SAAS,OAAO,SAAS,EAAE,CAAC;AAC1C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAc,EACd,eAAuB,EACvB,OAAgB,EAChB,gBAAgB,GAAG,GAAG;IAEtB,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAyB,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;QACpF,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,GAAG,IAAI,KAAK;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QACjD,OAAO,GAAG,CAAC;IACb,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,KAAK,CAAC,EAAE,CAAC;IAC3B,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAE3C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,SAAS,CAAC,GAAG,gBAAgB;QAAE,OAAO,KAAK,CAAC;IAE/D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,SAAS,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClG,OAAO,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;AAC7F,CAAC"}

package/dist/plugins/appContext.d.ts

@@ -0,0 +1,4 @@
+import type { FastifyInstance } from "fastify";
+declare const _default: (app: FastifyInstance) => Promise<void>;
+export default _default;
+//# sourceMappingURL=appContext.d.ts.map

package/dist/plugins/appContext.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"appContext.d.ts","sourceRoot":"","sources":["../../src/plugins/appContext.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAkB,MAAM,SAAS,CAAC;8BAKR,eAAe;AAAtE,wBAmCG"}

package/dist/plugins/appContext.js

@@ -0,0 +1,63 @@
+import fp from "fastify-plugin";
+import { eq, and, arrayContains } from "drizzle-orm";
+import { db } from "../db/index.js";
+import { applications, organizations, orgMemberships } from "../db/schema.js";
+export default fp(async function appContextPlugin(app) {
+    app.addHook("onRequest", async (request) => {
+        // Ensure every request has a fresh state object.
+        request.state = {};
+        const clientId = extractClientId(request);
+        const origin = request.headers.origin;
+        const appRecord = clientId
+            ? await findApplicationByClientId(clientId)
+            : origin
+                ? await findApplicationByOrigin(origin)
+                : undefined;
+        if (!appRecord)
+            return;
+        request.state.app = appRecord;
+        request.state.org = appRecord.organization;
+        if (request.user) {
+            const [membership] = await db
+                .select()
+                .from(orgMemberships)
+                .where(and(eq(orgMemberships.orgId, appRecord.organization.id), eq(orgMemberships.userId, request.user.id)))
+                .limit(1);
+            if (membership) {
+                request.state.membership = membership;
+            }
+        }
+    });
+});
+function extractClientId(request) {
+    const header = request.headers["x-app-client-id"];
+    if (typeof header === "string" && header)
+        return header;
+    const query = request.query.client_id;
+    if (query)
+        return query;
+    return undefined;
+}
+async function findApplicationByClientId(clientId) {
+    const [row] = await db
+        .select()
+        .from(applications)
+        .where(and(eq(applications.clientId, clientId), eq(applications.isActive, true)))
+        .innerJoin(organizations, eq(applications.orgId, organizations.id))
+        .limit(1);
+    if (!row)
+        return undefined;
+    return { ...row.applications, organization: row.organizations };
+}
+async function findApplicationByOrigin(origin) {
+    const [row] = await db
+        .select()
+        .from(applications)
+        .where(and(arrayContains(applications.allowedOrigins, [origin]), eq(applications.isActive, true)))
+        .innerJoin(organizations, eq(applications.orgId, organizations.id))
+        .limit(1);
+    if (!row)
+        return undefined;
+    return { ...row.applications, organization: row.organizations };
+}
+//# sourceMappingURL=appContext.js.map

package/dist/plugins/appContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"appContext.js","sourceRoot":"","sources":["../../src/plugins/appContext.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAEhC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAE9E,eAAe,EAAE,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAoB;IACpE,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAuB,EAAE,EAAE;QACzD,iDAAiD;QACjD,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC;QAEnB,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;QAEtC,MAAM,SAAS,GAAG,QAAQ;YACxB,CAAC,CAAC,MAAM,yBAAyB,CAAC,QAAQ,CAAC;YAC3C,CAAC,CAAC,MAAM;gBACN,CAAC,CAAC,MAAM,uBAAuB,CAAC,MAAM,CAAC;gBACvC,CAAC,CAAC,SAAS,CAAC;QAEhB,IAAI,CAAC,SAAS;YAAE,OAAO;QAEvB,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,SAAS,CAAC;QAC9B,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,SAAS,CAAC,YAAY,CAAC;QAE3C,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;iBAC1B,MAAM,EAAE;iBACR,IAAI,CAAC,cAAc,CAAC;iBACpB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,SAAS,CAAC,YAAY,CAAC,EAAE,CAAC,EACnD,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAC3C,CACF;iBACA,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;YACxC,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,SAAS,eAAe,CAAC,OAAuB;IAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAClD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAExD,MAAM,KAAK,GAAI,OAAO,CAAC,KAA4C,CAAC,SAAS,CAAC;IAC9E,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IAExB,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,QAAgB;IACvD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,YAAY,CAAC;SAClB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;SAChF,SAAS,CAAC,aAAa,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC;SAClE,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,OAAO,EAAE,GAAG,GAAG,CAAC,YAAY,EAAE,YAAY,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC;AAClE,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,MAAc;IACnD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,YAAY,CAAC;SAClB,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,YAAY,CAAC,cAAc,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;SACjG,SAAS,CAAC,aAAa,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC;SAClE,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,OAAO,EAAE,GAAG,GAAG,CAAC,YAAY,EAAE,YAAY,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC;AAClE,CAAC"}

package/dist/plugins/audit.d.ts

@@ -0,0 +1,11 @@
+import type { FastifyInstance } from "fastify";
+import { type AuditEvent } from "../services/audit.js";
+declare module "fastify" {
+    interface FastifyRequest {
+        audit: (event: AuditEvent, metadata?: Record<string, unknown>) => Promise<void>;
+        emitEvent: (event: string, metadata?: Record<string, unknown>) => Promise<void>;
+    }
+}
+declare const _default: (app: FastifyInstance) => Promise<void>;
+export default _default;
+//# sourceMappingURL=audit.d.ts.map

package/dist/plugins/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/plugins/audit.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAkB,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAS,KAAK,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAI9D,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,cAAc;QACtB,KAAK,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QAChF,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;KACjF;CACF;8BAciD,eAAe;AAAjE,wBAgBG"}

package/dist/plugins/audit.js

@@ -0,0 +1,23 @@
+import fp from "fastify-plugin";
+import { audit } from "../services/audit.js";
+import { emit } from "../services/events/bus.js";
+function buildPayload(request, metadata) {
+    return {
+        userId: request.user?.id,
+        orgId: request.state?.org?.id,
+        appId: request.state?.app?.id,
+        requestId: request.id,
+        ip: request.ip,
+        userAgent: request.headers["user-agent"],
+        metadata,
+    };
+}
+export default fp(async function auditPlugin(app) {
+    app.decorateRequest("audit", async function (event, metadata) {
+        await audit({ ...buildPayload(this, metadata), event });
+    });
+    app.decorateRequest("emitEvent", async function (event, metadata) {
+        await emit({ type: event, payload: buildPayload(this, metadata) });
+    });
+});
+//# sourceMappingURL=audit.js.map

package/dist/plugins/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/plugins/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAEhC,OAAO,EAAE,KAAK,EAAmB,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,2BAA2B,CAAC;AAUjD,SAAS,YAAY,CAAC,OAAuB,EAAE,QAAkC;IAC/E,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE;QACxB,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QAC7B,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QAC7B,SAAS,EAAE,OAAO,CAAC,EAAE;QACrB,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;QACxC,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,eAAe,EAAE,CAAC,KAAK,UAAU,WAAW,CAAC,GAAoB;IAC/D,GAAG,CAAC,eAAe,CAAC,OAAO,EAAE,KAAK,WAEhC,KAAiB,EACjB,QAAkC;QAElC,MAAM,KAAK,CAAC,EAAE,GAAG,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,eAAe,CAAC,WAAW,EAAE,KAAK,WAEpC,KAAa,EACb,QAAkC;QAElC,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/plugins/auth.d.ts

@@ -0,0 +1,21 @@
+import type { FastifyInstance, FastifyReply, FastifyRequest } from "fastify";
+import { serviceAccounts } from "../db/schema.js";
+declare module "fastify" {
+    interface FastifyInstance {
+        authenticate: (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
+        authenticateOrApiKey: (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
+        requireScopes: (...scopes: string[]) => (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
+    }
+    interface FastifyRequest {
+        serviceAccount?: typeof serviceAccounts.$inferSelect;
+        apiKeyScopes?: string[];
+    }
+}
+export declare function accessCookieName(clientId?: string): string;
+export declare function refreshCookieName(clientId?: string): string;
+export declare function setSessionCookies(reply: FastifyReply, accessToken: string, refreshToken: string, clientId?: string): void;
+export declare function clearSessionCookies(reply: FastifyReply, clientId?: string): void;
+export declare function getRefreshToken(request: FastifyRequest, clientId?: string): string | undefined;
+declare const _default: (app: FastifyInstance) => Promise<void>;
+export default _default;
+//# sourceMappingURL=auth.d.ts.map

package/dist/plugins/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/plugins/auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAI7E,OAAO,EAAkB,eAAe,EAAa,MAAM,iBAAiB,CAAC;AAI7E,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,eAAe;QACvB,YAAY,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9E,oBAAoB,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QACtF,aAAa,EAAE,CAAC,GAAG,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;KACzG;IAED,UAAU,cAAc;QACtB,cAAc,CAAC,EAAE,OAAO,eAAe,CAAC,YAAY,CAAC;QACrD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;KACzB;CACF;AAKD,wBAAgB,gBAAgB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAE3D;AAmBD,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,YAAY,EACnB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,GAChB,IAAI,CAWN;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAIhF;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,cAAc,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE9F;8BA+CgD,eAAe;AAAhE,wBAqFG"}

package/dist/plugins/auth.js

@@ -0,0 +1,190 @@
+import fp from "fastify-plugin";
+import { eq, and, isNull } from "drizzle-orm";
+import { config } from "../config.js";
+import { db } from "../db/index.js";
+import { apiKeys, users, serviceAccounts } from "../db/schema.js";
+import { verifyAccessToken, hashApiKey } from "../services/tokens.js";
+const DEFAULT_ACCESS_COOKIE = config.COOKIE_NAME;
+const DEFAULT_REFRESH_COOKIE = `${config.COOKIE_NAME}-refresh`;
+export function accessCookieName(clientId) {
+    return clientId ? `app-${clientId}-session` : DEFAULT_ACCESS_COOKIE;
+}
+export function refreshCookieName(clientId) {
+    return clientId ? `app-${clientId}-session-refresh` : DEFAULT_REFRESH_COOKIE;
+}
+function cookieOptions() {
+    const sameSite = config.COOKIE_SAME_SITE || (config.NODE_ENV === "production" ? "strict" : "lax");
+    return {
+        path: "/",
+        httpOnly: true,
+        secure: config.COOKIE_SECURE,
+        sameSite,
+        domain: config.COOKIE_DOMAIN || undefined,
+    };
+}
+export function setSessionCookies(reply, accessToken, refreshToken, clientId) {
+    const opts = cookieOptions();
+    reply.setCookie(accessCookieName(clientId), accessToken, {
+        ...opts,
+        maxAge: config.ACCESS_TOKEN_TTL_SECONDS,
+    });
+    reply.setCookie(refreshCookieName(clientId), refreshToken, {
+        ...opts,
+        maxAge: config.REFRESH_TOKEN_TTL_SECONDS,
+    });
+}
+export function clearSessionCookies(reply, clientId) {
+    const opts = cookieOptions();
+    reply.clearCookie(accessCookieName(clientId), opts);
+    reply.clearCookie(refreshCookieName(clientId), opts);
+}
+export function getRefreshToken(request, clientId) {
+    return request.cookies[refreshCookieName(clientId)];
+}
+async function resolveUserFromClaims(claims) {
+    const [user] = await db.select().from(users).where(eq(users.id, claims.sub)).limit(1);
+    return user;
+}
+async function resolveApiKeyRecord(key) {
+    const hash = hashApiKey(key);
+    const [keyRecord] = await db
+        .select()
+        .from(apiKeys)
+        .where(and(eq(apiKeys.keyHash, hash), isNull(apiKeys.revokedAt)))
+        .limit(1);
+    return keyRecord;
+}
+async function resolveUserFromApiKey(key) {
+    const keyRecord = await resolveApiKeyRecord(key);
+    if (!keyRecord)
+        return undefined;
+    if (keyRecord.expiresAt && keyRecord.expiresAt < new Date())
+        return undefined;
+    await db.update(apiKeys).set({ lastUsedAt: new Date() }).where(eq(apiKeys.id, keyRecord.id));
+    if (keyRecord.userId) {
+        const [user] = await db.select().from(users).where(eq(users.id, keyRecord.userId)).limit(1);
+        if (!user)
+            return undefined;
+        return { user, scopes: keyRecord.scopes ?? [] };
+    }
+    return undefined;
+}
+function extractAccessToken(request) {
+    // Prefer the app-specific cookie if an app context is present.
+    const appClientId = request.state?.app?.clientId;
+    const appCookie = appClientId ? request.cookies[accessCookieName(appClientId)] : undefined;
+    if (appCookie)
+        return appCookie;
+    const defaultCookie = request.cookies[DEFAULT_ACCESS_COOKIE];
+    if (defaultCookie)
+        return defaultCookie;
+    const header = request.headers.authorization;
+    if (header?.startsWith("Bearer "))
+        return header.slice(7);
+    return undefined;
+}
+export default fp(async function authPlugin(app) {
+    app.decorate("authenticate", async function authenticate(request, reply) {
+        const token = extractAccessToken(request);
+        if (!token) {
+            return reply.status(401).send({ error: "Unauthorized" });
+        }
+        try {
+            const claims = await verifyAccessToken(token);
+            const user = await resolveUserFromClaims(claims);
+            if (!user) {
+                return reply.status(401).send({ error: "User not found" });
+            }
+            request.user = user;
+        }
+        catch {
+            return reply.status(401).send({ error: "Invalid token" });
+        }
+    });
+    app.decorate("authenticateOrApiKey", async function authenticateOrApiKey(request, reply) {
+        const token = extractAccessToken(request);
+        if (!token) {
+            return reply.status(401).send({ error: "Unauthorized" });
+        }
+        try {
+            const claims = await verifyAccessToken(token);
+            const user = await resolveUserFromClaims(claims);
+            if (!user) {
+                return reply.status(401).send({ error: "User not found" });
+            }
+            request.user = user;
+            return;
+        }
+        catch {
+            // Not a valid access token — try API key.
+        }
+        const apiKeyUser = await resolveUserFromApiKey(token);
+        if (apiKeyUser) {
+            request.user = apiKeyUser.user;
+            request.apiKeyScopes = apiKeyUser.scopes;
+            return;
+        }
+        const serviceAccount = await resolveServiceAccountFromApiKey(token);
+        if (serviceAccount) {
+            request.serviceAccount = serviceAccount;
+            request.apiKeyScopes = ["api:read", "api:write", "service_account"];
+            // Synthesize a user so existing routes that expect request.user keep working.
+            request.user = {
+                id: `sa:${serviceAccount.id}`,
+                email: `service-account@${serviceAccount.id}.internal`,
+                username: `sa-${serviceAccount.id.slice(0, 8)}`,
+                name: serviceAccount.name,
+                avatarUrl: null,
+                emailVerified: true,
+                plan: "enterprise",
+                role: "service_account",
+                provider: "api_key",
+                zitadelUserId: null,
+                defaultOrgId: serviceAccount.orgId,
+                phoneNumber: null,
+                phoneVerified: false,
+                totpSecret: null,
+                totpEnabled: false,
+                totpVerifiedAt: null,
+                createdAt: serviceAccount.createdAt,
+                updatedAt: serviceAccount.updatedAt,
+            };
+            return;
+        }
+        return reply.status(401).send({ error: "Invalid token or API key" });
+    });
+    app.decorate("requireScopes", function requireScopes(...required) {
+        return async function scopeCheck(request, reply) {
+            // Session-based authentication has full scope access.
+            if (!request.apiKeyScopes)
+                return;
+            const scopes = request.apiKeyScopes;
+            const hasAll = required.every((scope) => scopes.includes(scope) || scopes.includes("service_account"));
+            if (!hasAll) {
+                return reply.status(403).send({ error: "Insufficient API key scope", required });
+            }
+        };
+    });
+});
+async function resolveServiceAccountFromApiKey(key) {
+    const hash = hashApiKey(key);
+    const [keyRecord] = await db
+        .select()
+        .from(apiKeys)
+        .where(and(eq(apiKeys.keyHash, hash), isNull(apiKeys.revokedAt)))
+        .limit(1);
+    if (!keyRecord)
+        return undefined;
+    if (keyRecord.expiresAt && keyRecord.expiresAt < new Date())
+        return undefined;
+    if (!keyRecord.serviceAccountId)
+        return undefined;
+    await db.update(apiKeys).set({ lastUsedAt: new Date() }).where(eq(apiKeys.id, keyRecord.id));
+    const [account] = await db
+        .select()
+        .from(serviceAccounts)
+        .where(and(eq(serviceAccounts.id, keyRecord.serviceAccountId), eq(serviceAccounts.isActive, true)))
+        .limit(1);
+    return account;
+}
+//# sourceMappingURL=auth.js.map

package/dist/plugins/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/plugins/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAEhC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAM,MAAM,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAa,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAgBtE,MAAM,qBAAqB,GAAG,MAAM,CAAC,WAAW,CAAC;AACjD,MAAM,sBAAsB,GAAG,GAAG,MAAM,CAAC,WAAW,UAAU,CAAC;AAE/D,MAAM,UAAU,gBAAgB,CAAC,QAAiB;IAChD,OAAO,QAAQ,CAAC,CAAC,CAAC,OAAO,QAAQ,UAAU,CAAC,CAAC,CAAC,qBAAqB,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAiB;IACjD,OAAO,QAAQ,CAAC,CAAC,CAAC,OAAO,QAAQ,kBAAkB,CAAC,CAAC,CAAC,sBAAsB,CAAC;AAC/E,CAAC;AAED,SAAS,aAAa;IAOpB,MAAM,QAAQ,GAAI,MAAM,CAAC,gBAA8C,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACjI,OAAO;QACL,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,MAAM,CAAC,aAAa;QAC5B,QAAQ;QACR,MAAM,EAAE,MAAM,CAAC,aAAa,IAAI,SAAS;KAC1C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,KAAmB,EACnB,WAAmB,EACnB,YAAoB,EACpB,QAAiB;IAEjB,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAE7B,KAAK,CAAC,SAAS,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE;QACvD,GAAG,IAAI;QACP,MAAM,EAAE,MAAM,CAAC,wBAAwB;KACxC,CAAC,CAAC;IACH,KAAK,CAAC,SAAS,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,YAAY,EAAE;QACzD,GAAG,IAAI;QACP,MAAM,EAAE,MAAM,CAAC,yBAAyB;KACzC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAmB,EAAE,QAAiB;IACxE,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,KAAK,CAAC,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;IACpD,KAAK,CAAC,WAAW,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAuB,EAAE,QAAiB;IACxE,OAAO,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,MAAmB;IACtD,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACtF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,GAAW;IAC5C,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE;SACzB,MAAM,EAAE;SACR,IAAI,CAAC,OAAO,CAAC;SACb,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;SAChE,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,GAAW;IAC9C,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACjD,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACjC,IAAI,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE;QAAE,OAAO,SAAS,CAAC;IAE9E,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;IAE7F,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5F,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;IAClD,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAuB;IACjD,+DAA+D;IAC/D,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC;IACjD,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3F,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAEhC,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC7D,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAExC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;IAC7C,IAAI,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,eAAe,EAAE,CAAC,KAAK,UAAU,UAAU,CAAC,GAAoB;IAC9D,GAAG,CAAC,QAAQ,CAAC,cAAc,EAAE,KAAK,UAAU,YAAY,CAAC,OAAO,EAAE,KAAK;QACrE,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC9C,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAC;YACjD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,QAAQ,CAAC,sBAAsB,EAAE,KAAK,UAAU,oBAAoB,CAAC,OAAO,EAAE,KAAK;QACrF,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC9C,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAC;YACjD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;YACpB,OAAO;QACT,CAAC;QAAC,MAAM,CAAC;YACP,0CAA0C;QAC5C,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACtD,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;YAC/B,OAAO,CAAC,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC;YACzC,OAAO;QACT,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,+BAA+B,CAAC,KAAK,CAAC,CAAC;QACpE,IAAI,cAAc,EAAE,CAAC;YACnB,OAAO,CAAC,cAAc,GAAG,cAAc,CAAC;YACxC,OAAO,CAAC,YAAY,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC;YACpE,8EAA8E;YAC9E,OAAO,CAAC,IAAI,GAAG;gBACb,EAAE,EAAE,MAAM,cAAc,CAAC,EAAE,EAAE;gBAC7B,KAAK,EAAE,mBAAmB,cAAc,CAAC,EAAE,WAAW;gBACtD,QAAQ,EAAE,MAAM,cAAc,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;gBAC/C,IAAI,EAAE,cAAc,CAAC,IAAI;gBACzB,SAAS,EAAE,IAAI;gBACf,aAAa,EAAE,IAAI;gBACnB,IAAI,EAAE,YAAY;gBAClB,IAAI,EAAE,iBAAiB;gBACvB,QAAQ,EAAE,SAAS;gBACnB,aAAa,EAAE,IAAI;gBACnB,YAAY,EAAE,cAAc,CAAC,KAAK;gBAClC,WAAW,EAAE,IAAI;gBACjB,aAAa,EAAE,KAAK;gBACpB,UAAU,EAAE,IAAI;gBAChB,WAAW,EAAE,KAAK;gBAClB,cAAc,EAAE,IAAI;gBACpB,SAAS,EAAE,cAAc,CAAC,SAAS;gBACnC,SAAS,EAAE,cAAc,CAAC,SAAS;aAC5B,CAAC;YACV,OAAO;QACT,CAAC;QAED,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,QAAQ,CAAC,eAAe,EAAE,SAAS,aAAa,CAAC,GAAG,QAAkB;QACxE,OAAO,KAAK,UAAU,UAAU,CAAC,OAAuB,EAAE,KAAmB;YAC3E,sDAAsD;YACtD,IAAI,CAAC,OAAO,CAAC,YAAY;gBAAE,OAAO;YAClC,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;YACpC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC;YACvG,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,QAAQ,EAAE,CAAC,CAAC;YACnF,CAAC;QACH,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,+BAA+B,CAAC,GAAW;IACxD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE;SACzB,MAAM,EAAE;SACR,IAAI,CAAC,OAAO,CAAC;SACb,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;SAChE,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACjC,IAAI,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE;QAAE,OAAO,SAAS,CAAC;IAC9E,IAAI,CAAC,SAAS,CAAC,gBAAgB;QAAE,OAAO,SAAS,CAAC;IAElD,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7F,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,EAAE;SACR,IAAI,CAAC,eAAe,CAAC;SACrB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,SAAS,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;SAClG,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/plugins/metrics.d.ts

@@ -0,0 +1,8 @@
+import type { FastifyInstance } from "fastify";
+import { Counter, Histogram } from "prom-client";
+export declare const httpRequestsTotal: Counter<"method" | "route" | "status_code">;
+export declare const httpRequestDurationSeconds: Histogram<"method" | "route" | "status_code">;
+export declare const failedLoginsTotal: Counter<"reason">;
+declare const _default: (app: FastifyInstance) => Promise<void>;
+export default _default;
+//# sourceMappingURL=metrics.d.ts.map

package/dist/plugins/metrics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics.d.ts","sourceRoot":"","sources":["../../src/plugins/metrics.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAY,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE3D,eAAO,MAAM,iBAAiB,6CAI5B,CAAC;AAEH,eAAO,MAAM,0BAA0B,+CAKrC,CAAC;AAEH,eAAO,MAAM,iBAAiB,mBAI5B,CAAC;8BAEiD,eAAe;AAAnE,wBAiBG"}

package/dist/plugins/metrics.js

@@ -0,0 +1,36 @@
+import fp from "fastify-plugin";
+import { register, Counter, Histogram } from "prom-client";
+export const httpRequestsTotal = new Counter({
+    name: "keystone_http_requests_total",
+    help: "Total HTTP requests",
+    labelNames: ["method", "route", "status_code"],
+});
+export const httpRequestDurationSeconds = new Histogram({
+    name: "keystone_http_request_duration_seconds",
+    help: "HTTP request duration in seconds",
+    labelNames: ["method", "route", "status_code"],
+    buckets: [0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10],
+});
+export const failedLoginsTotal = new Counter({
+    name: "keystone_failed_logins_total",
+    help: "Total failed login attempts",
+    labelNames: ["reason"],
+});
+export default fp(async function metricsPlugin(app) {
+    app.addHook("onResponse", async (request, reply) => {
+        const route = request.routeOptions?.url || request.url;
+        const labels = {
+            method: request.method,
+            route,
+            status_code: String(reply.statusCode),
+        };
+        httpRequestsTotal.inc(labels);
+        const elapsedMs = reply.elapsedTime ?? 0;
+        httpRequestDurationSeconds.observe(labels, elapsedMs / 1000);
+    });
+    app.get("/metrics", async (_request, reply) => {
+        reply.header("Content-Type", register.contentType);
+        return register.metrics();
+    });
+});
+//# sourceMappingURL=metrics.js.map

package/dist/plugins/metrics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics.js","sourceRoot":"","sources":["../../src/plugins/metrics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAEhC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE3D,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,OAAO,CAAC;IAC3C,IAAI,EAAE,8BAA8B;IACpC,IAAI,EAAE,qBAAqB;IAC3B,UAAU,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,aAAa,CAAC;CAC/C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,SAAS,CAAC;IACtD,IAAI,EAAE,wCAAwC;IAC9C,IAAI,EAAE,kCAAkC;IACxC,UAAU,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,aAAa,CAAC;IAC9C,OAAO,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;CACnE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,OAAO,CAAC;IAC3C,IAAI,EAAE,8BAA8B;IACpC,IAAI,EAAE,6BAA6B;IACnC,UAAU,EAAE,CAAC,QAAQ,CAAC;CACvB,CAAC,CAAC;AAEH,eAAe,EAAE,CAAC,KAAK,UAAU,aAAa,CAAC,GAAoB;IACjE,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAC/E,MAAM,KAAK,GAAI,OAA0D,CAAC,YAAY,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;QAC3G,MAAM,MAAM,GAAG;YACb,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,KAAK;YACL,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;SACtC,CAAC;QACF,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,SAAS,GAAI,KAA6C,CAAC,WAAW,IAAI,CAAC,CAAC;QAClF,0BAA0B,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,QAAwB,EAAE,KAAmB,EAAE,EAAE;QAC1E,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;QACnD,OAAO,QAAQ,CAAC,OAAO,EAAE,CAAC;IAC5B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/plugins/mtls.d.ts

@@ -0,0 +1,14 @@
+import type { FastifyInstance, FastifyReply, FastifyRequest } from "fastify";
+declare module "fastify" {
+    interface FastifyInstance {
+        requireMTLS: (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
+    }
+}
+export declare function extractClientCert(request: FastifyRequest): {
+    fingerprint?: string;
+    subject?: string;
+};
+export declare function requireMTLS(): (request: FastifyRequest, reply: FastifyReply) => Promise<undefined>;
+declare const _default: (app: FastifyInstance) => Promise<void>;
+export default _default;
+//# sourceMappingURL=mtls.d.ts.map

package/dist/plugins/mtls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mtls.d.ts","sourceRoot":"","sources":["../../src/plugins/mtls.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAuB7E,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,eAAe;QACvB,WAAW,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;KAC9E;CACF;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,cAAc,GAAG;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAOrG;AAkCD,wBAAgB,WAAW,KACF,SAAS,cAAc,EAAE,OAAO,YAAY,wBAiBpE;8BAEgD,eAAe;AAAhE,wBAEG"}