@hilbras/keystone 1.1.0

package/dist/routes/scim.js

@@ -0,0 +1,175 @@
+import { z } from "zod";
+import { eq, and } from "drizzle-orm";
+import { db } from "../db/index.js";
+import { orgMemberships, users } from "../db/schema.js";
+const ScimUserSchema = z.object({
+    userName: z.string().email(),
+    name: z.object({ givenName: z.string().optional(), familyName: z.string().optional() }).optional(),
+    emails: z.array(z.object({ value: z.string().email(), primary: z.boolean().optional() })).optional(),
+    active: z.boolean().optional(),
+});
+function scimUserResponse(user) {
+    return {
+        schemas: ["urn:ietf:params:scim:schemas:core:2.0:User"],
+        id: user.id,
+        userName: user.email,
+        name: {
+            givenName: user.name?.split(" ")[0] || "",
+            familyName: user.name?.split(" ").slice(1).join(" ") || "",
+        },
+        emails: [{ value: user.email, primary: true }],
+        active: true,
+        meta: {
+            resourceType: "User",
+        },
+    };
+}
+function scimGroupResponse(group) {
+    return {
+        schemas: ["urn:ietf:params:scim:schemas:core:2.0:Group"],
+        id: group.id,
+        displayName: group.displayName,
+        members: group.members.map((m) => ({
+            value: m.value,
+            display: m.display,
+            $ref: `Users/${m.value}`,
+        })),
+        meta: {
+            resourceType: "Group",
+        },
+    };
+}
+function scimError(status, detail) {
+    return {
+        schemas: ["urn:ietf:params:scim:api:messages:2.0:Error"],
+        status: String(status),
+        detail,
+    };
+}
+export default async function scimRoutes(app) {
+    app.addHook("onRequest", async (request, reply) => {
+        const auth = request.headers.authorization;
+        const expected = process.env.SCIM_BEARER_TOKEN;
+        if (!expected) {
+            return reply.status(501).send(scimError(501, "SCIM not configured"));
+        }
+        if (!auth || !auth.startsWith("Bearer ") || auth.slice(7) !== expected) {
+            return reply.status(401).send(scimError(401, "Unauthorized"));
+        }
+    });
+    app.get("/scim/v2/Users", async () => {
+        const allUsers = await app.container.userRepository.listAll();
+        return {
+            schemas: ["urn:ietf:params:scim:api:messages:2.0:ListResponse"],
+            totalResults: allUsers.length,
+            Resources: allUsers.map(scimUserResponse),
+        };
+    });
+    app.get("/scim/v2/Users/:userId", async (request, reply) => {
+        const { userId } = request.params;
+        const user = await app.container.userRepository.findById(userId);
+        if (!user) {
+            return reply.status(404).send(scimError(404, "User not found"));
+        }
+        return scimUserResponse(user);
+    });
+    app.post("/scim/v2/Users", async (request, reply) => {
+        const body = ScimUserSchema.parse(request.body);
+        const email = body.userName.toLowerCase().trim();
+        let user = await app.container.userRepository.findByEmail(email);
+        let isNewUser = false;
+        if (!user) {
+            const base = email.split("@")[0];
+            const username = await app.container.userRepository.ensureUniqueUsername(base);
+            const name = body.name
+                ? `${body.name.givenName || ""} ${body.name.familyName || ""}`.trim() || username
+                : username;
+            user = await app.container.userRepository.create({
+                email,
+                username,
+                name,
+                provider: "scim",
+                emailVerified: true,
+            });
+            isNewUser = true;
+        }
+        await request.audit(isNewUser ? "scim_user_created" : "scim_user_updated", { userId: user.id, email: user.email });
+        return reply.status(201).send(scimUserResponse(user));
+    });
+    app.put("/scim/v2/Users/:userId", async (request, reply) => {
+        const { userId } = request.params;
+        const body = ScimUserSchema.parse(request.body);
+        const updated = await app.container.userRepository.update(userId, {
+            email: body.userName.toLowerCase().trim(),
+            name: body.name
+                ? `${body.name.givenName || ""} ${body.name.familyName || ""}`.trim()
+                : undefined,
+        });
+        if (!updated) {
+            return reply.status(404).send(scimError(404, "User not found"));
+        }
+        await request.audit("scim_user_updated", { userId: updated.id, email: updated.email });
+        return scimUserResponse(updated);
+    });
+    app.delete("/scim/v2/Users/:userId", async (request, reply) => {
+        const { userId } = request.params;
+        const user = await app.container.userRepository.findById(userId);
+        await app.container.userRepository.deleteById(userId);
+        await request.audit("scim_user_deleted", { userId, email: user?.email });
+        return reply.status(204).send();
+    });
+    app.get("/scim/v2/Groups", async () => {
+        const memberships = await db
+            .select({ orgId: orgMemberships.orgId, role: orgMemberships.role })
+            .from(orgMemberships);
+        const groupMap = new Map();
+        for (const m of memberships) {
+            const key = `${m.orgId}:${m.role}`;
+            if (!groupMap.has(key)) {
+                groupMap.set(key, { orgId: m.orgId, role: m.role, members: [] });
+            }
+        }
+        const groups = [];
+        for (const [key, group] of groupMap) {
+            const org = await app.container.organizationRepository.findById(group.orgId);
+            const orgName = org?.name || group.orgId;
+            const members = await db
+                .select({ userId: orgMemberships.userId, email: users.email })
+                .from(orgMemberships)
+                .where(and(eq(orgMemberships.orgId, group.orgId), eq(orgMemberships.role, group.role)))
+                .innerJoin(users, eq(orgMemberships.userId, users.id));
+            groups.push({
+                id: key,
+                displayName: `${orgName}:${group.role}`,
+                members: members.map((m) => ({ value: m.userId, display: m.email })),
+            });
+        }
+        return {
+            schemas: ["urn:ietf:params:scim:api:messages:2.0:ListResponse"],
+            totalResults: groups.length,
+            Resources: groups.map(scimGroupResponse),
+        };
+    });
+    app.get("/scim/v2/Groups/:groupId", async (request, reply) => {
+        const { groupId } = request.params;
+        const [orgId, role] = groupId.split(":");
+        if (!orgId || !role) {
+            return reply.status(400).send(scimError(400, "Invalid group ID format. Expected orgId:role"));
+        }
+        const org = await app.container.organizationRepository.findById(orgId);
+        if (!org) {
+            return reply.status(404).send(scimError(404, "Organization not found"));
+        }
+        const members = await db
+            .select({ userId: orgMemberships.userId, email: users.email })
+            .from(orgMemberships)
+            .where(and(eq(orgMemberships.orgId, orgId), eq(orgMemberships.role, role)))
+            .innerJoin(users, eq(orgMemberships.userId, users.id));
+        return scimGroupResponse({
+            id: groupId,
+            displayName: `${org.name}:${role}`,
+            members: members.map((m) => ({ value: m.userId, display: m.email })),
+        });
+    });
+}
+//# sourceMappingURL=scim.js.map

package/dist/routes/scim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scim.js","sourceRoot":"","sources":["../../src/routes/scim.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAExD,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;IAClG,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpG,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAEH,SAAS,gBAAgB,CAAC,IAAwD;IAChF,OAAO;QACL,OAAO,EAAE,CAAC,4CAA4C,CAAC;QACvD,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,QAAQ,EAAE,IAAI,CAAC,KAAK;QACpB,IAAI,EAAE;YACJ,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;YACzC,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;SAC3D;QACD,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC9C,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE;YACJ,YAAY,EAAE,MAAM;SACrB;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAyF;IAClH,OAAO;QACL,OAAO,EAAE,CAAC,6CAA6C,CAAC;QACxD,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjC,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,IAAI,EAAE,SAAS,CAAC,CAAC,KAAK,EAAE;SACzB,CAAC,CAAC;QACH,IAAI,EAAE;YACJ,YAAY,EAAE,OAAO;SACtB;KACF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,MAAc,EAAE,MAAc;IAC/C,OAAO;QACL,OAAO,EAAE,CAAC,6CAA6C,CAAC;QACxD,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;QACtB,MAAM;KACP,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,UAAU,CAAC,GAAoB;IAC3D,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAC9E,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAC3C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YACvE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC;QAChE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,IAAI,EAAE;QACnC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;QAC9D,OAAO;YACL,OAAO,EAAE,CAAC,oDAAoD,CAAC;YAC/D,YAAY,EAAE,QAAQ,CAAC,MAAM;YAC7B,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAC;SAC1C,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACvF,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAA4B,CAAC;QACxD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAChF,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;QAEjD,IAAI,IAAI,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACjE,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACjC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;YAC/E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI;gBACpB,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,QAAQ;gBACjF,CAAC,CAAC,QAAQ,CAAC;YACb,IAAI,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,MAAM,CAAC;gBAC/C,KAAK;gBACL,QAAQ;gBACR,IAAI;gBACJ,QAAQ,EAAE,MAAM;gBAChB,aAAa,EAAE,IAAI;aACpB,CAAC,CAAC;YACH,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;QAED,MAAM,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACnH,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACvF,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAA4B,CAAC;QACxD,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEhD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE;YAChE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE;YACzC,IAAI,EAAE,IAAI,CAAC,IAAI;gBACb,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE;gBACrE,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,OAAO,CAAC,KAAK,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACvF,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,wBAAwB,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAC1F,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAA4B,CAAC;QACxD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACjE,MAAM,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACtD,MAAM,OAAO,CAAC,KAAK,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,IAAI,EAAE;QACpC,MAAM,WAAW,GAAG,MAAM,EAAE;aACzB,MAAM,CAAC,EAAE,KAAK,EAAE,cAAc,CAAC,KAAK,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,EAAE,CAAC;aAClE,IAAI,CAAC,cAAc,CAAC,CAAC;QAExB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA0F,CAAC;QACnH,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvB,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAyF,EAAE,CAAC;QACxG,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;YACpC,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC7E,MAAM,OAAO,GAAG,GAAG,EAAE,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC;YACzC,MAAM,OAAO,GAAG,MAAM,EAAE;iBACrB,MAAM,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;iBAC7D,IAAI,CAAC,cAAc,CAAC;iBACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;iBACtF,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;YAEzD,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE,EAAE,GAAG;gBACP,WAAW,EAAE,GAAG,OAAO,IAAI,KAAK,CAAC,IAAI,EAAE;gBACvC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;aACrE,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,OAAO,EAAE,CAAC,oDAAoD,CAAC;YAC/D,YAAY,EAAE,MAAM,CAAC,MAAM;YAC3B,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC;SACzC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,0BAA0B,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACzF,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,MAA6B,CAAC;QAC1D,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAEzC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YACpB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,8CAA8C,CAAC,CAAC,CAAC;QAChG,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACvE,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;aAC7D,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;aAC1E,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QAEzD,OAAO,iBAAiB,CAAC;YACvB,EAAE,EAAE,OAAO;YACX,WAAW,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,IAAI,EAAE;YAClC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;SACrE,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/routes/sdk.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyInstance } from "fastify";
+export default function sdkRoutes(app: FastifyInstance): Promise<void>;
+//# sourceMappingURL=sdk.d.ts.map

package/dist/routes/sdk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk.d.ts","sourceRoot":"","sources":["../../src/routes/sdk.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAe7E,wBAA8B,SAAS,CAAC,GAAG,EAAE,eAAe,iBAuH3D"}

package/dist/routes/sdk.js

@@ -0,0 +1,129 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import crypto from "node:crypto";
+import { gzip } from "node:zlib";
+import { promisify } from "node:util";
+import { fileURLToPath } from "node:url";
+import { z } from "zod";
+import { createApplication, findApplicationByClientId } from "../services/applications.js";
+import { createOrganization, findOrganizationBySlug, findOrganizationById } from "../services/organizations.js";
+const gzipAsync = promisify(gzip);
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const SDK_FILE = path.resolve(__dirname, "../../packages/keystone-sdk/dist/keystone-dropin.js");
+const ConnectSchema = z.object({
+    projectId: z.string().min(1).max(128).regex(/^[a-zA-Z0-9_-]+$/),
+    redirectUri: z.string().url().optional(),
+    clientId: z.string().optional(),
+});
+export default async function sdkRoutes(app) {
+    // Serve the drop-in SDK so external projects can load it with one script tag.
+    app.get("/keystone-dropin.js", async (request, reply) => {
+        try {
+            const content = await fs.readFile(SDK_FILE, "utf-8");
+            const hash = crypto.createHash("sha256").update(content).digest("base64");
+            const etag = `"${hash}"`;
+            const ifNoneMatch = request.headers["if-none-match"];
+            if (ifNoneMatch === etag) {
+                return reply.status(304).send();
+            }
+            const acceptEncoding = request.headers["accept-encoding"] || "";
+            const useGzip = acceptEncoding.includes("gzip");
+            const body = useGzip ? await gzipAsync(content) : content;
+            reply
+                .header("Content-Type", "application/javascript; charset=utf-8")
+                .header("Cache-Control", "public, max-age=86400, immutable")
+                .header("ETag", etag);
+            if (useGzip)
+                reply.header("Content-Encoding", "gzip");
+            return reply.send(body);
+        }
+        catch (err) {
+            app.log.error({ err }, "SDK file not found");
+            return reply.status(404).send({ error: "SDK not built. Run npm run build:sdk first." });
+        }
+    });
+    // SRI hash for the drop-in SDK so consumers can use integrity="sha256-…".
+    app.get("/keystone-dropin.js.sri", async (request, reply) => {
+        try {
+            const content = await fs.readFile(SDK_FILE, "utf-8");
+            const hash = crypto.createHash("sha256").update(content).digest("base64");
+            reply.header("Cache-Control", "public, max-age=86400, immutable");
+            return { integrity: `sha256-${hash}` };
+        }
+        catch (err) {
+            app.log.error({ err }, "SDK file not found");
+            return reply.status(404).send({ error: "SDK not built. Run npm run build:sdk first." });
+        }
+    });
+    // Public branding lookup for hosted login pages and the drop-in SDK.
+    // Returns only display-safe fields — never secrets.
+    app.get("/branding/:clientId", async (request, reply) => {
+        const { clientId } = request.params;
+        const application = await findApplicationByClientId(clientId);
+        if (!application) {
+            return reply.status(404).send({ error: "Application not found" });
+        }
+        const org = await findOrganizationById(application.orgId);
+        const orgBranding = (org?.branding ?? {});
+        const appBranding = (application.branding ?? {});
+        // App-level branding wins over org-level defaults.
+        const merged = { ...orgBranding, ...appBranding };
+        const pick = (key) => (typeof merged[key] === "string" ? merged[key] : undefined);
+        reply.header("Cache-Control", "public, max-age=300");
+        return {
+            name: pick("companyName") ?? application.name,
+            logoUrl: pick("logoUrl"),
+            primaryColor: pick("primaryColor"),
+            accentColor: pick("accentColor"),
+            supportEmail: pick("supportEmail"),
+            loginTitle: pick("loginTitle"),
+            loginSubtitle: pick("loginSubtitle"),
+        };
+    });
+    // Register or connect an external project/application.
+    app.post("/connect", async (request, reply) => {
+        const parsed = ConnectSchema.safeParse(request.body);
+        if (!parsed.success) {
+            return reply.status(400).send({ error: "Invalid input", details: parsed.error.issues });
+        }
+        const { projectId, redirectUri, clientId } = parsed.data;
+        try {
+            // If clientId is provided, verify the application exists.
+            if (clientId) {
+                const existing = await findApplicationByClientId(clientId);
+                if (!existing) {
+                    return reply.status(404).send({ error: "Application not found" });
+                }
+                return reply.send({
+                    connected: true,
+                    clientId: existing.clientId,
+                    message: "Connected to existing application",
+                });
+            }
+            // Otherwise create a new public client application for this project.
+            // In production this endpoint should be protected or require an admin API key.
+            let defaultOrg = await findOrganizationBySlug("external-projects");
+            if (!defaultOrg) {
+                defaultOrg = await createOrganization({ name: "External Projects", slug: "external-projects" });
+            }
+            const app = await createApplication({
+                orgId: defaultOrg.id,
+                name: projectId,
+                clientId: projectId,
+                redirectUris: redirectUri ? [redirectUri] : [],
+                allowedOrigins: [request.headers.origin || "*"].filter(Boolean),
+            });
+            return reply.status(201).send({
+                connected: true,
+                clientId: app.clientId,
+                clientSecret: app.clientSecret,
+                message: "Application connected to Keystone",
+            });
+        }
+        catch (err) {
+            request.log.error({ err }, "SDK connect failed");
+            return reply.status(500).send({ error: "Connection failed" });
+        }
+    });
+}
+//# sourceMappingURL=sdk.js.map

package/dist/routes/sdk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk.js","sourceRoot":"","sources":["../../src/routes/sdk.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAC3F,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAEhH,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;AAClC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,qDAAqD,CAAC,CAAC;AAEhG,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;IAC/D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACxC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAEH,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,SAAS,CAAC,GAAoB;IAC1D,8EAA8E;IAC9E,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACpF,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACrD,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1E,MAAM,IAAI,GAAG,IAAI,IAAI,GAAG,CAAC;YACzB,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YACrD,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;gBACzB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YAClC,CAAC;YAED,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC;YAChE,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YAE1D,KAAK;iBACF,MAAM,CAAC,cAAc,EAAE,uCAAuC,CAAC;iBAC/D,MAAM,CAAC,eAAe,EAAE,kCAAkC,CAAC;iBAC3D,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACxB,IAAI,OAAO;gBAAE,KAAK,CAAC,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;YACtD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,oBAAoB,CAAC,CAAC;YAC7C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6CAA6C,EAAE,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACxF,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACrD,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1E,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,kCAAkC,CAAC,CAAC;YAClE,OAAO,EAAE,SAAS,EAAE,UAAU,IAAI,EAAE,EAAE,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,oBAAoB,CAAC,CAAC;YAC7C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6CAA6C,EAAE,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,oDAAoD;IACpD,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACpF,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,MAA8B,CAAC;QAC5D,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QAC9D,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAG1D,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAa,CAAC;QACtD,MAAM,WAAW,GAAG,CAAC,WAAW,CAAC,QAAQ,IAAI,EAAE,CAAa,CAAC;QAC7D,mDAAmD;QACnD,MAAM,MAAM,GAAa,EAAE,GAAG,WAAW,EAAE,GAAG,WAAW,EAAE,CAAC;QAC5D,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAE1F,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC;QACrD,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,WAAW,CAAC,IAAI;YAC7C,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;YACxB,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC;YAClC,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC;YAChC,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC;YAClC,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC;YAC9B,aAAa,EAAE,IAAI,CAAC,eAAe,CAAC;SACrC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,uDAAuD;IACvD,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAC1E,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;QAEzD,IAAI,CAAC;YACH,0DAA0D;YAC1D,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,QAAQ,CAAC,CAAC;gBAC3D,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;gBACpE,CAAC;gBACD,OAAO,KAAK,CAAC,IAAI,CAAC;oBAChB,SAAS,EAAE,IAAI;oBACf,QAAQ,EAAE,QAAQ,CAAC,QAAQ;oBAC3B,OAAO,EAAE,mCAAmC;iBAC7C,CAAC,CAAC;YACL,CAAC;YAED,qEAAqE;YACrE,+EAA+E;YAC/E,IAAI,UAAU,GAAG,MAAM,sBAAsB,CAAC,mBAAmB,CAAC,CAAC;YACnE,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,UAAU,GAAG,MAAM,kBAAkB,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAClG,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC;gBAClC,KAAK,EAAE,UAAU,CAAC,EAAE;gBACpB,IAAI,EAAE,SAAS;gBACf,QAAQ,EAAE,SAAS;gBACnB,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE;gBAC9C,cAAc,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;aAChE,CAAC,CAAC;YAEH,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,SAAS,EAAE,IAAI;gBACf,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,OAAO,EAAE,mCAAmC;aAC7C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,oBAAoB,CAAC,CAAC;YACjD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/routes/serviceAccounts.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyInstance } from "fastify";
+export default function serviceAccountRoutes(app: FastifyInstance): Promise<void>;
+//# sourceMappingURL=serviceAccounts.d.ts.map

package/dist/routes/serviceAccounts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serviceAccounts.d.ts","sourceRoot":"","sources":["../../src/routes/serviceAccounts.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AA2B7E,wBAA8B,oBAAoB,CAAC,GAAG,EAAE,eAAe,iBA+FtE"}

package/dist/routes/serviceAccounts.js

@@ -0,0 +1,82 @@
+import { z } from "zod";
+import { createServiceAccount, findServiceAccountsByOrgId, findServiceAccountById, updateServiceAccount, listServiceAccountApiKeys, } from "../services/serviceAccounts.js";
+import { generateApiKey, hashApiKey } from "../services/tokens.js";
+const CreateSchema = z.object({
+    name: z.string().min(1).max(100),
+    description: z.string().max(500).optional(),
+});
+const UpdateSchema = z.object({
+    name: z.string().min(1).max(100).optional(),
+    description: z.string().max(500).optional(),
+    isActive: z.boolean().optional(),
+});
+const CreateKeySchema = z.object({
+    name: z.string().min(1).max(100),
+    scopes: z.array(z.string()).optional(),
+    expiresAt: z.string().datetime().optional(),
+});
+export default async function serviceAccountRoutes(app) {
+    app.post("/organizations/:id/service-accounts", { preHandler: [app.requirePermission("service_account", "create")] }, async (request, reply) => {
+        const { id } = request.params;
+        const body = CreateSchema.parse(request.body);
+        const record = await createServiceAccount({
+            orgId: id,
+            name: body.name,
+            description: body.description,
+        });
+        await request.audit("service_account_created", { orgId: id, serviceAccountId: record.id });
+        return reply.status(201).send(record);
+    });
+    app.get("/organizations/:id/service-accounts", { preHandler: [app.requirePermission("service_account", "read")] }, async (request) => {
+        const { id } = request.params;
+        const accounts = await findServiceAccountsByOrgId(id);
+        return { serviceAccounts: accounts };
+    });
+    app.get("/organizations/:id/service-accounts/:accountId", { preHandler: [app.requirePermission("service_account", "read")] }, async (request, reply) => {
+        const { id, accountId } = request.params;
+        const record = await findServiceAccountById(accountId, id);
+        if (!record) {
+            return reply.status(404).send({ error: "Service account not found" });
+        }
+        const keys = await listServiceAccountApiKeys(accountId);
+        return { ...record, apiKeys: keys };
+    });
+    app.patch("/organizations/:id/service-accounts/:accountId", { preHandler: [app.requirePermission("service_account", "update")] }, async (request, reply) => {
+        const { id, accountId } = request.params;
+        const body = UpdateSchema.parse(request.body);
+        const updated = await updateServiceAccount(accountId, id, body);
+        if (!updated) {
+            return reply.status(404).send({ error: "Service account not found" });
+        }
+        await request.audit("service_account_updated", {
+            orgId: id,
+            serviceAccountId: updated.id,
+        });
+        return updated;
+    });
+    app.post("/organizations/:id/service-accounts/:accountId/api-keys", { preHandler: [app.requirePermission("api_key", "create")] }, async (request, reply) => {
+        const { id, accountId } = request.params;
+        const body = CreateKeySchema.parse(request.body);
+        const account = await findServiceAccountById(accountId, id);
+        if (!account) {
+            return reply.status(404).send({ error: "Service account not found" });
+        }
+        const { key, prefix } = generateApiKey();
+        const record = await app.container.apiKeyRepository.create({
+            serviceAccountId: account.id,
+            orgId: id,
+            name: body.name,
+            prefix,
+            keyHash: hashApiKey(key),
+            scopes: body.scopes?.length ? body.scopes : ["api:read"],
+            expiresAt: body.expiresAt ? new Date(body.expiresAt) : null,
+        });
+        await request.audit("api_key_created", {
+            orgId: id,
+            serviceAccountId: account.id,
+            keyId: record.id,
+        });
+        return { key, apiKey: record };
+    });
+}
+//# sourceMappingURL=serviceAccounts.js.map

package/dist/routes/serviceAccounts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serviceAccounts.js","sourceRoot":"","sources":["../../src/routes/serviceAccounts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,sBAAsB,EACtB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEnE,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAEH,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,oBAAoB,CAAC,GAAoB;IACrE,GAAG,CAAC,IAAI,CACN,qCAAqC,EACrC,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC,EAAE,EACpE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAE9C,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC;YACxC,KAAK,EAAE,EAAE;YACT,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC;QAEH,MAAM,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3F,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,GAAG,CACL,qCAAqC,EACrC,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,EAAE,EAClE,KAAK,EAAE,OAAuB,EAAE,EAAE;QAChC,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC,EAAE,CAAC,CAAC;QACtD,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC;IACvC,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,GAAG,CACL,gDAAgD,EAChD,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,EAAE,EAClE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,MAA2C,CAAC;QAC9E,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,yBAAyB,CAAC,SAAS,CAAC,CAAC;QACxD,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACtC,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,KAAK,CACP,gDAAgD,EAChD,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC,EAAE,EACpE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,MAA2C,CAAC;QAC9E,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAE9C,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,SAAS,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE;YAC7C,KAAK,EAAE,EAAE;YACT,gBAAgB,EAAE,OAAO,CAAC,EAAE;SAC7B,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,yDAAyD,EACzD,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,EAAE,EAC5D,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,MAA2C,CAAC;QAC9E,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEjD,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,MAAM,CAAC;YACzD,gBAAgB,EAAE,OAAO,CAAC,EAAE;YAC5B,KAAK,EAAE,EAAE;YACT,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM;YACN,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC;YACxB,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;YACxD,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;SAC5D,CAAC,CAAC;QAEH,MAAM,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE;YACrC,KAAK,EAAE,EAAE;YACT,gBAAgB,EAAE,OAAO,CAAC,EAAE;YAC5B,KAAK,EAAE,MAAM,CAAC,EAAE;SACjB,CAAC,CAAC;QAEH,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjC,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/routes/sessions.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyInstance } from "fastify";
+export default function sessionRoutes(app: FastifyInstance): Promise<void>;
+//# sourceMappingURL=sessions.d.ts.map

package/dist/routes/sessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/routes/sessions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAU7E,wBAA8B,aAAa,CAAC,GAAG,EAAE,eAAe,iBAkD/D"}

package/dist/routes/sessions.js

@@ -0,0 +1,55 @@
+import crypto from "node:crypto";
+import { config } from "../config.js";
+import { SessionRepository } from "../repositories/session.js";
+const sessions = new SessionRepository();
+function hashToken(token) {
+    return crypto.createHash("sha256").update(token).digest("hex");
+}
+export default async function sessionRoutes(app) {
+    app.get("/sessions", { preHandler: [app.authenticate] }, async (request) => {
+        const userId = request.user?.id;
+        if (!userId)
+            return { sessions: [] };
+        const list = await sessions.listByUser(userId);
+        return {
+            sessions: list.map((s) => ({
+                id: s.id,
+                deviceFingerprint: s.deviceFingerprint,
+                ipAddress: s.ipAddress,
+                userAgent: s.userAgent,
+                lastSeenAt: s.lastSeenAt,
+                expiresAt: s.expiresAt,
+                createdAt: s.createdAt,
+            })),
+        };
+    });
+    app.delete("/sessions/:id", { preHandler: [app.authenticate] }, async (request, reply) => {
+        const userId = request.user?.id;
+        const { id } = request.params;
+        if (!userId)
+            return reply.status(401).send({ error: "Unauthorized" });
+        const session = await sessions.findById(id);
+        if (!session || session.userId !== userId) {
+            return reply.status(404).send({ error: "Session not found" });
+        }
+        await sessions.revokeRefreshToken(session.refreshTokenId);
+        await sessions.deleteById(id, userId);
+        await request.audit("session_revoked", { sessionId: id });
+        return { success: true };
+    });
+    app.post("/sessions/revoke-all", { preHandler: [app.authenticate] }, async (request, reply) => {
+        const userId = request.user?.id;
+        if (!userId)
+            return reply.status(401).send({ error: "Unauthorized" });
+        const currentRefreshToken = request.cookies?.[config.COOKIE_NAME];
+        let currentRefreshTokenId;
+        if (currentRefreshToken) {
+            const row = await sessions.findRefreshTokenByHash(hashToken(currentRefreshToken));
+            currentRefreshTokenId = row?.id;
+        }
+        await sessions.deleteAllForUser(userId, currentRefreshTokenId);
+        await request.audit("sessions_revoked_all", { exceptSessionId: currentRefreshTokenId });
+        return { success: true };
+    });
+}
+//# sourceMappingURL=sessions.js.map

package/dist/routes/sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/routes/sessions.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAE/D,MAAM,QAAQ,GAAG,IAAI,iBAAiB,EAAE,CAAC;AAEzC,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,aAAa,CAAC,GAAoB;IAC9D,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,OAAuB,EAAE,EAAE;QACzF,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC/C,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACzB,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,iBAAiB,EAAE,CAAC,CAAC,iBAAiB;gBACtC,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,SAAS,EAAE,CAAC,CAAC,SAAS;aACvB,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,eAAe,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrH,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAEtE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,QAAQ,CAAC,kBAAkB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC1D,MAAM,QAAQ,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAEtC,MAAM,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAC1H,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAEtE,MAAM,mBAAmB,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAClE,IAAI,qBAAyC,CAAC;QAC9C,IAAI,mBAAmB,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,sBAAsB,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC,CAAC;YAClF,qBAAqB,GAAG,GAAG,EAAE,EAAE,CAAC;QAClC,CAAC;QAED,MAAM,QAAQ,CAAC,gBAAgB,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;QAC/D,MAAM,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,eAAe,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACxF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/routes/setup.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyInstance } from "fastify";
+export default function setupRoutes(app: FastifyInstance): Promise<void>;
+//# sourceMappingURL=setup.d.ts.map

package/dist/routes/setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../../src/routes/setup.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AA+H7E,wBAA8B,WAAW,CAAC,GAAG,EAAE,eAAe,iBA0L7D"}