@hilbras/keystone 1.1.0

package/dist/plugins/mtls.js

@@ -0,0 +1,76 @@
+import fp from "fastify-plugin";
+import { eq } from "drizzle-orm";
+import { db } from "../db/index.js";
+import { serviceAccounts } from "../db/schema.js";
+/**
+ * mTLS authentication plugin.
+ *
+ * In production, terminate TLS at a reverse proxy (nginx, envoy, AWS ALB, etc.)
+ * that validates the client certificate and forwards the certificate fingerprint
+ * or subject in a trusted header. This plugin reads that header and maps
+ * certificates to service accounts.
+ *
+ * Headers read:
+ *   - x-client-cert-fingerprint: SHA-256 fingerprint of the client certificate
+ *   - x-forwarded-client-cert: PEM-encoded client certificate or DN subject
+ *   - x-service-account-id: Optional explicit service account ID (for non-mTLS fallback)
+ */
+const MTLS_HEADER = "x-forwarded-client-cert";
+const MTLS_FINGERPRINT_HEADER = "x-client-cert-fingerprint";
+const SERVICE_ACCOUNT_ID_HEADER = "x-service-account-id";
+export function extractClientCert(request) {
+    const fingerprint = request.headers[MTLS_FINGERPRINT_HEADER];
+    const cert = request.headers[MTLS_HEADER];
+    return {
+        fingerprint: typeof fingerprint === "string" ? fingerprint : undefined,
+        subject: typeof cert === "string" ? cert : undefined,
+    };
+}
+async function resolveServiceAccount(request) {
+    const explicitId = request.headers[SERVICE_ACCOUNT_ID_HEADER];
+    if (typeof explicitId === "string" && explicitId) {
+        const [sa] = await db
+            .select()
+            .from(serviceAccounts)
+            .where(eq(serviceAccounts.id, explicitId))
+            .limit(1);
+        if (sa?.isActive) {
+            return sa;
+        }
+    }
+    const { fingerprint, subject } = extractClientCert(request);
+    if (!fingerprint && !subject)
+        return undefined;
+    // Look up service accounts by name matching the fingerprint or subject.
+    // In a production system, you would store the certificate fingerprint in
+    // the service_accounts table and query by it directly.
+    const [sa] = await db
+        .select()
+        .from(serviceAccounts)
+        .where(eq(serviceAccounts.name, fingerprint || subject || ""))
+        .limit(1);
+    if (sa?.isActive) {
+        return sa;
+    }
+    return undefined;
+}
+export function requireMTLS() {
+    return async function (request, reply) {
+        const { fingerprint, subject } = extractClientCert(request);
+        const explicitId = request.headers[SERVICE_ACCOUNT_ID_HEADER];
+        if (!fingerprint && !subject && !explicitId) {
+            return reply.status(401).send({ error: "Client certificate required" });
+        }
+        const serviceAccount = await resolveServiceAccount(request);
+        if (!serviceAccount) {
+            request.log.warn({ fingerprint, subject }, "mTLS: no matching service account found");
+            return reply.status(403).send({ error: "Client certificate not mapped to a service account" });
+        }
+        request.serviceAccount = serviceAccount;
+        request.log.debug({ serviceAccountId: serviceAccount.id }, "mTLS: service account authenticated");
+    };
+}
+export default fp(async function mtlsPlugin(app) {
+    app.decorate("requireMTLS", requireMTLS());
+});
+//# sourceMappingURL=mtls.js.map

package/dist/plugins/mtls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mtls.js","sourceRoot":"","sources":["../../src/plugins/mtls.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAEhC,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD;;;;;;;;;;;;GAYG;AAEH,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAC9C,MAAM,uBAAuB,GAAG,2BAA2B,CAAC;AAC5D,MAAM,yBAAyB,GAAG,sBAAsB,CAAC;AAQzD,MAAM,UAAU,iBAAiB,CAAC,OAAuB;IACvD,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1C,OAAO;QACL,WAAW,EAAE,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;QACtE,OAAO,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;KACrD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,OAAuB;IAC1D,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAC9D,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,EAAE,CAAC;QACjD,MAAM,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE;aAClB,MAAM,EAAE;aACR,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;aACzC,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC;YACjB,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC5D,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAE/C,wEAAwE;IACxE,yEAAyE;IACzE,uDAAuD;IACvD,MAAM,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE;SAClB,MAAM,EAAE;SACR,IAAI,CAAC,eAAe,CAAC;SACrB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,WAAW,IAAI,OAAO,IAAI,EAAE,CAAC,CAAC;SAC7D,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC;QACjB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,OAAO,KAAK,WAAW,OAAuB,EAAE,KAAmB;QACjE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC5D,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;QAE9D,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC;YAC5C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,yCAAyC,CAAC,CAAC;YACtF,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oDAAoD,EAAE,CAAC,CAAC;QACjG,CAAC;QAED,OAAO,CAAC,cAAc,GAAG,cAAc,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,gBAAgB,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,qCAAqC,CAAC,CAAC;IACpG,CAAC,CAAC;AACJ,CAAC;AAED,eAAe,EAAE,CAAC,KAAK,UAAU,UAAU,CAAC,GAAoB;IAC9D,GAAG,CAAC,QAAQ,CAAC,aAAa,EAAE,WAAW,EAAE,CAAC,CAAC;AAC7C,CAAC,CAAC,CAAC"}

package/dist/plugins/permissions.d.ts

@@ -0,0 +1,9 @@
+import type { FastifyInstance } from "fastify";
+declare module "fastify" {
+    interface FastifyInstance {
+        requirePermission: (resource: string, action: string) => (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
+    }
+}
+declare const _default: (app: FastifyInstance) => Promise<void>;
+export default _default;
+//# sourceMappingURL=permissions.d.ts.map

package/dist/plugins/permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/plugins/permissions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAG7E,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,eAAe;QACvB,iBAAiB,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;KAC1H;CACF;8BAEuD,eAAe;AAAvE,wBAkBG"}

package/dist/plugins/permissions.js

@@ -0,0 +1,20 @@
+import fp from "fastify-plugin";
+import { requirePermission } from "../services/permissions.js";
+export default fp(async function permissionsPlugin(app) {
+    app.decorate("requirePermission", function (resource, action) {
+        return async function (request, reply) {
+            const membership = request.state?.membership;
+            if (!membership) {
+                return reply.status(403).send({ error: "Organization membership required" });
+            }
+            try {
+                await requirePermission(membership.role, resource, action);
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : "Forbidden";
+                return reply.status(403).send({ error: message });
+            }
+        };
+    });
+});
+//# sourceMappingURL=permissions.js.map

package/dist/plugins/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/plugins/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAEhC,OAAO,EAAE,iBAAiB,EAAuC,MAAM,4BAA4B,CAAC;AAQpG,eAAe,EAAE,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAoB;IACrE,GAAG,CAAC,QAAQ,CACV,mBAAmB,EACnB,UAAU,QAAgB,EAAE,MAAc;QACxC,OAAO,KAAK,WAAW,OAAuB,EAAE,KAAmB;YACjE,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC;YAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,iBAAiB,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC7D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;gBACjE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YACpD,CAAC;QACH,CAAC,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/plugins/rateLimit.d.ts

@@ -0,0 +1,20 @@
+import type { FastifyInstance, FastifyReply, FastifyRequest } from "fastify";
+interface RateLimitPluginOptions {
+    keyPrefix: string;
+    maxAttempts: number;
+    windowSeconds: number;
+}
+export interface GlobalRateLimitOptions {
+    maxRequests?: number;
+    windowSeconds?: number;
+    keyPrefix?: string;
+}
+export declare function rateLimit(options: RateLimitPluginOptions): (request: FastifyRequest, reply: FastifyReply) => Promise<undefined>;
+export declare function globalRateLimit(options?: GlobalRateLimitOptions): (request: FastifyRequest, reply: FastifyReply) => Promise<undefined>;
+export declare function appRateLimit(options: {
+    maxAttempts: number;
+    windowSeconds: number;
+}): (request: FastifyRequest, reply: FastifyReply) => Promise<undefined>;
+declare const _default: (app: FastifyInstance) => Promise<void>;
+export default _default;
+//# sourceMappingURL=rateLimit.d.ts.map

package/dist/plugins/rateLimit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rateLimit.d.ts","sourceRoot":"","sources":["../../src/plugins/rateLimit.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAG7E,UAAU,sBAAsB;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,sBAAsB;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAkED,wBAAgB,SAAS,CAAC,OAAO,EAAE,sBAAsB,IACtB,SAAS,cAAc,EAAE,OAAO,YAAY,wBAW9E;AAED,wBAAgB,eAAe,CAAC,OAAO,GAAE,sBAA2B,IAKlC,SAAS,cAAc,EAAE,OAAO,YAAY,wBAW7E;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,IACjD,SAAS,cAAc,EAAE,OAAO,YAAY,wBAY9E;8BAEqD,eAAe;AAArE,wBAIG"}

package/dist/plugins/rateLimit.js

@@ -0,0 +1,101 @@
+import crypto from "node:crypto";
+import fp from "fastify-plugin";
+import { redis, isRedisReady } from "../services/redis.js";
+/**
+ * Atomic sliding-window rate limit script.
+ *
+ * Returns the number of requests already seen in the current window *before*
+ * recording the current request. The request is only recorded when the count
+ * is still below the limit, so blocked requests do not pollute the window.
+ */
+const slidingWindowLua = `
+local key = KEYS[1]
+local windowMs = tonumber(ARGV[1])
+local now = tonumber(ARGV[2])
+local member = ARGV[3]
+local maxAttempts = tonumber(ARGV[4])
+local windowStart = now - windowMs
+
+redis.call("zremrangebyscore", key, 0, windowStart)
+local count = redis.call("zcard", key)
+if count >= maxAttempts then
+  return count
+end
+
+redis.call("zadd", key, now, member)
+redis.call("pexpire", key, windowMs)
+return count
+`;
+async function isAllowed(key, maxAttempts, windowSeconds) {
+    if (!isRedisReady()) {
+        // Fail open when Redis is not connected; the endpoint remains functional.
+        return true;
+    }
+    const now = Date.now();
+    const member = `${now}:${cryptoRandom()}`;
+    try {
+        const count = (await redis.eval(slidingWindowLua, 1, key, windowSeconds * 1000, now, member, maxAttempts));
+        return count < maxAttempts;
+    }
+    catch (err) {
+        // Fail open on transient Redis errors so a network blip cannot lock users out.
+        console.error("[rateLimit] Redis error:", err);
+        return true;
+    }
+}
+function cryptoRandom() {
+    return crypto.randomBytes(8).toString("hex");
+}
+function clientIdentifier(request) {
+    return (request.headers["x-forwarded-for"]?.split(",")[0]?.trim() ||
+        request.ip);
+}
+export function rateLimit(options) {
+    return async function preHandler(request, reply) {
+        const id = clientIdentifier(request);
+        const key = `${options.keyPrefix}:${id}:${request.body?.email ?? ""}`;
+        const allowed = await isAllowed(key, options.maxAttempts, options.windowSeconds);
+        if (!allowed) {
+            return reply
+                .header("Retry-After", String(options.windowSeconds))
+                .status(429)
+                .send({ error: "Too many attempts. Please try again later." });
+        }
+    };
+}
+export function globalRateLimit(options = {}) {
+    const maxRequests = options.maxRequests ?? 100;
+    const windowSeconds = options.windowSeconds ?? 60;
+    const keyPrefix = options.keyPrefix ?? "global";
+    return async function onRequest(request, reply) {
+        const id = clientIdentifier(request);
+        const key = `${keyPrefix}:${id}`;
+        const allowed = await isAllowed(key, maxRequests, windowSeconds);
+        if (!allowed) {
+            return reply
+                .header("Retry-After", String(windowSeconds))
+                .status(429)
+                .send({ error: "Rate limit exceeded. Please slow down." });
+        }
+    };
+}
+export function appRateLimit(options) {
+    return async function preHandler(request, reply) {
+        const clientId = request.body?.client_id ?? "anonymous";
+        const id = clientIdentifier(request);
+        const key = `app:${clientId}:${id}`;
+        const allowed = await isAllowed(key, options.maxAttempts, options.windowSeconds);
+        if (!allowed) {
+            return reply
+                .header("Retry-After", String(options.windowSeconds))
+                .status(429)
+                .send({ error: "Too many attempts for this application. Please try again later." });
+        }
+    };
+}
+export default fp(async function rateLimitPlugin(app) {
+    app.addHook("onClose", async () => {
+        await redis.quit();
+    });
+});
+//# sourceMappingURL=rateLimit.js.map

package/dist/plugins/rateLimit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rateLimit.js","sourceRoot":"","sources":["../../src/plugins/rateLimit.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAEhC,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAc3D;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;CAiBxB,CAAC;AAEF,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,WAAmB,EAAE,aAAqB;IAC9E,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;QACpB,0EAA0E;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,GAAG,GAAG,IAAI,YAAY,EAAE,EAAE,CAAC;IAE1C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,CAC7B,gBAAgB,EAChB,CAAC,EACD,GAAG,EACH,aAAa,GAAG,IAAI,EACpB,GAAG,EACH,MAAM,EACN,WAAW,CACZ,CAAW,CAAC;QACb,OAAO,KAAK,GAAG,WAAW,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,+EAA+E;QAC/E,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAuB;IAC/C,OAAO,CACJ,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAY,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;QACrE,OAAO,CAAC,EAAE,CACX,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,OAA+B;IACvD,OAAO,KAAK,UAAU,UAAU,CAAC,OAAuB,EAAE,KAAmB;QAC3E,MAAM,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,IAAK,OAAO,CAAC,IAA2C,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;QAC9G,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;QACjF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK;iBACT,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;iBACpD,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC,CAAC;QACnE,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,UAAkC,EAAE;IAClE,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,GAAG,CAAC;IAC/C,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;IAClD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAC;IAEhD,OAAO,KAAK,UAAU,SAAS,CAAC,OAAuB,EAAE,KAAmB;QAC1E,MAAM,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,GAAG,SAAS,IAAI,EAAE,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;QACjE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK;iBACT,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;iBAC5C,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAuD;IAClF,OAAO,KAAK,UAAU,UAAU,CAAC,OAAuB,EAAE,KAAmB;QAC3E,MAAM,QAAQ,GAAI,OAAO,CAAC,IAA2C,EAAE,SAAS,IAAI,WAAW,CAAC;QAChG,MAAM,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,OAAO,QAAQ,IAAI,EAAE,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;QACjF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK;iBACT,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;iBACpD,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,EAAE,KAAK,EAAE,iEAAiE,EAAE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,eAAe,EAAE,CAAC,KAAK,UAAU,eAAe,CAAC,GAAoB;IACnE,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QAChC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/plugins/requestLogger.d.ts

@@ -0,0 +1,4 @@
+import type { FastifyInstance } from "fastify";
+declare const _default: (app: FastifyInstance) => Promise<void>;
+export default _default;
+//# sourceMappingURL=requestLogger.d.ts.map

package/dist/plugins/requestLogger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestLogger.d.ts","sourceRoot":"","sources":["../../src/plugins/requestLogger.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;8BAEzB,eAAe;AAAnE,wBAqBG"}

package/dist/plugins/requestLogger.js

@@ -0,0 +1,20 @@
+import fp from "fastify-plugin";
+export default fp(async function requestLogger(app) {
+    app.addHook("onRequest", async (request, reply) => {
+        request._startTime = Date.now();
+        reply.header("request-id", request.id);
+    });
+    app.addHook("onResponse", async (request, reply) => {
+        const start = request._startTime;
+        const durationMs = start ? Date.now() - start : undefined;
+        request.log.info({
+            requestId: request.id,
+            method: request.method,
+            path: request.url,
+            statusCode: reply.statusCode,
+            durationMs,
+            ip: request.ip,
+        }, "request");
+    });
+});
+//# sourceMappingURL=requestLogger.js.map

package/dist/plugins/requestLogger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestLogger.js","sourceRoot":"","sources":["../../src/plugins/requestLogger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAGhC,eAAe,EAAE,CAAC,KAAK,UAAU,aAAa,CAAC,GAAoB;IACjE,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAC7E,OAA8C,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACxE,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAC/E,MAAM,KAAK,GAAI,OAA8C,CAAC,UAAgC,CAAC;QAC/F,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,IAAI,CACd;YACE,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,IAAI,EAAE,OAAO,CAAC,GAAG;YACjB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,UAAU;YACV,EAAE,EAAE,OAAO,CAAC,EAAE;SACf,EACD,SAAS,CACV,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/plugins/tracing.d.ts

@@ -0,0 +1,3 @@
+export declare function startTracing(): void;
+export declare function stopTracing(): Promise<void>;
+//# sourceMappingURL=tracing.d.ts.map

package/dist/plugins/tracing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tracing.d.ts","sourceRoot":"","sources":["../../src/plugins/tracing.ts"],"names":[],"mappings":"AAMA,wBAAgB,YAAY,IAAI,IAAI,CAQnC;AAED,wBAAsB,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAKjD"}

package/dist/plugins/tracing.js

@@ -0,0 +1,21 @@
+import { NodeSDK } from "@opentelemetry/sdk-node";
+import { getNodeAutoInstrumentations } from "@opentelemetry/auto-instrumentations-node";
+import { config } from "../config.js";
+let sdk;
+export function startTracing() {
+    if (sdk)
+        return;
+    if (config.OTEL_EXPORTER_OTLP_ENDPOINT || process.env.OTEL_EXPORTER_OTLP_ENDPOINT) {
+        sdk = new NodeSDK({
+            instrumentations: [getNodeAutoInstrumentations()],
+        });
+        sdk.start();
+    }
+}
+export async function stopTracing() {
+    if (sdk) {
+        await sdk.shutdown();
+        sdk = undefined;
+    }
+}
+//# sourceMappingURL=tracing.js.map

package/dist/plugins/tracing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tracing.js","sourceRoot":"","sources":["../../src/plugins/tracing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AACxF,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC,IAAI,GAAwB,CAAC;AAE7B,MAAM,UAAU,YAAY;IAC1B,IAAI,GAAG;QAAE,OAAO;IAChB,IAAI,MAAM,CAAC,2BAA2B,IAAI,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,CAAC;QAClF,GAAG,GAAG,IAAI,OAAO,CAAC;YAChB,gBAAgB,EAAE,CAAC,2BAA2B,EAAE,CAAC;SAClD,CAAC,CAAC;QACH,GAAG,CAAC,KAAK,EAAE,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC;QACrB,GAAG,GAAG,SAAS,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/repositories/apiKey.d.ts

@@ -0,0 +1,40 @@
+import { type ApiKey } from "../db/schema.js";
+type ApiKeyPublic = Omit<ApiKey, "keyHash">;
+export interface ApiKeyRepository {
+    create(input: {
+        userId?: string | null;
+        serviceAccountId?: string | null;
+        orgId?: string | null;
+        appId?: string | null;
+        name: string;
+        prefix: string;
+        keyHash: string;
+        scopes?: string[];
+        expiresAt?: Date | null;
+    }): Promise<ApiKey>;
+    listByUserId(userId: string): Promise<ApiKeyPublic[]>;
+    listByOrgId(orgId: string): Promise<ApiKeyPublic[]>;
+    listByServiceAccountId(serviceAccountId: string): Promise<ApiKeyPublic[]>;
+    revokeByKeyIdAndUserId(keyId: string, userId: string): Promise<ApiKeyPublic | undefined>;
+    revokeByKeyIdAndOrgId(keyId: string, orgId: string): Promise<ApiKeyPublic | undefined>;
+}
+export declare class DrizzleApiKeyRepository implements ApiKeyRepository {
+    create(input: {
+        userId?: string | null;
+        serviceAccountId?: string | null;
+        orgId?: string | null;
+        appId?: string | null;
+        name: string;
+        prefix: string;
+        keyHash: string;
+        scopes?: string[];
+        expiresAt?: Date | null;
+    }): Promise<ApiKey>;
+    listByUserId(userId: string): Promise<ApiKeyPublic[]>;
+    listByOrgId(orgId: string): Promise<ApiKeyPublic[]>;
+    listByServiceAccountId(serviceAccountId: string): Promise<ApiKeyPublic[]>;
+    revokeByKeyIdAndUserId(keyId: string, userId: string): Promise<ApiKeyPublic | undefined>;
+    revokeByKeyIdAndOrgId(keyId: string, orgId: string): Promise<ApiKeyPublic | undefined>;
+}
+export {};
+//# sourceMappingURL=apiKey.d.ts.map

package/dist/repositories/apiKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiKey.d.ts","sourceRoot":"","sources":["../../src/repositories/apiKey.ts"],"names":[],"mappings":"AAEA,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAEvD,KAAK,YAAY,GAAG,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAE5C,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,KAAK,EAAE;QACZ,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;KACzB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IACtD,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IACpD,sBAAsB,CAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC1E,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;IACzF,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;CACxF;AAED,qBAAa,uBAAwB,YAAW,gBAAgB;IACxD,MAAM,CAAC,KAAK,EAAE;QAClB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;KACzB,GAAG,OAAO,CAAC,MAAM,CAAC;IAkBb,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAoBrD,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAoBnD,sBAAsB,CAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAoBzE,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IAsBxF,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;CAqB7F"}

package/dist/repositories/apiKey.js

@@ -0,0 +1,122 @@
+import { eq, and } from "drizzle-orm";
+import { db } from "../db/index.js";
+import { apiKeys } from "../db/schema.js";
+export class DrizzleApiKeyRepository {
+    async create(input) {
+        const [record] = await db
+            .insert(apiKeys)
+            .values({
+            userId: input.userId ?? null,
+            serviceAccountId: input.serviceAccountId ?? null,
+            orgId: input.orgId ?? null,
+            appId: input.appId ?? null,
+            name: input.name,
+            prefix: input.prefix,
+            keyHash: input.keyHash,
+            scopes: input.scopes?.length ? input.scopes : ["api:read"],
+            expiresAt: input.expiresAt ?? null,
+        })
+            .returning();
+        return record;
+    }
+    async listByUserId(userId) {
+        return db
+            .select({
+            id: apiKeys.id,
+            userId: apiKeys.userId,
+            serviceAccountId: apiKeys.serviceAccountId,
+            orgId: apiKeys.orgId,
+            appId: apiKeys.appId,
+            name: apiKeys.name,
+            prefix: apiKeys.prefix,
+            scopes: apiKeys.scopes,
+            lastUsedAt: apiKeys.lastUsedAt,
+            expiresAt: apiKeys.expiresAt,
+            revokedAt: apiKeys.revokedAt,
+            createdAt: apiKeys.createdAt,
+        })
+            .from(apiKeys)
+            .where(eq(apiKeys.userId, userId));
+    }
+    async listByOrgId(orgId) {
+        return db
+            .select({
+            id: apiKeys.id,
+            userId: apiKeys.userId,
+            serviceAccountId: apiKeys.serviceAccountId,
+            orgId: apiKeys.orgId,
+            appId: apiKeys.appId,
+            name: apiKeys.name,
+            prefix: apiKeys.prefix,
+            scopes: apiKeys.scopes,
+            lastUsedAt: apiKeys.lastUsedAt,
+            expiresAt: apiKeys.expiresAt,
+            revokedAt: apiKeys.revokedAt,
+            createdAt: apiKeys.createdAt,
+        })
+            .from(apiKeys)
+            .where(eq(apiKeys.orgId, orgId));
+    }
+    async listByServiceAccountId(serviceAccountId) {
+        return db
+            .select({
+            id: apiKeys.id,
+            userId: apiKeys.userId,
+            serviceAccountId: apiKeys.serviceAccountId,
+            orgId: apiKeys.orgId,
+            appId: apiKeys.appId,
+            name: apiKeys.name,
+            prefix: apiKeys.prefix,
+            scopes: apiKeys.scopes,
+            lastUsedAt: apiKeys.lastUsedAt,
+            expiresAt: apiKeys.expiresAt,
+            revokedAt: apiKeys.revokedAt,
+            createdAt: apiKeys.createdAt,
+        })
+            .from(apiKeys)
+            .where(eq(apiKeys.serviceAccountId, serviceAccountId));
+    }
+    async revokeByKeyIdAndUserId(keyId, userId) {
+        const [record] = await db
+            .update(apiKeys)
+            .set({ revokedAt: new Date() })
+            .where(and(eq(apiKeys.id, keyId), eq(apiKeys.userId, userId)))
+            .returning({
+            id: apiKeys.id,
+            userId: apiKeys.userId,
+            serviceAccountId: apiKeys.serviceAccountId,
+            orgId: apiKeys.orgId,
+            appId: apiKeys.appId,
+            name: apiKeys.name,
+            prefix: apiKeys.prefix,
+            scopes: apiKeys.scopes,
+            lastUsedAt: apiKeys.lastUsedAt,
+            expiresAt: apiKeys.expiresAt,
+            revokedAt: apiKeys.revokedAt,
+            createdAt: apiKeys.createdAt,
+        });
+        return record;
+    }
+    async revokeByKeyIdAndOrgId(keyId, orgId) {
+        const [record] = await db
+            .update(apiKeys)
+            .set({ revokedAt: new Date() })
+            .where(and(eq(apiKeys.id, keyId), eq(apiKeys.orgId, orgId)))
+            .returning({
+            id: apiKeys.id,
+            userId: apiKeys.userId,
+            serviceAccountId: apiKeys.serviceAccountId,
+            orgId: apiKeys.orgId,
+            appId: apiKeys.appId,
+            name: apiKeys.name,
+            prefix: apiKeys.prefix,
+            scopes: apiKeys.scopes,
+            lastUsedAt: apiKeys.lastUsedAt,
+            expiresAt: apiKeys.expiresAt,
+            revokedAt: apiKeys.revokedAt,
+            createdAt: apiKeys.createdAt,
+        });
+        return record;
+    }
+}
+//# sourceMappingURL=apiKey.js.map

package/dist/repositories/apiKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiKey.js","sourceRoot":"","sources":["../../src/repositories/apiKey.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,OAAO,EAAe,MAAM,iBAAiB,CAAC;AAuBvD,MAAM,OAAO,uBAAuB;IAClC,KAAK,CAAC,MAAM,CAAC,KAUZ;QACC,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC,OAAO,CAAC;aACf,MAAM,CAAC;YACN,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;YAC5B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,IAAI;YAChD,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;YAC1B,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;YAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;YAC1D,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;SACnC,CAAC;aACD,SAAS,EAAE,CAAC;QACf,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,OAAO,EAAE;aACN,MAAM,CAAC;YACN,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC;aACD,IAAI,CAAC,OAAO,CAAC;aACb,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,OAAO,EAAE;aACN,MAAM,CAAC;YACN,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC;aACD,IAAI,CAAC,OAAO,CAAC;aACb,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,gBAAwB;QACnD,OAAO,EAAE;aACN,MAAM,CAAC;YACN,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC;aACD,IAAI,CAAC,OAAO,CAAC;aACb,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,KAAa,EAAE,MAAc;QACxD,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAC9B,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;aAC7D,SAAS,CAAC;YACT,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC,CAAC;QACL,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,KAAa,EAAE,KAAa;QACtD,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAC9B,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;aAC3D,SAAS,CAAC;YACT,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC,CAAC;QACL,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/repositories/application.d.ts

@@ -0,0 +1,13 @@
+import { type Application } from "../db/schema.js";
+import type { ApplicationRepository, CreateApplicationInput, UpdateApplicationInput } from "./types.js";
+export declare class DrizzleApplicationRepository implements ApplicationRepository {
+    private generateClientId;
+    create(input: CreateApplicationInput): Promise<Application & {
+        clientSecret: string;
+    }>;
+    findByClientId(clientId: string): Promise<Application | undefined>;
+    listByOrgId(orgId: string): Promise<Application[]>;
+    update(appId: string, orgId: string, input: UpdateApplicationInput): Promise<Application | undefined>;
+    verifyClientSecret(clientId: string, secret: string): Promise<Application | undefined>;
+}
+//# sourceMappingURL=application.d.ts.map

package/dist/repositories/application.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"application.d.ts","sourceRoot":"","sources":["../../src/repositories/application.ts"],"names":[],"mappings":"AAGA,OAAO,EAAgB,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEjE,OAAO,KAAK,EACV,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB,qBAAa,4BAA6B,YAAW,qBAAqB;IACxE,OAAO,CAAC,gBAAgB;IAIlB,MAAM,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,WAAW,GAAG;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAgBtF,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IASlE,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAIlD,MAAM,CACV,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAS7B,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;CAW7F"}

package/dist/repositories/application.js

@@ -0,0 +1,57 @@
+import crypto from "node:crypto";
+import { eq, and } from "drizzle-orm";
+import { db } from "../db/index.js";
+import { applications } from "../db/schema.js";
+import { generateClientSecret, hashClientSecret } from "../services/secrets.js";
+export class DrizzleApplicationRepository {
+    generateClientId() {
+        return `app_${crypto.randomBytes(16).toString("base64url")}`;
+    }
+    async create(input) {
+        const clientSecret = input.clientSecret || generateClientSecret();
+        const [app] = await db
+            .insert(applications)
+            .values({
+            orgId: input.orgId,
+            clientId: input.clientId || this.generateClientId(),
+            clientSecretHash: hashClientSecret(clientSecret),
+            name: input.name,
+            redirectUris: input.redirectUris ?? [],
+            allowedOrigins: input.allowedOrigins ?? [],
+        })
+            .returning();
+        return { ...app, clientSecret };
+    }
+    async findByClientId(clientId) {
+        const [app] = await db
+            .select()
+            .from(applications)
+            .where(eq(applications.clientId, clientId))
+            .limit(1);
+        return app;
+    }
+    async listByOrgId(orgId) {
+        return db.select().from(applications).where(eq(applications.orgId, orgId));
+    }
+    async update(appId, orgId, input) {
+        const [updated] = await db
+            .update(applications)
+            .set(input)
+            .where(and(eq(applications.id, appId), eq(applications.orgId, orgId)))
+            .returning();
+        return updated;
+    }
+    async verifyClientSecret(clientId, secret) {
+        const [app] = await db
+            .select()
+            .from(applications)
+            .where(and(eq(applications.clientId, clientId), eq(applications.isActive, true)))
+            .limit(1);
+        if (!app)
+            return undefined;
+        if (app.clientSecretHash !== hashClientSecret(secret))
+            return undefined;
+        return app;
+    }
+}
+//# sourceMappingURL=application.js.map

package/dist/repositories/application.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"application.js","sourceRoot":"","sources":["../../src/repositories/application.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,YAAY,EAAoB,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAOhF,MAAM,OAAO,4BAA4B;IAC/B,gBAAgB;QACtB,OAAO,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAA6B;QACxC,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,IAAI,oBAAoB,EAAE,CAAC;QAClE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC,YAAY,CAAC;aACpB,MAAM,CAAC;YACN,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,gBAAgB,EAAE;YACnD,gBAAgB,EAAE,gBAAgB,CAAC,YAAY,CAAC;YAChD,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,EAAE;YACtC,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,EAAE;SAC3C,CAAC;aACD,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,GAAG,GAAG,EAAE,YAAY,EAAE,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAgB;QACnC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,EAAE;aACR,IAAI,CAAC,YAAY,CAAC;aAClB,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;aAC1C,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED,KAAK,CAAC,MAAM,CACV,KAAa,EACb,KAAa,EACb,KAA6B;QAE7B,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACvB,MAAM,CAAC,YAAY,CAAC;aACpB,GAAG,CAAC,KAAK,CAAC;aACV,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;aACrE,SAAS,EAAE,CAAC;QACf,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,QAAgB,EAAE,MAAc;QACvD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,EAAE;aACR,IAAI,CAAC,YAAY,CAAC;aAClB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;aAChF,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,IAAI,GAAG,CAAC,gBAAgB,KAAK,gBAAgB,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAC;QACxE,OAAO,GAAG,CAAC;IACb,CAAC;CACF"}

package/dist/repositories/audit.d.ts

@@ -0,0 +1,13 @@
+import { auditLog } from "../db/schema.js";
+import type { AuditRepository } from "./types.js";
+export declare class DrizzleAuditRepository implements AuditRepository {
+    list(opts: {
+        orgId?: string;
+        appId?: string;
+        userId?: string;
+        event?: string;
+        limit?: number;
+        offset?: number;
+    }): Promise<typeof auditLog.$inferSelect[]>;
+}
+//# sourceMappingURL=audit.d.ts.map

package/dist/repositories/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/repositories/audit.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,qBAAa,sBAAuB,YAAW,eAAe;IACtD,IAAI,CAAC,IAAI,EAAE;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,OAAO,QAAQ,CAAC,YAAY,EAAE,CAAC;CAkB5C"}

package/dist/repositories/audit.js

@@ -0,0 +1,26 @@
+import { eq, and, desc, sql } from "drizzle-orm";
+import { db } from "../db/index.js";
+import { auditLog } from "../db/schema.js";
+export class DrizzleAuditRepository {
+    async list(opts) {
+        const limit = opts.limit ?? 50;
+        const offset = opts.offset ?? 0;
+        const conditions = [];
+        if (opts.orgId)
+            conditions.push(eq(auditLog.orgId, opts.orgId));
+        if (opts.appId)
+            conditions.push(eq(auditLog.appId, opts.appId));
+        if (opts.userId)
+            conditions.push(eq(auditLog.userId, opts.userId));
+        if (opts.event)
+            conditions.push(eq(auditLog.event, opts.event));
+        return db
+            .select()
+            .from(auditLog)
+            .where(conditions.length ? and(...conditions) : sql `true`)
+            .orderBy(desc(auditLog.createdAt))
+            .limit(limit)
+            .offset(offset);
+    }
+}
+//# sourceMappingURL=audit.js.map

package/dist/repositories/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/repositories/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAG3C,MAAM,OAAO,sBAAsB;IACjC,KAAK,CAAC,IAAI,CAAC,IAOV;QACC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;QAEhC,MAAM,UAAU,GAAG,EAAE,CAAC;QACtB,IAAI,IAAI,CAAC,KAAK;YAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAChE,IAAI,IAAI,CAAC,KAAK;YAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAChE,IAAI,IAAI,CAAC,MAAM;YAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QACnE,IAAI,IAAI,CAAC,KAAK;YAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAEhE,OAAO,EAAE;aACN,MAAM,EAAE;aACR,IAAI,CAAC,QAAQ,CAAC;aACd,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA,MAAM,CAAC;aACzD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;aACjC,KAAK,CAAC,KAAK,CAAC;aACZ,MAAM,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;CACF"}