@hilbras/keystone 1.5.0 → 1.9.0

package/dist/routes/totp.js

@@ -1,23 +1,55 @@
 import { z } from "zod";
 import { config } from "../config.js";
-import { generateSecret, buildProvisioningUri, verifyTOTP, encryptSecret, decryptSecret, generateBackupCodes, storeBackupCodes, verifyBackupCode, } from "../services/totp.js";
+import { rateLimit } from "../plugins/rateLimit.js";
+import { revokeAllUserRefreshTokens } from "../services/tokens.js";
+import { requireStepUp } from "../services/stepUp.js";
+import { SessionRepository } from "../repositories/session.js";
+import { generateSecret, buildProvisioningUri, encryptSecret, generateBackupCodes, storeBackupCodes, verifyBackupCode, verifyUserTotpCode, deleteBackupCodes, } from "../services/totp.js";
 const CodeSchema = z.object({
-    code: z.string().min(6).max(8),
+    code: z.string().regex(/^[0-9]{6}$/, "A TOTP code must be exactly six digits"),
+    // Required to change how the account proves its identity. A stolen session
+    // token must not be enough to take over the account's second factor.
+    password: z.string().max(128).optional(),
+});
+const EnrollSchema = z.object({
+    password: z.string().min(1).max(128),
 });
 const BackupCodeSchema = z.object({
-    code: z.string().min(8).max(16),
+    code: z.string().min(10).max(40),
 });
+/** Sensitive factor operations get their own budget, separate from login. */
+const factorRateLimit = (keyPrefix) => rateLimit({ keyPrefix, maxAttempts: 10, windowSeconds: 300 });
 export default async function totpRoutes(app) {
-    app.post("/totp/enroll", { preHandler: [app.authenticate] }, async (request, reply) => {
+    app.post("/totp/enroll", { preHandler: [app.authenticate, factorRateLimit("totp-enroll")] }, async (request, reply) => {
         const user = request.user;
         if (user.totpEnabled) {
             return reply.status(409).send({ error: "TOTP already enrolled" });
         }
+        // Enrollment hands out the raw secret and the backup codes, so a valid
+        // session is not sufficient on its own.
+        const body = EnrollSchema.parse(request.body);
+        const stepUp = await requireStepUp(request.server.container.userRepository, user, body.password);
+        if (!stepUp.ok) {
+            await request.audit("mfa_bypass_blocked", { userId: user.id, action: "totp_enroll" });
+            return reply.status(stepUp.error.statusCode ?? 401).send({
+                error: stepUp.error.message,
+                code: stepUp.error.code,
+            });
+        }
         const secret = generateSecret();
         const encrypted = encryptSecret(secret);
         const { codes, hashes } = generateBackupCodes();
-        await app.container.userRepository.setTotpSecret(user.id, encrypted);
-        await storeBackupCodes(user.id, hashes);
+        // Enrollment is not atomic on its own, so a partial failure must not leave
+        // a usable factor half-registered.
+        try {
+            await app.container.userRepository.setTotpSecret(user.id, encrypted);
+            await storeBackupCodes(user.id, hashes);
+        }
+        catch (err) {
+            await app.container.userRepository.disableTotp(user.id).catch(() => { });
+            request.log.error({ err }, "TOTP enrollment failed");
+            return reply.status(500).send({ error: "Could not start TOTP enrollment" });
+        }
         const provisioningUri = buildProvisioningUri({
             secret,
             email: user.email,
@@ -30,49 +62,107 @@ export default async function totpRoutes(app) {
             backupCodes: codes,
         };
     });
-    app.post("/totp/backup", { preHandler: [app.authenticate] }, async (request, reply) => {
+    /**
+     * Regenerate backup codes. Requires the current TOTP code so a hijacked
+     * session cannot silently mint fresh recovery material.
+     */
+    app.post("/totp/backup", { preHandler: [app.authenticate, factorRateLimit("totp-backup")] }, async (request, reply) => {
         const user = request.user;
         if (!user.totpSecret || !user.totpEnabled) {
             return reply.status(400).send({ error: "TOTP not enabled" });
         }
-        const body = BackupCodeSchema.parse(request.body);
-        const valid = await verifyBackupCode(user.id, body.code);
-        if (!valid) {
-            await request.audit("totp_verify_failed", { userId: user.id, method: "backup_code" });
-            return reply.status(400).send({ error: "Invalid backup code" });
+        const body = CodeSchema.parse(request.body);
+        const stepUp = await requireStepUp(request.server.container.userRepository, user, body.password);
+        if (!stepUp.ok) {
+            await request.audit("mfa_bypass_blocked", { userId: user.id, action: "totp_backup_regen" });
+            return reply.status(stepUp.error.statusCode ?? 401).send({
+                error: stepUp.error.message,
+                code: stepUp.error.code,
+            });
         }
-        await request.audit("totp_enabled", { userId: user.id, method: "backup_code" });
-        return { success: true };
+        const verified = await verifyUserTotpCode(user, body.code);
+        if (!verified.valid) {
+            await request.audit("totp_verify_failed", { userId: user.id, method: "totp" });
+            return reply.status(401).send({ error: "Invalid code" });
+        }
+        const { codes, hashes } = generateBackupCodes();
+        await storeBackupCodes(user.id, hashes);
+        await request.audit("mfa_backup_code_regenerated", { userId: user.id });
+        return { backupCodes: codes };
     });
-    app.post("/totp/verify", { preHandler: [app.authenticate] }, async (request, reply) => {
+    app.post("/totp/verify", { preHandler: [app.authenticate, factorRateLimit("totp-verify")] }, async (request, reply) => {
         const user = request.user;
         if (!user.totpSecret) {
             return reply.status(400).send({ error: "TOTP not enrolled" });
         }
         const body = CodeSchema.parse(request.body);
-        const secret = decryptSecret(user.totpSecret);
-        if (!verifyTOTP(secret, body.code)) {
+        const stepUp = await requireStepUp(request.server.container.userRepository, user, body.password);
+        if (!stepUp.ok) {
+            await request.audit("mfa_bypass_blocked", { userId: user.id, action: "totp_verify" });
+            return reply.status(stepUp.error.statusCode ?? 401).send({
+                error: stepUp.error.message,
+                code: stepUp.error.code,
+            });
+        }
+        // Enrollment verification still goes through the user's own secret, and
+        // the time-step is consumed so the same code cannot enable MFA twice.
+        const verified = await verifyUserTotpCode(user, body.code, {
+            requireEnabled: false,
+        });
+        if (!verified.valid) {
             await request.audit("totp_verify_failed", { userId: user.id });
-            return reply.status(400).send({ error: "Invalid code" });
+            return reply.status(401).send({ error: "Invalid code" });
         }
         await app.container.userRepository.enableTotp(user.id);
+        // Enrolling MFA must not leave sessions that were created before the
+        // second factor existed.
+        await revokeAllUserRefreshTokens(user.id);
+        await new SessionRepository().revokeAllForUser(user.id);
+        await app.container.mfaChallengeRepository.invalidateUserChallenges(user.id, new Date());
         await request.audit("totp_enabled", { userId: user.id });
-        return { success: true };
+        return { success: true, sessionsRevoked: true };
     });
-    app.post("/totp/disable", { preHandler: [app.authenticate] }, async (request, reply) => {
+    app.post("/totp/disable", { preHandler: [app.authenticate, factorRateLimit("totp-disable")] }, async (request, reply) => {
         const user = request.user;
         if (!user.totpSecret || !user.totpEnabled) {
             return reply.status(400).send({ error: "TOTP not enabled" });
         }
         const body = CodeSchema.parse(request.body);
-        const secret = decryptSecret(user.totpSecret);
-        if (!verifyTOTP(secret, body.code)) {
+        const stepUp = await requireStepUp(request.server.container.userRepository, user, body.password);
+        if (!stepUp.ok) {
+            await request.audit("mfa_bypass_blocked", { userId: user.id, action: "totp_disable" });
+            return reply.status(stepUp.error.statusCode ?? 401).send({
+                error: stepUp.error.message,
+                code: stepUp.error.code,
+            });
+        }
+        const verified = await verifyUserTotpCode(user, body.code);
+        if (!verified.valid) {
             await request.audit("totp_disable_failed", { userId: user.id });
-            return reply.status(400).send({ error: "Invalid code" });
+            return reply.status(401).send({ error: "Invalid code" });
         }
         await app.container.userRepository.disableTotp(user.id);
+        // Recovery material must not outlive the factor it recovers.
+        await deleteBackupCodes(user.id);
         await request.audit("totp_disabled", { userId: user.id });
         return { success: true };
     });
+    /**
+     * Verify a backup code out of band (e.g. account recovery tooling). This
+     * never establishes a session; login completes through /auth/mfa/verify.
+     */
+    app.post("/totp/backup/verify", { preHandler: [app.authenticate, factorRateLimit("totp-backup-verify")] }, async (request, reply) => {
+        const user = request.user;
+        if (!user.totpSecret || !user.totpEnabled) {
+            return reply.status(400).send({ error: "TOTP not enabled" });
+        }
+        const body = BackupCodeSchema.parse(request.body);
+        const valid = await verifyBackupCode(user.id, body.code);
+        if (!valid) {
+            await request.audit("totp_verify_failed", { userId: user.id, method: "backup_code" });
+            return reply.status(401).send({ error: "Invalid backup code" });
+        }
+        return { success: true, sessionEstablished: false };
+    });
 }
 //# sourceMappingURL=totp.js.map

package/dist/routes/totp.js.map

@@ -1 +1 @@
-{"version":3,"file":"totp.js","sourceRoot":"","sources":["../../src/routes/totp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,UAAU,EACV,aAAa,EACb,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAE7B,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CAChC,CAAC,CAAC;AAEH,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,UAAU,CAAC,GAAoB;IAC3D,GAAG,CAAC,IAAI,CACN,cAAc,EACd,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAClC,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,mBAAmB,EAAE,CAAC;QAEhD,MAAM,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QACrE,MAAM,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAExC,MAAM,eAAe,GAAG,oBAAoB,CAAC;YAC3C,MAAM;YACN,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,MAAM,CAAC,WAAW;SAC3B,CAAC,CAAC;QAEH,MAAM,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAE1D,OAAO;YACL,MAAM;YACN,eAAe;YACf,WAAW,EAAE,KAAK;SACnB,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,cAAc,EACd,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAClC,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;YACtF,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;QAChF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,cAAc,EACd,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAClC,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/D,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvD,MAAM,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAEzD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,eAAe,EACf,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAClC,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YAChE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxD,MAAM,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAE1D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"totp.js","sourceRoot":"","sources":["../../src/routes/totp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAE7B,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,wCAAwC,CAAC;IAC9E,2EAA2E;IAC3E,qEAAqE;IACrE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACrC,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CACjC,CAAC,CAAC;AAEH,6EAA6E;AAC7E,MAAM,eAAe,GAAG,CAAC,SAAiB,EAAE,EAAE,CAC5C,SAAS,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC;AAEhE,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,UAAU,CAAC,GAAoB;IAC3D,GAAG,CAAC,IAAI,CACN,cAAc,EACd,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC,aAAa,CAAC,CAAC,EAAE,EAClE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,uEAAuE;QACvE,wCAAwC;QACxC,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjG,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;YACtF,OAAO,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAM,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;gBACxD,KAAK,EAAE,MAAM,CAAC,KAAM,CAAC,OAAO;gBAC5B,IAAI,EAAE,MAAM,CAAC,KAAM,CAAC,IAAI;aACzB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,mBAAmB,EAAE,CAAC;QAEhD,2EAA2E;QAC3E,mCAAmC;QACnC,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YACrE,MAAM,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACxE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,wBAAwB,CAAC,CAAC;YACrD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,eAAe,GAAG,oBAAoB,CAAC;YAC3C,MAAM;YACN,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,MAAM,CAAC,WAAW;SAC3B,CAAC,CAAC;QAEH,MAAM,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAE1D,OAAO;YACL,MAAM;YACN,eAAe;YACf,WAAW,EAAE,KAAK;SACnB,CAAC;IACJ,CAAC,CACF,CAAC;IAEF;;;OAGG;IACH,GAAG,CAAC,IAAI,CACN,cAAc,EACd,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC,aAAa,CAAC,CAAC,EAAE,EAClE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAE5C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjG,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC5F,OAAO,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAM,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;gBACxD,KAAK,EAAE,MAAM,CAAC,KAAM,CAAC,OAAO;gBAC5B,IAAI,EAAE,MAAM,CAAC,KAAM,CAAC,IAAI;aACzB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACpB,MAAM,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YAC/E,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,mBAAmB,EAAE,CAAC;QAChD,MAAM,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACxC,MAAM,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAExE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IAChC,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,cAAc,EACd,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC,aAAa,CAAC,CAAC,EAAE,EAClE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAE5C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjG,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;YACtF,OAAO,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAM,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;gBACxD,KAAK,EAAE,MAAM,CAAC,KAAM,CAAC,OAAO;gBAC5B,IAAI,EAAE,MAAM,CAAC,KAAM,CAAC,IAAI;aACzB,CAAC,CAAC;QACL,CAAC;QAED,wEAAwE;QACxE,sEAAsE;QACtE,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;YACzD,cAAc,EAAE,KAAK;SACtB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACpB,MAAM,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/D,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEvD,qEAAqE;QACrE,yBAAyB;QACzB,MAAM,0BAA0B,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1C,MAAM,IAAI,iBAAiB,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxD,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;QAEzF,MAAM,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAEzD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;IAClD,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,eAAe,EACf,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC,cAAc,CAAC,CAAC,EAAE,EACnE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAE5C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjG,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;YACvF,OAAO,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAM,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;gBACxD,KAAK,EAAE,MAAM,CAAC,KAAM,CAAC,OAAO;gBAC5B,IAAI,EAAE,MAAM,CAAC,KAAM,CAAC,IAAI;aACzB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACpB,MAAM,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YAChE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxD,6DAA6D;QAC7D,MAAM,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAE1D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CACF,CAAC;IAEF;;;OAGG;IACH,GAAG,CAAC,IAAI,CACN,qBAAqB,EACrB,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC,oBAAoB,CAAC,CAAC,EAAE,EACzE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;YACtF,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC;IACtD,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/routes/webauthn.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webauthn.d.ts","sourceRoot":"","sources":["../../src/routes/webauthn.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAkD7E,wBAA8B,cAAc,CAAC,GAAG,EAAE,eAAe,iBA+FhE"}
+{"version":3,"file":"webauthn.d.ts","sourceRoot":"","sources":["../../src/routes/webauthn.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAsD7E,wBAA8B,cAAc,CAAC,GAAG,EAAE,eAAe,iBAuIhE"}

package/dist/routes/webauthn.js

@@ -1,15 +1,17 @@
 import { z } from "zod";
+import { config } from "../config.js";
 import { buildRegistrationOptions, verifyAndStoreRegistration, buildAuthenticationOptions, verifyAuthentication, consumeChallenge, } from "../services/webauthn.js";
-import { createTokenSet } from "../services/tokens.js";
+import { createTokenSet, MfaRequiredError } from "../services/tokens.js";
+import { requireStepUp } from "../services/stepUp.js";
 import { setSessionCookies } from "../plugins/auth.js";
 import { fingerprintFromRequest, recordDevice } from "../services/devices.js";
-import { toPublicUser } from "../types.js";
+import { toSelfUser } from "../types.js";
 const ChallengeCookieName = "keystone_webauthn_challenge";
 function setChallengeCookie(reply, challenge) {
     reply.setCookie(ChallengeCookieName, challenge, {
         path: "/",
         httpOnly: true,
-        secure: process.env.COOKIE_SECURE === "true",
+        secure: config.COOKIE_SECURE,
         sameSite: "lax",
         maxAge: 300,
     });
@@ -21,14 +23,17 @@ function clearChallengeCookie(reply) {
     reply.clearCookie(ChallengeCookieName, { path: "/" });
 }
 const RegisterVerifySchema = z.object({
-    response: z.record(z.unknown()),
+    response: z.record(z.string(), z.unknown()),
     deviceName: z.string().max(100).optional(),
+    // Required to register a passkey on an account that already has TOTP: a
+    // stolen session token must not be enough to mint a new second factor.
+    password: z.string().max(128).optional(),
 });
 const AuthenticateOptionsSchema = z.object({
     email: z.string().email().optional(),
 });
 const AuthenticateVerifySchema = z.object({
-    response: z.record(z.unknown()),
+    response: z.record(z.string(), z.unknown()),
 });
 export default async function webauthnRoutes(app) {
     app.get("/webauthn/register/options", { preHandler: [app.authenticate] }, async (request, reply) => {
@@ -40,6 +45,16 @@ export default async function webauthnRoutes(app) {
     app.post("/webauthn/register/verify", { preHandler: [app.authenticate] }, async (request, reply) => {
         const user = request.user;
         const body = RegisterVerifySchema.parse(request.body);
+        if (user.totpEnabled) {
+            const stepUp = await requireStepUp(request.server.container.userRepository, user, body.password);
+            if (!stepUp.ok) {
+                await request.audit("mfa_bypass_blocked", { userId: user.id, action: "webauthn_register" });
+                return reply.status(stepUp.error.statusCode ?? 401).send({
+                    error: stepUp.error.message,
+                    code: stepUp.error.code,
+                });
+            }
+        }
         const challenge = getChallengeCookie(request);
         if (!challenge) {
             return reply.status(400).send({ error: "Challenge expired or missing" });
@@ -78,20 +93,41 @@ export default async function webauthnRoutes(app) {
             return reply.status(400).send({ error: "Invalid challenge" });
         }
         try {
-            const { user } = await verifyAuthentication(body.response, challenge);
+            const { user, credentialRegisteredAt } = await verifyAuthentication(body.response, challenge);
             clearChallengeCookie(reply);
+            // A passkey registered *after* TOTP was enabled must not be able to
+            // satisfy the TOTP requirement on its own, otherwise a leaked session
+            // token could be traded for a permanent second-factor bypass.
+            const enrolledAfterTotp = user.totpEnabled &&
+                !!user.totpVerifiedAt &&
+                credentialRegisteredAt.getTime() > user.totpVerifiedAt.getTime();
+            if (enrolledAfterTotp) {
+                await request.audit("mfa_bypass_blocked", { userId: user.id, action: "webauthn_after_totp" });
+                return reply.status(403).send({
+                    error: "This passkey was registered after multi-factor authentication was enabled and cannot be used to sign in on its own.",
+                    code: "MFA_REQUIRED",
+                });
+            }
             const fingerprint = fingerprintFromRequest(request);
             await recordDevice(user.id, fingerprint, request.ip, request.headers["user-agent"]);
-            const tokens = await createTokenSet(user, request.ip, request.headers["user-agent"], {}, fingerprint);
+            const tokens = await createTokenSet(user, request.ip, request.headers["user-agent"], 
+            // A verified WebAuthn assertion is itself a possession factor.
+            { mfaFactor: "webauthn" }, fingerprint);
             setSessionCookies(reply, tokens.accessToken, tokens.refreshToken);
             await request.audit("webauthn_authenticated", { userId: user.id });
             return {
-                user: toPublicUser(user),
+                user: toSelfUser(user),
                 accessToken: tokens.accessToken,
                 refreshToken: tokens.refreshToken,
             };
         }
         catch (err) {
+            if (err instanceof MfaRequiredError) {
+                return reply.status(403).send({
+                    error: "Multi-factor authentication is required for this account.",
+                    code: "MFA_REQUIRED",
+                });
+            }
             const message = err instanceof Error ? err.message : "Authentication failed";
             return reply.status(400).send({ error: message });
         }

package/dist/routes/webauthn.js.map

@@ -1 +1 @@
-{"version":3,"file":"webauthn.js","sourceRoot":"","sources":["../../src/routes/webauthn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,0BAA0B,EAC1B,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,mBAAmB,GAAG,6BAA6B,CAAC;AAE1D,SAAS,kBAAkB,CAAC,KAAmB,EAAE,SAAiB;IAChE,KAAK,CAAC,SAAS,CAAC,mBAAmB,EAAE,SAAS,EAAE;QAC9C,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,MAAM;QAC5C,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,GAAG;KACZ,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAuB;IACjD,OAAO,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAmB;IAC/C,KAAK,CAAC,WAAW,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAEH,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAEH,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;CAChC,CAAC,CAAC;AAEH,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,cAAc,CAAC,GAAoB;IAC/D,GAAG,CAAC,GAAG,CACL,4BAA4B,EAC5B,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAClC,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACrD,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC7C,OAAO,OAAO,CAAC;IACjB,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,2BAA2B,EAC3B,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAClC,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;YACzC,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,0BAA0B,CAC9B,IAAI,EACJ,IAAI,CAAC,QAA+C,EACpD,SAAS,EACT,IAAI,CAAC,UAAU,CAChB,CAAC;YACF,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAC5B,MAAM,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YAChE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC;YAC3E,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CAAC,gCAAgC,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAChG,MAAM,IAAI,GAAG,yBAAyB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7D,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC7C,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,+BAA+B,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAC/F,MAAM,IAAI,GAAG,wBAAwB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,SAAS,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,oBAAoB,CACzC,IAAI,CAAC,QAAiD,EACtD,SAAS,CACV,CAAC;YACF,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAE5B,MAAM,WAAW,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;YACpD,MAAM,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;YACpF,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC,IAAI,EACJ,OAAO,CAAC,EAAE,EACV,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAC7B,EAAE,EACF,WAAW,CACZ,CAAC;YACF,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;YAElE,MAAM,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACnE,OAAO;gBACL,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC;gBACxB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;aAClC,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC;YAC7E,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"webauthn.js","sourceRoot":"","sources":["../../src/routes/webauthn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAMtC,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,0BAA0B,EAC1B,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,mBAAmB,GAAG,6BAA6B,CAAC;AAE1D,SAAS,kBAAkB,CAAC,KAAmB,EAAE,SAAiB;IAChE,KAAK,CAAC,SAAS,CAAC,mBAAmB,EAAE,SAAS,EAAE;QAC9C,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,MAAM,CAAC,aAAa;QAC5B,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,GAAG;KACZ,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAuB;IACjD,OAAO,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAmB;IAC/C,KAAK,CAAC,WAAW,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC1C,wEAAwE;IACxE,uEAAuE;IACvE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAEH,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAEH,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;CAC5C,CAAC,CAAC;AAEH,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,cAAc,CAAC,GAAoB;IAC/D,GAAG,CAAC,GAAG,CACL,4BAA4B,EAC5B,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAClC,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACrD,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC7C,OAAO,OAAO,CAAC;IACjB,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,2BAA2B,EAC3B,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAClC,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEtD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,EACvC,IAAI,EACJ,IAAI,CAAC,QAAQ,CACd,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,MAAM,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBAC5F,OAAO,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAM,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;oBACxD,KAAK,EAAE,MAAM,CAAC,KAAM,CAAC,OAAO;oBAC5B,IAAI,EAAE,MAAM,CAAC,KAAM,CAAC,IAAI;iBACzB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;YACzC,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,0BAA0B,CAC9B,IAAI,EACJ,IAAI,CAAC,QAA+C,EACpD,SAAS,EACT,IAAI,CAAC,UAAU,CAChB,CAAC;YACF,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAC5B,MAAM,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YAChE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC;YAC3E,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CAAC,gCAAgC,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAChG,MAAM,IAAI,GAAG,yBAAyB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7D,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC7C,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,+BAA+B,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAC/F,MAAM,IAAI,GAAG,wBAAwB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,SAAS,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,MAAM,oBAAoB,CACjE,IAAI,CAAC,QAAiD,EACtD,SAAS,CACV,CAAC;YACF,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAE5B,oEAAoE;YACpE,sEAAsE;YACtE,8DAA8D;YAC9D,MAAM,iBAAiB,GACrB,IAAI,CAAC,WAAW;gBAChB,CAAC,CAAC,IAAI,CAAC,cAAc;gBACrB,sBAAsB,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;YAEnE,IAAI,iBAAiB,EAAE,CAAC;gBACtB,MAAM,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;gBAC9F,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBAC5B,KAAK,EACH,qHAAqH;oBACvH,IAAI,EAAE,cAAc;iBACrB,CAAC,CAAC;YACL,CAAC;YAED,MAAM,WAAW,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;YACpD,MAAM,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;YACpF,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC,IAAI,EACJ,OAAO,CAAC,EAAE,EACV,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;YAC7B,+DAA+D;YAC/D,EAAE,SAAS,EAAE,UAAU,EAAE,EACzB,WAAW,CACZ,CAAC;YACF,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;YAElE,MAAM,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACnE,OAAO;gBACL,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC;gBACtB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;aAClC,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,gBAAgB,EAAE,CAAC;gBACpC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBAC5B,KAAK,EAAE,2DAA2D;oBAClE,IAAI,EAAE,cAAc;iBACrB,CAAC,CAAC;YACL,CAAC;YACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC;YAC7E,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/routes/workflows.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflows.d.ts","sourceRoot":"","sources":["../../src/routes/workflows.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAuC7E,wBAA8B,cAAc,CAAC,GAAG,EAAE,eAAe,iBAoHhE"}
+{"version":3,"file":"workflows.d.ts","sourceRoot":"","sources":["../../src/routes/workflows.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AA8B/C,wBAA8B,cAAc,CAAC,GAAG,EAAE,eAAe,iBAmKhE"}

package/dist/routes/workflows.js

@@ -3,35 +3,28 @@ import { eq, and } from "drizzle-orm";
 import { db } from "../db/index.js";
 import { workflows, orgMemberships } from "../db/schema.js";
 import { registerWorkflow, listWorkflowRuns } from "../services/workflows/engine.js";
-const WorkflowStepSchema = z.object({
+import { isBlockedWorkflowStep } from "../services/workflows/steps.js";
+import { isPlatformRole } from "../services/domain/authorization.js";
+import { getSdk } from "../sdk/index.js";
+import { sendResultError } from "./admin/helpers.js";
+const WorkflowStepSchema = z
+    .object({
     type: z.string(),
     name: z.string().optional(),
+})
+    .passthrough()
+    .refine((step) => !isBlockedWorkflowStep(step), {
+    message: "This workflow step is not allowed for organization workflows",
 });
 const CreateWorkflowSchema = z.object({
     orgId: z.string().uuid(),
     name: z.string().min(1).max(255),
     trigger: z.enum(["user_registered", "user_login", "organization_created"]),
     definition: z.object({
-        steps: z.array(WorkflowStepSchema.and(z.record(z.unknown()))),
+        steps: z.array(WorkflowStepSchema),
     }),
     isActive: z.boolean().optional(),
 });
-async function requireOrgMembership(request, reply, orgId) {
-    await request.server.authenticate(request, reply);
-    if (reply.sent)
-        return false;
-    const userId = request.user.id;
-    const [membership] = await db
-        .select()
-        .from(orgMemberships)
-        .where(and(eq(orgMemberships.orgId, orgId), eq(orgMemberships.userId, userId)))
-        .limit(1);
-    if (!membership) {
-        reply.status(403).send({ error: "Forbidden: not a member of this organization" });
-        return false;
-    }
-    return true;
-}
 export default async function workflowRoutes(app) {
     app.get("/workflows", { preHandler: [app.authenticate] }, async (request, reply) => {
         const query = request.query;
@@ -53,7 +46,16 @@ export default async function workflowRoutes(app) {
         return { workflows: all };
     });
     app.post("/workflows", { preHandler: [app.authenticate] }, async (request, reply) => {
-        const body = CreateWorkflowSchema.parse(request.body);
+        const parsed = CreateWorkflowSchema.safeParse(request.body);
+        if (!parsed.success) {
+            return reply.status(400).send({ error: "Invalid workflow", details: parsed.error.issues });
+        }
+        const body = parsed.data;
+        const permission = await getSdk().authorization.requirePermission(request.user.id, body.orgId, "organization", "update");
+        if (!permission.success) {
+            await request.audit("unauthorized_access", { action: "workflow_create", orgId: body.orgId });
+            return sendResultError(reply, permission);
+        }
         // Verify org membership
         const userId = request.user.id;
         const [membership] = await db
@@ -64,11 +66,15 @@ export default async function workflowRoutes(app) {
         if (!membership) {
             return reply.status(403).send({ error: "Forbidden: not a member of this organization" });
         }
+        request.state.membership = membership;
+        request.state.org = await app.container.organizationRepository.findById(body.orgId) ?? undefined;
         const workflow = await registerWorkflow({
+            actorId: request.user.id,
             orgId: body.orgId,
             name: body.name,
             trigger: body.trigger,
             definition: body.definition,
+            isActive: body.isActive,
         });
         await request.audit("workflow_created", { workflowId: workflow.id, trigger: body.trigger, orgId: body.orgId });
         return reply.status(201).send(workflow);
@@ -78,8 +84,13 @@ export default async function workflowRoutes(app) {
         const [workflow] = await db.select().from(workflows).where(eq(workflows.id, id)).limit(1);
         if (!workflow)
             return reply.status(404).send({ error: "Workflow not found" });
-        // Verify org membership
-        if (workflow.orgId) {
+        if (!workflow.orgId) {
+            if (!isPlatformRole(request.user.role) || request.user.role !== "owner") {
+                await request.audit("unauthorized_access", { action: "global_workflow_access", workflowId: workflow.id });
+                return reply.status(403).send({ error: "Platform owner access required" });
+            }
+        }
+        else {
             const userId = request.user.id;
             const [membership] = await db
                 .select()
@@ -89,6 +100,8 @@ export default async function workflowRoutes(app) {
             if (!membership) {
                 return reply.status(403).send({ error: "Forbidden" });
             }
+            request.state.membership = membership;
+            request.state.org = await app.container.organizationRepository.findById(workflow.orgId) ?? undefined;
         }
         return { workflow };
     });
@@ -99,16 +112,29 @@ export default async function workflowRoutes(app) {
         const [workflow] = await db.select().from(workflows).where(eq(workflows.id, id)).limit(1);
         if (!workflow)
             return reply.status(404).send({ error: "Workflow not found" });
-        // Verify org membership
-        if (workflow.orgId) {
+        if (!workflow.orgId) {
+            if (!isPlatformRole(request.user.role) || request.user.role !== "owner") {
+                await request.audit("unauthorized_access", { action: "global_workflow_access", workflowId: workflow.id });
+                return reply.status(403).send({ error: "Platform owner access required" });
+            }
+        }
+        else {
             const [membership] = await db
                 .select()
                 .from(orgMemberships)
                 .where(and(eq(orgMemberships.orgId, workflow.orgId), eq(orgMemberships.userId, userId)))
                 .limit(1);
             if (!membership) {
+                await request.audit("unauthorized_access", { action: "workflow_membership_required", workflowId: workflow.id, orgId: workflow.orgId });
                 return reply.status(403).send({ error: "Forbidden" });
             }
+            request.state.membership = membership;
+            request.state.org = await app.container.organizationRepository.findById(workflow.orgId) ?? undefined;
+            const permission = await getSdk().authorization.requirePermission(userId, workflow.orgId, "organization", "update");
+            if (!permission.success) {
+                await request.audit("unauthorized_access", { action: "workflow_delete", orgId: workflow.orgId, workflowId: workflow.id });
+                return sendResultError(reply, permission);
+            }
         }
         const [record] = await db.delete(workflows).where(eq(workflows.id, id)).returning();
         if (!record)
@@ -121,8 +147,13 @@ export default async function workflowRoutes(app) {
         const [workflow] = await db.select().from(workflows).where(eq(workflows.id, id)).limit(1);
         if (!workflow)
             return reply.status(404).send({ error: "Workflow not found" });
-        // Verify org membership
-        if (workflow.orgId) {
+        if (!workflow.orgId) {
+            if (!isPlatformRole(request.user.role) || request.user.role !== "owner") {
+                await request.audit("unauthorized_access", { action: "global_workflow_access", workflowId: workflow.id });
+                return reply.status(403).send({ error: "Platform owner access required" });
+            }
+        }
+        else {
             const userId = request.user.id;
             const [membership] = await db
                 .select()
@@ -132,6 +163,8 @@ export default async function workflowRoutes(app) {
             if (!membership) {
                 return reply.status(403).send({ error: "Forbidden" });
             }
+            request.state.membership = membership;
+            request.state.org = await app.container.organizationRepository.findById(workflow.orgId) ?? undefined;
         }
         const runs = await listWorkflowRuns(id);
         return { runs };

package/dist/routes/workflows.js.map

@@ -1 +1 @@
-{"version":3,"file":"workflows.js","sourceRoot":"","sources":["../../src/routes/workflows.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAErF,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACxB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,iBAAiB,EAAE,YAAY,EAAE,sBAAsB,CAAC,CAAC;IAC1E,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;KAC9D,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,KAAK,UAAU,oBAAoB,CAAC,OAAuB,EAAE,KAAmB,EAAE,KAAa;IAC7F,MAAM,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAE7B,MAAM,MAAM,GAAG,OAAO,CAAC,IAAK,CAAC,EAAE,CAAC;IAChC,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;SAC1B,MAAM,EAAE;SACR,IAAI,CAAC,cAAc,CAAC;SACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;SAC9E,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8CAA8C,EAAE,CAAC,CAAC;QAClF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,cAAc,CAAC,GAAoB;IAC/D,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACjF,MAAM,KAAK,GAAG,OAAO,CAAC,KAA2B,CAAC;QAClD,MAAM,KAAK,GAAG,KAAK,EAAE,KAAK,CAAC;QAE3B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC,CAAC;QAChF,CAAC;QAED,wBAAwB;QACxB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAK,CAAC,EAAE,CAAC;QAChC,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;aAC1B,MAAM,EAAE;aACR,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;aAC9E,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8CAA8C,EAAE,CAAC,CAAC;QAC3F,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;QAChF,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAClF,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEtD,wBAAwB;QACxB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAK,CAAC,EAAE,CAAC;QAChC,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;aAC1B,MAAM,EAAE;aACR,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;aACnF,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8CAA8C,EAAE,CAAC,CAAC;QAC3F,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC;YACtC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC/G,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACrF,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1F,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAE9E,wBAAwB;QACxB,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAK,CAAC,EAAE,CAAC;YAChC,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;iBAC1B,MAAM,EAAE;iBACR,IAAI,CAAC,cAAc,CAAC;iBACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;iBACvF,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,gBAAgB,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACxF,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAK,CAAC,EAAE,CAAC;QAEhC,8CAA8C;QAC9C,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1F,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAE9E,wBAAwB;QACxB,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;iBAC1B,MAAM,EAAE;iBACR,IAAI,CAAC,cAAc,CAAC;iBACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;iBACvF,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QAED,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QACpF,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAC5E,MAAM,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QACnE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC1F,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1F,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAE9E,wBAAwB;QACxB,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAK,CAAC,EAAE,CAAC;YAChC,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;iBAC1B,MAAM,EAAE;iBACR,IAAI,CAAC,cAAc,CAAC;iBACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;iBACvF,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACxC,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"workflows.js","sourceRoot":"","sources":["../../src/routes/workflows.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACrF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AACrE,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,MAAM,kBAAkB,GAAG,CAAC;KACzB,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC;KACD,WAAW,EAAE;KACb,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;IAC9C,OAAO,EAAE,8DAA8D;CACxE,CAAC,CAAC;AAEL,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACxB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,iBAAiB,EAAE,YAAY,EAAE,sBAAsB,CAAC,CAAC;IAC1E,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;KACnC,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,cAAc,CAAC,GAAoB;IAC/D,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACjF,MAAM,KAAK,GAAG,OAAO,CAAC,KAA2B,CAAC;QAClD,MAAM,KAAK,GAAG,KAAK,EAAE,KAAK,CAAC;QAE3B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC,CAAC;QAChF,CAAC;QAED,wBAAwB;QACxB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAK,CAAC,EAAE,CAAC;QAChC,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;aAC1B,MAAM,EAAE;aACR,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;aAC9E,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8CAA8C,EAAE,CAAC,CAAC;QAC3F,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;QAChF,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAClF,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,MAAM,UAAU,GAAG,MAAM,MAAM,EAAE,CAAC,aAAa,CAAC,iBAAiB,CAC/D,OAAO,CAAC,IAAK,CAAC,EAAE,EAChB,IAAI,CAAC,KAAK,EACV,cAAc,EACd,QAAQ,CACT,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YACxB,MAAM,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YAC7F,OAAO,eAAe,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC5C,CAAC;QAED,wBAAwB;QACxB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAK,CAAC,EAAE,CAAC;QAChC,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;aAC1B,MAAM,EAAE;aACR,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;aACnF,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8CAA8C,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;QACtC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC;QAEjG,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC;YACtC,OAAO,EAAE,OAAO,CAAC,IAAK,CAAC,EAAE;YACzB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC/G,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACrF,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1F,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAE9E,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACpB,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,IAAK,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC1E,MAAM,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC1G,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,OAAO,CAAC,IAAK,CAAC,EAAE,CAAC;YAChC,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;iBAC1B,MAAM,EAAE;iBACR,IAAI,CAAC,cAAc,CAAC;iBACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;iBACvF,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YACxD,CAAC;YACD,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;YACtC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC;QACvG,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,gBAAgB,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACxF,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAK,CAAC,EAAE,CAAC;QAEhC,8CAA8C;QAC9C,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1F,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAE9E,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACpB,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,IAAK,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC1E,MAAM,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC1G,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;iBAC1B,MAAM,EAAE;iBACR,IAAI,CAAC,cAAc,CAAC;iBACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;iBACvF,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,8BAA8B,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;gBACvI,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YACxD,CAAC;YACD,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;YACtC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC;YACrG,MAAM,UAAU,GAAG,MAAM,MAAM,EAAE,CAAC,aAAa,CAAC,iBAAiB,CAC/D,MAAM,EACN,QAAQ,CAAC,KAAK,EACd,cAAc,EACd,QAAQ,CACT,CAAC;YACF,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;gBACxB,MAAM,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC1H,OAAO,eAAe,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QACpF,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAC5E,MAAM,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QACnE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC1F,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1F,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAE9E,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACpB,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,IAAK,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC1E,MAAM,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC1G,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,OAAO,CAAC,IAAK,CAAC,EAAE,CAAC;YAChC,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;iBAC1B,MAAM,EAAE;iBACR,IAAI,CAAC,cAAc,CAAC;iBACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;iBACvF,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YACxD,CAAC;YACD,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;YACtC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC;QACvG,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACxC,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/sdk/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sdk/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAqE,MAAM,YAAY,CAAC;AAsIjH,wBAAgB,MAAM,IAAI,WAAW,CAWpC;AAED,wBAAgB,MAAM,CAAC,GAAG,EAAE,WAAW,GAAG,IAAI,CAE7C;AAED,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,WAAW,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sdk/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAqE,MAAM,YAAY,CAAC;AA+NjH,wBAAgB,MAAM,IAAI,WAAW,CAWpC;AAED,wBAAgB,MAAM,CAAC,GAAG,EAAE,WAAW,GAAG,IAAI,CAE7C;AAED,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,WAAW,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC"}