@hilbras/keystone 1.6.0 → 2.5.0

package/dist/routes/admin/sso.js

@@ -1,7 +1,19 @@
 import { z } from "zod";
-import { requireAuthAndRole } from "./helpers.js";
+import { requireOrganizationRole } from "./helpers.js";
 import { config } from "../../config.js";
 import { escapeXml } from "../helpers.js";
+import { toPublicOidcConnection, toPublicSamlConnection } from "../../types.js";
+import { validateSsoEndpoint } from "../../services/ssoEndpointPolicy.js";
+import { ScimConnectionService } from "../../services/scimCredentials.js";
+import { sendResultError } from "../helpers.js";
+const ScimConnectionSchema = z.object({
+    name: z.string().min(1).max(255),
+    expiresInDays: z.number().int().min(1).max(3650).optional(),
+    rotationGraceSeconds: z.number().int().min(0).max(30 * 24 * 3600).optional(),
+});
+const ScimRotateSchema = z.object({
+    rotationGraceSeconds: z.number().int().min(0).max(30 * 24 * 3600).optional(),
+});
 const SamlConnectionSchema = z.object({
     name: z.string().min(1).max(255),
     idpEntityId: z.string().min(1).optional(),
@@ -9,7 +21,7 @@ const SamlConnectionSchema = z.object({
     idpCertificate: z.string().optional(),
     spEntityId: z.string().min(1),
     spAcsUrl: z.string().url(),
-    attributeMapping: z.record(z.array(z.string())).optional(),
+    attributeMapping: z.record(z.string(), z.array(z.string())).optional(),
     isActive: z.boolean().optional(),
 });
 const OidcConnectionSchema = z.object({
@@ -18,16 +30,21 @@ const OidcConnectionSchema = z.object({
     authorizationEndpoint: z.string().url(),
     tokenEndpoint: z.string().url(),
     userinfoEndpoint: z.string().url().optional(),
-    jwksUri: z.string().url().optional(),
+    jwksUri: z.string().url(),
     clientId: z.string().min(1),
     clientSecret: z.string().min(1),
     scopes: z.array(z.string()).optional(),
-    attributeMapping: z.record(z.array(z.string())).optional(),
+    attributeMapping: z.record(z.string(), z.array(z.string())).optional(),
     isActive: z.boolean().optional(),
 });
 export default async function ssoRoutes(app) {
-    const requireSsoManager = requireAuthAndRole(["owner", "admin"], { resource: "sso_connection", action: "manage" });
-    const requireSsoReader = requireAuthAndRole(["owner", "admin", "member"], { resource: "sso_connection", action: "read" });
+    const requireSsoManager = requireOrganizationRole(["owner", "admin"], { resource: "sso_connection", action: "manage" });
+    const requireSsoReader = requireOrganizationRole(["owner", "admin", "member"], { resource: "sso_connection", action: "read" });
+    // Issuing, rotating, and revoking a SCIM credential is owner-only: a SCIM
+    // token provisions and deactivates tenant users, so it must not be mintable
+    // by a mere admin.
+    const requireSsoOwner = requireOrganizationRole(["owner"], { resource: "sso_connection", action: "manage" });
+    const scimCredentials = new ScimConnectionService(app.container.scimConnectionRepository);
     // SAML connections.
     app.get("/organizations/:id/saml-connections", { preHandler: [requireSsoReader] }, async (request) => {
         const { id } = request.params;
@@ -37,13 +54,21 @@ export default async function ssoRoutes(app) {
     app.post("/organizations/:id/saml-connections", { preHandler: [requireSsoManager] }, async (request, reply) => {
         const { id } = request.params;
         const body = SamlConnectionSchema.parse(request.body);
+        try {
+            if (body.idpSsoUrl)
+                validateSsoEndpoint(body.idpSsoUrl, "idpSsoUrl");
+            validateSsoEndpoint(body.spAcsUrl, "spAcsUrl");
+        }
+        catch (error) {
+            return reply.status(400).send({ error: error instanceof Error ? error.message : "Invalid SAML endpoint" });
+        }
         const connection = await app.container.samlConnectionRepository.create({ orgId: id, ...body });
         await request.audit("saml_connection_created", { orgId: id, connectionId: connection.id });
-        return reply.status(201).send(connection);
+        return reply.status(201).send(toPublicSamlConnection(connection));
     });
     app.get("/organizations/:id/saml-connections/:connectionId/metadata", { preHandler: [requireSsoReader] }, async (request, reply) => {
-        const { connectionId } = request.params;
-        const connection = await app.container.samlConnectionRepository.findById(connectionId);
+        const { id, connectionId } = request.params;
+        const connection = await app.container.samlConnectionRepository.findByIdAndOrgId(connectionId, id);
         if (!connection)
             return reply.status(404).send({ error: "Connection not found" });
         const metadata = `<?xml version="1.0" encoding="UTF-8"?>
@@ -71,9 +96,21 @@ export default async function ssoRoutes(app) {
     app.post("/organizations/:id/oidc-connections", { preHandler: [requireSsoManager] }, async (request, reply) => {
         const { id } = request.params;
         const body = OidcConnectionSchema.parse(request.body);
+        try {
+            validateSsoEndpoint(body.issuer, "issuer");
+            validateSsoEndpoint(body.authorizationEndpoint, "authorizationEndpoint");
+            validateSsoEndpoint(body.tokenEndpoint, "tokenEndpoint");
+            if (body.userinfoEndpoint)
+                validateSsoEndpoint(body.userinfoEndpoint, "userinfoEndpoint");
+            if (body.jwksUri)
+                validateSsoEndpoint(body.jwksUri, "jwksUri");
+        }
+        catch (error) {
+            return reply.status(400).send({ error: error instanceof Error ? error.message : "Invalid OIDC endpoint" });
+        }
         const connection = await app.container.oidcConnectionRepository.create({ orgId: id, ...body });
         await request.audit("oidc_connection_created", { orgId: id, connectionId: connection.id });
-        return reply.status(201).send(connection);
+        return reply.status(201).send(toPublicOidcConnection(connection));
     });
     app.delete("/organizations/:id/oidc-connections/:connectionId", { preHandler: [requireSsoManager] }, async (request, reply) => {
         const { id, connectionId } = request.params;
@@ -83,15 +120,109 @@ export default async function ssoRoutes(app) {
         await request.audit("oidc_connection_deleted", { orgId: id, connectionId: record.id });
         return { success: true };
     });
-    // SCIM config.
+    // --- SCIM connections --------------------------------------------------
+    //
+    // A SCIM credential belongs to exactly one organization. There is no global
+    // SCIM configuration, and the bearer token is returned only once, at creation
+    // or rotation; afterwards only its hint is visible.
     app.get("/organizations/:id/scim-config", { preHandler: [requireSsoReader] }, async (request) => {
         const { id } = request.params;
         const base = config.AUTH_API_PUBLIC_URL || `http://localhost:${config.PORT}`;
+        const connections = await app.container.scimConnectionRepository.listByOrg(id);
+        const active = connections.find((c) => c.revokedAt === null) ?? null;
         return {
-            enabled: !!process.env.SCIM_BEARER_TOKEN,
+            enabled: active !== null,
             baseUrl: `${base}/scim/v2`,
             orgId: id,
+            activeConnection: active ? publicScimConnection(active) : null,
+            connectionCount: connections.length,
+        };
+    });
+    app.get("/organizations/:id/scim-connections", { preHandler: [requireSsoReader] }, async (request) => {
+        const { id } = request.params;
+        const connections = await app.container.scimConnectionRepository.listByOrg(id);
+        return { connections: connections.map(publicScimConnection) };
+    });
+    app.post("/organizations/:id/scim-connections", { preHandler: [requireSsoOwner] }, async (request, reply) => {
+        const { id: orgId } = request.params;
+        const body = ScimConnectionSchema.parse(request.body);
+        const organization = await app.container.organizationRepository.findById(orgId);
+        if (!organization)
+            return reply.status(404).send({ error: "Organization not found" });
+        const result = await scimCredentials.create({
+            orgId,
+            name: body.name,
+            createdByUserId: request.user?.id,
+            options: {
+                expiresInDays: body.expiresInDays,
+                rotationGraceSeconds: body.rotationGraceSeconds,
+            },
+        });
+        if (!result.success)
+            return sendResultError(reply, result);
+        const connection = await app.container.scimConnectionRepository.findById(result.data.connectionId);
+        await request.audit("scim_connection_created", {
+            orgId,
+            connectionId: result.data.connectionId,
+            name: body.name,
+        });
+        // The token is shown exactly once and is never recoverable afterwards.
+        return reply.status(201).send({
+            ...publicScimConnection(connection),
+            token: result.data.token,
+            warning: "Store this token now. It cannot be retrieved again.",
+        });
+    });
+    app.post("/organizations/:id/scim-connections/:connectionId/rotate", { preHandler: [requireSsoOwner] }, async (request, reply) => {
+        const { id: orgId, connectionId } = request.params;
+        const body = ScimRotateSchema.parse(request.body ?? {});
+        const connection = await app.container.scimConnectionRepository.findById(connectionId);
+        if (!connection || connection.orgId !== orgId) {
+            return reply.status(404).send({ error: "SCIM connection not found" });
+        }
+        const result = await scimCredentials.rotate(connectionId, {
+            rotationGraceSeconds: body.rotationGraceSeconds,
+        });
+        if (!result.success)
+            return sendResultError(reply, result);
+        await request.audit("scim_connection_rotated", {
+            orgId,
+            connectionId,
+            previousTokenValidUntil: result.data.previousTokenValidUntil.toISOString(),
+        });
+        return {
+            connectionId,
+            token: result.data.token,
+            tokenHint: result.data.tokenHint,
+            previousTokenValidUntil: result.data.previousTokenValidUntil.toISOString(),
+            warning: "Store this token now. It cannot be retrieved again.",
         };
     });
+    app.delete("/organizations/:id/scim-connections/:connectionId", { preHandler: [requireSsoOwner] }, async (request, reply) => {
+        const { id: orgId, connectionId } = request.params;
+        const connection = await app.container.scimConnectionRepository.findById(connectionId);
+        if (!connection || connection.orgId !== orgId) {
+            return reply.status(404).send({ error: "SCIM connection not found" });
+        }
+        const result = await scimCredentials.revoke(connectionId);
+        if (!result.success)
+            return sendResultError(reply, result);
+        await request.audit("scim_connection_revoked", { orgId, connectionId });
+        return reply.status(204).send();
+    });
+}
+/** Never expose token material, only a short hint for identification. */
+function publicScimConnection(connection) {
+    return {
+        id: connection.id,
+        organizationId: connection.orgId,
+        name: connection.name,
+        tokenHint: connection.tokenHint,
+        expiresAt: connection.expiresAt,
+        revokedAt: connection.revokedAt,
+        lastRotatedAt: connection.lastRotatedAt,
+        lastUsedAt: connection.lastUsedAt,
+        createdAt: connection.createdAt,
+    };
 }
 //# sourceMappingURL=sso.js.map

package/dist/routes/admin/sso.js.map

@@ -1 +1 @@
-{"version":3,"file":"sso.js","sourceRoot":"","sources":["../../../src/routes/admin/sso.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE1C,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACtC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC1B,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1D,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACxB,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACvC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC/B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC7C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1D,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,SAAS,CAAC,GAAoB;IAC1D,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IACnH,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAE1H,oBAAoB;IACpB,GAAG,CAAC,GAAG,CACL,qCAAqC,EACrC,EAAE,UAAU,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAClC,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACjF,OAAO,EAAE,WAAW,EAAE,CAAC;IACzB,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,qCAAqC,EACrC,EAAE,UAAU,EAAE,CAAC,iBAAiB,CAAC,EAAE,EACnC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,wBAAwB,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QAC/F,MAAM,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3F,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC5C,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,GAAG,CACL,4DAA4D,EAC5D,EAAE,UAAU,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAClC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,MAAkC,CAAC;QACpE,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,wBAAwB,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACvF,IAAI,CAAC,UAAU;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAElF,MAAM,QAAQ,GAAG;iFAC0D,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC;;sGAEX,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC;;uBAE7G,CAAC;QAClB,OAAO,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxE,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,MAAM,CACR,mDAAmD,EACnD,EAAE,UAAU,EAAE,CAAC,iBAAiB,CAAC,EAAE,EACnC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,EAAE,EAAE,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,MAA8C,CAAC;QACpF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QACjG,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAC9E,MAAM,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QACvF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CACF,CAAC;IAEF,oBAAoB;IACpB,GAAG,CAAC,GAAG,CACL,qCAAqC,EACrC,EAAE,UAAU,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAClC,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACjF,OAAO,EAAE,WAAW,EAAE,CAAC;IACzB,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,qCAAqC,EACrC,EAAE,UAAU,EAAE,CAAC,iBAAiB,CAAC,EAAE,EACnC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,wBAAwB,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QAC/F,MAAM,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3F,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC5C,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,MAAM,CACR,mDAAmD,EACnD,EAAE,UAAU,EAAE,CAAC,iBAAiB,CAAC,EAAE,EACnC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,EAAE,EAAE,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,MAA8C,CAAC;QACpF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QACjG,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAC9E,MAAM,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QACvF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CACF,CAAC;IAEF,eAAe;IACf,GAAG,CAAC,GAAG,CACL,gCAAgC,EAChC,EAAE,UAAU,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAClC,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,IAAI,GAAG,MAAM,CAAC,mBAAmB,IAAI,oBAAoB,MAAM,CAAC,IAAI,EAAE,CAAC;QAC7E,OAAO;YACL,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB;YACxC,OAAO,EAAE,GAAG,IAAI,UAAU;YAC1B,KAAK,EAAE,EAAE;SACV,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"sso.js","sourceRoot":"","sources":["../../../src/routes/admin/sso.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAC3D,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE;CAC7E,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE;CAC7E,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACtC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC1B,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACxB,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACvC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC/B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC7C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,SAAS,CAAC,GAAoB;IAC1D,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IACxH,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/H,0EAA0E;IAC1E,4EAA4E;IAC5E,mBAAmB;IACnB,MAAM,eAAe,GAAG,uBAAuB,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC7G,MAAM,eAAe,GAAG,IAAI,qBAAqB,CAAC,GAAG,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;IAE1F,oBAAoB;IACpB,GAAG,CAAC,GAAG,CACL,qCAAqC,EACrC,EAAE,UAAU,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAClC,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACjF,OAAO,EAAE,WAAW,EAAE,CAAC;IACzB,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,qCAAqC,EACrC,EAAE,UAAU,EAAE,CAAC,iBAAiB,CAAC,EAAE,EACnC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,SAAS;gBAAE,mBAAmB,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YACrE,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,wBAAwB,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QAC/F,MAAM,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3F,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC,CAAC;IACpE,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,GAAG,CACL,4DAA4D,EAC5D,EAAE,UAAU,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAClC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,EAAE,EAAE,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,MAA8C,CAAC;QACpF,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QACnG,IAAI,CAAC,UAAU;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAElF,MAAM,QAAQ,GAAG;iFAC0D,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC;;sGAEX,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC;;uBAE7G,CAAC;QAClB,OAAO,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxE,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,MAAM,CACR,mDAAmD,EACnD,EAAE,UAAU,EAAE,CAAC,iBAAiB,CAAC,EAAE,EACnC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,EAAE,EAAE,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,MAA8C,CAAC;QACpF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QACjG,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAC9E,MAAM,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QACvF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CACF,CAAC;IAEF,oBAAoB;IACpB,GAAG,CAAC,GAAG,CACL,qCAAqC,EACrC,EAAE,UAAU,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAClC,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACjF,OAAO,EAAE,WAAW,EAAE,CAAC;IACzB,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,qCAAqC,EACrC,EAAE,UAAU,EAAE,CAAC,iBAAiB,CAAC,EAAE,EACnC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC;YACH,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC3C,mBAAmB,CAAC,IAAI,CAAC,qBAAqB,EAAE,uBAAuB,CAAC,CAAC;YACzE,mBAAmB,CAAC,IAAI,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;YACzD,IAAI,IAAI,CAAC,gBAAgB;gBAAE,mBAAmB,CAAC,IAAI,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;YAC1F,IAAI,IAAI,CAAC,OAAO;gBAAE,mBAAmB,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,wBAAwB,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QAC/F,MAAM,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3F,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC,CAAC;IACpE,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,MAAM,CACR,mDAAmD,EACnD,EAAE,UAAU,EAAE,CAAC,iBAAiB,CAAC,EAAE,EACnC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,EAAE,EAAE,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,MAA8C,CAAC;QACpF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QACjG,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAC9E,MAAM,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QACvF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CACF,CAAC;IAEF,0EAA0E;IAC1E,EAAE;IACF,4EAA4E;IAC5E,8EAA8E;IAC9E,oDAAoD;IAEpD,GAAG,CAAC,GAAG,CACL,gCAAgC,EAChC,EAAE,UAAU,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAClC,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,IAAI,GAAG,MAAM,CAAC,mBAAmB,IAAI,oBAAoB,MAAM,CAAC,IAAI,EAAE,CAAC;QAC7E,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,wBAAwB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC/E,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC;QAErE,OAAO;YACL,OAAO,EAAE,MAAM,KAAK,IAAI;YACxB,OAAO,EAAE,GAAG,IAAI,UAAU;YAC1B,KAAK,EAAE,EAAE;YACT,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;YAC9D,eAAe,EAAE,WAAW,CAAC,MAAM;SACpC,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,GAAG,CACL,qCAAqC,EACrC,EAAE,UAAU,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAClC,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,wBAAwB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC/E,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC;IAChE,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,qCAAqC,EACrC,EAAE,UAAU,EAAE,CAAC,eAAe,CAAC,EAAE,EACjC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QACvD,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEtD,MAAM,YAAY,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAChF,IAAI,CAAC,YAAY;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;QAEtF,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC;YAC1C,KAAK;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,eAAe,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE;YACjC,OAAO,EAAE;gBACP,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;aAChD;SACF,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAE3D,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,wBAAwB,CAAC,QAAQ,CACtE,MAAM,CAAC,IAAI,CAAC,YAAY,CACzB,CAAC;QACF,MAAM,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE;YAC7C,KAAK;YACL,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY;YACtC,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;QAEH,uEAAuE;QACvE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YAC5B,GAAG,oBAAoB,CAAC,UAAW,CAAC;YACpC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;YACxB,OAAO,EAAE,qDAAqD;SAC/D,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,0DAA0D,EAC1D,EAAE,UAAU,EAAE,CAAC,eAAe,CAAC,EAAE,EACjC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,MAA8C,CAAC;QAC3F,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAExD,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,wBAAwB,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACvF,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YAC9C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,YAAY,EAAE;YACxD,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;SAChD,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAE3D,MAAM,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE;YAC7C,KAAK;YACL,YAAY;YACZ,uBAAuB,EAAE,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE;SAC3E,CAAC,CAAC;QAEH,OAAO;YACL,YAAY;YACZ,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;YACxB,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS;YAChC,uBAAuB,EAAE,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE;YAC1E,OAAO,EAAE,qDAAqD;SAC/D,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,MAAM,CACR,mDAAmD,EACnD,EAAE,UAAU,EAAE,CAAC,eAAe,CAAC,EAAE,EACjC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,MAA8C,CAAC;QAC3F,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,wBAAwB,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACvF,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YAC9C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAE3D,MAAM,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;QACxE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAClC,CAAC,CACF,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,SAAS,oBAAoB,CAAC,UAU7B;IACC,OAAO;QACL,EAAE,EAAE,UAAU,CAAC,EAAE;QACjB,cAAc,EAAE,UAAU,CAAC,KAAK;QAChC,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,aAAa,EAAE,UAAU,CAAC,aAAa;QACvC,UAAU,EAAE,UAAU,CAAC,UAAU;QACjC,SAAS,EAAE,UAAU,CAAC,SAAS;KAChC,CAAC;AACJ,CAAC"}

package/dist/routes/admin/webhooks.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { requireOwner } from "./helpers.js";
+import { requirePlatformRole } from "./helpers.js";
 import { listEndpoints, createEndpoint, updateEndpoint, deleteEndpoint, rotateEndpointSecret, listDeliveries, retryDelivery } from "../../services/webhooks.js";
 const CreateWebhookSchema = z.object({
     appId: z.string().uuid().nullable().optional(),
@@ -14,19 +14,19 @@ const UpdateWebhookSchema = z.object({
     isActive: z.boolean().optional(),
 });
 export default async function webhooksRoutes(app) {
-    app.get("/platform/webhooks", { preHandler: [requireOwner()] }, async (request) => {
+    app.get("/platform/webhooks", { preHandler: [requirePlatformRole("owner")] }, async (request) => {
         const query = request.query;
         const endpoints = await listEndpoints(query.appId);
         return { endpoints: endpoints.map(({ secret: _secret, ...rest }) => rest) };
     });
-    app.post("/platform/webhooks", { preHandler: [requireOwner()] }, async (request, reply) => {
+    app.post("/platform/webhooks", { preHandler: [requirePlatformRole("owner")] }, async (request, reply) => {
         const body = CreateWebhookSchema.parse(request.body);
         const endpoint = await createEndpoint(body);
         await request.audit("platform_webhook_created", { endpointId: endpoint.id, url: endpoint.url });
         const { secret: _secret, ...rest } = endpoint;
         return reply.status(201).send({ endpoint: rest, signingSecret: endpoint.signingSecret });
     });
-    app.patch("/platform/webhooks/:id", { preHandler: [requireOwner()] }, async (request, reply) => {
+    app.patch("/platform/webhooks/:id", { preHandler: [requirePlatformRole("owner")] }, async (request, reply) => {
         const { id } = request.params;
         const body = UpdateWebhookSchema.parse(request.body);
         const updated = await updateEndpoint(id, body);
@@ -36,7 +36,7 @@ export default async function webhooksRoutes(app) {
         const { secret: _secret, ...rest } = updated;
         return { endpoint: rest };
     });
-    app.delete("/platform/webhooks/:id", { preHandler: [requireOwner()] }, async (request, reply) => {
+    app.delete("/platform/webhooks/:id", { preHandler: [requirePlatformRole("owner")] }, async (request, reply) => {
         const { id } = request.params;
         const deleted = await deleteEndpoint(id);
         if (!deleted)
@@ -44,7 +44,7 @@ export default async function webhooksRoutes(app) {
         await request.audit("platform_webhook_deleted", { endpointId: id });
         return { success: true };
     });
-    app.post("/platform/webhooks/:id/rotate-secret", { preHandler: [requireOwner()] }, async (request, reply) => {
+    app.post("/platform/webhooks/:id/rotate-secret", { preHandler: [requirePlatformRole("owner")] }, async (request, reply) => {
         const { id } = request.params;
         const result = await rotateEndpointSecret(id);
         if (!result)
@@ -52,12 +52,12 @@ export default async function webhooksRoutes(app) {
         await request.audit("platform_webhook_secret_rotated", { endpointId: id });
         return { signingSecret: result.signingSecret };
     });
-    app.get("/platform/webhooks/:id/deliveries", { preHandler: [requireOwner()] }, async (request) => {
+    app.get("/platform/webhooks/:id/deliveries", { preHandler: [requirePlatformRole("owner")] }, async (request) => {
         const { id } = request.params;
         const deliveries = await listDeliveries(id);
         return { deliveries };
     });
-    app.post("/platform/webhook-deliveries/:id/retry", { preHandler: [requireOwner()] }, async (request, reply) => {
+    app.post("/platform/webhook-deliveries/:id/retry", { preHandler: [requirePlatformRole("owner")] }, async (request, reply) => {
         const { id } = request.params;
         const ok = await retryDelivery(id);
         if (!ok)

package/dist/routes/admin/webhooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../../src/routes/admin/webhooks.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,oBAAoB,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAEhK,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC9C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC;IAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC/C,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACtD,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC9C,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,cAAc,CAAC,GAAoB;IAC/D,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,EAAE,UAAU,EAAE,CAAC,YAAY,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChF,MAAM,KAAK,GAAG,OAAO,CAAC,KAA2B,CAAC;QAClD,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnD,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,UAAU,EAAE,CAAC,YAAY,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACxF,MAAM,IAAI,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QAChG,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,QAAQ,CAAC;QAC9C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAE,UAAU,EAAE,CAAC,YAAY,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC7F,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,IAAI,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC5E,MAAM,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACtF,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;QAC7C,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,wBAAwB,EAAE,EAAE,UAAU,EAAE,CAAC,YAAY,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC9F,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC5E,MAAM,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;QACpE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,sCAAsC,EAAE,EAAE,UAAU,EAAE,CAAC,YAAY,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC1G,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC3E,MAAM,OAAO,CAAC,KAAK,CAAC,iCAAiC,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,mCAAmC,EAAE,EAAE,UAAU,EAAE,CAAC,YAAY,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC/F,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,EAAE,CAAC,CAAC;QAC5C,OAAO,EAAE,UAAU,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,wCAAwC,EAAE,EAAE,UAAU,EAAE,CAAC,YAAY,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC5G,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,EAAE,CAAC,CAAC;QACnC,IAAI,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC,CAAC;QACvF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../../src/routes/admin/webhooks.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,oBAAoB,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAEhK,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC9C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC;IAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC/C,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACtD,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC9C,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,cAAc,CAAC,GAAoB;IAC/D,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,EAAE,UAAU,EAAE,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC9F,MAAM,KAAK,GAAG,OAAO,CAAC,KAA2B,CAAC;QAClD,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnD,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,UAAU,EAAE,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACtG,MAAM,IAAI,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QAChG,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,QAAQ,CAAC;QAC9C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAE,UAAU,EAAE,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC3G,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,IAAI,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC5E,MAAM,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACtF,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;QAC7C,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,wBAAwB,EAAE,EAAE,UAAU,EAAE,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC5G,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC5E,MAAM,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;QACpE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,sCAAsC,EAAE,EAAE,UAAU,EAAE,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACxH,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC3E,MAAM,OAAO,CAAC,KAAK,CAAC,iCAAiC,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,mCAAmC,EAAE,EAAE,UAAU,EAAE,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC7G,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,EAAE,CAAC,CAAC;QAC5C,OAAO,EAAE,UAAU,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,wCAAwC,EAAE,EAAE,UAAU,EAAE,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC1H,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,EAAE,CAAC,CAAC;QACnC,IAAI,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC,CAAC;QACvF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/routes/apiKeys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apiKeys.d.ts","sourceRoot":"","sources":["../../src/routes/apiKeys.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAS/C,wBAA8B,YAAY,CAAC,GAAG,EAAE,eAAe,iBAiD9D"}
+{"version":3,"file":"apiKeys.d.ts","sourceRoot":"","sources":["../../src/routes/apiKeys.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAS/C,wBAA8B,YAAY,CAAC,GAAG,EAAE,eAAe,iBAqE9D"}

package/dist/routes/apiKeys.js

@@ -1,16 +1,32 @@
 import { z } from "zod";
 import { generateApiKey, hashApiKey } from "../services/tokens.js";
-import { toPublicUser } from "../types.js";
+import { toPublicApiKey, toPublicUser } from "../types.js";
 const CreateKeySchema = z.object({
     name: z.string().min(1).max(100),
     scopes: z.array(z.string()).optional(),
 });
 export default async function apiKeyRoutes(app) {
-    app.post("/api-keys", { preHandler: [app.authenticate] }, async (request, reply) => {
+    app.post("/api-keys", { preHandler: [app.authenticate] }, async (request) => {
         const body = CreateKeySchema.parse(request.body);
         const user = request.user;
-        const orgId = request.state?.org?.id;
-        const appId = request.state?.app?.id;
+        let orgId = user.defaultOrgId ?? null;
+        let appId;
+        if (request.state?.app) {
+            const membership = await app.container.organizationRepository.findMembership(request.state.app.orgId, user.id);
+            if (membership) {
+                orgId = request.state.app.orgId;
+                appId = request.state.app.id;
+                request.state.membership = membership;
+                request.state.org = await app.container.organizationRepository.findById(request.state.app.orgId);
+            }
+        }
+        else if (orgId) {
+            const membership = await app.container.organizationRepository.findMembership(orgId, user.id);
+            if (membership) {
+                request.state.membership = membership;
+                request.state.org = await app.container.organizationRepository.findById(orgId);
+            }
+        }
         const { key, prefix } = generateApiKey();
         const record = await app.container.apiKeyRepository.create({
             userId: user.id,
@@ -24,8 +40,10 @@ export default async function apiKeyRoutes(app) {
         await request.audit("api_key_created", {
             keyId: record.id,
             name: record.name,
+            orgId,
+            appId,
         });
-        return { key, apiKey: record };
+        return { key, apiKey: toPublicApiKey(record) };
     });
     app.get("/api-keys", { preHandler: [app.authenticate] }, async (request) => {
         const user = request.user;

package/dist/routes/apiKeys.js.map

@@ -1 +1 @@
-{"version":3,"file":"apiKeys.js","sourceRoot":"","sources":["../../src/routes/apiKeys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,YAAY,CAAC,GAAoB;IAC7D,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACjF,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC;QAErC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,MAAM,CAAC;YACzD,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,KAAK,EAAE,KAAK,IAAI,IAAI;YACpB,KAAK,EAAE,KAAK,IAAI,IAAI;YACpB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM;YACN,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC;YACxB,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;SACzD,CAAC,CAAC;QAEH,MAAM,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE;YACrC,KAAK,EAAE,MAAM,CAAC,EAAE;YAChB,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB,CAAC,CAAC;QAEH,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACzE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,eAAe,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvF,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAE3B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACxF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAChF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACjF,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"apiKeys.js","sourceRoot":"","sources":["../../src/routes/apiKeys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3D,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,YAAY,CAAC,GAAoB;IAC7D,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC1E,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,IAAI,KAAK,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC;QACtC,IAAI,KAAyB,CAAC;QAC9B,IAAI,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;YACvB,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,cAAc,CAC1E,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EACvB,IAAI,CAAC,EAAE,CACR,CAAC;YACF,IAAI,UAAU,EAAE,CAAC;gBACf,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC;gBAChC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7B,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;gBACtC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACnG,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,EAAE,CAAC;YACjB,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YAC7F,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;gBACtC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;QAED,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,MAAM,CAAC;YACzD,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,KAAK,EAAE,KAAK,IAAI,IAAI;YACpB,KAAK,EAAE,KAAK,IAAI,IAAI;YACpB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM;YACN,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC;YACxB,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;SACzD,CAAC,CAAC;QAEH,MAAM,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE;YACrC,KAAK,EAAE,MAAM,CAAC,EAAE;YAChB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,KAAK;YACL,KAAK;SACN,CAAC,CAAC;QAEH,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACzE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,eAAe,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvF,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAE3B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACxF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAChF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACjF,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/routes/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/routes/auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAwD/C,wBAA8B,UAAU,CAAC,GAAG,EAAE,eAAe,iBA4J5D"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/routes/auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AA6D/C,wBAA8B,UAAU,CAAC,GAAG,EAAE,eAAe,iBA0P5D"}

package/dist/routes/auth.js

@@ -5,9 +5,9 @@ import { rateLimit } from "../plugins/rateLimit.js";
 import { checkImpossibleTravel } from "../services/anomalyDetection.js";
 import { sendSuspiciousLoginAlert } from "../services/email.js";
 import { checkIpAllowed } from "../services/ipControls.js";
-import { toPublicUser } from "../types.js";
-import { verifyTOTP } from "../services/totp.js";
+import { toSelfUser } from "../types.js";
 import { sendResultError } from "./helpers.js";
+import { findApplicationByClientId } from "../services/applications.js";
 /**
  * Fire-and-forget impossible-travel check after a successful login.
  * Emits a suspicious-login email when the user's previous login came from a
@@ -35,13 +35,17 @@ const RegisterSchema = z.object({
     password: z.string().min(8).max(128),
     name: z.string().max(255).optional(),
     client_id: z.string().optional(),
-    metadata: z.record(z.unknown()).optional(),
+    metadata: z.record(z.string(), z.unknown()).optional(),
 });
 const LoginSchema = z.object({
     email: z.string().email().max(255),
     password: z.string().min(1).max(128),
     client_id: z.string().optional(),
-    totp_code: z.string().min(6).max(8).optional(),
+});
+const MfaVerifySchema = z.object({
+    challenge: z.string().min(20).max(256),
+    code: z.string().min(6).max(64),
+    factor: z.enum(["totp", "backup_code"]).optional(),
 });
 const RefreshSchema = z.object({
     client_id: z.string().optional(),
@@ -72,9 +76,10 @@ export default async function authRoutes(app) {
         });
         if (!result.success)
             return sendResultError(reply, result);
+        request.state.auditUserId = result.data.user.id;
         await request.audit("user_registered", { userId: result.data.user.id, email: result.data.user.email });
         setSessionCookies(reply, result.data.accessToken, result.data.refreshToken, body.client_id);
-        return { user: toPublicUser(result.data.user) };
+        return { user: toSelfUser(result.data.user) };
     });
     app.post("/login", {
         preHandler: [
@@ -94,19 +99,30 @@ export default async function authRoutes(app) {
             email: body.email,
             password: body.password,
             clientId: body.client_id,
+            flow: "login",
         });
         if (!result.success)
             return sendResultError(reply, result);
-        if (body.totp_code) {
-            const validTotp = await verifyTOTP(result.data.user.id, body.totp_code);
-            if (!validTotp) {
-                return reply.status(401).send({ error: "Invalid two-factor code." });
-            }
+        if (result.data.status === "requires_mfa") {
+            const pending = result.data.data;
+            request.state.auditUserId = pending.user.id;
+            await request.audit("mfa_challenge_created", { userId: pending.user.id, flow: "login" });
+            reply.header("Cache-Control", "no-store");
+            return reply.status(401).send({
+                error: "Multi-factor authentication required",
+                code: "MFA_REQUIRED",
+                mfaRequired: true,
+                challenge: pending.challenge,
+                expiresAt: pending.expiresAt,
+                methods: ["totp", "backup_code"],
+            });
         }
-        await request.audit("user_login", { userId: result.data.user.id });
-        detectImpossibleTravel(result.data.user, request.ip, request.headers["user-agent"]);
-        setSessionCookies(reply, result.data.accessToken, result.data.refreshToken, body.client_id);
-        return { user: toPublicUser(result.data.user) };
+        const auth = result.data.data;
+        request.state.auditUserId = auth.user.id;
+        await request.audit("user_login", { userId: auth.user.id });
+        detectImpossibleTravel(auth.user, request.ip, request.headers["user-agent"]);
+        setSessionCookies(reply, auth.accessToken, auth.refreshToken, body.client_id);
+        return { user: toSelfUser(auth.user) };
     });
     app.post("/token-login", {
         preHandler: [
@@ -126,24 +142,85 @@ export default async function authRoutes(app) {
             email: body.email,
             password: body.password,
             clientId: body.client_id,
+            flow: "token_login",
         });
         if (!result.success)
             return sendResultError(reply, result);
-        if (body.totp_code) {
-            const validTotp = await verifyTOTP(result.data.user.id, body.totp_code);
-            if (!validTotp) {
-                return reply.status(401).send({ error: "Invalid two-factor code." });
+        if (result.data.status === "requires_mfa") {
+            const pending = result.data.data;
+            request.state.auditUserId = pending.user.id;
+            await request.audit("mfa_challenge_created", { userId: pending.user.id, flow: "token_login" });
+            reply.header("Cache-Control", "no-store");
+            return reply.status(401).send({
+                error: "Multi-factor authentication required",
+                code: "MFA_REQUIRED",
+                mfaRequired: true,
+                challenge: pending.challenge,
+                expiresAt: pending.expiresAt,
+                methods: ["totp", "backup_code"],
+            });
+        }
+        const auth = result.data.data;
+        request.state.auditUserId = auth.user.id;
+        await request.audit("user_token_login", { userId: auth.user.id });
+        detectImpossibleTravel(auth.user, request.ip, request.headers["user-agent"]);
+        return {
+            accessToken: auth.accessToken,
+            refreshToken: auth.refreshToken,
+            expiresAt: auth.expiresAt,
+            user: toSelfUser(auth.user),
+        };
+    });
+    /**
+     * Completes the `requires_mfa` state started by /login or /token-login.
+     * Authenticated by the opaque challenge alone: `app.authenticate` is not used
+     * and no token exists yet at this point.
+     */
+    app.post("/mfa/verify", {
+        preHandler: [
+            rateLimit({
+                keyPrefix: "mfa-verify",
+                maxAttempts: 20,
+                windowSeconds: 300,
+            }),
+        ],
+    }, async (request, reply) => {
+        const body = MfaVerifySchema.parse(request.body);
+        const result = await sdk.authentication.completeMfa({
+            challenge: body.challenge,
+            code: body.code,
+            factor: body.factor,
+            ipAddress: request.ip,
+            userAgent: request.headers["user-agent"],
+        });
+        if (!result.success) {
+            if (result.error.code === "MFA_INVALID_CODE") {
+                await request.audit("mfa_challenge_failed", { factor: body.factor ?? "auto" });
             }
+            return sendResultError(reply, result);
         }
-        await request.audit("user_token_login", { userId: result.data.user.id });
+        request.state.auditUserId = result.data.user.id;
+        await request.audit("mfa_verified", { userId: result.data.user.id, factor: result.data.factor });
         detectImpossibleTravel(result.data.user, request.ip, request.headers["user-agent"]);
+        if (result.data.flow === "login") {
+            await request.audit("user_login", { userId: result.data.user.id, mfa: result.data.factor });
+            // Scope the session cookie to the client the challenge was created for,
+            // exactly as the password step of /login does.
+            setSessionCookies(reply, result.data.accessToken, result.data.refreshToken, result.data.clientId);
+        }
+        else {
+            await request.audit("user_token_login", { userId: result.data.user.id, mfa: result.data.factor });
+        }
         return {
             accessToken: result.data.accessToken,
-            user: toPublicUser(result.data.user),
+            refreshToken: result.data.refreshToken,
+            expiresAt: result.data.expiresAt,
+            factor: result.data.factor,
+            user: toSelfUser(result.data.user),
         };
     });
     app.get("/me", { preHandler: [app.authenticate] }, async (request) => {
-        return { user: request.user ? toPublicUser(request.user) : null };
+        return { user: request.user ? toSelfUser(request.user) : null };
     });
     app.post("/refresh", async (request, reply) => {
         const body = RefreshSchema.parse(request.body ?? {});
@@ -155,7 +232,20 @@ export default async function authRoutes(app) {
         const result = await sdk.authentication.refresh(refreshToken, clientId);
         if (!result.success)
             return sendResultError(reply, result);
-        await request.audit("token_refresh", {});
+        if (result.data.userId)
+            request.state.auditUserId = result.data.userId;
+        if (clientId) {
+            const application = await findApplicationByClientId(clientId);
+            if (application && result.data.userId) {
+                const membership = await request.server.container.organizationRepository.findMembership(application.orgId, result.data.userId);
+                if (membership) {
+                    request.state.app = application;
+                    request.state.membership = membership;
+                    request.state.org = await request.server.container.organizationRepository.findById(application.orgId);
+                }
+            }
+        }
+        await request.audit("token_refresh", { userId: result.data.userId, clientId, appId: request.state.app?.id, orgId: request.state.org?.id });
         setSessionCookies(reply, result.data.accessToken, result.data.refreshToken, clientId);
         return { success: true };
     });