@hilbras/keystone 1.6.0 → 2.5.0

package/dist/plugins/headerSanitization.d.ts

@@ -0,0 +1,15 @@
+import type { FastifyInstance } from "fastify";
+/**
+ * Runs before routing, authentication, and every route handler.
+ *
+ * Identity-bearing headers are removed from any request that did not arrive
+ * from a configured trusted proxy. Stripping — rather than merely ignoring the
+ * headers where we happen to check them — means no route, plugin, or future
+ * feature can read a spoofed identity by accident.
+ *
+ * With no trusted proxies configured, this strips unconditionally, which is
+ * the safe default.
+ */
+declare const _default: (app: FastifyInstance) => Promise<void>;
+export default _default;
+//# sourceMappingURL=headerSanitization.d.ts.map

package/dist/plugins/headerSanitization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"headerSanitization.d.ts","sourceRoot":"","sources":["../../src/plugins/headerSanitization.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAQ/C;;;;;;;;;;GAUG;8BAC4D,eAAe"}

package/dist/plugins/headerSanitization.js

@@ -0,0 +1,39 @@
+import fp from "fastify-plugin";
+import { describeUntrustedPeer, hasTrustedProxies, peerAddress, stripUntrustedHeaders, } from "../services/trustedProxies.js";
+/**
+ * Runs before routing, authentication, and every route handler.
+ *
+ * Identity-bearing headers are removed from any request that did not arrive
+ * from a configured trusted proxy. Stripping — rather than merely ignoring the
+ * headers where we happen to check them — means no route, plugin, or future
+ * feature can read a spoofed identity by accident.
+ *
+ * With no trusted proxies configured, this strips unconditionally, which is
+ * the safe default.
+ */
+export default fp(async function headerSanitizationPlugin(app) {
+    let warned = false;
+    app.addHook("onRequest", async (request) => {
+        const trusted = stripUntrustedHeaders(request);
+        if (trusted)
+            return;
+        request.log.debug({ peer: peerAddress(request) }, "stripped untrusted client-identity headers");
+        // The one stripping outcome that indicates a broken deployment rather than
+        // a hostile client: an infrastructure address arriving while no trusted
+        // proxy is configured. That state fails silently — every client shares one
+        // rate-limit budget — so say so once instead of leaving it to be guessed.
+        if (!warned) {
+            const reason = describeUntrustedPeer(peerAddress(request));
+            if (reason) {
+                warned = true;
+                request.log.warn({ peer: peerAddress(request) }, `mTLS/proxy trust boundary not configured: ${reason}`);
+            }
+        }
+    });
+    // State the trust posture at boot. A deployment that expected a proxy to be
+    // trusted should not have to discover the mistake from a support ticket.
+    app.log.info(hasTrustedProxies()
+        ? "client-identity headers will be honoured from configured trusted proxies"
+        : "no trusted proxies configured: client-identity headers will be stripped from every request");
+});
+//# sourceMappingURL=headerSanitization.js.map

package/dist/plugins/headerSanitization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"headerSanitization.js","sourceRoot":"","sources":["../../src/plugins/headerSanitization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAEhC,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,WAAW,EACX,qBAAqB,GACtB,MAAM,+BAA+B,CAAC;AAEvC;;;;;;;;;;GAUG;AACH,eAAe,EAAE,CAAC,KAAK,UAAU,wBAAwB,CAAC,GAAoB;IAC5E,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACzC,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,OAAO;YAAE,OAAO;QAEpB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,EAAE,4CAA4C,CAAC,CAAC;QAEhG,2EAA2E;QAC3E,wEAAwE;QACxE,2EAA2E;QAC3E,0EAA0E;QAC1E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,MAAM,GAAG,qBAAqB,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3D,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,GAAG,IAAI,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,IAAI,CACd,EAAE,IAAI,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,EAC9B,6CAA6C,MAAM,EAAE,CACtD,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,yEAAyE;IACzE,GAAG,CAAC,GAAG,CAAC,IAAI,CACV,iBAAiB,EAAE;QACjB,CAAC,CAAC,0EAA0E;QAC5E,CAAC,CAAC,4FAA4F,CACjG,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/plugins/metrics.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"metrics.d.ts","sourceRoot":"","sources":["../../src/plugins/metrics.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAY,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE3D,eAAO,MAAM,iBAAiB,6CAI5B,CAAC;AAEH,eAAO,MAAM,0BAA0B,+CAKrC,CAAC;AAEH,eAAO,MAAM,iBAAiB,mBAI5B,CAAC;8BAEiD,eAAe;AAAnE,wBAiBG"}
+{"version":3,"file":"metrics.d.ts","sourceRoot":"","sources":["../../src/plugins/metrics.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAY,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE3D,eAAO,MAAM,iBAAiB,6CAI5B,CAAC;AAEH,eAAO,MAAM,0BAA0B,+CAKrC,CAAC;AAEH,eAAO,MAAM,iBAAiB,mBAI5B,CAAC;8BAEiD,eAAe"}

package/dist/plugins/mtls.d.ts

@@ -4,11 +4,30 @@ declare module "fastify" {
         requireMTLS: (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
     }
 }
-export declare function extractClientCert(request: FastifyRequest): {
+export interface ClientCertEvidence {
     fingerprint?: string;
     subject?: string;
-};
+    /** Whether the evidence came from a configured trusted proxy. */
+    trusted: boolean;
+}
+/**
+ * Read certificate evidence. Returns nothing when the peer is not a trusted
+ * proxy, even if the headers are present.
+ */
+export declare function extractClientCert(request: FastifyRequest): ClientCertEvidence;
 export declare function requireMTLS(): (request: FastifyRequest, reply: FastifyReply) => Promise<undefined>;
 declare const _default: (app: FastifyInstance) => Promise<void>;
 export default _default;
+/** Exported for tests: find any service account bound to a fingerprint. */
+export declare function findServiceAccountByFingerprint(fingerprint: string): Promise<{
+    certFingerprint: string | null;
+    createdAt: Date;
+    description: string | null;
+    id: string;
+    isActive: boolean;
+    name: string;
+    orgId: string;
+    revokedAt: Date | null;
+    updatedAt: Date;
+} | undefined>;
 //# sourceMappingURL=mtls.d.ts.map

package/dist/plugins/mtls.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mtls.d.ts","sourceRoot":"","sources":["../../src/plugins/mtls.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAuB7E,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,eAAe;QACvB,WAAW,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;KAC9E;CACF;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,cAAc,GAAG;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAOrG;AAkCD,wBAAgB,WAAW,KACF,SAAS,cAAc,EAAE,OAAO,YAAY,wBAiBpE;8BAEgD,eAAe;AAAhE,wBAEG"}
+{"version":3,"file":"mtls.d.ts","sourceRoot":"","sources":["../../src/plugins/mtls.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AA2C7E,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,eAAe;QACvB,WAAW,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;KAC9E;CACF;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iEAAiE;IACjE,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,cAAc,GAAG,kBAAkB,CAiB7E;AAyCD,wBAAgB,WAAW,cACO,cAAc,SAAS,YAAY,wBAuCpE;8BAEgD,eAAe;;AAIhE,2EAA2E;AAC3E,wBAAsB,+BAA+B,CAAC,WAAW,EAAE,MAAM;;;;;;;;;;eAExE"}

package/dist/plugins/mtls.js

@@ -1,70 +1,112 @@
 import fp from "fastify-plugin";
-import { eq } from "drizzle-orm";
+import { and, eq, isNull, or } from "drizzle-orm";
 import { db } from "../db/index.js";
 import { serviceAccounts } from "../db/schema.js";
+import { canonicalFingerprint, isFromTrustedProxy, isValidFingerprint, peerAddress, } from "../services/trustedProxies.js";
 /**
- * mTLS authentication plugin.
+ * mTLS service-account authentication.
  *
- * In production, terminate TLS at a reverse proxy (nginx, envoy, AWS ALB, etc.)
- * that validates the client certificate and forwards the certificate fingerprint
- * or subject in a trusted header. This plugin reads that header and maps
- * certificates to service accounts.
+ * TLS is terminated at a reverse proxy that validates the client certificate.
+ * Keystone learns the result from headers the proxy sets — but only when the
+ * request actually came from that proxy.
  *
- * Headers read:
- *   - x-client-cert-fingerprint: SHA-256 fingerprint of the client certificate
- *   - x-forwarded-client-cert: PEM-encoded client certificate or DN subject
- *   - x-service-account-id: Optional explicit service account ID (for non-mTLS fallback)
+ * Rules this plugin enforces:
+ *
+ *  1. **A header never establishes identity by itself.** Identity comes from a
+ *     client certificate fingerprint that a trusted proxy forwarded, and that
+ *     fingerprint is cryptographically bound to the service account in the
+ *     database. The previous `x-service-account-id` shortcut is gone: it let any
+ *     client name a service account and become it, with no certificate at all.
+ *  2. **A request that did not come from a trusted proxy has no certificate
+ *     identity.** `x-service-account-id` is accepted only as a *hint*, and only
+ *     when the request also presents a valid fingerprint; the hint is then
+ *     cross-checked against that fingerprint's binding.
+ *  3. **A fingerprint must be a well-formed SHA-256 digest**, so a garbage or
+ *     oversized header cannot be used as a lookup key.
+ *
+ * Service accounts without a bound fingerprint cannot authenticate by
+ * certificate at all.
  */
 const MTLS_HEADER = "x-forwarded-client-cert";
 const MTLS_FINGERPRINT_HEADER = "x-client-cert-fingerprint";
 const SERVICE_ACCOUNT_ID_HEADER = "x-service-account-id";
+/** Cap on header length before parsing, so a hostile proxy cannot inflate work. */
+const MAX_CERT_HEADER_LENGTH = 8192;
+/**
+ * Read certificate evidence. Returns nothing when the peer is not a trusted
+ * proxy, even if the headers are present.
+ */
 export function extractClientCert(request) {
-    const fingerprint = request.headers[MTLS_FINGERPRINT_HEADER];
-    const cert = request.headers[MTLS_HEADER];
-    return {
-        fingerprint: typeof fingerprint === "string" ? fingerprint : undefined,
-        subject: typeof cert === "string" ? cert : undefined,
-    };
+    if (!isFromTrustedProxy(request))
+        return { trusted: false };
+    const rawFingerprint = request.headers[MTLS_FINGERPRINT_HEADER];
+    const rawCert = request.headers[MTLS_HEADER];
+    const fingerprint = typeof rawFingerprint === "string" && isValidFingerprint(rawFingerprint.trim())
+        ? canonicalFingerprint(rawFingerprint)
+        : undefined;
+    const subject = typeof rawCert === "string" && rawCert.length > 0 && rawCert.length <= MAX_CERT_HEADER_LENGTH
+        ? rawCert
+        : undefined;
+    return { fingerprint, subject, trusted: true };
 }
-async function resolveServiceAccount(request) {
-    const explicitId = request.headers[SERVICE_ACCOUNT_ID_HEADER];
-    if (typeof explicitId === "string" && explicitId) {
-        const [sa] = await db
-            .select()
-            .from(serviceAccounts)
-            .where(eq(serviceAccounts.id, explicitId))
-            .limit(1);
-        if (sa?.isActive) {
-            return sa;
-        }
-    }
-    const { fingerprint, subject } = extractClientCert(request);
-    if (!fingerprint && !subject)
-        return undefined;
-    // Look up service accounts by name matching the fingerprint or subject.
-    // In a production system, you would store the certificate fingerprint in
-    // the service_accounts table and query by it directly.
-    const [sa] = await db
+/**
+ * Resolve a service account from a validated certificate fingerprint.
+ *
+ * The lookup is by `certFingerprint`, not by `name`: a name is operator-chosen
+ * and guessable, whereas the fingerprint is pinned to a certificate.
+ */
+async function resolveByFingerprint(fingerprint) {
+    const [record] = await db
         .select()
         .from(serviceAccounts)
-        .where(eq(serviceAccounts.name, fingerprint || subject || ""))
+        .where(and(eq(serviceAccounts.certFingerprint, fingerprint), eq(serviceAccounts.isActive, true), isNull(serviceAccounts.revokedAt)))
         .limit(1);
-    if (sa?.isActive) {
-        return sa;
-    }
-    return undefined;
+    return record;
+}
+/**
+ * Optional narrowing: when the proxy also named the service account, the named
+ * account must be the one bound to the presented certificate. A mismatch is a
+ * spoofing signal, not a fallback.
+ */
+async function crossCheckHint(hintId, fingerprint) {
+    const [hinted] = await db
+        .select()
+        .from(serviceAccounts)
+        .where(and(eq(serviceAccounts.id, hintId), isNull(serviceAccounts.revokedAt)))
+        .limit(1);
+    if (!hinted)
+        return undefined;
+    if (hinted.certFingerprint && hinted.certFingerprint !== fingerprint)
+        return undefined;
+    return resolveByFingerprint(fingerprint);
 }
 export function requireMTLS() {
     return async function (request, reply) {
-        const { fingerprint, subject } = extractClientCert(request);
-        const explicitId = request.headers[SERVICE_ACCOUNT_ID_HEADER];
-        if (!fingerprint && !subject && !explicitId) {
-            return reply.status(401).send({ error: "Client certificate required" });
+        const evidence = extractClientCert(request);
+        if (!evidence.trusted) {
+            // Distinguish "not behind a proxy we trust" from "no certificate" so an
+            // operator can tell a misconfiguration from an attack.
+            return reply.status(401).send({
+                error: "Client certificate required",
+                code: isFromTrustedProxy(request) ? "MTLS_CERTIFICATE_MISSING" : "MTLS_UNTRUSTED_PEER",
+            });
         }
-        const serviceAccount = await resolveServiceAccount(request);
+        if (!evidence.fingerprint) {
+            return reply.status(401).send({
+                error: "A valid client certificate fingerprint is required",
+                code: "MTLS_FINGERPRINT_MISSING",
+            });
+        }
+        const hint = request.headers[SERVICE_ACCOUNT_ID_HEADER];
+        const serviceAccount = typeof hint === "string" && hint
+            ? await crossCheckHint(hint, evidence.fingerprint)
+            : await resolveByFingerprint(evidence.fingerprint);
         if (!serviceAccount) {
-            request.log.warn({ fingerprint, subject }, "mTLS: no matching service account found");
-            return reply.status(403).send({ error: "Client certificate not mapped to a service account" });
+            request.log.warn({ fingerprint: evidence.fingerprint, peer: peerAddress(request) }, "mTLS: no active service account is bound to the presented certificate");
+            return reply.status(403).send({
+                error: "Client certificate not mapped to a service account",
+                code: "MTLS_CERTIFICATE_UNMAPPED",
+            });
         }
         request.serviceAccount = serviceAccount;
         request.log.debug({ serviceAccountId: serviceAccount.id }, "mTLS: service account authenticated");
@@ -73,4 +115,9 @@ export function requireMTLS() {
 export default fp(async function mtlsPlugin(app) {
     app.decorate("requireMTLS", requireMTLS());
 });
+/** Exported for tests: find any service account bound to a fingerprint. */
+export async function findServiceAccountByFingerprint(fingerprint) {
+    return resolveByFingerprint(canonicalFingerprint(fingerprint));
+}
+void or;
 //# sourceMappingURL=mtls.js.map

package/dist/plugins/mtls.js.map

@@ -1 +1 @@
-{"version":3,"file":"mtls.js","sourceRoot":"","sources":["../../src/plugins/mtls.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAEhC,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD;;;;;;;;;;;;GAYG;AAEH,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAC9C,MAAM,uBAAuB,GAAG,2BAA2B,CAAC;AAC5D,MAAM,yBAAyB,GAAG,sBAAsB,CAAC;AAQzD,MAAM,UAAU,iBAAiB,CAAC,OAAuB;IACvD,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1C,OAAO;QACL,WAAW,EAAE,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;QACtE,OAAO,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;KACrD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,OAAuB;IAC1D,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAC9D,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,EAAE,CAAC;QACjD,MAAM,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE;aAClB,MAAM,EAAE;aACR,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;aACzC,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC;YACjB,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC5D,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAE/C,wEAAwE;IACxE,yEAAyE;IACzE,uDAAuD;IACvD,MAAM,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE;SAClB,MAAM,EAAE;SACR,IAAI,CAAC,eAAe,CAAC;SACrB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,WAAW,IAAI,OAAO,IAAI,EAAE,CAAC,CAAC;SAC7D,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC;QACjB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,OAAO,KAAK,WAAW,OAAuB,EAAE,KAAmB;QACjE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC5D,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;QAE9D,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC;YAC5C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,yCAAyC,CAAC,CAAC;YACtF,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oDAAoD,EAAE,CAAC,CAAC;QACjG,CAAC;QAED,OAAO,CAAC,cAAc,GAAG,cAAc,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,gBAAgB,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,qCAAqC,CAAC,CAAC;IACpG,CAAC,CAAC;AACJ,CAAC;AAED,eAAe,EAAE,CAAC,KAAK,UAAU,UAAU,CAAC,GAAoB;IAC9D,GAAG,CAAC,QAAQ,CAAC,aAAa,EAAE,WAAW,EAAE,CAAC,CAAC;AAC7C,CAAC,CAAC,CAAC"}
+{"version":3,"file":"mtls.js","sourceRoot":"","sources":["../../src/plugins/mtls.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAEhC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,GACZ,MAAM,+BAA+B,CAAC;AAEvC;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAC9C,MAAM,uBAAuB,GAAG,2BAA2B,CAAC;AAC5D,MAAM,yBAAyB,GAAG,sBAAsB,CAAC;AAEzD,mFAAmF;AACnF,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAepC;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAuB;IACvD,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAE5D,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAE7C,MAAM,WAAW,GACf,OAAO,cAAc,KAAK,QAAQ,IAAI,kBAAkB,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAC7E,CAAC,CAAC,oBAAoB,CAAC,cAAc,CAAC;QACtC,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,OAAO,GACX,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,IAAI,sBAAsB;QAC3F,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACjD,CAAC;AAID;;;;;GAKG;AACH,KAAK,UAAU,oBAAoB,CAAC,WAAmB;IACrD,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,EAAE;SACR,IAAI,CAAC,eAAe,CAAC;SACrB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,eAAe,CAAC,eAAe,EAAE,WAAW,CAAC,EAChD,EAAE,CAAC,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,EAClC,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAClC,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,cAAc,CAAC,MAAc,EAAE,WAAmB;IAC/D,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,EAAE;SACR,IAAI,CAAC,eAAe,CAAC;SACrB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;SAC7E,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,IAAI,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,eAAe,KAAK,WAAW;QAAE,OAAO,SAAS,CAAC;IACvF,OAAO,oBAAoB,CAAC,WAAW,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,OAAO,KAAK,WAAW,OAAuB,EAAE,KAAmB;QACjE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAE5C,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,wEAAwE;YACxE,uDAAuD;YACvD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,6BAA6B;gBACpC,IAAI,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,qBAAqB;aACvF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,oDAAoD;gBAC3D,IAAI,EAAE,0BAA0B;aACjC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;QACxD,MAAM,cAAc,GAClB,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI;YAC9B,CAAC,CAAC,MAAM,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,WAAW,CAAC;YAClD,CAAC,CAAC,MAAM,oBAAoB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAEvD,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,IAAI,CACd,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,IAAI,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,EACjE,uEAAuE,CACxE,CAAC;YACF,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,oDAAoD;gBAC3D,IAAI,EAAE,2BAA2B;aAClC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,CAAC,cAAc,GAAG,cAAc,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,gBAAgB,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,qCAAqC,CAAC,CAAC;IACpG,CAAC,CAAC;AACJ,CAAC;AAED,eAAe,EAAE,CAAC,KAAK,UAAU,UAAU,CAAC,GAAoB;IAC9D,GAAG,CAAC,QAAQ,CAAC,aAAa,EAAE,WAAW,EAAE,CAAC,CAAC;AAC7C,CAAC,CAAC,CAAC;AAEH,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,WAAmB;IACvE,OAAO,oBAAoB,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,KAAK,EAAE,CAAC"}

package/dist/plugins/permissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/plugins/permissions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAG7E,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,eAAe;QACvB,iBAAiB,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;KAC1H;CACF;8BAEuD,eAAe;AAAvE,wBAkBG"}
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/plugins/permissions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAG7E,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,eAAe;QACvB,iBAAiB,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;KAC1H;CACF;8BAEuD,eAAe"}

package/dist/plugins/permissions.js

@@ -1,19 +1,39 @@
 import fp from "fastify-plugin";
-import { requirePermission } from "../services/permissions.js";
+import { isOrganizationRole } from "../services/domain/authorization.js";
 export default fp(async function permissionsPlugin(app) {
     app.decorate("requirePermission", function (resource, action) {
         return async function (request, reply) {
-            const membership = request.state?.membership;
-            if (!membership) {
-                return reply.status(403).send({ error: "Organization membership required" });
+            await request.server.authenticate(request, reply);
+            if (reply.sent)
+                return;
+            const { id: orgId } = request.params;
+            if (!orgId) {
+                return reply.status(403).send({ error: "Organization context required" });
             }
-            try {
-                await requirePermission(membership.role, resource, action);
+            const membership = await request.server.container.organizationRepository.findMembership(orgId, request.user.id);
+            if (!membership || !isOrganizationRole(membership.role)) {
+                await request.audit("unauthorized_access", {
+                    action: "organization_permission_required",
+                    orgId,
+                    resource,
+                    requiredAction: action,
+                });
+                return reply.status(403).send({ error: "Organization membership required" });
             }
-            catch (err) {
-                const message = err instanceof Error ? err.message : "Forbidden";
-                return reply.status(403).send({ error: message });
+            const allowed = await request.server.container.permissionRepository.hasPermission(membership.role, resource, action);
+            if (!allowed) {
+                await request.audit("unauthorized_access", {
+                    action: "organization_permission_required",
+                    orgId,
+                    resource,
+                    requiredAction: action,
+                });
+                return reply.status(403).send({ error: `Missing permission ${resource}:${action}` });
             }
+            request.state.membership = membership;
+            const organization = await request.server.container.organizationRepository.findById(orgId);
+            if (organization)
+                request.state.org = organization;
         };
     });
 });

package/dist/plugins/permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/plugins/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAEhC,OAAO,EAAE,iBAAiB,EAAuC,MAAM,4BAA4B,CAAC;AAQpG,eAAe,EAAE,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAoB;IACrE,GAAG,CAAC,QAAQ,CACV,mBAAmB,EACnB,UAAU,QAAgB,EAAE,MAAc;QACxC,OAAO,KAAK,WAAW,OAAuB,EAAE,KAAmB;YACjE,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC;YAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,iBAAiB,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC7D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;gBACjE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YACpD,CAAC;QACH,CAAC,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC,CAAC,CAAC"}
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/plugins/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAEhC,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAQzE,eAAe,EAAE,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAoB;IACrE,GAAG,CAAC,QAAQ,CACV,mBAAmB,EACnB,UAAU,QAAgB,EAAE,MAAc;QACxC,OAAO,KAAK,WAAW,OAAuB,EAAE,KAAmB;YACjE,MAAM,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAClD,IAAI,KAAK,CAAC,IAAI;gBAAE,OAAO;YAEvB,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,MAAyB,CAAC;YACxD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,CAAC;YAC5E,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,sBAAsB,CAAC,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,IAAK,CAAC,EAAE,CAAC,CAAC;YACjH,IAAI,CAAC,UAAU,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxD,MAAM,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE;oBACzC,MAAM,EAAE,kCAAkC;oBAC1C,KAAK;oBACL,QAAQ;oBACR,cAAc,EAAE,MAAM;iBACvB,CAAC,CAAC;gBACH,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC,CAAC;YAC/E,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,oBAAoB,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YACrH,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE;oBACzC,MAAM,EAAE,kCAAkC;oBAC1C,KAAK;oBACL,QAAQ;oBACR,cAAc,EAAE,MAAM;iBACvB,CAAC,CAAC;gBACH,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,QAAQ,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;YACvF,CAAC;YAED,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;YACtC,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,sBAAsB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC3F,IAAI,YAAY;gBAAE,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,YAAY,CAAC;QACrD,CAAC,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/plugins/rateLimit.d.ts

@@ -1,14 +1,30 @@
 import type { FastifyInstance, FastifyReply, FastifyRequest } from "fastify";
+import { clientAddress } from "../services/trustedProxies.js";
 interface RateLimitPluginOptions {
     keyPrefix: string;
     maxAttempts: number;
     windowSeconds: number;
+    /**
+     * Override how the caller is identified. Used where the meaningful principal
+     * is not an IP address — for example SCIM, which is limited per credential so
+     * one noisy identity provider cannot exhaust the budget of every other tenant.
+     */
+    keyFrom?: (request: FastifyRequest) => string;
 }
 export interface GlobalRateLimitOptions {
     maxRequests?: number;
     windowSeconds?: number;
     keyPrefix?: string;
 }
+declare function isAllowed(key: string, maxAttempts: number, windowSeconds: number): Promise<boolean>;
+/**
+ * Re-exported so a route that must run before the normal limiter (because it
+ * emits audit events on failure) can still budget itself rather than being
+ * unbounded.
+ */
+export { clientAddress };
+/** Raw sliding-window check, for the same pre-limiter case. */
+export { isAllowed };
 export declare function rateLimit(options: RateLimitPluginOptions): (request: FastifyRequest, reply: FastifyReply) => Promise<undefined>;
 export declare function globalRateLimit(options?: GlobalRateLimitOptions): (request: FastifyRequest, reply: FastifyReply) => Promise<undefined>;
 export declare function appRateLimit(options: {

package/dist/plugins/rateLimit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rateLimit.d.ts","sourceRoot":"","sources":["../../src/plugins/rateLimit.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAG7E,UAAU,sBAAsB;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,sBAAsB;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAkED,wBAAgB,SAAS,CAAC,OAAO,EAAE,sBAAsB,IACtB,SAAS,cAAc,EAAE,OAAO,YAAY,wBAW9E;AAED,wBAAgB,eAAe,CAAC,OAAO,GAAE,sBAA2B,IAKlC,SAAS,cAAc,EAAE,OAAO,YAAY,wBAW7E;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,IACjD,SAAS,cAAc,EAAE,OAAO,YAAY,wBAY9E;8BAEqD,eAAe;AAArE,wBAIG"}
+{"version":3,"file":"rateLimit.d.ts","sourceRoot":"","sources":["../../src/plugins/rateLimit.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE7E,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAE9D,UAAU,sBAAsB;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,MAAM,CAAC;CAC/C;AAED,MAAM,WAAW,sBAAsB;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AA4BD,iBAAe,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAyBlG;AAeD;;;;GAIG;AACH,OAAO,EAAE,aAAa,EAAE,CAAC;AAEzB,+DAA+D;AAC/D,OAAO,EAAE,SAAS,EAAE,CAAC;AAErB,wBAAgB,SAAS,CAAC,OAAO,EAAE,sBAAsB,aACb,cAAc,SAAS,YAAY,wBAW9E;AAED,wBAAgB,eAAe,CAAC,OAAO,GAAE,sBAA2B,aAKzB,cAAc,SAAS,YAAY,wBAW7E;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,aACxC,cAAc,SAAS,YAAY,wBAY9E;8BAEqD,eAAe"}

package/dist/plugins/rateLimit.js

@@ -1,6 +1,7 @@
 import crypto from "node:crypto";
 import fp from "fastify-plugin";
 import { redis, isRedisReady } from "../services/redis.js";
+import { clientAddress } from "../services/trustedProxies.js";
 /**
  * Atomic sliding-window rate limit script.
  *
@@ -46,13 +47,25 @@ async function isAllowed(key, maxAttempts, windowSeconds) {
 function cryptoRandom() {
     return crypto.randomBytes(8).toString("hex");
 }
+/**
+ * Rate-limit key source. Uses the peer address unless the request came from a
+ * configured trusted proxy, so a client cannot rotate `x-forwarded-for` to get a
+ * fresh budget.
+ */
 function clientIdentifier(request) {
-    return (request.headers["x-forwarded-for"]?.split(",")[0]?.trim() ||
-        request.ip);
+    return clientAddress(request);
 }
+/**
+ * Re-exported so a route that must run before the normal limiter (because it
+ * emits audit events on failure) can still budget itself rather than being
+ * unbounded.
+ */
+export { clientAddress };
+/** Raw sliding-window check, for the same pre-limiter case. */
+export { isAllowed };
 export function rateLimit(options) {
     return async function preHandler(request, reply) {
-        const id = clientIdentifier(request);
+        const id = options.keyFrom ? options.keyFrom(request) : clientIdentifier(request);
         const key = `${options.keyPrefix}:${id}:${request.body?.email ?? ""}`;
         const allowed = await isAllowed(key, options.maxAttempts, options.windowSeconds);
         if (!allowed) {

package/dist/plugins/rateLimit.js.map

@@ -1 +1 @@
-{"version":3,"file":"rateLimit.js","sourceRoot":"","sources":["../../src/plugins/rateLimit.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAEhC,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAc3D;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;CAiBxB,CAAC;AAEF,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,WAAmB,EAAE,aAAqB;IAC9E,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;QACpB,0EAA0E;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,GAAG,GAAG,IAAI,YAAY,EAAE,EAAE,CAAC;IAE1C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,CAC7B,gBAAgB,EAChB,CAAC,EACD,GAAG,EACH,aAAa,GAAG,IAAI,EACpB,GAAG,EACH,MAAM,EACN,WAAW,CACZ,CAAW,CAAC;QACb,OAAO,KAAK,GAAG,WAAW,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,+EAA+E;QAC/E,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAuB;IAC/C,OAAO,CACJ,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAY,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;QACrE,OAAO,CAAC,EAAE,CACX,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,OAA+B;IACvD,OAAO,KAAK,UAAU,UAAU,CAAC,OAAuB,EAAE,KAAmB;QAC3E,MAAM,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,IAAK,OAAO,CAAC,IAA2C,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;QAC9G,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;QACjF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK;iBACT,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;iBACpD,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC,CAAC;QACnE,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,UAAkC,EAAE;IAClE,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,GAAG,CAAC;IAC/C,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;IAClD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAC;IAEhD,OAAO,KAAK,UAAU,SAAS,CAAC,OAAuB,EAAE,KAAmB;QAC1E,MAAM,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,GAAG,SAAS,IAAI,EAAE,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;QACjE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK;iBACT,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;iBAC5C,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAuD;IAClF,OAAO,KAAK,UAAU,UAAU,CAAC,OAAuB,EAAE,KAAmB;QAC3E,MAAM,QAAQ,GAAI,OAAO,CAAC,IAA2C,EAAE,SAAS,IAAI,WAAW,CAAC;QAChG,MAAM,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,OAAO,QAAQ,IAAI,EAAE,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;QACjF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK;iBACT,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;iBACpD,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,EAAE,KAAK,EAAE,iEAAiE,EAAE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,eAAe,EAAE,CAAC,KAAK,UAAU,eAAe,CAAC,GAAoB;IACnE,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QAChC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"rateLimit.js","sourceRoot":"","sources":["../../src/plugins/rateLimit.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAEhC,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAoB9D;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;CAiBxB,CAAC;AAEF,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,WAAmB,EAAE,aAAqB;IAC9E,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;QACpB,0EAA0E;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,GAAG,GAAG,IAAI,YAAY,EAAE,EAAE,CAAC;IAE1C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,CAC7B,gBAAgB,EAChB,CAAC,EACD,GAAG,EACH,aAAa,GAAG,IAAI,EACpB,GAAG,EACH,MAAM,EACN,WAAW,CACZ,CAAW,CAAC;QACb,OAAO,KAAK,GAAG,WAAW,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,+EAA+E;QAC/E,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,OAAuB;IAC/C,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,OAAO,EAAE,aAAa,EAAE,CAAC;AAEzB,+DAA+D;AAC/D,OAAO,EAAE,SAAS,EAAE,CAAC;AAErB,MAAM,UAAU,SAAS,CAAC,OAA+B;IACvD,OAAO,KAAK,UAAU,UAAU,CAAC,OAAuB,EAAE,KAAmB;QAC3E,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAClF,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,IAAK,OAAO,CAAC,IAA2C,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;QAC9G,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;QACjF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK;iBACT,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;iBACpD,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC,CAAC;QACnE,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAO,GAA2B,EAAE;IAClE,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,GAAG,CAAC;IAC/C,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;IAClD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAC;IAEhD,OAAO,KAAK,UAAU,SAAS,CAAC,OAAuB,EAAE,KAAmB;QAC1E,MAAM,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,GAAG,SAAS,IAAI,EAAE,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;QACjE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK;iBACT,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;iBAC5C,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAuD;IAClF,OAAO,KAAK,UAAU,UAAU,CAAC,OAAuB,EAAE,KAAmB;QAC3E,MAAM,QAAQ,GAAI,OAAO,CAAC,IAA2C,EAAE,SAAS,IAAI,WAAW,CAAC;QAChG,MAAM,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,OAAO,QAAQ,IAAI,EAAE,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;QACjF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK;iBACT,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;iBACpD,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,EAAE,KAAK,EAAE,iEAAiE,EAAE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,eAAe,EAAE,CAAC,KAAK,UAAU,eAAe,CAAC,GAAoB;IACnE,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QAChC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/plugins/requestLogger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"requestLogger.d.ts","sourceRoot":"","sources":["../../src/plugins/requestLogger.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;8BAEzB,eAAe;AAAnE,wBAqBG"}
+{"version":3,"file":"requestLogger.d.ts","sourceRoot":"","sources":["../../src/plugins/requestLogger.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;8BAEzB,eAAe"}

package/dist/repositories/apiKey.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apiKey.d.ts","sourceRoot":"","sources":["../../src/repositories/apiKey.ts"],"names":[],"mappings":"AAEA,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAEvD,KAAK,YAAY,GAAG,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAE5C,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,KAAK,EAAE;QACZ,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;KACzB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IACtD,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IACpD,sBAAsB,CAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC1E,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;IACzF,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;CACxF;AAED,qBAAa,uBAAwB,YAAW,gBAAgB;IACxD,MAAM,CAAC,KAAK,EAAE;QAClB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;KACzB,GAAG,OAAO,CAAC,MAAM,CAAC;IAkBb,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAoBrD,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAoBnD,sBAAsB,CAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAoBzE,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IAsBxF,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;CAqB7F"}
+{"version":3,"file":"apiKey.d.ts","sourceRoot":"","sources":["../../src/repositories/apiKey.ts"],"names":[],"mappings":"AAEA,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAEvD,KAAK,YAAY,GAAG,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAE5C,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,KAAK,EAAE;QACZ,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;KACzB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IACtD,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IACpD,sBAAsB,CAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC1E,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;IACzF,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;CACxF;AAED,qBAAa,uBAAwB,YAAW,gBAAgB;IACxD,MAAM,CAAC,KAAK,EAAE;QAClB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;KACzB,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBlB;IAEK,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAkB1D;IAEK,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAkBxD;IAEK,sBAAsB,CAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAkB9E;IAEK,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAoB7F;IAEK,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAoB3F;CACF"}

package/dist/repositories/application.d.ts

@@ -3,7 +3,7 @@ import type { ApplicationRepository, CreateApplicationInput, UpdateApplicationIn
 export declare class DrizzleApplicationRepository implements ApplicationRepository {
     private generateClientId;
     create(input: CreateApplicationInput): Promise<Application & {
-        clientSecret: string;
+        clientSecret: string | null;
     }>;
     findByClientId(clientId: string): Promise<Application | undefined>;
     listByOrgId(orgId: string): Promise<Application[]>;

package/dist/repositories/application.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"application.d.ts","sourceRoot":"","sources":["../../src/repositories/application.ts"],"names":[],"mappings":"AAGA,OAAO,EAAgB,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEjE,OAAO,KAAK,EACV,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB,qBAAa,4BAA6B,YAAW,qBAAqB;IACxE,OAAO,CAAC,gBAAgB;IAIlB,MAAM,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,WAAW,GAAG;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAgBtF,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IASlE,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAIlD,MAAM,CACV,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAS7B,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;CAW7F"}
+{"version":3,"file":"application.d.ts","sourceRoot":"","sources":["../../src/repositories/application.ts"],"names":[],"mappings":"AAGA,OAAO,EAAgB,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEjE,OAAO,KAAK,EACV,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB,qBAAa,4BAA6B,YAAW,qBAAqB;IACxE,OAAO,CAAC,gBAAgB;IAIlB,MAAM,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,WAAW,GAAG;QAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAoBlG;IAEK,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAOvE;IAEK,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAEvD;IAEK,MAAM,CACV,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAOlC;IAEK,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAU3F;CACF"}

package/dist/repositories/application.js

@@ -8,13 +8,19 @@ export class DrizzleApplicationRepository {
         return `app_${crypto.randomBytes(16).toString("base64url")}`;
     }
     async create(input) {
-        const clientSecret = input.clientSecret || generateClientSecret();
+        // A public client is issued no secret at all, rather than a secret it is
+        // expected to ignore. Storing one would leave a credential in the database
+        // that appears to protect the client and does not.
+        const clientType = input.clientType ?? "confidential";
+        const clientSecret = clientType === "public" ? null : input.clientSecret || generateClientSecret();
         const [app] = await db
             .insert(applications)
             .values({
             orgId: input.orgId,
             clientId: input.clientId || this.generateClientId(),
-            clientSecretHash: hashClientSecret(clientSecret),
+            clientSecretHash: clientSecret ? hashClientSecret(clientSecret) : null,
+            clientType,
+            allowedScopes: input.allowedScopes ?? [],
             name: input.name,
             redirectUris: input.redirectUris ?? [],
             allowedOrigins: input.allowedOrigins ?? [],
@@ -26,7 +32,7 @@ export class DrizzleApplicationRepository {
         const [app] = await db
             .select()
             .from(applications)
-            .where(eq(applications.clientId, clientId))
+            .where(and(eq(applications.clientId, clientId), eq(applications.isActive, true)))
             .limit(1);
         return app;
     }

package/dist/repositories/application.js.map

@@ -1 +1 @@
-{"version":3,"file":"application.js","sourceRoot":"","sources":["../../src/repositories/application.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,YAAY,EAAoB,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAOhF,MAAM,OAAO,4BAA4B;IAC/B,gBAAgB;QACtB,OAAO,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAA6B;QACxC,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,IAAI,oBAAoB,EAAE,CAAC;QAClE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC,YAAY,CAAC;aACpB,MAAM,CAAC;YACN,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,gBAAgB,EAAE;YACnD,gBAAgB,EAAE,gBAAgB,CAAC,YAAY,CAAC;YAChD,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,EAAE;YACtC,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,EAAE;SAC3C,CAAC;aACD,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,GAAG,GAAG,EAAE,YAAY,EAAE,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAgB;QACnC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,EAAE;aACR,IAAI,CAAC,YAAY,CAAC;aAClB,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;aAC1C,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED,KAAK,CAAC,MAAM,CACV,KAAa,EACb,KAAa,EACb,KAA6B;QAE7B,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACvB,MAAM,CAAC,YAAY,CAAC;aACpB,GAAG,CAAC,KAAK,CAAC;aACV,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;aACrE,SAAS,EAAE,CAAC;QACf,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,QAAgB,EAAE,MAAc;QACvD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,EAAE;aACR,IAAI,CAAC,YAAY,CAAC;aAClB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;aAChF,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,IAAI,GAAG,CAAC,gBAAgB,KAAK,gBAAgB,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAC;QACxE,OAAO,GAAG,CAAC;IACb,CAAC;CACF"}
+{"version":3,"file":"application.js","sourceRoot":"","sources":["../../src/repositories/application.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,YAAY,EAAoB,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAOhF,MAAM,OAAO,4BAA4B;IAC/B,gBAAgB;QACtB,OAAO,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAA6B;QACxC,yEAAyE;QACzE,2EAA2E;QAC3E,mDAAmD;QACnD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,cAAc,CAAC;QACtD,MAAM,YAAY,GAAG,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,IAAI,oBAAoB,EAAE,CAAC;QACnG,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC,YAAY,CAAC;aACpB,MAAM,CAAC;YACN,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,gBAAgB,EAAE;YACnD,gBAAgB,EAAE,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI;YACtE,UAAU;YACV,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,EAAE;YACxC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,EAAE;YACtC,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,EAAE;SAC3C,CAAC;aACD,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,GAAG,GAAG,EAAE,YAAY,EAAE,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAgB;QACnC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,EAAE;aACR,IAAI,CAAC,YAAY,CAAC;aAClB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;aAChF,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED,KAAK,CAAC,MAAM,CACV,KAAa,EACb,KAAa,EACb,KAA6B;QAE7B,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACvB,MAAM,CAAC,YAAY,CAAC;aACpB,GAAG,CAAC,KAAK,CAAC;aACV,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;aACrE,SAAS,EAAE,CAAC;QACf,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,QAAgB,EAAE,MAAc;QACvD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,EAAE;aACR,IAAI,CAAC,YAAY,CAAC;aAClB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;aAChF,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,IAAI,GAAG,CAAC,gBAAgB,KAAK,gBAAgB,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAC;QACxE,OAAO,GAAG,CAAC;IACb,CAAC;CACF"}

package/dist/repositories/audit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/repositories/audit.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,qBAAa,sBAAuB,YAAW,eAAe;IACtD,IAAI,CAAC,IAAI,EAAE;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,OAAO,QAAQ,CAAC,YAAY,EAAE,CAAC;CAkB5C"}
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/repositories/audit.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,qBAAa,sBAAuB,YAAW,eAAe;IACtD,IAAI,CAAC,IAAI,EAAE;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,OAAO,QAAQ,CAAC,YAAY,EAAE,CAAC,CAiB1C;CACF"}

package/dist/repositories/index.d.ts

@@ -7,4 +7,7 @@ export { DrizzlePermissionRepository } from "./permission.js";
 export { DrizzleApiKeyRepository, type ApiKeyRepository } from "./apiKey.js";
 export { DrizzleSamlConnectionRepository, type SamlConnectionRepository } from "./samlConnection.js";
 export { DrizzleOidcConnectionRepository, type OidcConnectionRepository } from "./oidcConnection.js";
+export { DrizzleMfaChallengeRepository } from "./mfaChallenge.js";
+export { DrizzleScimConnectionRepository } from "./scimConnection.js";
+export { DrizzleScimGroupRepository } from "./scimGroup.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/repositories/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/repositories/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AAC7E,OAAO,EAAE,6BAA6B,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,uBAAuB,EAAE,KAAK,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC7E,OAAO,EAAE,+BAA+B,EAAE,KAAK,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AACrG,OAAO,EAAE,+BAA+B,EAAE,KAAK,wBAAwB,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/repositories/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AAC7E,OAAO,EAAE,6BAA6B,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,uBAAuB,EAAE,KAAK,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC7E,OAAO,EAAE,+BAA+B,EAAE,KAAK,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AACrG,OAAO,EAAE,+BAA+B,EAAE,KAAK,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AACrG,OAAO,EAAE,6BAA6B,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAE,+BAA+B,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/repositories/index.js

@@ -7,4 +7,7 @@ export { DrizzlePermissionRepository } from "./permission.js";
 export { DrizzleApiKeyRepository } from "./apiKey.js";
 export { DrizzleSamlConnectionRepository } from "./samlConnection.js";
 export { DrizzleOidcConnectionRepository } from "./oidcConnection.js";
+export { DrizzleMfaChallengeRepository } from "./mfaChallenge.js";
+export { DrizzleScimConnectionRepository } from "./scimConnection.js";
+export { DrizzleScimGroupRepository } from "./scimGroup.js";
 //# sourceMappingURL=index.js.map

package/dist/repositories/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/repositories/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AAC7E,OAAO,EAAE,6BAA6B,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,uBAAuB,EAAyB,MAAM,aAAa,CAAC;AAC7E,OAAO,EAAE,+BAA+B,EAAiC,MAAM,qBAAqB,CAAC;AACrG,OAAO,EAAE,+BAA+B,EAAiC,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/repositories/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AAC7E,OAAO,EAAE,6BAA6B,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,uBAAuB,EAAyB,MAAM,aAAa,CAAC;AAC7E,OAAO,EAAE,+BAA+B,EAAiC,MAAM,qBAAqB,CAAC;AACrG,OAAO,EAAE,+BAA+B,EAAiC,MAAM,qBAAqB,CAAC;AACrG,OAAO,EAAE,6BAA6B,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAE,+BAA+B,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/repositories/mfaChallenge.d.ts

@@ -0,0 +1,23 @@
+import { type MfaChallenge } from "../db/schema.js";
+import type { CreateMfaChallengeInput, MfaChallengeRepository } from "./types.js";
+/**
+ * Durable storage for pre-authentication MFA challenges.
+ *
+ * Challenges are single-use: `consume` performs a conditional update so two
+ * concurrent verifications can never both complete, and only the stored hash of
+ * the challenge is persisted.
+ */
+export declare class DrizzleMfaChallengeRepository implements MfaChallengeRepository {
+    create(input: CreateMfaChallengeInput): Promise<MfaChallenge>;
+    findByHash(challengeHash: string): Promise<MfaChallenge | undefined>;
+    /**
+     * Record a failed attempt only while the challenge is still active and below
+     * its attempt budget. Reaching the budget marks the challenge failed so it can
+     * never be used again.
+     */
+    recordFailedAttempt(id: string, now: Date): Promise<MfaChallenge | undefined>;
+    consume(id: string, now: Date): Promise<MfaChallenge | undefined>;
+    invalidateUserChallenges(userId: string, now: Date): Promise<void>;
+    deleteExpired(now: Date): Promise<number>;
+}
+//# sourceMappingURL=mfaChallenge.d.ts.map