@hilbras/keystone 1.9.0 → 2.6.0

package/README.md

@@ -1,6 +1,6 @@
 # Hilbras Keystone
 
-**Current version: `1.7.0`**
+**Current version: `2.6.0`**
 
 > A provider-agnostic, API-first identity platform for Hilbras products and third-party applications.
 
@@ -22,6 +22,104 @@ Keystone is a **standalone identity platform**, not a wrapper around another ide
 
 ---
 
+## What's new in v2.6.0
+
+- **API key scopes are now a real registry** — a single list of scope names with descriptions. A scope not in the registry cannot be granted, so there is no string a caller can invent, and a route that needs a scope names it from the list so enforcement cannot quietly drift out of date again.
+- **Unknown scopes are refused, not dropped** — key creation previously stored whatever strings it was given. Silently discarding an unrecognised one hides a typo and leaves the caller believing they hold something they do not, so it now returns `400` listing what was rejected and what is allowed.
+- **The `service_account` wildcard is gone** — the scope guard treated a key as holding *every* scope if its scope list merely contained the string `"service_account"`, and that string was client-suppliable at key creation. It is no longer a scope, and a key holding only it satisfies nothing.
+- **The scope guard fails closed** — it previously returned early whenever `apiKeyScopes` was absent, which is indistinguishable from "this is a session", so a key that resolved without a scope list skipped the check entirely. It now keys off `apiKeyId`, which is set only when a machine credential authenticated.
+- **Scopes are enforced** on key, session, and profile routes, so a key is limited to the operations its grant covers.
+- **Profile and MFA scopes cannot be granted to a service account** — a machine's "profile" is a synthesized object with an id of `sa:<uuid>` that matches no user row, and it has no authenticator to enrol a second factor with.
+- **A stated boundary for machine principals** — `requireHumanPrincipal` refuses a service account on TOTP, WebAuthn, SMS OTP, identity linking, consent, and userinfo routes, with an explicit `403` and an audit record, rather than relying on the synthetic principal happening to match no row.
+- **Personal keys default to read-only** on the caller's own resources. The previous default, `api:read`, was not in any registry — a fair sign that nothing was checking it.
+
+> **Note on reachability.** `app.authenticate` is JWT-only, so almost every route still refuses an API key outright. `GET /auth/validate` is the one route that accepts one, and it is where scope enforcement is observable end to end. What this release fixes is the enforcement machinery, so the next route to adopt key authentication inherits a real check.
+
+## What's new in v2.5.0
+
+- **The OIDC nonce now reaches the Google connector** — `GoogleConnector.exchangeCode` overrode the base method without forwarding its options, so the nonce added in 2.4.0 was silently discarded for the default provider. Every non-Google OIDC provider validated the nonce; Google, the most likely to be in use, did not.
+- **The unsigned SAML `Issuer` is now validated** — the response-level `<saml:Issuer>` sits outside both signed regions, so rewriting it does not invalidate the signature, and nothing compared it to the registered IdP. An assertion could claim to come from a different identity provider. Keystone now checks it against the connection, as SAML 2.0 §2.5.1.5 requires. The assertion's own issuer is inside the signed region and was always covered.
+- **`RelayState` verification returns false instead of throwing** — a malformed RelayState is a bad request an attacker fully controls, so it produced a 500 rather than a 400.
+- **A missing userinfo endpoint is reported as unconfigured** — it was passed to the fetcher with a non-null assertion, surfacing a misleading "must be a valid URL" for a URL that was never set.
+- **24 adversarial SAML tests** — tampered signatures, untrusted signing keys, rotated-out certificates, unsigned assertions, XML signature wrapping, issuer and audience substitution, destination and recipient prefix/superstring/case variants, expired and not-yet-valid assertions, `InResponseTo` mismatch, transaction replay, and five RelayState tampering scenarios.
+- **[enterprise-sso.md](docs/security/enterprise-sso.md)** — SAML and OIDC setup, every check applied to an assertion or ID token, certificate rotation (and its lack of a grace period), endpoint SSRF policy, organization scoping, and recommendations.
+
+## What's new in v2.4.0
+
+> **Breaking.** The `authorization_code` grant now requires client authentication. A client redeeming an authorization code must present its `client_secret`; requests without one now receive `401 invalid_client`. Clients that were relying on the grant working without a secret must send it.
+
+- **The authorization code grant now authenticates the client** — it previously looked the client up and redeemed the code without ever checking a secret, so the code and its PKCE verifier were the only factors. This violates RFC 6749 §3.2.1 for confidential clients.
+- **`javascript:` and `data:` are refused as redirect URIs** — validation was `z.string().url()`, which accepts anything the URL parser accepts, including script-bearing schemes. A redirect URI is a value Keystone puts in a `Location` header on its own origin, so an org admin could previously register one and hand any user who authorized their app a redirect toward script execution. Also rejects wildcards, fragments, embedded credentials, and plaintext HTTP to non-loopback hosts.
+- **Public clients are supported and must use PKCE** — a `public` client type is issued no secret at all, rather than a secret it is expected to ignore, and a database constraint keeps the two halves of a client type consistent. PKCE is then mandatory for it, because client authentication is the only thing a secretless client cannot do.
+- **Scopes are intersected, not trusted** — the effective set is registered ∩ requested ∩ consented. A scope outside the registration is refused with `invalid_scope` rather than silently dropped, so a client asking for more than it has is visible instead of quietly downgraded. An empty registration preserves existing behaviour.
+- **OIDC federation sends and verifies a nonce** — `state` already proved the callback belonged to a login this browser started, but nothing bound the *ID token* to it. Any ID token the provider considered valid was accepted, including one minted for a different user or session.
+- **ID token verification is stricter** — algorithms are pinned rather than inferred from key material, and `exp`, `iat`, `iss`, `aud`, `sub` are *required* rather than merely checked when present. A token with no expiry was previously accepted indefinitely.
+- **Refresh tokens carry the granted scope set** — rotation preserves the authorization context instead of dropping it at the first refresh, and a refresh can narrow the grant but never widen it.
+
+## What's new in v2.3.0
+
+- **A password reset now actually logs the attacker out** — completing a reset changed the password but left every existing session and refresh token working. A reset is the standard response to a suspected compromise, so this defeated its own purpose: whoever prompted the reset kept their access. Sessions, refresh tokens, and outstanding recovery credentials are now all invalidated.
+- **An intercepted earlier reset email is dead** — reset tokens issued alongside the one used are now spent, so someone who captured a previous reset email cannot complete it after the user has already recovered.
+- **One revocation layer** — `revokeUserSessions`, `revokeRefreshTokens`, `revokeAuthenticationSessions`, and `revokeRecoveryCredentials` live in one place. Revocation was previously open-coded per call site, which is how the reset path came to omit it; the MFA-enable path now routes through the same function so the rule cannot drift.
+- **Recovery is left intact** — resetting revokes access but does not lock the user out: they can immediately log in with the new password. Covered by a test.
+
+> **Not revoked on reset:** API keys. They are separately issued, long-lived credentials belonging to integrations rather than to the person, and killing them silently breaks deployments. The residual gap — a key minted by an attacker who already held the password — is real; see [SECURITY.md](docs/SECURITY.md) for why key expiry is the right fix.
+
+## What's new in v2.2.0
+
+- **Magic links can no longer be redeemed twice at once** — consumption was a conditional `SELECT` followed by an *unconditional* `UPDATE`. Any number of parallel redemptions passed the check and every one of them logged in. The write is now the gate, so exactly one succeeds.
+- **Password reset tokens are spent exactly once** — the same race meant parallel resets each wrote a different password, last writer winning. This was the most consequential of the three, since whoever won held the account.
+- **SMS OTP codes are spent exactly once** — same shape, same fix.
+- **Replays are reported, not just refused** — a credential presented after it was already used now emits `magic_link_replayed`, `sms_otp_replayed`, or `password_reset_token_replayed`, which reaches the audit log. Previously a replay was indistinguishable from a typo, so a leaked token coming back was invisible. An *expired* credential is deliberately not reported as a replay, since that is not a leak.
+- **One shared primitive** — all consumption goes through a single atomic claim, so the pattern exists once rather than in three places that can drift.
+
+## What's new in v2.1.0
+
+- **Dependency tree is clean** — `npm audit` reports zero vulnerabilities across production *and* development trees, including a transitive `esbuild@0.18.20` that `drizzle-kit` was pinning. Resolved with an `overrides` entry rather than `audit fix --force`, which offered only a breaking downgrade of `drizzle-kit`.
+- **Continuous dependency security** — Dependabot for npm, GitHub Actions, and Docker; OSV scanning as an advisory source independent of npm's; enforced `npm audit`; dependency review on pull requests; SBOM generation; container scanning; and a license gate restricted to permissive terms.
+- **Release metadata is verified** — `npm run verify:release` fails the build on a version that disagrees between `package.json` and the lockfile, a missing or malformed license, or a missing `repository` field. Runs in CI and again before `npm publish`.
+- **The container image no longer ships a vulnerable npm** — the runtime image carried 8 HIGH-severity advisories inherited from the base image's bundled `npm@10.9.9`, invisible to `npm audit` and OSV because they are not in the dependency tree. npm is now removed from the production stage, which the app never invokes, clearing all 8 and shrinking the image from 600 MB to 550 MB.
+- **The package now declares its license** — `package.json` had no `license` field despite shipping an MIT `LICENSE` file, so the published package carried no machine-readable terms.
+
+## What's new in v2.0.0
+
+> **Breaking.** Two changes affect every deployment. `x-service-account-id` no
+> longer authenticates on its own, and `x-forwarded-for` is no longer believed
+> unless `KEYSTONE_TRUSTED_PROXIES` is set — behind a proxy with it unset, all
+> clients share one rate-limit budget. Read
+> [MIGRATION-2.0.md](docs/MIGRATION-2.0.md) before upgrading.
+
+- **A service account cannot be named into existence** — `x-service-account-id` previously authenticated as any service account named in the header, with no certificate and no credential. Identity now comes only from a certificate bound to the account or an authenticated credential.
+- **Certificates are bound to a fingerprint** — a service account authenticates by a client certificate whose SHA-256 fingerprint is bound to it, uniquely. A fingerprint can map to at most one account, and malformed values are rejected before they reach the database.
+- **Client identity headers are stripped from untrusted peers** — an `onRequest` hook removes them before routing and authentication, so no route can read a spoofed identity by accident.
+- **Rate limits can no longer be escaped** — the limiter previously read `x-forwarded-for` unconditionally, so any client could present a fresh address per request and never be limited. Keys come from the peer address unless a trusted proxy forwarded one.
+- **`KEYSTONE_TRUSTED_PROXIES`** names the proxies permitted to set identity headers. Unset by default, which trusts nothing.
+- **Service accounts can be revoked** — `POST /v1/admin/organizations/:id/service-accounts/:accountId/revoke` stops both certificate and API-key authentication.
+- **Documented trust boundaries** — [trust-boundaries.md](docs/security/trust-boundaries.md), [proxy-security.md](docs/security/proxy-security.md), and [mtls.md](docs/security/mtls.md).
+
+## What's new in v1.9.0
+
+- **SCIM is organization-scoped** — every SCIM connection belongs to exactly one organization, and every user and group read and write is filtered by it. A cross-tenant target returns `404`, so the endpoint is not a tenant oracle.
+- **SCIM credentials are per organization** — bearer tokens are stored only as a SHA-256 digest, resolved by that digest, and can be expired, rotated, and revoked. Issuing, rotating, and revoking is owner-only.
+- **Deprovisioning no longer reaches outside the tenant** — removing a user removes that organization's membership, and deactivates the account only when no membership remains anywhere. Previously it disabled a shared account in every organization that user belonged to.
+- **Real SCIM groups** — create, read, replace, patch, and delete groups, manage members, and search. Replaces the old synthetic role-bucket projection.
+- **New SCIM surface** — `PATCH /Users/:id`, `Users/.search`, `ServiceProviderConfig`, `ResourceTypes`, and `filter`/`startIndex`/`count`. Unsupported filters are rejected rather than silently ignored.
+
+> **Migration:** `SCIM_BEARER_TOKEN` and `SCIM_ORG_ID` are deprecated. If still set they are adopted once into a connection and then ignored — including after a revocation, so a restart cannot resurrect a credential you revoked. See [MIGRATION-1.9.md](docs/MIGRATION-1.9.md).
+
+## What's new in v1.8.0
+
+- **MFA is mandatory** — a user with TOTP enabled never receives a token before completing the second factor. Password authentication stops at `requires_mfa`; only `POST /auth/mfa/verify` completes the login.
+- **One-time MFA challenges** — opaque, short-lived, stored only as a hash, single-use, with an attempt budget enforced in the database.
+- **A single token-issuance chokepoint** — a token cannot be minted for an MFA-enabled user without a recorded factor, so no login path can bypass MFA by omission.
+- **TOTP verified against the user's own secret**, and each time-step is accepted exactly once, so a captured code is rejected even against a freshly issued challenge.
+- **Hardened backup codes** — 80 bits of entropy, keyed (peppered) hashing, expiry, and single-use consumption via a conditional update.
+- **Step-up on factor changes** — enrolling, confirming, disabling, or regenerating TOTP codes requires the account password, so a leaked session token cannot take over an account's second factor.
+- **Enabling MFA revokes existing sessions and refresh tokens**, and refresh rotation refuses sessions with no recorded factor.
+- **TOTP secrets are encrypted with AES-256-GCM**; values written by earlier versions remain readable.
+
+> **Migration:** `/auth/login` and `/auth/token-login` return `401` with `code: "MFA_REQUIRED"` and a challenge when MFA is required. Clients must render a code step and call `/auth/mfa/verify`. See [MIGRATION-1.8.md](docs/MIGRATION-1.8.md).
+
 ## What's new in v1.7.0
 
 - **Authorization boundary hardening** — platform roles (`owner`/`user`) and organization roles (`owner`/`admin`/`member`) are now separate namespaces.
@@ -489,6 +587,14 @@ services:
 | `KEYSTONE_QUEUE_PROVIDER` | `in-process`, `bullmq`, or empty to auto-select when Redis is available |
 | `KEYSTONE_PLUGINS` | Comma-separated module paths of plugins to load at startup |
 | `KEYSTONE_FEATURE_FLAGS` | Comma-separated `flag=true|false` runtime feature toggles |
+| `KEYSTONE_TOTP_ENCRYPTION_KEY` | Encrypts TOTP secrets and keys the backup-code hash. Falls back to `KEYSTONE_INTERNAL_API_KEY`. Must be stable — changing it invalidates enrolled authenticators |
+| `MFA_CHALLENGE_TTL_SECONDS` | Lifetime of a login MFA challenge (default `300`) |
+| `MFA_MAX_ATTEMPTS` | Factor attempts per challenge before it is locked (default `5`) |
+| `TOTP_BACKUP_CODE_TTL_SECONDS` | Backup-code lifetime (default `7776000`, 90 days) |
+| `SCIM_ROTATION_GRACE_SECONDS` | Grace window for a rotated SCIM token. Defaults to `0`, so rotation revokes the previous token |
+| `SCIM_RATE_LIMIT_MAX` / `SCIM_RATE_LIMIT_WINDOW_SECONDS` | Per-credential SCIM request budget |
+| `SCIM_AUTH_FAILURE_MAX` / `SCIM_AUTH_FAILURE_WINDOW_SECONDS` | Budget for unauthenticated SCIM requests, applied before authentication |
+| `KEYSTONE_TRUSTED_PROXIES` | Comma-separated proxy IPs / CIDRs allowed to set client-identity headers. **Unset means trust nothing** — forwarded headers are stripped and all clients share one rate-limit budget. Required when Keystone runs behind a reverse proxy |
 
 ---
 
@@ -516,8 +622,9 @@ If Keystone feels slow or uses a lot of memory during development, see [`docs/PE
 | Method | Path | Description |
 |--------|------|-------------|
 | POST | `/auth/register` | Email/password signup (local password hashing) |
-| POST | `/auth/login` | Email/password login (sets session cookies) |
+| POST | `/auth/login` | Email/password login (sets session cookies; returns `401 MFA_REQUIRED` + a challenge when MFA is required) |
 | POST | `/auth/token-login` | Email/password login for SPA/dashboard (returns bearer token) |
+| POST | `/auth/mfa/verify` | Complete a login MFA challenge and receive tokens |
 | POST | `/auth/logout` | Revoke session |
 | GET | `/auth/me` | Current user |
 | POST | `/auth/refresh` | Rotate refresh token |
@@ -525,7 +632,8 @@ If Keystone feels slow or uses a lot of memory during development, see [`docs/PE
 | GET | `/auth/callback/:provider` | OAuth callback |
 | POST | `/auth/forgot-password` | Request password reset |
 | POST | `/auth/reset-password` | Complete password reset |
-| POST/GET/DELETE | `/auth/api-keys` | Personal API keys |
+| POST/GET | `/auth/api-keys` | Create / list personal API keys |
+| DELETE | `/auth/api-keys/:id` | Revoke a personal API key |
 | GET | `/auth/validate` | Internal token/API-key validation |
 
 ### Federation
@@ -564,8 +672,10 @@ If Keystone feels slow or uses a lot of memory during development, see [`docs/PE
 | PATCH | `/v1/admin/platform/users/:userId` | Update non-role platform user fields (**owner only**) |
 | PATCH | `/v1/admin/platform/users/:userId/role` | Change a platform role (`owner`/`user`, **owner only**) |
 | GET | `/v1/admin/permissions` | **Owner only** — list all permissions |
-| GET/POST/DELETE | `/v1/admin/roles/:role/permissions` | **Owner only** — manage role permissions |
-| GET/DELETE | `/v1/admin/organizations/:id/api-keys` | Org-scoped API keys |
+| GET/POST | `/v1/admin/roles/:role/permissions` | **Owner only** — list / assign role permissions |
+| DELETE | `/v1/admin/roles/:role/permissions/:permissionId` | **Owner only** — remove a role permission |
+| GET | `/v1/admin/organizations/:id/api-keys` | List org-scoped API keys |
+| DELETE | `/v1/admin/organizations/:id/api-keys/:keyId` | Revoke an org-scoped API key |
 | GET | `/v1/admin/organizations/:id/audit-logs` | Paginated audit logs |
 | GET | `/v1/admin/platform/users` | **Owner only** — list all users |
 | GET | `/v1/admin/platform/organizations` | **Owner only** — list all organizations |
@@ -577,21 +687,31 @@ If Keystone feels slow or uses a lot of memory during development, see [`docs/PE
 | GET | `/v1/admin/platform/queue/failed` | **Owner only** — failed jobs |
 | POST | `/v1/admin/platform/queue/failed/:id/retry` | **Owner only** — retry failed job |
 | POST | `/v1/admin/platform/queue/retry-all` | **Owner only** — retry all failed jobs |
-| GET/POST/PATCH/DELETE | `/v1/admin/platform/webhooks` | **Owner only** — webhook management |
+| GET/POST | `/v1/admin/platform/webhooks` | **Owner only** — list / create webhooks |
+| PATCH | `/v1/admin/platform/webhooks/:id` | **Owner only** — update a webhook |
+| DELETE | `/v1/admin/platform/webhooks/:id` | **Owner only** — delete a webhook |
 | POST | `/v1/admin/platform/webhooks/:id/rotate-secret` | **Owner only** — rotate webhook secret |
-| GET/POST/DELETE | `/v1/admin/organizations/:id/saml-connections` | SAML connection management |
+| GET/POST | `/v1/admin/organizations/:id/saml-connections` | SAML connection management |
+| DELETE | `/v1/admin/organizations/:id/saml-connections/:connectionId` | Delete a SAML connection |
 | GET | `/v1/admin/organizations/:id/saml-connections/:connectionId/metadata` | SAML SP metadata |
-| GET/POST/DELETE | `/v1/admin/organizations/:id/oidc-connections` | OIDC connection management |
+| GET/POST | `/v1/admin/organizations/:id/oidc-connections` | OIDC connection management |
+| DELETE | `/v1/admin/organizations/:id/oidc-connections/:connectionId` | Delete an OIDC connection |
 
 ### Enterprise SSO
 
 | Method | Path | Description |
 |--------|------|-------------|
-| GET | `/saml/:connectionId` | Start SAML SSO login |
-| POST | `/saml/acs` | SAML assertion consumer service |
-| GET | `/saml/:connectionId/metadata` | SAML SP metadata |
-| GET | `/sso/oidc/:connectionId` | Start enterprise OIDC SSO login |
-| GET | `/sso/oidc/:connectionId/callback` | Enterprise OIDC callback |
+| GET | `/sso/saml/:connectionId` | Start SAML SSO login (requires `?orgId=`) |
+| POST | `/sso/saml/acs` | SAML assertion consumer service |
+| GET | `/sso/saml/:connectionId/metadata` | SAML SP metadata (requires `?orgId=`) |
+| GET | `/sso/sso/oidc/:connectionId` | Start enterprise OIDC SSO login (requires `?orgId=`) |
+| GET | `/sso/sso/oidc/:connectionId/callback` | Enterprise OIDC callback (requires `?orgId=`) |
+
+> **Note:** the doubled `/sso/sso/oidc` segment is real, not a typo. The OIDC
+> enterprise routes declare `/sso/oidc/...` *and* are mounted under the `/sso`
+> prefix. SAML is mounted the same way but declares `/saml/...`, so it resolves
+> cleanly to `/sso/saml/...`. Changing the OIDC path would break existing
+> deployments, so it is scheduled for a future minor release.
 
 ### SCIM Provisioning
 
@@ -609,7 +729,8 @@ that organization. Cross-tenant targets return `404`.
 | POST | `/scim/v2/Users/.search` | Search users |
 | GET | `/scim/v2/Groups` | List groups (filter) |
 | GET | `/scim/v2/Groups/:groupId` | Get group by ID |
-| POST/PUT/PATCH/DELETE | `/scim/v2/Groups/:groupId` | Manage groups |
+| POST | `/scim/v2/Groups` | Create group |
+| PUT/PATCH/DELETE | `/scim/v2/Groups/:groupId` | Manage group |
 | GET/POST | `/scim/v2/Groups/:groupId/members` | Manage group members |
 | GET | `/scim/v2/ServiceProviderConfig` | Supported features |
 
@@ -621,29 +742,31 @@ once and stored only as a digest.
 
 | Method | Path | Description |
 |--------|------|-------------|
-| POST | `/mfa/verify` | Complete a login MFA challenge and receive tokens |
-| POST | `/totp/enroll` | Begin TOTP enrollment |
-| POST | `/totp/verify` | Confirm enrollment; revokes existing sessions |
-| POST | `/totp/disable` | Disable TOTP MFA |
-| POST | `/totp/backup` | Regenerate backup codes (requires a TOTP code) |
-| POST | `/totp/backup/verify` | Consume a backup code |
-| POST | `/sms-otp/send` | Send SMS OTP |
-| POST | `/sms-otp/verify` | Verify SMS OTP |
-| POST | `/magic-link/send` | Send magic link |
-| GET | `/magic-link/verify` | Verify magic link |
-| POST | `/email-verification/send` | Send verification email |
-| POST | `/email-verification/request` | Request verification email |
-| GET | `/email-verification/verify` | Verify email token |
-| POST | `/webauthn/register` | Register WebAuthn credential |
-| POST | `/webauthn/authenticate` | Authenticate with WebAuthn |
+| POST | `/auth/mfa/verify` | Complete a login MFA challenge and receive tokens |
+| POST | `/auth/totp/enroll` | Begin TOTP enrollment (requires `password`) |
+| POST | `/auth/totp/verify` | Confirm enrollment (requires `password` + `code`); revokes existing sessions |
+| POST | `/auth/totp/disable` | Disable TOTP MFA (requires `password` + `code`) |
+| POST | `/auth/totp/backup` | Regenerate backup codes (requires `password` + `code`) |
+| POST | `/auth/totp/backup/verify` | Consume a backup code; never establishes a session |
+| POST | `/auth/sms-otp/send` | Send SMS OTP |
+| POST | `/auth/sms-otp/verify` | Verify SMS OTP |
+| POST | `/auth/magic-link/send` | Send magic link |
+| GET | `/auth/magic-link/verify` | Verify magic link |
+| POST | `/auth/email-verification/send` | Send verification email |
+| POST | `/auth/email-verification/request` | Request verification email |
+| GET | `/auth/email-verification/verify` | Verify email token |
+| GET | `/auth/webauthn/register/options` | WebAuthn creation options |
+| POST | `/auth/webauthn/register/verify` | Register a WebAuthn credential |
+| POST | `/auth/webauthn/authenticate/options` | WebAuthn assertion options |
+| POST | `/auth/webauthn/authenticate/verify` | Authenticate and establish a session |
 
 ### Sessions
 
 | Method | Path | Description |
 |--------|------|-------------|
-| GET | `/sessions` | List active sessions |
-| DELETE | `/sessions/:id` | Revoke session |
-| POST | `/sessions/revoke-all` | Revoke all sessions |
+| GET | `/auth/sessions` | List active sessions |
+| DELETE | `/auth/sessions/:id` | Revoke session |
+| POST | `/auth/sessions/revoke-all` | Revoke all sessions |
 
 ### Workflows
 
@@ -712,6 +835,12 @@ npx keystone org:create --name "Acme" --owner-email admin@example.com
 - Internal implementation details are not exposed in API responses.
 - Input validation uses Zod schemas on all routes.
 - Error messages are sanitized in production mode.
+- **MFA is enforced before token issuance.** An account with TOTP enabled cannot receive a token until a second factor is verified, and the check happens at a single chokepoint rather than per route.
+- TOTP secrets are stored encrypted with AES-256-GCM; backup codes are stored as a keyed, peppered hash, expire, and can only be consumed once.
+- Changing how an account proves its identity — enrolling, confirming, disabling TOTP, or registering a passkey — requires the account password in addition to a valid session.
+- **SCIM credentials are per organization.** Tokens are stored only as a digest, and every SCIM read and write is scoped to the credential's organization. A cross-tenant target is reported as not found.
+- SCIM deprovisioning never reaches outside the caller's organization, and cannot remove the last owner of an organization.
+- SCIM credential creation, rotation, and revocation are restricted to organization owners.
 
 ---
 
@@ -726,6 +855,8 @@ Full documentation lives in [`docs/`](docs/README.md):
 | [Deployment](docs/DEPLOYMENT.md) | Docker Compose, Kubernetes, systemd, hardening |
 | [Integration guide](docs/INTEGRATION.md) | Connect your apps to Keystone |
 | [Security model](docs/SECURITY.md) | Threat model and hardening checklist |
+| [v1.8 migration guide](docs/MIGRATION-1.8.md) | Mandatory MFA: new endpoints, response changes, upgrade steps |
+| [v1.9 migration guide](docs/MIGRATION-1.9.md) | SCIM tenancy: per-organization credentials, deprovisioning semantics, upgrade steps |
 | [Performance](docs/PERFORMANCE.md) | Tuning and load-testing notes |
 | [Contributing](docs/CONTRIBUTING.md) | Dev environment and PR process |
 | [Roadmap](docs/ROADMAP.md) | Planned work |

package/dist/config.d.ts

@@ -54,6 +54,14 @@ export declare const config: {
     /** Budget for unauthenticated SCIM requests, which run before the credential limiter. */
     readonly SCIM_AUTH_FAILURE_MAX: number;
     readonly SCIM_AUTH_FAILURE_WINDOW_SECONDS: number;
+    /**
+     * Comma-separated IP addresses and CIDR ranges of reverse proxies allowed to
+     * set client-identity headers (`x-forwarded-for`, `x-forwarded-client-cert`,
+     * ...). Empty means trust nothing: the peer address is used and those headers
+     * are stripped. Set this only when Keystone genuinely sits behind a proxy you
+     * control — an over-broad value lets any client behind it forge an identity.
+     */
+    readonly TRUSTED_PROXIES: string;
     readonly MFA_CHALLENGE_TTL_SECONDS: number;
     readonly MFA_MAX_ATTEMPTS: number;
     readonly TOTP_BACKUP_CODE_TTL_SECONDS: number;

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AA6DA,eAAO,MAAM,MAAM;aACjB,QAAQ;aACR,IAAI;aACJ,IAAI;aAEJ,YAAY;aACZ,SAAS;aAGT,cAAc;aACd,cAAc;aACd,kBAAkB;aAGlB,yBAAyB;aACzB,6BAA6B;aAC7B,mBAAmB;aAGnB,iBAAiB;aACjB,qBAAqB;aAGrB,qBAAqB;aACrB,qBAAqB;aAErB,WAAW;aACX,aAAa;aACb,aAAa;aACb,gBAAgB,EAAuG,QAAQ,GAAG,KAAK,GAAG,MAAM;aAChJ,2BAA2B;aAE3B,mBAAmB;aACnB,wBAAwB;aACxB,yBAAyB;aAGzB,eAAe;aACf,cAAc;aAGd,uBAAuB;aAGvB,yBAAyB;aAGzB,uBAAuB;aAGvB,gBAAgB;aAGhB,gBAAgB;aAEhB,gBAAgB;aAEhB,gBAAgB;aAEhB,eAAe;aAEf,mBAAmB;aACnB,yBAAyB;aACzB,qBAAqB;aACrB,wBAAwB;aAExB,yBAAyB;aACzB,gCAAgC;aAEhC,kBAAkB;aAIlB,2BAA2B;aAC3B,sBAAsB;aACtB,sBAAsB;aACtB,WAAW;aACX,mBAAmB;aAInB,iBAAiB;aACjB,WAAW;IACX,uDAAuD;aAGvD,2BAA2B;IAC3B,qEAAqE;aACrE,mBAAmB;aACnB,8BAA8B;IAC9B,yFAAyF;aACzF,qBAAqB;aACrB,gCAAgC;aAChC,yBAAyB;aACzB,gBAAgB;aAChB,4BAA4B;aAC5B,cAAc;aACd,UAAU;aACV,SAAS;aACT,SAAS;aACT,SAAS;aACT,SAAS;aACT,WAAW;aACX,gBAAgB;aAChB,eAAe;aACf,cAAc;aACd,YAAY;aACZ,kBAAkB;aAClB,iBAAiB;aACjB,kBAAkB;aAClB,4BAA4B;aAC5B,2BAA2B;aAC3B,iBAAiB;aACjB,oBAAoB;aACpB,sBAAsB;CACd,CAAC;AAEX,wBAAgB,cAAc,IAAI,MAAM,CAMvC;AAED,wBAAgB,mBAAmB,IAAI,OAAO,CAE7C"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AA6DA,eAAO,MAAM,MAAM;aACjB,QAAQ;aACR,IAAI;aACJ,IAAI;aAEJ,YAAY;aACZ,SAAS;aAGT,cAAc;aACd,cAAc;aACd,kBAAkB;aAGlB,yBAAyB;aACzB,6BAA6B;aAC7B,mBAAmB;aAGnB,iBAAiB;aACjB,qBAAqB;aAGrB,qBAAqB;aACrB,qBAAqB;aAErB,WAAW;aACX,aAAa;aACb,aAAa;aACb,gBAAgB,EAAuG,QAAQ,GAAG,KAAK,GAAG,MAAM;aAChJ,2BAA2B;aAE3B,mBAAmB;aACnB,wBAAwB;aACxB,yBAAyB;aAGzB,eAAe;aACf,cAAc;aAGd,uBAAuB;aAGvB,yBAAyB;aAGzB,uBAAuB;aAGvB,gBAAgB;aAGhB,gBAAgB;aAEhB,gBAAgB;aAEhB,gBAAgB;aAEhB,eAAe;aAEf,mBAAmB;aACnB,yBAAyB;aACzB,qBAAqB;aACrB,wBAAwB;aAExB,yBAAyB;aACzB,gCAAgC;aAEhC,kBAAkB;aAIlB,2BAA2B;aAC3B,sBAAsB;aACtB,sBAAsB;aACtB,WAAW;aACX,mBAAmB;aAInB,iBAAiB;aACjB,WAAW;IACX,uDAAuD;aAGvD,2BAA2B;IAC3B,qEAAqE;aACrE,mBAAmB;aACnB,8BAA8B;IAC9B,yFAAyF;aACzF,qBAAqB;aACrB,gCAAgC;IAChC;;;;;;OAMG;aACH,eAAe;aACf,yBAAyB;aACzB,gBAAgB;aAChB,4BAA4B;aAC5B,cAAc;aACd,UAAU;aACV,SAAS;aACT,SAAS;aACT,SAAS;aACT,SAAS;aACT,WAAW;aACX,gBAAgB;aAChB,eAAe;aACf,cAAc;aACd,YAAY;aACZ,kBAAkB;aAClB,iBAAiB;aACjB,kBAAkB;aAClB,4BAA4B;aAC5B,2BAA2B;aAC3B,iBAAiB;aACjB,oBAAoB;aACpB,sBAAsB;CACd,CAAC;AAEX,wBAAgB,cAAc,IAAI,MAAM,CAMvC;AAED,wBAAgB,mBAAmB,IAAI,OAAO,CAE7C"}

package/dist/config.js

@@ -119,6 +119,14 @@ export const config = {
     /** Budget for unauthenticated SCIM requests, which run before the credential limiter. */
     SCIM_AUTH_FAILURE_MAX: positiveInt("SCIM_AUTH_FAILURE_MAX", "60"),
     SCIM_AUTH_FAILURE_WINDOW_SECONDS: positiveInt("SCIM_AUTH_FAILURE_WINDOW_SECONDS", "60"),
+    /**
+     * Comma-separated IP addresses and CIDR ranges of reverse proxies allowed to
+     * set client-identity headers (`x-forwarded-for`, `x-forwarded-client-cert`,
+     * ...). Empty means trust nothing: the peer address is used and those headers
+     * are stripped. Set this only when Keystone genuinely sits behind a proxy you
+     * control — an over-broad value lets any client behind it forge an identity.
+     */
+    TRUSTED_PROXIES: getEnv("KEYSTONE_TRUSTED_PROXIES"),
     MFA_CHALLENGE_TTL_SECONDS: positiveInt("MFA_CHALLENGE_TTL_SECONDS", "300"),
     MFA_MAX_ATTEMPTS: positiveInt("MFA_MAX_ATTEMPTS", "5"),
     TOTP_BACKUP_CODE_TTL_SECONDS: positiveInt("TOTP_BACKUP_CODE_TTL_SECONDS", "7776000"),

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;AAC5D,MAAM,CAAC,MAAM,EAAE,CAAC;AAEhB,SAAS,MAAM,CAAC,IAAY,EAAE,QAAQ,GAAG,EAAE;IACzC,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,IAAY,EAAE,QAAgB;IACpD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,CAAC,IAAI,CACV,YAAY,IAAI,wCAAwC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,QAAQ,EAAE,CAClG,CAAC;QACF,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,QAAgB;IACjD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,CAAC,IAAI,CACV,YAAY,IAAI,oCAAoC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,QAAQ,EAAE,CAC9F,CAAC;QACF,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY;IACzC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,MAAM,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,0CAA0C,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,IAAI,EAAE,CAAC;AACrB,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,GAAG,MAAM,CACvB,aAAa,EACb,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,kBAAkB,CACpG,CAAC;AACF,MAAM,YAAY,GAAG,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;AAEtD,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC;IAC3C,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC;IAE/B,YAAY,EAAE,qBAAqB,CAAC,cAAc,CAAC;IACnD,SAAS,EAAE,MAAM,CAAC,WAAW,EAAE,wBAAwB,CAAC;IAExD,wEAAwE;IACxE,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC;IACxC,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC;IACxC,kBAAkB,EAAE,MAAM,CAAC,oBAAoB,CAAC;IAEhD,6DAA6D;IAC7D,yBAAyB,EAAE,MAAM,CAAC,2BAA2B,CAAC;IAC9D,6BAA6B,EAAE,MAAM,CAAC,+BAA+B,CAAC;IACtE,mBAAmB,EAAE,MAAM,CAAC,qBAAqB,CAAC;IAElD,iEAAiE;IACjE,iBAAiB,EAAE,MAAM,CAAC,mBAAmB,CAAC;IAC9C,qBAAqB,EAAE,MAAM,CAAC,uBAAuB,CAAC;IAEtD,wFAAwF;IACxF,qBAAqB,EAAE,MAAM,CAAC,uBAAuB,CAAC;IACtD,qBAAqB,EAAE,MAAM,CAAC,uBAAuB,CAAC;IAEtD,WAAW,EAAE,UAAU;IACvB,aAAa,EAAE,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,mBAAmB,CAAC;IACtF,aAAa,EAAE,YAAY,IAAI,MAAM,CAAC,eAAe,EAAE,OAAO,CAAC,KAAK,MAAM;IAC1E,gBAAgB,EAAE,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAA8B;IAChJ,2BAA2B,EAAE,MAAM,CAAC,6BAA6B,EAAE,OAAO,CAAC,KAAK,MAAM;IAEtF,mBAAmB,EAAE,MAAM,CAAC,qBAAqB,CAAC;IAClD,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;IACvE,yBAAyB,EAAE,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,QAAQ,CAAC,CAAC;IAE5E,oFAAoF;IACpF,eAAe,EAAE,MAAM,CAAC,iBAAiB,CAAC;IAC1C,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC;IAExC,sGAAsG;IACtG,uBAAuB,EAAE,MAAM,CAAC,yBAAyB,CAAC;IAE1D,2DAA2D;IAC3D,yBAAyB,EAAE,MAAM,CAAC,2BAA2B,EAAE,UAAU,CAAC;IAE1E,gHAAgH;IAChH,uBAAuB,EAAE,MAAM,CAAC,yBAAyB,EAAE,YAAY,CAAC;IAExE,sDAAsD;IACtD,gBAAgB,EAAE,MAAM,CAAC,kBAAkB,EAAE,WAAW,CAAC;IAEzD,kEAAkE;IAClE,gBAAgB,EAAE,MAAM,CAAC,kBAAkB,CAAC;IAE5C,gBAAgB,EAAE,MAAM,CAAC,2BAA2B,CAAC,IAAI,MAAM,CAAC,0BAA0B,EAAE,EAAE,CAAC;IAE/F,gBAAgB,EAAE,MAAM,CAAC,2BAA2B,CAAC;IAErD,eAAe,EAAE,OAAO,CAAC,iBAAiB,CAAC;IAE3C,mBAAmB,EAAE,MAAM,CAAC,MAAM,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;IAC/D,yBAAyB,EAAE,MAAM,CAAC,MAAM,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAC;IAC7E,qBAAqB,EAAE,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;IACrE,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC,0BAA0B,EAAE,IAAI,CAAC,CAAC;IAE1E,yBAAyB,EAAE,MAAM,CAAC,MAAM,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;IAC3E,gCAAgC,EAAE,MAAM,CAAC,MAAM,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAC;IAE5F,kBAAkB,EAAE,MAAM,CAAC,oBAAoB,EAAE,OAAO,CAAC,KAAK,MAAM;IACpE,yEAAyE;IACzE,yEAAyE;IACzE,kCAAkC;IAClC,2BAA2B,EAAE,MAAM,CAAC,6BAA6B,EAAE,OAAO,CAAC,KAAK,MAAM;IACtF,sBAAsB,EAAE,MAAM,CAAC,MAAM,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;IACvE,sBAAsB,EAAE,MAAM,CAAC,MAAM,CAAC,wBAAwB,EAAE,IAAI,CAAC,CAAC;IACtE,WAAW,EAAE,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC;IAC7C,mBAAmB,EAAE,MAAM,CAAC,8BAA8B,CAAC;IAC3D,8EAA8E;IAC9E,0EAA0E;IAC1E,sEAAsE;IACtE,iBAAiB,EAAE,MAAM,CAAC,mBAAmB,CAAC;IAC9C,WAAW,EAAE,MAAM,CAAC,aAAa,CAAC;IAClC,uDAAuD;IACvD,yEAAyE;IACzE,oEAAoE;IACpE,2BAA2B,EAAE,cAAc,CAAC,6BAA6B,EAAE,GAAG,CAAC;IAC/E,qEAAqE;IACrE,mBAAmB,EAAE,WAAW,CAAC,qBAAqB,EAAE,KAAK,CAAC;IAC9D,8BAA8B,EAAE,WAAW,CAAC,gCAAgC,EAAE,IAAI,CAAC;IACnF,yFAAyF;IACzF,qBAAqB,EAAE,WAAW,CAAC,uBAAuB,EAAE,IAAI,CAAC;IACjE,gCAAgC,EAAE,WAAW,CAAC,kCAAkC,EAAE,IAAI,CAAC;IACvF,yBAAyB,EAAE,WAAW,CAAC,2BAA2B,EAAE,KAAK,CAAC;IAC1E,gBAAgB,EAAE,WAAW,CAAC,kBAAkB,EAAE,GAAG,CAAC;IACtD,4BAA4B,EAAE,WAAW,CAAC,8BAA8B,EAAE,SAAS,CAAC;IACpF,cAAc,EAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAChD,UAAU,EAAE,MAAM,CAAC,YAAY,EAAE,2BAA2B,CAAC;IAC7D,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAC7C,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,KAAK,MAAM;IACtD,gBAAgB,EAAE,MAAM,CAAC,kBAAkB,CAAC;IAC5C,eAAe,EAAE,MAAM,CAAC,iBAAiB,CAAC;IAC1C,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC;IACxC,YAAY,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC;IAC5C,kBAAkB,EAAE,MAAM,CAAC,oBAAoB,CAAC;IAChD,iBAAiB,EAAE,MAAM,CAAC,mBAAmB,CAAC;IAC9C,kBAAkB,EAAE,MAAM,CAAC,oBAAoB,CAAC;IAChD,4BAA4B,EAAE,MAAM,CAAC,8BAA8B,CAAC;IACpE,2BAA2B,EAAE,MAAM,CAAC,6BAA6B,CAAC;IAClE,iBAAiB,EAAE,MAAM,CAAC,mBAAmB,CAAC;IAC9C,oBAAoB,EAAE,MAAM,CAAC,sBAAsB,EAAE,OAAO,CAAC;IAC7D,sBAAsB,EAAE,MAAM,CAAC,wBAAwB,CAAC,IAAI,MAAM,CAAC,iCAAiC,CAAC;CAC7F,CAAC;AAEX,MAAM,UAAU,cAAc;IAC5B,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,EAAE,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO,OAAO,CAAC,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,iBAAiB,CAAC,CAAC;AACpE,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;AAC5D,MAAM,CAAC,MAAM,EAAE,CAAC;AAEhB,SAAS,MAAM,CAAC,IAAY,EAAE,QAAQ,GAAG,EAAE;IACzC,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,IAAY,EAAE,QAAgB;IACpD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,CAAC,IAAI,CACV,YAAY,IAAI,wCAAwC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,QAAQ,EAAE,CAClG,CAAC;QACF,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,QAAgB;IACjD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,CAAC,IAAI,CACV,YAAY,IAAI,oCAAoC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,QAAQ,EAAE,CAC9F,CAAC;QACF,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY;IACzC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,MAAM,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,0CAA0C,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,IAAI,EAAE,CAAC;AACrB,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,GAAG,MAAM,CACvB,aAAa,EACb,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,kBAAkB,CACpG,CAAC;AACF,MAAM,YAAY,GAAG,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;AAEtD,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC;IAC3C,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC;IAE/B,YAAY,EAAE,qBAAqB,CAAC,cAAc,CAAC;IACnD,SAAS,EAAE,MAAM,CAAC,WAAW,EAAE,wBAAwB,CAAC;IAExD,wEAAwE;IACxE,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC;IACxC,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC;IACxC,kBAAkB,EAAE,MAAM,CAAC,oBAAoB,CAAC;IAEhD,6DAA6D;IAC7D,yBAAyB,EAAE,MAAM,CAAC,2BAA2B,CAAC;IAC9D,6BAA6B,EAAE,MAAM,CAAC,+BAA+B,CAAC;IACtE,mBAAmB,EAAE,MAAM,CAAC,qBAAqB,CAAC;IAElD,iEAAiE;IACjE,iBAAiB,EAAE,MAAM,CAAC,mBAAmB,CAAC;IAC9C,qBAAqB,EAAE,MAAM,CAAC,uBAAuB,CAAC;IAEtD,wFAAwF;IACxF,qBAAqB,EAAE,MAAM,CAAC,uBAAuB,CAAC;IACtD,qBAAqB,EAAE,MAAM,CAAC,uBAAuB,CAAC;IAEtD,WAAW,EAAE,UAAU;IACvB,aAAa,EAAE,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,mBAAmB,CAAC;IACtF,aAAa,EAAE,YAAY,IAAI,MAAM,CAAC,eAAe,EAAE,OAAO,CAAC,KAAK,MAAM;IAC1E,gBAAgB,EAAE,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAA8B;IAChJ,2BAA2B,EAAE,MAAM,CAAC,6BAA6B,EAAE,OAAO,CAAC,KAAK,MAAM;IAEtF,mBAAmB,EAAE,MAAM,CAAC,qBAAqB,CAAC;IAClD,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;IACvE,yBAAyB,EAAE,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,QAAQ,CAAC,CAAC;IAE5E,oFAAoF;IACpF,eAAe,EAAE,MAAM,CAAC,iBAAiB,CAAC;IAC1C,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC;IAExC,sGAAsG;IACtG,uBAAuB,EAAE,MAAM,CAAC,yBAAyB,CAAC;IAE1D,2DAA2D;IAC3D,yBAAyB,EAAE,MAAM,CAAC,2BAA2B,EAAE,UAAU,CAAC;IAE1E,gHAAgH;IAChH,uBAAuB,EAAE,MAAM,CAAC,yBAAyB,EAAE,YAAY,CAAC;IAExE,sDAAsD;IACtD,gBAAgB,EAAE,MAAM,CAAC,kBAAkB,EAAE,WAAW,CAAC;IAEzD,kEAAkE;IAClE,gBAAgB,EAAE,MAAM,CAAC,kBAAkB,CAAC;IAE5C,gBAAgB,EAAE,MAAM,CAAC,2BAA2B,CAAC,IAAI,MAAM,CAAC,0BAA0B,EAAE,EAAE,CAAC;IAE/F,gBAAgB,EAAE,MAAM,CAAC,2BAA2B,CAAC;IAErD,eAAe,EAAE,OAAO,CAAC,iBAAiB,CAAC;IAE3C,mBAAmB,EAAE,MAAM,CAAC,MAAM,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;IAC/D,yBAAyB,EAAE,MAAM,CAAC,MAAM,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAC;IAC7E,qBAAqB,EAAE,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;IACrE,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC,0BAA0B,EAAE,IAAI,CAAC,CAAC;IAE1E,yBAAyB,EAAE,MAAM,CAAC,MAAM,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;IAC3E,gCAAgC,EAAE,MAAM,CAAC,MAAM,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAC;IAE5F,kBAAkB,EAAE,MAAM,CAAC,oBAAoB,EAAE,OAAO,CAAC,KAAK,MAAM;IACpE,yEAAyE;IACzE,yEAAyE;IACzE,kCAAkC;IAClC,2BAA2B,EAAE,MAAM,CAAC,6BAA6B,EAAE,OAAO,CAAC,KAAK,MAAM;IACtF,sBAAsB,EAAE,MAAM,CAAC,MAAM,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;IACvE,sBAAsB,EAAE,MAAM,CAAC,MAAM,CAAC,wBAAwB,EAAE,IAAI,CAAC,CAAC;IACtE,WAAW,EAAE,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC;IAC7C,mBAAmB,EAAE,MAAM,CAAC,8BAA8B,CAAC;IAC3D,8EAA8E;IAC9E,0EAA0E;IAC1E,sEAAsE;IACtE,iBAAiB,EAAE,MAAM,CAAC,mBAAmB,CAAC;IAC9C,WAAW,EAAE,MAAM,CAAC,aAAa,CAAC;IAClC,uDAAuD;IACvD,yEAAyE;IACzE,oEAAoE;IACpE,2BAA2B,EAAE,cAAc,CAAC,6BAA6B,EAAE,GAAG,CAAC;IAC/E,qEAAqE;IACrE,mBAAmB,EAAE,WAAW,CAAC,qBAAqB,EAAE,KAAK,CAAC;IAC9D,8BAA8B,EAAE,WAAW,CAAC,gCAAgC,EAAE,IAAI,CAAC;IACnF,yFAAyF;IACzF,qBAAqB,EAAE,WAAW,CAAC,uBAAuB,EAAE,IAAI,CAAC;IACjE,gCAAgC,EAAE,WAAW,CAAC,kCAAkC,EAAE,IAAI,CAAC;IACvF;;;;;;OAMG;IACH,eAAe,EAAE,MAAM,CAAC,0BAA0B,CAAC;IACnD,yBAAyB,EAAE,WAAW,CAAC,2BAA2B,EAAE,KAAK,CAAC;IAC1E,gBAAgB,EAAE,WAAW,CAAC,kBAAkB,EAAE,GAAG,CAAC;IACtD,4BAA4B,EAAE,WAAW,CAAC,8BAA8B,EAAE,SAAS,CAAC;IACpF,cAAc,EAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAChD,UAAU,EAAE,MAAM,CAAC,YAAY,EAAE,2BAA2B,CAAC;IAC7D,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAC7C,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,KAAK,MAAM;IACtD,gBAAgB,EAAE,MAAM,CAAC,kBAAkB,CAAC;IAC5C,eAAe,EAAE,MAAM,CAAC,iBAAiB,CAAC;IAC1C,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC;IACxC,YAAY,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC;IAC5C,kBAAkB,EAAE,MAAM,CAAC,oBAAoB,CAAC;IAChD,iBAAiB,EAAE,MAAM,CAAC,mBAAmB,CAAC;IAC9C,kBAAkB,EAAE,MAAM,CAAC,oBAAoB,CAAC;IAChD,4BAA4B,EAAE,MAAM,CAAC,8BAA8B,CAAC;IACpE,2BAA2B,EAAE,MAAM,CAAC,6BAA6B,CAAC;IAClE,iBAAiB,EAAE,MAAM,CAAC,mBAAmB,CAAC;IAC9C,oBAAoB,EAAE,MAAM,CAAC,sBAAsB,EAAE,OAAO,CAAC;IAC7D,sBAAsB,EAAE,MAAM,CAAC,wBAAwB,CAAC,IAAI,MAAM,CAAC,iCAAiC,CAAC;CAC7F,CAAC;AAEX,MAAM,UAAU,cAAc;IAC5B,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,EAAE,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO,OAAO,CAAC,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,iBAAiB,CAAC,CAAC;AACpE,CAAC"}

package/dist/db/migrations/0015_chief_vargas.sql

@@ -0,0 +1,7 @@
+DROP INDEX "scim_connections_token_hash_idx";--> statement-breakpoint
+DROP INDEX "scim_connections_previous_token_hash_idx";--> statement-breakpoint
+ALTER TABLE "service_accounts" ADD COLUMN "cert_fingerprint" text;--> statement-breakpoint
+ALTER TABLE "service_accounts" ADD COLUMN "revoked_at" timestamp with time zone;--> statement-breakpoint
+CREATE UNIQUE INDEX "scim_connections_token_hash_unique" ON "scim_connections" USING btree ("token_hash");--> statement-breakpoint
+CREATE UNIQUE INDEX "scim_connections_previous_token_hash_unique" ON "scim_connections" USING btree ("previous_token_hash") WHERE previous_token_hash is not null;--> statement-breakpoint
+CREATE UNIQUE INDEX "service_accounts_cert_fingerprint_unique" ON "service_accounts" USING btree ("cert_fingerprint") WHERE cert_fingerprint is not null;

package/dist/db/migrations/0016_gorgeous_charles_xavier.sql

@@ -0,0 +1,5 @@
+ALTER TABLE "applications" ALTER COLUMN "client_secret_hash" DROP NOT NULL;--> statement-breakpoint
+ALTER TABLE "applications" ADD COLUMN "client_type" text DEFAULT 'confidential' NOT NULL;--> statement-breakpoint
+ALTER TABLE "applications" ADD COLUMN "allowed_scopes" text[] DEFAULT '{}'::text[] NOT NULL;--> statement-breakpoint
+ALTER TABLE "applications" ADD CONSTRAINT "applications_client_type_check" CHECK ("applications"."client_type" in ('confidential', 'public'));--> statement-breakpoint
+ALTER TABLE "applications" ADD CONSTRAINT "applications_public_client_no_secret_check" CHECK (("applications"."client_type" = 'public' and "applications"."client_secret_hash" is null) or "applications"."client_type" <> 'public');

package/dist/db/migrations/0017_flashy_nekra.sql

@@ -0,0 +1 @@
+ALTER TABLE "refresh_tokens" ADD COLUMN "scopes" text[] DEFAULT '{}'::text[] NOT NULL;