@hilbras/keystone 1.1.0

package/dist/routes/apiKeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiKeys.d.ts","sourceRoot":"","sources":["../../src/routes/apiKeys.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAS/C,wBAA8B,YAAY,CAAC,GAAG,EAAE,eAAe,iBAiD9D"}

package/dist/routes/apiKeys.js

@@ -0,0 +1,50 @@
+import { z } from "zod";
+import { generateApiKey, hashApiKey } from "../services/tokens.js";
+import { toPublicUser } from "../types.js";
+const CreateKeySchema = z.object({
+    name: z.string().min(1).max(100),
+    scopes: z.array(z.string()).optional(),
+});
+export default async function apiKeyRoutes(app) {
+    app.post("/api-keys", { preHandler: [app.authenticate] }, async (request, reply) => {
+        const body = CreateKeySchema.parse(request.body);
+        const user = request.user;
+        const orgId = request.state?.org?.id;
+        const appId = request.state?.app?.id;
+        const { key, prefix } = generateApiKey();
+        const record = await app.container.apiKeyRepository.create({
+            userId: user.id,
+            orgId: orgId ?? null,
+            appId: appId ?? null,
+            name: body.name,
+            prefix,
+            keyHash: hashApiKey(key),
+            scopes: body.scopes?.length ? body.scopes : ["api:read"],
+        });
+        await request.audit("api_key_created", {
+            keyId: record.id,
+            name: record.name,
+        });
+        return { key, apiKey: record };
+    });
+    app.get("/api-keys", { preHandler: [app.authenticate] }, async (request) => {
+        const user = request.user;
+        const rows = await app.container.apiKeyRepository.listByUserId(user.id);
+        return { keys: rows };
+    });
+    app.delete("/api-keys/:id", { preHandler: [app.authenticate] }, async (request, reply) => {
+        const { id } = request.params;
+        const user = request.user;
+        const record = await app.container.apiKeyRepository.revokeByKeyIdAndUserId(id, user.id);
+        if (!record) {
+            return reply.status(404).send({ error: "API key not found" });
+        }
+        await request.audit("api_key_revoked", { keyId: record.id, name: record.name });
+        return { success: true };
+    });
+    app.get("/validate", { preHandler: [app.authenticateOrApiKey] }, async (request) => {
+        const user = request.user;
+        return { valid: true, user: toPublicUser(user) };
+    });
+}
+//# sourceMappingURL=apiKeys.js.map

package/dist/routes/apiKeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiKeys.js","sourceRoot":"","sources":["../../src/routes/apiKeys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,YAAY,CAAC,GAAoB;IAC7D,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACjF,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC;QAErC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,MAAM,CAAC;YACzD,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,KAAK,EAAE,KAAK,IAAI,IAAI;YACpB,KAAK,EAAE,KAAK,IAAI,IAAI;YACpB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM;YACN,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC;YACxB,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;SACzD,CAAC,CAAC;QAEH,MAAM,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE;YACrC,KAAK,EAAE,MAAM,CAAC,EAAE;YAChB,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB,CAAC,CAAC;QAEH,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACzE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,eAAe,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvF,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAE3B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACxF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAChF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACjF,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/routes/auth.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyInstance } from "fastify";
+export default function authRoutes(app: FastifyInstance): Promise<void>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/routes/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/routes/auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAwD/C,wBAA8B,UAAU,CAAC,GAAG,EAAE,eAAe,iBA4J5D"}

package/dist/routes/auth.js

@@ -0,0 +1,174 @@
+import { z } from "zod";
+import { getSdk } from "../sdk/index.js";
+import { setSessionCookies, clearSessionCookies, getRefreshToken, } from "../plugins/auth.js";
+import { rateLimit } from "../plugins/rateLimit.js";
+import { checkImpossibleTravel } from "../services/anomalyDetection.js";
+import { sendSuspiciousLoginAlert } from "../services/email.js";
+import { checkIpAllowed } from "../services/ipControls.js";
+import { toPublicUser } from "../types.js";
+import { verifyTOTP } from "../services/totp.js";
+import { sendResultError } from "./helpers.js";
+/**
+ * Fire-and-forget impossible-travel check after a successful login.
+ * Emits a suspicious-login email when the user's previous login came from a
+ * different IP within the anomaly window.
+ */
+function detectImpossibleTravel(user, ip, userAgent) {
+    checkImpossibleTravel(user.id, ip)
+        .then(async (suspicious) => {
+        if (!suspicious)
+            return;
+        await sendSuspiciousLoginAlert({
+            email: user.email,
+            ipAddress: ip,
+            userAgent,
+            reason: "Sign-in from a new location within minutes of the previous one",
+        });
+    })
+        .catch((err) => {
+        console.error("[anomaly] impossible-travel check failed:", err);
+    });
+}
+const RegisterSchema = z.object({
+    username: z.string().min(3).max(32).regex(/^[a-zA-Z0-9_-]+$/),
+    email: z.string().email().max(255),
+    password: z.string().min(8).max(128),
+    name: z.string().max(255).optional(),
+    client_id: z.string().optional(),
+    metadata: z.record(z.unknown()).optional(),
+});
+const LoginSchema = z.object({
+    email: z.string().email().max(255),
+    password: z.string().min(1).max(128),
+    client_id: z.string().optional(),
+    totp_code: z.string().min(6).max(8).optional(),
+});
+const RefreshSchema = z.object({
+    client_id: z.string().optional(),
+});
+export default async function authRoutes(app) {
+    const sdk = getSdk();
+    app.post("/register", {
+        preHandler: [
+            rateLimit({
+                keyPrefix: "register",
+                maxAttempts: 5,
+                windowSeconds: 900,
+            }),
+        ],
+    }, async (request, reply) => {
+        const body = RegisterSchema.parse(request.body);
+        const ipCheck = await checkIpAllowed(body.client_id, request.ip);
+        if (!ipCheck.allowed) {
+            return reply.status(403).send({ error: ipCheck.reason, code: "IP_NOT_ALLOWED" });
+        }
+        const result = await sdk.authentication.register({
+            username: body.username,
+            email: body.email,
+            password: body.password,
+            name: body.name,
+            clientId: body.client_id,
+            metadata: body.metadata,
+        });
+        if (!result.success)
+            return sendResultError(reply, result);
+        await request.audit("user_registered", { userId: result.data.user.id, email: result.data.user.email });
+        setSessionCookies(reply, result.data.accessToken, result.data.refreshToken, body.client_id);
+        return { user: toPublicUser(result.data.user) };
+    });
+    app.post("/login", {
+        preHandler: [
+            rateLimit({
+                keyPrefix: "login",
+                maxAttempts: 5,
+                windowSeconds: 900,
+            }),
+        ],
+    }, async (request, reply) => {
+        const body = LoginSchema.parse(request.body);
+        const ipCheck = await checkIpAllowed(body.client_id, request.ip);
+        if (!ipCheck.allowed) {
+            return reply.status(403).send({ error: ipCheck.reason, code: "IP_NOT_ALLOWED" });
+        }
+        const result = await sdk.authentication.login({
+            email: body.email,
+            password: body.password,
+            clientId: body.client_id,
+        });
+        if (!result.success)
+            return sendResultError(reply, result);
+        if (body.totp_code) {
+            const validTotp = await verifyTOTP(result.data.user.id, body.totp_code);
+            if (!validTotp) {
+                return reply.status(401).send({ error: "Invalid two-factor code." });
+            }
+        }
+        await request.audit("user_login", { userId: result.data.user.id });
+        detectImpossibleTravel(result.data.user, request.ip, request.headers["user-agent"]);
+        setSessionCookies(reply, result.data.accessToken, result.data.refreshToken, body.client_id);
+        return { user: toPublicUser(result.data.user) };
+    });
+    app.post("/token-login", {
+        preHandler: [
+            rateLimit({
+                keyPrefix: "login",
+                maxAttempts: 5,
+                windowSeconds: 900,
+            }),
+        ],
+    }, async (request, reply) => {
+        const body = LoginSchema.parse(request.body);
+        const ipCheck = await checkIpAllowed(body.client_id, request.ip);
+        if (!ipCheck.allowed) {
+            return reply.status(403).send({ error: ipCheck.reason, code: "IP_NOT_ALLOWED" });
+        }
+        const result = await sdk.authentication.login({
+            email: body.email,
+            password: body.password,
+            clientId: body.client_id,
+        });
+        if (!result.success)
+            return sendResultError(reply, result);
+        if (body.totp_code) {
+            const validTotp = await verifyTOTP(result.data.user.id, body.totp_code);
+            if (!validTotp) {
+                return reply.status(401).send({ error: "Invalid two-factor code." });
+            }
+        }
+        await request.audit("user_token_login", { userId: result.data.user.id });
+        detectImpossibleTravel(result.data.user, request.ip, request.headers["user-agent"]);
+        return {
+            accessToken: result.data.accessToken,
+            user: toPublicUser(result.data.user),
+        };
+    });
+    app.get("/me", { preHandler: [app.authenticate] }, async (request) => {
+        return { user: request.user ? toPublicUser(request.user) : null };
+    });
+    app.post("/refresh", async (request, reply) => {
+        const body = RefreshSchema.parse(request.body ?? {});
+        const clientId = body.client_id;
+        const refreshToken = getRefreshToken(request, clientId) || getRefreshToken(request);
+        if (!refreshToken) {
+            return reply.status(401).send({ error: "Unauthorized" });
+        }
+        const result = await sdk.authentication.refresh(refreshToken, clientId);
+        if (!result.success)
+            return sendResultError(reply, result);
+        await request.audit("token_refresh", {});
+        setSessionCookies(reply, result.data.accessToken, result.data.refreshToken, clientId);
+        return { success: true };
+    });
+    app.post("/logout", async (request, reply) => {
+        const appClientId = request.state?.app?.clientId;
+        const refreshToken = getRefreshToken(request, appClientId) || getRefreshToken(request);
+        const result = await sdk.authentication.logout(refreshToken);
+        if (!result.success)
+            return sendResultError(reply, result);
+        await request.audit("user_logout", { userId: request.user?.id });
+        clearSessionCookies(reply, appClientId);
+        clearSessionCookies(reply);
+        return { success: true };
+    });
+}
+//# sourceMappingURL=auth.js.map

package/dist/routes/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/routes/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,IAAmC,EAAE,EAAW,EAAE,SAAkB;IAClG,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC;SAC/B,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE;QACzB,IAAI,CAAC,UAAU;YAAE,OAAO;QACxB,MAAM,wBAAwB,CAAC;YAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,EAAE;YACb,SAAS;YACT,MAAM,EAAE,gEAAgE;SACzE,CAAC,CAAC;IACL,CAAC,CAAC;SACD,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QACtB,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;AACP,CAAC;AAED,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;IAC7D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACpC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC/C,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,UAAU,CAAC,GAAoB;IAC3D,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IAErB,GAAG,CAAC,IAAI,CACN,WAAW,EACX;QACE,UAAU,EAAE;YACV,SAAS,CAAC;gBACR,SAAS,EAAE,UAAU;gBACrB,WAAW,EAAE,CAAC;gBACd,aAAa,EAAE,GAAG;aACnB,CAAC;SACH;KACF,EACD,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEhD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC;YAC/C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAE3D,MAAM,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACvG,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5F,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAClD,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,QAAQ,EACR;QACE,UAAU,EAAE;YACV,SAAS,CAAC;gBACR,SAAS,EAAE,OAAO;gBAClB,WAAW,EAAE,CAAC;gBACd,aAAa,EAAE,GAAG;aACnB,CAAC;SACH;KACF,EACD,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAE7C,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC;YAC5C,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,IAAI,CAAC,SAAS;SACzB,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAE3D,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACxE,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QAED,MAAM,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACnE,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;QACpF,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5F,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAClD,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,cAAc,EACd;QACE,UAAU,EAAE;YACV,SAAS,CAAC;gBACR,SAAS,EAAE,OAAO;gBAClB,WAAW,EAAE,CAAC;gBACd,aAAa,EAAE,GAAG;aACnB,CAAC;SACH;KACF,EACD,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAE7C,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC;YAC5C,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,IAAI,CAAC,SAAS;SACzB,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAE3D,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACxE,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QAED,MAAM,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACzE,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;QACpF,OAAO;YACL,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;YACpC,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;SACrC,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACnE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC5C,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC;QAEhC,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC;QACpF,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAE3D,MAAM,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QACzC,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACtF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC3C,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC;QACjD,MAAM,YAAY,GAChB,eAAe,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAE3D,MAAM,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACjE,mBAAmB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QACxC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/routes/authz.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyInstance } from "fastify";
+export default function authzRoutes(app: FastifyInstance): Promise<void>;
+//# sourceMappingURL=authz.d.ts.map

package/dist/routes/authz.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz.d.ts","sourceRoot":"","sources":["../../src/routes/authz.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAQ7E,wBAA8B,WAAW,CAAC,GAAG,EAAE,eAAe,iBA4B7D"}

package/dist/routes/authz.js

@@ -0,0 +1,28 @@
+import { z } from "zod";
+import { getSdk } from "../sdk/index.js";
+const CheckSchema = z.object({
+    resource: z.string().min(1),
+    action: z.string().min(1),
+});
+export default async function authzRoutes(app) {
+    const sdk = getSdk();
+    app.post("/authz/check", { preHandler: [app.authenticate] }, async (request, reply) => {
+        const body = CheckSchema.parse(request.body);
+        const membership = request.state?.membership;
+        if (!membership) {
+            return reply.status(403).send({
+                allowed: false,
+                reason: "No organization context",
+            });
+        }
+        const allowed = await sdk.authorization.hasPermission(membership.role, body.resource, body.action);
+        await request.audit("authz_check", {
+            resource: body.resource,
+            action: body.action,
+            role: membership.role,
+            allowed,
+        });
+        return { allowed };
+    });
+}
+//# sourceMappingURL=authz.js.map

package/dist/routes/authz.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz.js","sourceRoot":"","sources":["../../src/routes/authz.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAEzC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1B,CAAC,CAAC;AAEH,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,WAAW,CAAC,GAAoB;IAC5D,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IAErB,GAAG,CAAC,IAAI,CACN,cAAc,EACd,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAClC,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC;QAE7C,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,yBAAyB;aAClC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,aAAa,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACnG,MAAM,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE;YACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,OAAO;SACR,CAAC,CAAC;QAEH,OAAO,EAAE,OAAO,EAAE,CAAC;IACrB,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/routes/config.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyInstance } from "fastify";
+export default function configRoutes(app: FastifyInstance): Promise<void>;
+//# sourceMappingURL=config.d.ts.map

package/dist/routes/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/routes/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAiB7E,wBAA8B,YAAY,CAAC,GAAG,EAAE,eAAe,iBAiD9D"}

package/dist/routes/config.js

@@ -0,0 +1,63 @@
+import { z } from "zod";
+import { createConfigWriter } from "../services/setup/configWriter.js";
+import { queue } from "../services/queue/index.js";
+const UpdateConfigSchema = z.object({
+    values: z.record(z.string()),
+});
+async function requireOwner(request, reply) {
+    await request.server.authenticate(request, reply);
+    if (reply.sent)
+        return;
+    if (request.user.role !== "owner") {
+        return reply.status(403).send({ error: "Forbidden: owner access required" });
+    }
+}
+export default async function configRoutes(app) {
+    // Read current configuration values from the configured store (.env by default).
+    app.get("/", { preHandler: [requireOwner] }, async (_request, reply) => {
+        try {
+            const writer = createConfigWriter();
+            const values = await writer.read();
+            return reply.send({ values });
+        }
+        catch (err) {
+            app.log.error({ err }, "Failed to read configuration");
+            return reply.status(500).send({ error: "Failed to read configuration" });
+        }
+    });
+    // Update configuration values. A restart is required for most changes to take effect.
+    app.put("/", { preHandler: [requireOwner] }, async (request, reply) => {
+        const parsed = UpdateConfigSchema.safeParse(request.body);
+        if (!parsed.success) {
+            return reply.status(400).send({ error: "Invalid input", details: parsed.error.issues });
+        }
+        try {
+            const writer = createConfigWriter();
+            const backup = await writer.backup();
+            if (!backup.success) {
+                return reply.status(500).send({ error: backup.error.message, code: backup.error.code });
+            }
+            const writeResult = await writer.write(parsed.data.values);
+            if (!writeResult.success) {
+                return reply.status(500).send({ error: writeResult.error.message, code: writeResult.error.code });
+            }
+            return reply.send({ ok: true, backupPath: backup.data || undefined });
+        }
+        catch (err) {
+            request.log.error({ err }, "Failed to update configuration");
+            return reply.status(500).send({ error: "Failed to update configuration" });
+        }
+    });
+    // Restart the server so new configuration is loaded.
+    app.post("/restart", { preHandler: [requireOwner] }, async (_request, reply) => {
+        reply.status(202).send({ ok: true, message: "Server is restarting" });
+        try {
+            await queue.close?.();
+        }
+        catch {
+            // ignore
+        }
+        setTimeout(() => process.exit(0), 500);
+    });
+}
+//# sourceMappingURL=config.js.map

package/dist/routes/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/routes/config.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC;AAEnD,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC7B,CAAC,CAAC;AAEH,KAAK,UAAU,YAAY,CAAC,OAAuB,EAAE,KAAmB;IACtE,MAAM,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,IAAI;QAAE,OAAO;IACvB,IAAI,OAAO,CAAC,IAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACnC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,YAAY,CAAC,GAAoB;IAC7D,iFAAiF;IACjF,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,QAAwB,EAAE,KAAmB,EAAE,EAAE;QACnG,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACnC,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,8BAA8B,CAAC,CAAC;YACvD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,sFAAsF;IACtF,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAClG,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;YACrC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1F,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC3D,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;gBACzB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACpG,CAAC;YAED,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,IAAI,SAAS,EAAE,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,gCAAgC,CAAC,CAAC;YAC7D,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,qDAAqD;IACrD,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,UAAU,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,QAAwB,EAAE,KAAmB,EAAE,EAAE;QAC3G,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/routes/emailVerification.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyInstance } from "fastify";
+export default function emailVerificationRoutes(app: FastifyInstance): Promise<void>;
+//# sourceMappingURL=emailVerification.d.ts.map

package/dist/routes/emailVerification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"emailVerification.d.ts","sourceRoot":"","sources":["../../src/routes/emailVerification.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAY7E,wBAA8B,uBAAuB,CAAC,GAAG,EAAE,eAAe,iBA2DzE"}

package/dist/routes/emailVerification.js

@@ -0,0 +1,64 @@
+import { z } from "zod";
+import { findUserByEmail } from "../services/users.js";
+import { sendVerificationEmail, consumeVerificationToken, } from "../services/emailVerification.js";
+import { rateLimit } from "../plugins/rateLimit.js";
+const SendSchema = z.object({
+    email: z.string().email(),
+});
+export default async function emailVerificationRoutes(app) {
+    // Authenticated: resend the verification email for the signed-in user.
+    app.post("/email-verification/send", { preHandler: [app.authenticate] }, async (request, reply) => {
+        const user = request.user;
+        if (!user)
+            return reply.status(401).send({ error: "Unauthorized" });
+        if (user.emailVerified)
+            return { success: true, alreadyVerified: true };
+        try {
+            await sendVerificationEmail(user);
+        }
+        catch (err) {
+            request.log.error({ err }, "Failed to send verification email");
+            return reply.status(500).send({ error: "Failed to send verification email" });
+        }
+        await request.audit("email_verification_sent", { userId: user.id });
+        return { success: true };
+    });
+    // Unauthenticated: request a verification email by address.
+    // Always returns success to avoid user enumeration.
+    app.post("/email-verification/request", {
+        preHandler: [
+            rateLimit({
+                keyPrefix: "email-verification",
+                maxAttempts: 3,
+                windowSeconds: 900,
+            }),
+        ],
+    }, async (request, reply) => {
+        const body = SendSchema.parse(request.body);
+        const user = await findUserByEmail(body.email);
+        if (!user || user.emailVerified) {
+            return reply.status(200).send({ success: true });
+        }
+        try {
+            await sendVerificationEmail(user);
+            await request.audit("email_verification_sent", { userId: user.id });
+        }
+        catch (err) {
+            request.log.error({ err }, "Failed to send verification email");
+        }
+        return { success: true };
+    });
+    app.get("/email-verification/verify", async (request, reply) => {
+        const query = request.query;
+        if (!query.token) {
+            return reply.status(400).send({ error: "Missing token" });
+        }
+        const user = await consumeVerificationToken(query.token);
+        if (!user) {
+            return reply.status(400).send({ error: "Invalid or expired token" });
+        }
+        await request.audit("email_verified", { userId: user.id });
+        return { success: true, email: user.email };
+    });
+}
+//# sourceMappingURL=emailVerification.js.map

package/dist/routes/emailVerification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"emailVerification.js","sourceRoot":"","sources":["../../src/routes/emailVerification.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EACL,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEpD,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;CAC1B,CAAC,CAAC;AAEH,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,uBAAuB,CAAC,GAAoB;IACxE,uEAAuE;IACvE,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAC9H,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAC1B,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QACpE,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;QAExE,IAAI,CAAC;YACH,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,mCAAmC,CAAC,CAAC;YAChE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC,CAAC;QAChF,CAAC;QAED,MAAM,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACpE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,4DAA4D;IAC5D,oDAAoD;IACpD,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE;QACtC,UAAU,EAAE;YACV,SAAS,CAAC;gBACR,SAAS,EAAE,oBAAoB;gBAC/B,WAAW,EAAE,CAAC;gBACd,aAAa,EAAE,GAAG;aACnB,CAAC;SACH;KACF,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACxD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YAChC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,CAAC;YACH,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAClC,MAAM,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,mCAAmC,CAAC,CAAC;QAClE,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,4BAA4B,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAC3F,MAAM,KAAK,GAAG,OAAO,CAAC,KAA2B,CAAC;QAClD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/routes/federation.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyInstance } from "fastify";
+export default function federationRoutes(app: FastifyInstance): Promise<void>;
+//# sourceMappingURL=federation.d.ts.map

package/dist/routes/federation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"federation.d.ts","sourceRoot":"","sources":["../../src/routes/federation.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAuE7E,wBAA8B,gBAAgB,CAAC,GAAG,EAAE,eAAe,iBAkFlE"}

package/dist/routes/federation.js

@@ -0,0 +1,133 @@
+import crypto from "node:crypto";
+import { z } from "zod";
+import { config } from "../config.js";
+import { listSupportedProviders, listConfiguredProviders } from "../services/connectors/registry.js";
+import { getSdk } from "../sdk/index.js";
+import { setSessionCookies, clearSessionCookies } from "../plugins/auth.js";
+import { findApplicationByClientId } from "../services/applications.js";
+import { buildOAuthErrorRedirect, buildOAuthErrorResponse } from "../lib/errors.js";
+import { sendResultError } from "./helpers.js";
+function isProvider(value) {
+    return listSupportedProviders().includes(value);
+}
+function randomState() {
+    return crypto.randomBytes(24).toString("base64url");
+}
+function publicUrl() {
+    return config.AUTH_API_PUBLIC_URL || `http://localhost:${config.PORT}`;
+}
+function callbackRedirectUri(provider) {
+    return `${publicUrl()}/federation/${provider}/callback`;
+}
+function setFederationState(reply, state, clientId) {
+    reply.setCookie("fed_state", state, {
+        path: "/",
+        httpOnly: true,
+        secure: config.COOKIE_SECURE,
+        sameSite: "lax",
+        domain: config.COOKIE_DOMAIN || undefined,
+        maxAge: 600,
+    });
+    if (clientId) {
+        reply.setCookie("fed_client_id", clientId, {
+            path: "/",
+            httpOnly: true,
+            secure: config.COOKIE_SECURE,
+            sameSite: "lax",
+            domain: config.COOKIE_DOMAIN || undefined,
+            maxAge: 600,
+        });
+    }
+}
+function clearFederationCookies(reply) {
+    const opts = {
+        path: "/",
+        httpOnly: true,
+        secure: config.COOKIE_SECURE,
+        sameSite: "lax",
+        domain: config.COOKIE_DOMAIN || undefined,
+    };
+    reply.clearCookie("fed_state", opts);
+    reply.clearCookie("fed_client_id", opts);
+}
+function redirectTargetUrl(clientId, app) {
+    if (app?.redirectUris?.length)
+        return app.redirectUris[0];
+    return process.env.CLIENT_APP_URL || "http://localhost:5173";
+}
+const LinkIdentitySchema = z.object({
+    providerType: z.string(),
+    providerId: z.string().uuid(),
+    externalSub: z.string(),
+    email: z.string().email().optional(),
+});
+export default async function federationRoutes(app) {
+    const sdk = getSdk();
+    app.get("/:provider/start", async (request, reply) => {
+        const { provider } = request.params;
+        if (!isProvider(provider)) {
+            return reply.status(400).send({ error: "Unsupported federation provider" });
+        }
+        const query = request.query;
+        const state = randomState();
+        setFederationState(reply, state, query.client_id);
+        try {
+            const result = await sdk.identity.getFederationAuthorizeUrl(provider, state, callbackRedirectUri(provider));
+            if (!result.success)
+                return sendResultError(reply, result);
+            return reply.redirect(result.data.url);
+        }
+        catch (err) {
+            request.log.error({ err }, "Federation start failed");
+            clearFederationCookies(reply);
+            const { statusCode, body } = buildOAuthErrorResponse(err);
+            return reply.status(statusCode).send(body);
+        }
+    });
+    app.get("/:provider/callback", async (request, reply) => {
+        const { provider } = request.params;
+        if (!isProvider(provider)) {
+            return reply.status(400).send({ error: "Unsupported federation provider" });
+        }
+        const { code, state } = request.query;
+        const cookieState = request.cookies.fed_state;
+        const clientId = request.cookies.fed_client_id;
+        if (!code || !state || state !== cookieState) {
+            clearFederationCookies(reply);
+            return reply.redirect(`${redirectTargetUrl(clientId)}?error=${encodeURIComponent("Invalid federation state")}`);
+        }
+        clearFederationCookies(reply);
+        try {
+            const result = await sdk.identity.completeFederationLogin(provider, code, callbackRedirectUri(provider));
+            if (!result.success)
+                return sendResultError(reply, result);
+            const app = clientId ? await findApplicationByClientId(clientId) : undefined;
+            setSessionCookies(reply, result.data.tokens.accessToken, result.data.tokens.refreshToken, app?.clientId);
+            return reply.redirect(redirectTargetUrl(clientId, app));
+        }
+        catch (err) {
+            request.log.error({ err }, "Federation callback failed");
+            clearSessionCookies(reply);
+            const url = buildOAuthErrorRedirect(err, redirectTargetUrl(clientId), { state });
+            return reply.redirect(url);
+        }
+    });
+    app.get("/providers", async () => {
+        return {
+            providers: listConfiguredProviders(),
+        };
+    });
+    app.post("/link", { preHandler: [app.authenticate] }, async (request, reply) => {
+        const body = LinkIdentitySchema.parse(request.body);
+        const result = await sdk.identity.linkUserIdentity(request.user.id, body.providerId, body.providerType, body.externalSub, body.email);
+        if (!result.success)
+            return sendResultError(reply, result);
+        await request.audit("federation_identity_linked", { userId: request.user.id, providerType: body.providerType, providerId: body.providerId });
+        return reply.status(201).send({ success: true });
+    });
+    app.get("/identities", { preHandler: [app.authenticate] }, async (request) => {
+        const rows = await app.container.identityRepository.listByUserId(request.user.id);
+        return { identities: rows };
+    });
+}
+//# sourceMappingURL=federation.js.map

package/dist/routes/federation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"federation.js","sourceRoot":"","sources":["../../src/routes/federation.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AACrG,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAExE,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AACpF,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,sBAAsB,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,MAAM,CAAC,mBAAmB,IAAI,oBAAoB,MAAM,CAAC,IAAI,EAAE,CAAC;AACzE,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,OAAO,GAAG,SAAS,EAAE,eAAe,QAAQ,WAAW,CAAC;AAC1D,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAmB,EAAE,KAAa,EAAE,QAAiB;IAC/E,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,EAAE;QAClC,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,MAAM,CAAC,aAAa;QAC5B,QAAQ,EAAE,KAAc;QACxB,MAAM,EAAE,MAAM,CAAC,aAAa,IAAI,SAAS;QACzC,MAAM,EAAE,GAAG;KACZ,CAAC,CAAC;IACH,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,CAAC,SAAS,CAAC,eAAe,EAAE,QAAQ,EAAE;YACzC,IAAI,EAAE,GAAG;YACT,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,MAAM,CAAC,aAAa;YAC5B,QAAQ,EAAE,KAAc;YACxB,MAAM,EAAE,MAAM,CAAC,aAAa,IAAI,SAAS;YACzC,MAAM,EAAE,GAAG;SACZ,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAmB;IACjD,MAAM,IAAI,GAAG;QACX,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,MAAM,CAAC,aAAa;QAC5B,QAAQ,EAAE,KAAc;QACxB,MAAM,EAAE,MAAM,CAAC,aAAa,IAAI,SAAS;KAC1C,CAAC;IACF,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IACrC,KAAK,CAAC,WAAW,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAiB,EAAE,GAAiB;IAC7D,IAAI,GAAG,EAAE,YAAY,EAAE,MAAM;QAAE,OAAO,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC1D,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,uBAAuB,CAAC;AAC/D,CAAC;AAED,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAEH,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAoB;IACjE,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IAErB,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACnD,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,MAA8B,CAAC;QAC5D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAsD,CAAC;QAC7E,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAC5B,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAElD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,yBAAyB,CAAC,QAAQ,EAAE,KAAK,EAAE,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC5G,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,yBAAyB,CAAC,CAAC;YACtD,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAC9B,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;YAC1D,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACtD,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,MAA8B,CAAC;QAC5D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,KAA0C,CAAC;QAC3E,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC;QAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAE/C,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;YAC7C,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAC9B,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,iBAAiB,CAAC,QAAQ,CAAC,UAAU,kBAAkB,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAC;QAClH,CAAC;QACD,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAE9B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,uBAAuB,CAAC,QAAQ,EAAE,IAAI,EAAE,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC;YACzG,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC3D,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,yBAAyB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7E,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;YACzG,OAAO,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,4BAA4B,CAAC,CAAC;YACzD,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC3B,MAAM,GAAG,GAAG,uBAAuB,CAAC,GAAG,EAAE,iBAAiB,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACjF,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,IAAI,EAAE;QAC/B,OAAO;YACL,SAAS,EAAE,uBAAuB,EAAE;SACrC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CACN,OAAO,EACP,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAClC,KAAK,EAAE,OAAuB,EAAE,KAAK,EAAE,EAAE;QACvC,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAChD,OAAO,CAAC,IAAK,CAAC,EAAE,EAChB,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,KAAK,CACX,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC3D,MAAM,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,IAAK,CAAC,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QAC9I,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,OAAuB,EAAE,EAAE;QAC3F,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,YAAY,CAAC,OAAO,CAAC,IAAK,CAAC,EAAE,CAAC,CAAC;QACnF,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/routes/helpers.d.ts

@@ -0,0 +1,14 @@
+import type { FastifyReply } from "fastify";
+export declare function sendResultError(reply: FastifyReply, result: {
+    success: false;
+    error: {
+        statusCode?: number;
+        message: string;
+        code: string;
+    };
+}): FastifyReply<import("fastify").RouteGenericInterface, import("fastify").RawServerDefault, import("http").IncomingMessage, import("http").ServerResponse<import("http").IncomingMessage>, unknown, import("fastify").FastifySchema, import("fastify").FastifyTypeProviderDefault, unknown>;
+/**
+ * Escape special XML characters to prevent XML injection.
+ */
+export declare function escapeXml(value: string): string;
+//# sourceMappingURL=helpers.d.ts.map

package/dist/routes/helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../src/routes/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE5C,wBAAgB,eAAe,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,6RAE7I;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAO/C"}