@hilbras/keystone 1.9.0 → 2.5.0

package/README.md

@@ -1,6 +1,6 @@
 # Hilbras Keystone
 
-**Current version: `1.7.0`**
+**Current version: `2.5.0`**
 
 > A provider-agnostic, API-first identity platform for Hilbras products and third-party applications.
 
@@ -22,6 +22,91 @@ Keystone is a **standalone identity platform**, not a wrapper around another ide
 
 ---
 
+## What's new in v2.5.0
+
+- **The OIDC nonce now reaches the Google connector** — `GoogleConnector.exchangeCode` overrode the base method without forwarding its options, so the nonce added in 2.4.0 was silently discarded for the default provider. Every non-Google OIDC provider validated the nonce; Google, the most likely to be in use, did not.
+- **The unsigned SAML `Issuer` is now validated** — the response-level `<saml:Issuer>` sits outside both signed regions, so rewriting it does not invalidate the signature, and nothing compared it to the registered IdP. An assertion could claim to come from a different identity provider. Keystone now checks it against the connection, as SAML 2.0 §2.5.1.5 requires. The assertion's own issuer is inside the signed region and was always covered.
+- **`RelayState` verification returns false instead of throwing** — a malformed RelayState is a bad request an attacker fully controls, so it produced a 500 rather than a 400.
+- **A missing userinfo endpoint is reported as unconfigured** — it was passed to the fetcher with a non-null assertion, surfacing a misleading "must be a valid URL" for a URL that was never set.
+- **24 adversarial SAML tests** — tampered signatures, untrusted signing keys, rotated-out certificates, unsigned assertions, XML signature wrapping, issuer and audience substitution, destination and recipient prefix/superstring/case variants, expired and not-yet-valid assertions, `InResponseTo` mismatch, transaction replay, and five RelayState tampering scenarios.
+- **[enterprise-sso.md](docs/security/enterprise-sso.md)** — SAML and OIDC setup, every check applied to an assertion or ID token, certificate rotation (and its lack of a grace period), endpoint SSRF policy, organization scoping, and recommendations.
+
+## What's new in v2.4.0
+
+> **Breaking.** The `authorization_code` grant now requires client authentication. A client redeeming an authorization code must present its `client_secret`; requests without one now receive `401 invalid_client`. Clients that were relying on the grant working without a secret must send it.
+
+- **The authorization code grant now authenticates the client** — it previously looked the client up and redeemed the code without ever checking a secret, so the code and its PKCE verifier were the only factors. This violates RFC 6749 §3.2.1 for confidential clients.
+- **`javascript:` and `data:` are refused as redirect URIs** — validation was `z.string().url()`, which accepts anything the URL parser accepts, including script-bearing schemes. A redirect URI is a value Keystone puts in a `Location` header on its own origin, so an org admin could previously register one and hand any user who authorized their app a redirect toward script execution. Also rejects wildcards, fragments, embedded credentials, and plaintext HTTP to non-loopback hosts.
+- **Public clients are supported and must use PKCE** — a `public` client type is issued no secret at all, rather than a secret it is expected to ignore, and a database constraint keeps the two halves of a client type consistent. PKCE is then mandatory for it, because client authentication is the only thing a secretless client cannot do.
+- **Scopes are intersected, not trusted** — the effective set is registered ∩ requested ∩ consented. A scope outside the registration is refused with `invalid_scope` rather than silently dropped, so a client asking for more than it has is visible instead of quietly downgraded. An empty registration preserves existing behaviour.
+- **OIDC federation sends and verifies a nonce** — `state` already proved the callback belonged to a login this browser started, but nothing bound the *ID token* to it. Any ID token the provider considered valid was accepted, including one minted for a different user or session.
+- **ID token verification is stricter** — algorithms are pinned rather than inferred from key material, and `exp`, `iat`, `iss`, `aud`, `sub` are *required* rather than merely checked when present. A token with no expiry was previously accepted indefinitely.
+- **Refresh tokens carry the granted scope set** — rotation preserves the authorization context instead of dropping it at the first refresh, and a refresh can narrow the grant but never widen it.
+
+## What's new in v2.3.0
+
+- **A password reset now actually logs the attacker out** — completing a reset changed the password but left every existing session and refresh token working. A reset is the standard response to a suspected compromise, so this defeated its own purpose: whoever prompted the reset kept their access. Sessions, refresh tokens, and outstanding recovery credentials are now all invalidated.
+- **An intercepted earlier reset email is dead** — reset tokens issued alongside the one used are now spent, so someone who captured a previous reset email cannot complete it after the user has already recovered.
+- **One revocation layer** — `revokeUserSessions`, `revokeRefreshTokens`, `revokeAuthenticationSessions`, and `revokeRecoveryCredentials` live in one place. Revocation was previously open-coded per call site, which is how the reset path came to omit it; the MFA-enable path now routes through the same function so the rule cannot drift.
+- **Recovery is left intact** — resetting revokes access but does not lock the user out: they can immediately log in with the new password. Covered by a test.
+
+> **Not revoked on reset:** API keys. They are separately issued, long-lived credentials belonging to integrations rather than to the person, and killing them silently breaks deployments. The residual gap — a key minted by an attacker who already held the password — is real; see [SECURITY.md](docs/SECURITY.md) for why key expiry is the right fix.
+
+## What's new in v2.2.0
+
+- **Magic links can no longer be redeemed twice at once** — consumption was a conditional `SELECT` followed by an *unconditional* `UPDATE`. Any number of parallel redemptions passed the check and every one of them logged in. The write is now the gate, so exactly one succeeds.
+- **Password reset tokens are spent exactly once** — the same race meant parallel resets each wrote a different password, last writer winning. This was the most consequential of the three, since whoever won held the account.
+- **SMS OTP codes are spent exactly once** — same shape, same fix.
+- **Replays are reported, not just refused** — a credential presented after it was already used now emits `magic_link_replayed`, `sms_otp_replayed`, or `password_reset_token_replayed`, which reaches the audit log. Previously a replay was indistinguishable from a typo, so a leaked token coming back was invisible. An *expired* credential is deliberately not reported as a replay, since that is not a leak.
+- **One shared primitive** — all consumption goes through a single atomic claim, so the pattern exists once rather than in three places that can drift.
+
+## What's new in v2.1.0
+
+- **Dependency tree is clean** — `npm audit` reports zero vulnerabilities across production *and* development trees, including a transitive `esbuild@0.18.20` that `drizzle-kit` was pinning. Resolved with an `overrides` entry rather than `audit fix --force`, which offered only a breaking downgrade of `drizzle-kit`.
+- **Continuous dependency security** — Dependabot for npm, GitHub Actions, and Docker; OSV scanning as an advisory source independent of npm's; enforced `npm audit`; dependency review on pull requests; SBOM generation; container scanning; and a license gate restricted to permissive terms.
+- **Release metadata is verified** — `npm run verify:release` fails the build on a version that disagrees between `package.json` and the lockfile, a missing or malformed license, or a missing `repository` field. Runs in CI and again before `npm publish`.
+- **The container image no longer ships a vulnerable npm** — the runtime image carried 8 HIGH-severity advisories inherited from the base image's bundled `npm@10.9.9`, invisible to `npm audit` and OSV because they are not in the dependency tree. npm is now removed from the production stage, which the app never invokes, clearing all 8 and shrinking the image from 600 MB to 550 MB.
+- **The package now declares its license** — `package.json` had no `license` field despite shipping an MIT `LICENSE` file, so the published package carried no machine-readable terms.
+
+## What's new in v2.0.0
+
+> **Breaking.** Two changes affect every deployment. `x-service-account-id` no
+> longer authenticates on its own, and `x-forwarded-for` is no longer believed
+> unless `KEYSTONE_TRUSTED_PROXIES` is set — behind a proxy with it unset, all
+> clients share one rate-limit budget. Read
+> [MIGRATION-2.0.md](docs/MIGRATION-2.0.md) before upgrading.
+
+- **A service account cannot be named into existence** — `x-service-account-id` previously authenticated as any service account named in the header, with no certificate and no credential. Identity now comes only from a certificate bound to the account or an authenticated credential.
+- **Certificates are bound to a fingerprint** — a service account authenticates by a client certificate whose SHA-256 fingerprint is bound to it, uniquely. A fingerprint can map to at most one account, and malformed values are rejected before they reach the database.
+- **Client identity headers are stripped from untrusted peers** — an `onRequest` hook removes them before routing and authentication, so no route can read a spoofed identity by accident.
+- **Rate limits can no longer be escaped** — the limiter previously read `x-forwarded-for` unconditionally, so any client could present a fresh address per request and never be limited. Keys come from the peer address unless a trusted proxy forwarded one.
+- **`KEYSTONE_TRUSTED_PROXIES`** names the proxies permitted to set identity headers. Unset by default, which trusts nothing.
+- **Service accounts can be revoked** — `POST /v1/admin/organizations/:id/service-accounts/:accountId/revoke` stops both certificate and API-key authentication.
+- **Documented trust boundaries** — [trust-boundaries.md](docs/security/trust-boundaries.md), [proxy-security.md](docs/security/proxy-security.md), and [mtls.md](docs/security/mtls.md).
+
+## What's new in v1.9.0
+
+- **SCIM is organization-scoped** — every SCIM connection belongs to exactly one organization, and every user and group read and write is filtered by it. A cross-tenant target returns `404`, so the endpoint is not a tenant oracle.
+- **SCIM credentials are per organization** — bearer tokens are stored only as a SHA-256 digest, resolved by that digest, and can be expired, rotated, and revoked. Issuing, rotating, and revoking is owner-only.
+- **Deprovisioning no longer reaches outside the tenant** — removing a user removes that organization's membership, and deactivates the account only when no membership remains anywhere. Previously it disabled a shared account in every organization that user belonged to.
+- **Real SCIM groups** — create, read, replace, patch, and delete groups, manage members, and search. Replaces the old synthetic role-bucket projection.
+- **New SCIM surface** — `PATCH /Users/:id`, `Users/.search`, `ServiceProviderConfig`, `ResourceTypes`, and `filter`/`startIndex`/`count`. Unsupported filters are rejected rather than silently ignored.
+
+> **Migration:** `SCIM_BEARER_TOKEN` and `SCIM_ORG_ID` are deprecated. If still set they are adopted once into a connection and then ignored — including after a revocation, so a restart cannot resurrect a credential you revoked. See [MIGRATION-1.9.md](docs/MIGRATION-1.9.md).
+
+## What's new in v1.8.0
+
+- **MFA is mandatory** — a user with TOTP enabled never receives a token before completing the second factor. Password authentication stops at `requires_mfa`; only `POST /auth/mfa/verify` completes the login.
+- **One-time MFA challenges** — opaque, short-lived, stored only as a hash, single-use, with an attempt budget enforced in the database.
+- **A single token-issuance chokepoint** — a token cannot be minted for an MFA-enabled user without a recorded factor, so no login path can bypass MFA by omission.
+- **TOTP verified against the user's own secret**, and each time-step is accepted exactly once, so a captured code is rejected even against a freshly issued challenge.
+- **Hardened backup codes** — 80 bits of entropy, keyed (peppered) hashing, expiry, and single-use consumption via a conditional update.
+- **Step-up on factor changes** — enrolling, confirming, disabling, or regenerating TOTP codes requires the account password, so a leaked session token cannot take over an account's second factor.
+- **Enabling MFA revokes existing sessions and refresh tokens**, and refresh rotation refuses sessions with no recorded factor.
+- **TOTP secrets are encrypted with AES-256-GCM**; values written by earlier versions remain readable.
+
+> **Migration:** `/auth/login` and `/auth/token-login` return `401` with `code: "MFA_REQUIRED"` and a challenge when MFA is required. Clients must render a code step and call `/auth/mfa/verify`. See [MIGRATION-1.8.md](docs/MIGRATION-1.8.md).
+
 ## What's new in v1.7.0
 
 - **Authorization boundary hardening** — platform roles (`owner`/`user`) and organization roles (`owner`/`admin`/`member`) are now separate namespaces.
@@ -489,6 +574,14 @@ services:
 | `KEYSTONE_QUEUE_PROVIDER` | `in-process`, `bullmq`, or empty to auto-select when Redis is available |
 | `KEYSTONE_PLUGINS` | Comma-separated module paths of plugins to load at startup |
 | `KEYSTONE_FEATURE_FLAGS` | Comma-separated `flag=true|false` runtime feature toggles |
+| `KEYSTONE_TOTP_ENCRYPTION_KEY` | Encrypts TOTP secrets and keys the backup-code hash. Falls back to `KEYSTONE_INTERNAL_API_KEY`. Must be stable — changing it invalidates enrolled authenticators |
+| `MFA_CHALLENGE_TTL_SECONDS` | Lifetime of a login MFA challenge (default `300`) |
+| `MFA_MAX_ATTEMPTS` | Factor attempts per challenge before it is locked (default `5`) |
+| `TOTP_BACKUP_CODE_TTL_SECONDS` | Backup-code lifetime (default `7776000`, 90 days) |
+| `SCIM_ROTATION_GRACE_SECONDS` | Grace window for a rotated SCIM token. Defaults to `0`, so rotation revokes the previous token |
+| `SCIM_RATE_LIMIT_MAX` / `SCIM_RATE_LIMIT_WINDOW_SECONDS` | Per-credential SCIM request budget |
+| `SCIM_AUTH_FAILURE_MAX` / `SCIM_AUTH_FAILURE_WINDOW_SECONDS` | Budget for unauthenticated SCIM requests, applied before authentication |
+| `KEYSTONE_TRUSTED_PROXIES` | Comma-separated proxy IPs / CIDRs allowed to set client-identity headers. **Unset means trust nothing** — forwarded headers are stripped and all clients share one rate-limit budget. Required when Keystone runs behind a reverse proxy |
 
 ---
 
@@ -516,8 +609,9 @@ If Keystone feels slow or uses a lot of memory during development, see [`docs/PE
 | Method | Path | Description |
 |--------|------|-------------|
 | POST | `/auth/register` | Email/password signup (local password hashing) |
-| POST | `/auth/login` | Email/password login (sets session cookies) |
+| POST | `/auth/login` | Email/password login (sets session cookies; returns `401 MFA_REQUIRED` + a challenge when MFA is required) |
 | POST | `/auth/token-login` | Email/password login for SPA/dashboard (returns bearer token) |
+| POST | `/auth/mfa/verify` | Complete a login MFA challenge and receive tokens |
 | POST | `/auth/logout` | Revoke session |
 | GET | `/auth/me` | Current user |
 | POST | `/auth/refresh` | Rotate refresh token |
@@ -525,7 +619,8 @@ If Keystone feels slow or uses a lot of memory during development, see [`docs/PE
 | GET | `/auth/callback/:provider` | OAuth callback |
 | POST | `/auth/forgot-password` | Request password reset |
 | POST | `/auth/reset-password` | Complete password reset |
-| POST/GET/DELETE | `/auth/api-keys` | Personal API keys |
+| POST/GET | `/auth/api-keys` | Create / list personal API keys |
+| DELETE | `/auth/api-keys/:id` | Revoke a personal API key |
 | GET | `/auth/validate` | Internal token/API-key validation |
 
 ### Federation
@@ -564,8 +659,10 @@ If Keystone feels slow or uses a lot of memory during development, see [`docs/PE
 | PATCH | `/v1/admin/platform/users/:userId` | Update non-role platform user fields (**owner only**) |
 | PATCH | `/v1/admin/platform/users/:userId/role` | Change a platform role (`owner`/`user`, **owner only**) |
 | GET | `/v1/admin/permissions` | **Owner only** — list all permissions |
-| GET/POST/DELETE | `/v1/admin/roles/:role/permissions` | **Owner only** — manage role permissions |
-| GET/DELETE | `/v1/admin/organizations/:id/api-keys` | Org-scoped API keys |
+| GET/POST | `/v1/admin/roles/:role/permissions` | **Owner only** — list / assign role permissions |
+| DELETE | `/v1/admin/roles/:role/permissions/:permissionId` | **Owner only** — remove a role permission |
+| GET | `/v1/admin/organizations/:id/api-keys` | List org-scoped API keys |
+| DELETE | `/v1/admin/organizations/:id/api-keys/:keyId` | Revoke an org-scoped API key |
 | GET | `/v1/admin/organizations/:id/audit-logs` | Paginated audit logs |
 | GET | `/v1/admin/platform/users` | **Owner only** — list all users |
 | GET | `/v1/admin/platform/organizations` | **Owner only** — list all organizations |
@@ -577,21 +674,31 @@ If Keystone feels slow or uses a lot of memory during development, see [`docs/PE
 | GET | `/v1/admin/platform/queue/failed` | **Owner only** — failed jobs |
 | POST | `/v1/admin/platform/queue/failed/:id/retry` | **Owner only** — retry failed job |
 | POST | `/v1/admin/platform/queue/retry-all` | **Owner only** — retry all failed jobs |
-| GET/POST/PATCH/DELETE | `/v1/admin/platform/webhooks` | **Owner only** — webhook management |
+| GET/POST | `/v1/admin/platform/webhooks` | **Owner only** — list / create webhooks |
+| PATCH | `/v1/admin/platform/webhooks/:id` | **Owner only** — update a webhook |
+| DELETE | `/v1/admin/platform/webhooks/:id` | **Owner only** — delete a webhook |
 | POST | `/v1/admin/platform/webhooks/:id/rotate-secret` | **Owner only** — rotate webhook secret |
-| GET/POST/DELETE | `/v1/admin/organizations/:id/saml-connections` | SAML connection management |
+| GET/POST | `/v1/admin/organizations/:id/saml-connections` | SAML connection management |
+| DELETE | `/v1/admin/organizations/:id/saml-connections/:connectionId` | Delete a SAML connection |
 | GET | `/v1/admin/organizations/:id/saml-connections/:connectionId/metadata` | SAML SP metadata |
-| GET/POST/DELETE | `/v1/admin/organizations/:id/oidc-connections` | OIDC connection management |
+| GET/POST | `/v1/admin/organizations/:id/oidc-connections` | OIDC connection management |
+| DELETE | `/v1/admin/organizations/:id/oidc-connections/:connectionId` | Delete an OIDC connection |
 
 ### Enterprise SSO
 
 | Method | Path | Description |
 |--------|------|-------------|
-| GET | `/saml/:connectionId` | Start SAML SSO login |
-| POST | `/saml/acs` | SAML assertion consumer service |
-| GET | `/saml/:connectionId/metadata` | SAML SP metadata |
-| GET | `/sso/oidc/:connectionId` | Start enterprise OIDC SSO login |
-| GET | `/sso/oidc/:connectionId/callback` | Enterprise OIDC callback |
+| GET | `/sso/saml/:connectionId` | Start SAML SSO login (requires `?orgId=`) |
+| POST | `/sso/saml/acs` | SAML assertion consumer service |
+| GET | `/sso/saml/:connectionId/metadata` | SAML SP metadata (requires `?orgId=`) |
+| GET | `/sso/sso/oidc/:connectionId` | Start enterprise OIDC SSO login (requires `?orgId=`) |
+| GET | `/sso/sso/oidc/:connectionId/callback` | Enterprise OIDC callback (requires `?orgId=`) |
+
+> **Note:** the doubled `/sso/sso/oidc` segment is real, not a typo. The OIDC
+> enterprise routes declare `/sso/oidc/...` *and* are mounted under the `/sso`
+> prefix. SAML is mounted the same way but declares `/saml/...`, so it resolves
+> cleanly to `/sso/saml/...`. Changing the OIDC path would break existing
+> deployments, so it is scheduled for a future minor release.
 
 ### SCIM Provisioning
 
@@ -609,7 +716,8 @@ that organization. Cross-tenant targets return `404`.
 | POST | `/scim/v2/Users/.search` | Search users |
 | GET | `/scim/v2/Groups` | List groups (filter) |
 | GET | `/scim/v2/Groups/:groupId` | Get group by ID |
-| POST/PUT/PATCH/DELETE | `/scim/v2/Groups/:groupId` | Manage groups |
+| POST | `/scim/v2/Groups` | Create group |
+| PUT/PATCH/DELETE | `/scim/v2/Groups/:groupId` | Manage group |
 | GET/POST | `/scim/v2/Groups/:groupId/members` | Manage group members |
 | GET | `/scim/v2/ServiceProviderConfig` | Supported features |
 
@@ -621,29 +729,31 @@ once and stored only as a digest.
 
 | Method | Path | Description |
 |--------|------|-------------|
-| POST | `/mfa/verify` | Complete a login MFA challenge and receive tokens |
-| POST | `/totp/enroll` | Begin TOTP enrollment |
-| POST | `/totp/verify` | Confirm enrollment; revokes existing sessions |
-| POST | `/totp/disable` | Disable TOTP MFA |
-| POST | `/totp/backup` | Regenerate backup codes (requires a TOTP code) |
-| POST | `/totp/backup/verify` | Consume a backup code |
-| POST | `/sms-otp/send` | Send SMS OTP |
-| POST | `/sms-otp/verify` | Verify SMS OTP |
-| POST | `/magic-link/send` | Send magic link |
-| GET | `/magic-link/verify` | Verify magic link |
-| POST | `/email-verification/send` | Send verification email |
-| POST | `/email-verification/request` | Request verification email |
-| GET | `/email-verification/verify` | Verify email token |
-| POST | `/webauthn/register` | Register WebAuthn credential |
-| POST | `/webauthn/authenticate` | Authenticate with WebAuthn |
+| POST | `/auth/mfa/verify` | Complete a login MFA challenge and receive tokens |
+| POST | `/auth/totp/enroll` | Begin TOTP enrollment (requires `password`) |
+| POST | `/auth/totp/verify` | Confirm enrollment (requires `password` + `code`); revokes existing sessions |
+| POST | `/auth/totp/disable` | Disable TOTP MFA (requires `password` + `code`) |
+| POST | `/auth/totp/backup` | Regenerate backup codes (requires `password` + `code`) |
+| POST | `/auth/totp/backup/verify` | Consume a backup code; never establishes a session |
+| POST | `/auth/sms-otp/send` | Send SMS OTP |
+| POST | `/auth/sms-otp/verify` | Verify SMS OTP |
+| POST | `/auth/magic-link/send` | Send magic link |
+| GET | `/auth/magic-link/verify` | Verify magic link |
+| POST | `/auth/email-verification/send` | Send verification email |
+| POST | `/auth/email-verification/request` | Request verification email |
+| GET | `/auth/email-verification/verify` | Verify email token |
+| GET | `/auth/webauthn/register/options` | WebAuthn creation options |
+| POST | `/auth/webauthn/register/verify` | Register a WebAuthn credential |
+| POST | `/auth/webauthn/authenticate/options` | WebAuthn assertion options |
+| POST | `/auth/webauthn/authenticate/verify` | Authenticate and establish a session |
 
 ### Sessions
 
 | Method | Path | Description |
 |--------|------|-------------|
-| GET | `/sessions` | List active sessions |
-| DELETE | `/sessions/:id` | Revoke session |
-| POST | `/sessions/revoke-all` | Revoke all sessions |
+| GET | `/auth/sessions` | List active sessions |
+| DELETE | `/auth/sessions/:id` | Revoke session |
+| POST | `/auth/sessions/revoke-all` | Revoke all sessions |
 
 ### Workflows
 
@@ -712,6 +822,12 @@ npx keystone org:create --name "Acme" --owner-email admin@example.com
 - Internal implementation details are not exposed in API responses.
 - Input validation uses Zod schemas on all routes.
 - Error messages are sanitized in production mode.
+- **MFA is enforced before token issuance.** An account with TOTP enabled cannot receive a token until a second factor is verified, and the check happens at a single chokepoint rather than per route.
+- TOTP secrets are stored encrypted with AES-256-GCM; backup codes are stored as a keyed, peppered hash, expire, and can only be consumed once.
+- Changing how an account proves its identity — enrolling, confirming, disabling TOTP, or registering a passkey — requires the account password in addition to a valid session.
+- **SCIM credentials are per organization.** Tokens are stored only as a digest, and every SCIM read and write is scoped to the credential's organization. A cross-tenant target is reported as not found.
+- SCIM deprovisioning never reaches outside the caller's organization, and cannot remove the last owner of an organization.
+- SCIM credential creation, rotation, and revocation are restricted to organization owners.
 
 ---
 
@@ -726,6 +842,8 @@ Full documentation lives in [`docs/`](docs/README.md):
 | [Deployment](docs/DEPLOYMENT.md) | Docker Compose, Kubernetes, systemd, hardening |
 | [Integration guide](docs/INTEGRATION.md) | Connect your apps to Keystone |
 | [Security model](docs/SECURITY.md) | Threat model and hardening checklist |
+| [v1.8 migration guide](docs/MIGRATION-1.8.md) | Mandatory MFA: new endpoints, response changes, upgrade steps |
+| [v1.9 migration guide](docs/MIGRATION-1.9.md) | SCIM tenancy: per-organization credentials, deprovisioning semantics, upgrade steps |
 | [Performance](docs/PERFORMANCE.md) | Tuning and load-testing notes |
 | [Contributing](docs/CONTRIBUTING.md) | Dev environment and PR process |
 | [Roadmap](docs/ROADMAP.md) | Planned work |

package/dist/config.d.ts

@@ -54,6 +54,14 @@ export declare const config: {
     /** Budget for unauthenticated SCIM requests, which run before the credential limiter. */
     readonly SCIM_AUTH_FAILURE_MAX: number;
     readonly SCIM_AUTH_FAILURE_WINDOW_SECONDS: number;
+    /**
+     * Comma-separated IP addresses and CIDR ranges of reverse proxies allowed to
+     * set client-identity headers (`x-forwarded-for`, `x-forwarded-client-cert`,
+     * ...). Empty means trust nothing: the peer address is used and those headers
+     * are stripped. Set this only when Keystone genuinely sits behind a proxy you
+     * control — an over-broad value lets any client behind it forge an identity.
+     */
+    readonly TRUSTED_PROXIES: string;
     readonly MFA_CHALLENGE_TTL_SECONDS: number;
     readonly MFA_MAX_ATTEMPTS: number;
     readonly TOTP_BACKUP_CODE_TTL_SECONDS: number;

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AA6DA,eAAO,MAAM,MAAM;aACjB,QAAQ;aACR,IAAI;aACJ,IAAI;aAEJ,YAAY;aACZ,SAAS;aAGT,cAAc;aACd,cAAc;aACd,kBAAkB;aAGlB,yBAAyB;aACzB,6BAA6B;aAC7B,mBAAmB;aAGnB,iBAAiB;aACjB,qBAAqB;aAGrB,qBAAqB;aACrB,qBAAqB;aAErB,WAAW;aACX,aAAa;aACb,aAAa;aACb,gBAAgB,EAAuG,QAAQ,GAAG,KAAK,GAAG,MAAM;aAChJ,2BAA2B;aAE3B,mBAAmB;aACnB,wBAAwB;aACxB,yBAAyB;aAGzB,eAAe;aACf,cAAc;aAGd,uBAAuB;aAGvB,yBAAyB;aAGzB,uBAAuB;aAGvB,gBAAgB;aAGhB,gBAAgB;aAEhB,gBAAgB;aAEhB,gBAAgB;aAEhB,eAAe;aAEf,mBAAmB;aACnB,yBAAyB;aACzB,qBAAqB;aACrB,wBAAwB;aAExB,yBAAyB;aACzB,gCAAgC;aAEhC,kBAAkB;aAIlB,2BAA2B;aAC3B,sBAAsB;aACtB,sBAAsB;aACtB,WAAW;aACX,mBAAmB;aAInB,iBAAiB;aACjB,WAAW;IACX,uDAAuD;aAGvD,2BAA2B;IAC3B,qEAAqE;aACrE,mBAAmB;aACnB,8BAA8B;IAC9B,yFAAyF;aACzF,qBAAqB;aACrB,gCAAgC;aAChC,yBAAyB;aACzB,gBAAgB;aAChB,4BAA4B;aAC5B,cAAc;aACd,UAAU;aACV,SAAS;aACT,SAAS;aACT,SAAS;aACT,SAAS;aACT,WAAW;aACX,gBAAgB;aAChB,eAAe;aACf,cAAc;aACd,YAAY;aACZ,kBAAkB;aAClB,iBAAiB;aACjB,kBAAkB;aAClB,4BAA4B;aAC5B,2BAA2B;aAC3B,iBAAiB;aACjB,oBAAoB;aACpB,sBAAsB;CACd,CAAC;AAEX,wBAAgB,cAAc,IAAI,MAAM,CAMvC;AAED,wBAAgB,mBAAmB,IAAI,OAAO,CAE7C"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AA6DA,eAAO,MAAM,MAAM;aACjB,QAAQ;aACR,IAAI;aACJ,IAAI;aAEJ,YAAY;aACZ,SAAS;aAGT,cAAc;aACd,cAAc;aACd,kBAAkB;aAGlB,yBAAyB;aACzB,6BAA6B;aAC7B,mBAAmB;aAGnB,iBAAiB;aACjB,qBAAqB;aAGrB,qBAAqB;aACrB,qBAAqB;aAErB,WAAW;aACX,aAAa;aACb,aAAa;aACb,gBAAgB,EAAuG,QAAQ,GAAG,KAAK,GAAG,MAAM;aAChJ,2BAA2B;aAE3B,mBAAmB;aACnB,wBAAwB;aACxB,yBAAyB;aAGzB,eAAe;aACf,cAAc;aAGd,uBAAuB;aAGvB,yBAAyB;aAGzB,uBAAuB;aAGvB,gBAAgB;aAGhB,gBAAgB;aAEhB,gBAAgB;aAEhB,gBAAgB;aAEhB,eAAe;aAEf,mBAAmB;aACnB,yBAAyB;aACzB,qBAAqB;aACrB,wBAAwB;aAExB,yBAAyB;aACzB,gCAAgC;aAEhC,kBAAkB;aAIlB,2BAA2B;aAC3B,sBAAsB;aACtB,sBAAsB;aACtB,WAAW;aACX,mBAAmB;aAInB,iBAAiB;aACjB,WAAW;IACX,uDAAuD;aAGvD,2BAA2B;IAC3B,qEAAqE;aACrE,mBAAmB;aACnB,8BAA8B;IAC9B,yFAAyF;aACzF,qBAAqB;aACrB,gCAAgC;IAChC;;;;;;OAMG;aACH,eAAe;aACf,yBAAyB;aACzB,gBAAgB;aAChB,4BAA4B;aAC5B,cAAc;aACd,UAAU;aACV,SAAS;aACT,SAAS;aACT,SAAS;aACT,SAAS;aACT,WAAW;aACX,gBAAgB;aAChB,eAAe;aACf,cAAc;aACd,YAAY;aACZ,kBAAkB;aAClB,iBAAiB;aACjB,kBAAkB;aAClB,4BAA4B;aAC5B,2BAA2B;aAC3B,iBAAiB;aACjB,oBAAoB;aACpB,sBAAsB;CACd,CAAC;AAEX,wBAAgB,cAAc,IAAI,MAAM,CAMvC;AAED,wBAAgB,mBAAmB,IAAI,OAAO,CAE7C"}

package/dist/config.js

@@ -119,6 +119,14 @@ export const config = {
     /** Budget for unauthenticated SCIM requests, which run before the credential limiter. */
     SCIM_AUTH_FAILURE_MAX: positiveInt("SCIM_AUTH_FAILURE_MAX", "60"),
     SCIM_AUTH_FAILURE_WINDOW_SECONDS: positiveInt("SCIM_AUTH_FAILURE_WINDOW_SECONDS", "60"),
+    /**
+     * Comma-separated IP addresses and CIDR ranges of reverse proxies allowed to
+     * set client-identity headers (`x-forwarded-for`, `x-forwarded-client-cert`,
+     * ...). Empty means trust nothing: the peer address is used and those headers
+     * are stripped. Set this only when Keystone genuinely sits behind a proxy you
+     * control — an over-broad value lets any client behind it forge an identity.
+     */
+    TRUSTED_PROXIES: getEnv("KEYSTONE_TRUSTED_PROXIES"),
     MFA_CHALLENGE_TTL_SECONDS: positiveInt("MFA_CHALLENGE_TTL_SECONDS", "300"),
     MFA_MAX_ATTEMPTS: positiveInt("MFA_MAX_ATTEMPTS", "5"),
     TOTP_BACKUP_CODE_TTL_SECONDS: positiveInt("TOTP_BACKUP_CODE_TTL_SECONDS", "7776000"),

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;AAC5D,MAAM,CAAC,MAAM,EAAE,CAAC;AAEhB,SAAS,MAAM,CAAC,IAAY,EAAE,QAAQ,GAAG,EAAE;IACzC,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,IAAY,EAAE,QAAgB;IACpD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,CAAC,IAAI,CACV,YAAY,IAAI,wCAAwC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,QAAQ,EAAE,CAClG,CAAC;QACF,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,QAAgB;IACjD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,CAAC,IAAI,CACV,YAAY,IAAI,oCAAoC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,QAAQ,EAAE,CAC9F,CAAC;QACF,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY;IACzC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,MAAM,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,0CAA0C,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,IAAI,EAAE,CAAC;AACrB,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,GAAG,MAAM,CACvB,aAAa,EACb,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,kBAAkB,CACpG,CAAC;AACF,MAAM,YAAY,GAAG,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;AAEtD,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC;IAC3C,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC;IAE/B,YAAY,EAAE,qBAAqB,CAAC,cAAc,CAAC;IACnD,SAAS,EAAE,MAAM,CAAC,WAAW,EAAE,wBAAwB,CAAC;IAExD,wEAAwE;IACxE,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC;IACxC,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC;IACxC,kBAAkB,EAAE,MAAM,CAAC,oBAAoB,CAAC;IAEhD,6DAA6D;IAC7D,yBAAyB,EAAE,MAAM,CAAC,2BAA2B,CAAC;IAC9D,6BAA6B,EAAE,MAAM,CAAC,+BAA+B,CAAC;IACtE,mBAAmB,EAAE,MAAM,CAAC,qBAAqB,CAAC;IAElD,iEAAiE;IACjE,iBAAiB,EAAE,MAAM,CAAC,mBAAmB,CAAC;IAC9C,qBAAqB,EAAE,MAAM,CAAC,uBAAuB,CAAC;IAEtD,wFAAwF;IACxF,qBAAqB,EAAE,MAAM,CAAC,uBAAuB,CAAC;IACtD,qBAAqB,EAAE,MAAM,CAAC,uBAAuB,CAAC;IAEtD,WAAW,EAAE,UAAU;IACvB,aAAa,EAAE,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,mBAAmB,CAAC;IACtF,aAAa,EAAE,YAAY,IAAI,MAAM,CAAC,eAAe,EAAE,OAAO,CAAC,KAAK,MAAM;IAC1E,gBAAgB,EAAE,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAA8B;IAChJ,2BAA2B,EAAE,MAAM,CAAC,6BAA6B,EAAE,OAAO,CAAC,KAAK,MAAM;IAEtF,mBAAmB,EAAE,MAAM,CAAC,qBAAqB,CAAC;IAClD,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;IACvE,yBAAyB,EAAE,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,QAAQ,CAAC,CAAC;IAE5E,oFAAoF;IACpF,eAAe,EAAE,MAAM,CAAC,iBAAiB,CAAC;IAC1C,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC;IAExC,sGAAsG;IACtG,uBAAuB,EAAE,MAAM,CAAC,yBAAyB,CAAC;IAE1D,2DAA2D;IAC3D,yBAAyB,EAAE,MAAM,CAAC,2BAA2B,EAAE,UAAU,CAAC;IAE1E,gHAAgH;IAChH,uBAAuB,EAAE,MAAM,CAAC,yBAAyB,EAAE,YAAY,CAAC;IAExE,sDAAsD;IACtD,gBAAgB,EAAE,MAAM,CAAC,kBAAkB,EAAE,WAAW,CAAC;IAEzD,kEAAkE;IAClE,gBAAgB,EAAE,MAAM,CAAC,kBAAkB,CAAC;IAE5C,gBAAgB,EAAE,MAAM,CAAC,2BAA2B,CAAC,IAAI,MAAM,CAAC,0BAA0B,EAAE,EAAE,CAAC;IAE/F,gBAAgB,EAAE,MAAM,CAAC,2BAA2B,CAAC;IAErD,eAAe,EAAE,OAAO,CAAC,iBAAiB,CAAC;IAE3C,mBAAmB,EAAE,MAAM,CAAC,MAAM,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;IAC/D,yBAAyB,EAAE,MAAM,CAAC,MAAM,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAC;IAC7E,qBAAqB,EAAE,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;IACrE,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC,0BAA0B,EAAE,IAAI,CAAC,CAAC;IAE1E,yBAAyB,EAAE,MAAM,CAAC,MAAM,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;IAC3E,gCAAgC,EAAE,MAAM,CAAC,MAAM,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAC;IAE5F,kBAAkB,EAAE,MAAM,CAAC,oBAAoB,EAAE,OAAO,CAAC,KAAK,MAAM;IACpE,yEAAyE;IACzE,yEAAyE;IACzE,kCAAkC;IAClC,2BAA2B,EAAE,MAAM,CAAC,6BAA6B,EAAE,OAAO,CAAC,KAAK,MAAM;IACtF,sBAAsB,EAAE,MAAM,CAAC,MAAM,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;IACvE,sBAAsB,EAAE,MAAM,CAAC,MAAM,CAAC,wBAAwB,EAAE,IAAI,CAAC,CAAC;IACtE,WAAW,EAAE,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC;IAC7C,mBAAmB,EAAE,MAAM,CAAC,8BAA8B,CAAC;IAC3D,8EAA8E;IAC9E,0EAA0E;IAC1E,sEAAsE;IACtE,iBAAiB,EAAE,MAAM,CAAC,mBAAmB,CAAC;IAC9C,WAAW,EAAE,MAAM,CAAC,aAAa,CAAC;IAClC,uDAAuD;IACvD,yEAAyE;IACzE,oEAAoE;IACpE,2BAA2B,EAAE,cAAc,CAAC,6BAA6B,EAAE,GAAG,CAAC;IAC/E,qEAAqE;IACrE,mBAAmB,EAAE,WAAW,CAAC,qBAAqB,EAAE,KAAK,CAAC;IAC9D,8BAA8B,EAAE,WAAW,CAAC,gCAAgC,EAAE,IAAI,CAAC;IACnF,yFAAyF;IACzF,qBAAqB,EAAE,WAAW,CAAC,uBAAuB,EAAE,IAAI,CAAC;IACjE,gCAAgC,EAAE,WAAW,CAAC,kCAAkC,EAAE,IAAI,CAAC;IACvF,yBAAyB,EAAE,WAAW,CAAC,2BAA2B,EAAE,KAAK,CAAC;IAC1E,gBAAgB,EAAE,WAAW,CAAC,kBAAkB,EAAE,GAAG,CAAC;IACtD,4BAA4B,EAAE,WAAW,CAAC,8BAA8B,EAAE,SAAS,CAAC;IACpF,cAAc,EAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAChD,UAAU,EAAE,MAAM,CAAC,YAAY,EAAE,2BAA2B,CAAC;IAC7D,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAC7C,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,KAAK,MAAM;IACtD,gBAAgB,EAAE,MAAM,CAAC,kBAAkB,CAAC;IAC5C,eAAe,EAAE,MAAM,CAAC,iBAAiB,CAAC;IAC1C,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC;IACxC,YAAY,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC;IAC5C,kBAAkB,EAAE,MAAM,CAAC,oBAAoB,CAAC;IAChD,iBAAiB,EAAE,MAAM,CAAC,mBAAmB,CAAC;IAC9C,kBAAkB,EAAE,MAAM,CAAC,oBAAoB,CAAC;IAChD,4BAA4B,EAAE,MAAM,CAAC,8BAA8B,CAAC;IACpE,2BAA2B,EAAE,MAAM,CAAC,6BAA6B,CAAC;IAClE,iBAAiB,EAAE,MAAM,CAAC,mBAAmB,CAAC;IAC9C,oBAAoB,EAAE,MAAM,CAAC,sBAAsB,EAAE,OAAO,CAAC;IAC7D,sBAAsB,EAAE,MAAM,CAAC,wBAAwB,CAAC,IAAI,MAAM,CAAC,iCAAiC,CAAC;CAC7F,CAAC;AAEX,MAAM,UAAU,cAAc;IAC5B,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,EAAE,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO,OAAO,CAAC,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,iBAAiB,CAAC,CAAC;AACpE,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;AAC5D,MAAM,CAAC,MAAM,EAAE,CAAC;AAEhB,SAAS,MAAM,CAAC,IAAY,EAAE,QAAQ,GAAG,EAAE;IACzC,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,IAAY,EAAE,QAAgB;IACpD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,CAAC,IAAI,CACV,YAAY,IAAI,wCAAwC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,QAAQ,EAAE,CAClG,CAAC;QACF,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,QAAgB;IACjD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,CAAC,IAAI,CACV,YAAY,IAAI,oCAAoC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,QAAQ,EAAE,CAC9F,CAAC;QACF,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY;IACzC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,MAAM,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,0CAA0C,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,IAAI,EAAE,CAAC;AACrB,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,GAAG,MAAM,CACvB,aAAa,EACb,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,kBAAkB,CACpG,CAAC;AACF,MAAM,YAAY,GAAG,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;AAEtD,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC;IAC3C,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC;IAE/B,YAAY,EAAE,qBAAqB,CAAC,cAAc,CAAC;IACnD,SAAS,EAAE,MAAM,CAAC,WAAW,EAAE,wBAAwB,CAAC;IAExD,wEAAwE;IACxE,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC;IACxC,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC;IACxC,kBAAkB,EAAE,MAAM,CAAC,oBAAoB,CAAC;IAEhD,6DAA6D;IAC7D,yBAAyB,EAAE,MAAM,CAAC,2BAA2B,CAAC;IAC9D,6BAA6B,EAAE,MAAM,CAAC,+BAA+B,CAAC;IACtE,mBAAmB,EAAE,MAAM,CAAC,qBAAqB,CAAC;IAElD,iEAAiE;IACjE,iBAAiB,EAAE,MAAM,CAAC,mBAAmB,CAAC;IAC9C,qBAAqB,EAAE,MAAM,CAAC,uBAAuB,CAAC;IAEtD,wFAAwF;IACxF,qBAAqB,EAAE,MAAM,CAAC,uBAAuB,CAAC;IACtD,qBAAqB,EAAE,MAAM,CAAC,uBAAuB,CAAC;IAEtD,WAAW,EAAE,UAAU;IACvB,aAAa,EAAE,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,mBAAmB,CAAC;IACtF,aAAa,EAAE,YAAY,IAAI,MAAM,CAAC,eAAe,EAAE,OAAO,CAAC,KAAK,MAAM;IAC1E,gBAAgB,EAAE,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAA8B;IAChJ,2BAA2B,EAAE,MAAM,CAAC,6BAA6B,EAAE,OAAO,CAAC,KAAK,MAAM;IAEtF,mBAAmB,EAAE,MAAM,CAAC,qBAAqB,CAAC;IAClD,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;IACvE,yBAAyB,EAAE,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,QAAQ,CAAC,CAAC;IAE5E,oFAAoF;IACpF,eAAe,EAAE,MAAM,CAAC,iBAAiB,CAAC;IAC1C,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC;IAExC,sGAAsG;IACtG,uBAAuB,EAAE,MAAM,CAAC,yBAAyB,CAAC;IAE1D,2DAA2D;IAC3D,yBAAyB,EAAE,MAAM,CAAC,2BAA2B,EAAE,UAAU,CAAC;IAE1E,gHAAgH;IAChH,uBAAuB,EAAE,MAAM,CAAC,yBAAyB,EAAE,YAAY,CAAC;IAExE,sDAAsD;IACtD,gBAAgB,EAAE,MAAM,CAAC,kBAAkB,EAAE,WAAW,CAAC;IAEzD,kEAAkE;IAClE,gBAAgB,EAAE,MAAM,CAAC,kBAAkB,CAAC;IAE5C,gBAAgB,EAAE,MAAM,CAAC,2BAA2B,CAAC,IAAI,MAAM,CAAC,0BAA0B,EAAE,EAAE,CAAC;IAE/F,gBAAgB,EAAE,MAAM,CAAC,2BAA2B,CAAC;IAErD,eAAe,EAAE,OAAO,CAAC,iBAAiB,CAAC;IAE3C,mBAAmB,EAAE,MAAM,CAAC,MAAM,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;IAC/D,yBAAyB,EAAE,MAAM,CAAC,MAAM,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAC;IAC7E,qBAAqB,EAAE,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;IACrE,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC,0BAA0B,EAAE,IAAI,CAAC,CAAC;IAE1E,yBAAyB,EAAE,MAAM,CAAC,MAAM,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;IAC3E,gCAAgC,EAAE,MAAM,CAAC,MAAM,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAC;IAE5F,kBAAkB,EAAE,MAAM,CAAC,oBAAoB,EAAE,OAAO,CAAC,KAAK,MAAM;IACpE,yEAAyE;IACzE,yEAAyE;IACzE,kCAAkC;IAClC,2BAA2B,EAAE,MAAM,CAAC,6BAA6B,EAAE,OAAO,CAAC,KAAK,MAAM;IACtF,sBAAsB,EAAE,MAAM,CAAC,MAAM,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;IACvE,sBAAsB,EAAE,MAAM,CAAC,MAAM,CAAC,wBAAwB,EAAE,IAAI,CAAC,CAAC;IACtE,WAAW,EAAE,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC;IAC7C,mBAAmB,EAAE,MAAM,CAAC,8BAA8B,CAAC;IAC3D,8EAA8E;IAC9E,0EAA0E;IAC1E,sEAAsE;IACtE,iBAAiB,EAAE,MAAM,CAAC,mBAAmB,CAAC;IAC9C,WAAW,EAAE,MAAM,CAAC,aAAa,CAAC;IAClC,uDAAuD;IACvD,yEAAyE;IACzE,oEAAoE;IACpE,2BAA2B,EAAE,cAAc,CAAC,6BAA6B,EAAE,GAAG,CAAC;IAC/E,qEAAqE;IACrE,mBAAmB,EAAE,WAAW,CAAC,qBAAqB,EAAE,KAAK,CAAC;IAC9D,8BAA8B,EAAE,WAAW,CAAC,gCAAgC,EAAE,IAAI,CAAC;IACnF,yFAAyF;IACzF,qBAAqB,EAAE,WAAW,CAAC,uBAAuB,EAAE,IAAI,CAAC;IACjE,gCAAgC,EAAE,WAAW,CAAC,kCAAkC,EAAE,IAAI,CAAC;IACvF;;;;;;OAMG;IACH,eAAe,EAAE,MAAM,CAAC,0BAA0B,CAAC;IACnD,yBAAyB,EAAE,WAAW,CAAC,2BAA2B,EAAE,KAAK,CAAC;IAC1E,gBAAgB,EAAE,WAAW,CAAC,kBAAkB,EAAE,GAAG,CAAC;IACtD,4BAA4B,EAAE,WAAW,CAAC,8BAA8B,EAAE,SAAS,CAAC;IACpF,cAAc,EAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAChD,UAAU,EAAE,MAAM,CAAC,YAAY,EAAE,2BAA2B,CAAC;IAC7D,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAC7C,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,KAAK,MAAM;IACtD,gBAAgB,EAAE,MAAM,CAAC,kBAAkB,CAAC;IAC5C,eAAe,EAAE,MAAM,CAAC,iBAAiB,CAAC;IAC1C,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC;IACxC,YAAY,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC;IAC5C,kBAAkB,EAAE,MAAM,CAAC,oBAAoB,CAAC;IAChD,iBAAiB,EAAE,MAAM,CAAC,mBAAmB,CAAC;IAC9C,kBAAkB,EAAE,MAAM,CAAC,oBAAoB,CAAC;IAChD,4BAA4B,EAAE,MAAM,CAAC,8BAA8B,CAAC;IACpE,2BAA2B,EAAE,MAAM,CAAC,6BAA6B,CAAC;IAClE,iBAAiB,EAAE,MAAM,CAAC,mBAAmB,CAAC;IAC9C,oBAAoB,EAAE,MAAM,CAAC,sBAAsB,EAAE,OAAO,CAAC;IAC7D,sBAAsB,EAAE,MAAM,CAAC,wBAAwB,CAAC,IAAI,MAAM,CAAC,iCAAiC,CAAC;CAC7F,CAAC;AAEX,MAAM,UAAU,cAAc;IAC5B,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,EAAE,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO,OAAO,CAAC,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,iBAAiB,CAAC,CAAC;AACpE,CAAC"}

package/dist/db/migrations/0015_chief_vargas.sql

@@ -0,0 +1,7 @@
+DROP INDEX "scim_connections_token_hash_idx";--> statement-breakpoint
+DROP INDEX "scim_connections_previous_token_hash_idx";--> statement-breakpoint
+ALTER TABLE "service_accounts" ADD COLUMN "cert_fingerprint" text;--> statement-breakpoint
+ALTER TABLE "service_accounts" ADD COLUMN "revoked_at" timestamp with time zone;--> statement-breakpoint
+CREATE UNIQUE INDEX "scim_connections_token_hash_unique" ON "scim_connections" USING btree ("token_hash");--> statement-breakpoint
+CREATE UNIQUE INDEX "scim_connections_previous_token_hash_unique" ON "scim_connections" USING btree ("previous_token_hash") WHERE previous_token_hash is not null;--> statement-breakpoint
+CREATE UNIQUE INDEX "service_accounts_cert_fingerprint_unique" ON "service_accounts" USING btree ("cert_fingerprint") WHERE cert_fingerprint is not null;

package/dist/db/migrations/0016_gorgeous_charles_xavier.sql

@@ -0,0 +1,5 @@
+ALTER TABLE "applications" ALTER COLUMN "client_secret_hash" DROP NOT NULL;--> statement-breakpoint
+ALTER TABLE "applications" ADD COLUMN "client_type" text DEFAULT 'confidential' NOT NULL;--> statement-breakpoint
+ALTER TABLE "applications" ADD COLUMN "allowed_scopes" text[] DEFAULT '{}'::text[] NOT NULL;--> statement-breakpoint
+ALTER TABLE "applications" ADD CONSTRAINT "applications_client_type_check" CHECK ("applications"."client_type" in ('confidential', 'public'));--> statement-breakpoint
+ALTER TABLE "applications" ADD CONSTRAINT "applications_public_client_no_secret_check" CHECK (("applications"."client_type" = 'public' and "applications"."client_secret_hash" is null) or "applications"."client_type" <> 'public');

package/dist/db/migrations/0017_flashy_nekra.sql

@@ -0,0 +1 @@
+ALTER TABLE "refresh_tokens" ADD COLUMN "scopes" text[] DEFAULT '{}'::text[] NOT NULL;