@hilbras/keystone 1.9.0 → 2.6.0

package/dist/plugins/auth.js

@@ -5,6 +5,7 @@ import { db } from "../db/index.js";
 import { apiKeys, users, serviceAccounts } from "../db/schema.js";
 import { verifyAccessToken, hashApiKey } from "../services/tokens.js";
 import { emit } from "../services/events/bus.js";
+import { SERVICE_ACCOUNT_DEFAULT_SCOPES, hasScopes } from "../services/scopes.js";
 const DEFAULT_ACCESS_COOKIE = config.COOKIE_NAME;
 const DEFAULT_REFRESH_COOKIE = `${config.COOKIE_NAME}-refresh`;
 export function accessCookieName(clientId) {
@@ -77,7 +78,7 @@ async function resolveUserFromApiKey(key, request) {
                 metadata: { keyId: keyRecord.id, scopes: keyRecord.scopes ?? [] },
             },
         });
-        return { user, scopes: keyRecord.scopes ?? [] };
+        return { user, scopes: keyRecord.scopes ?? [], keyId: keyRecord.id };
     }
     return undefined;
 }
@@ -135,13 +136,18 @@ export default fp(async function authPlugin(app) {
         if (apiKeyUser) {
             request.user = apiKeyUser.user;
             request.apiKeyScopes = apiKeyUser.scopes;
+            request.apiKeyId = apiKeyUser.keyId;
             return;
         }
         const serviceAccountResult = await resolveServiceAccountFromApiKey(token);
         if (serviceAccountResult) {
             const { serviceAccount, keyId, scopes } = serviceAccountResult;
             request.serviceAccount = serviceAccount;
-            request.apiKeyScopes = ["api:read", "api:write", "service_account"];
+            // An explicit set from the registry, not a wildcard string. Service
+            // accounts are granted scopes explicitly and the grant is stored on the
+            // key, so revoking it is a data change rather than a code change.
+            request.apiKeyScopes = scopes.length > 0 ? scopes : SERVICE_ACCOUNT_DEFAULT_SCOPES;
+            request.apiKeyId = keyId;
             await emit({
                 type: "api_key_used",
                 payload: {
@@ -180,12 +186,20 @@ export default fp(async function authPlugin(app) {
     });
     app.decorate("requireScopes", function requireScopes(...required) {
         return async function scopeCheck(request, reply) {
-            // Session-based authentication has full scope access.
-            if (!request.apiKeyScopes)
+            // A session or bearer token carries the authority of a human and is
+            // governed by the permission system instead. Only machine credentials are
+            // scope-limited.
+            if (!request.apiKeyId)
                 return;
-            const scopes = request.apiKeyScopes;
-            const hasAll = required.every((scope) => scopes.includes(scope) || scopes.includes("service_account"));
-            if (!hasAll) {
+            // Fail closed. Previously the guard returned early whenever
+            // `apiKeyScopes` was absent, which is indistinguishable from "this is a
+            // session" — so a key that resolved without a scope list skipped the check
+            // entirely. Keying off `apiKeyId` removes the ambiguity.
+            if (!hasScopes(request.apiKeyScopes, required)) {
+                await request.audit("unauthorized_access", {
+                    action: "insufficient_api_key_scope",
+                    requiredScope: required.join(" "),
+                });
                 return reply.status(403).send({ error: "Insufficient API key scope", required });
             }
         };

package/dist/plugins/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/plugins/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAEhC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAa,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEtE,OAAO,EAAE,IAAI,EAAE,MAAM,2BAA2B,CAAC;AAejD,MAAM,qBAAqB,GAAG,MAAM,CAAC,WAAW,CAAC;AACjD,MAAM,sBAAsB,GAAG,GAAG,MAAM,CAAC,WAAW,UAAU,CAAC;AAE/D,MAAM,UAAU,gBAAgB,CAAC,QAAiB;IAChD,OAAO,QAAQ,CAAC,CAAC,CAAC,OAAO,QAAQ,UAAU,CAAC,CAAC,CAAC,qBAAqB,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAiB;IACjD,OAAO,QAAQ,CAAC,CAAC,CAAC,OAAO,QAAQ,kBAAkB,CAAC,CAAC,CAAC,sBAAsB,CAAC;AAC/E,CAAC;AAED,SAAS,aAAa;IAOpB,MAAM,QAAQ,GAAI,MAAM,CAAC,gBAA8C,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACjI,OAAO;QACL,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,MAAM,CAAC,aAAa;QAC5B,QAAQ;QACR,MAAM,EAAE,MAAM,CAAC,aAAa,IAAI,SAAS;KAC1C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,KAAmB,EACnB,WAAmB,EACnB,YAAoB,EACpB,QAAiB;IAEjB,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAE7B,KAAK,CAAC,SAAS,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE;QACvD,GAAG,IAAI;QACP,MAAM,EAAE,MAAM,CAAC,wBAAwB;KACxC,CAAC,CAAC;IACH,KAAK,CAAC,SAAS,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,YAAY,EAAE;QACzD,GAAG,IAAI;QACP,MAAM,EAAE,MAAM,CAAC,yBAAyB;KACzC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAmB,EAAE,QAAiB;IACxE,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,KAAK,CAAC,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;IACpD,KAAK,CAAC,WAAW,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAuB,EAAE,QAAiB;IACxE,OAAO,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,MAAmB;IACtD,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACtF,OAAO,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3C,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,GAAW;IAC5C,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE;SACzB,MAAM,EAAE;SACR,IAAI,CAAC,OAAO,CAAC;SACb,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;SAChE,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,GAAW,EACX,OAAuB;IAEvB,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACjD,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACjC,IAAI,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE;QAAE,OAAO,SAAS,CAAC;IAE9E,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;IAE7F,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5F,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC9C,MAAM,IAAI,CAAC;YACT,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE;gBACP,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,SAAS;gBACnC,SAAS,EAAE,OAAO,CAAC,EAAE;gBACrB,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;gBACxC,QAAQ,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,EAAE,EAAE;aAClE;SACF,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;IAClD,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAuB;IACjD,+DAA+D;IAC/D,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC;IACjD,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3F,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAEhC,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC7D,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAExC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;IAC7C,IAAI,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,eAAe,EAAE,CAAC,KAAK,UAAU,UAAU,CAAC,GAAoB;IAC9D,GAAG,CAAC,QAAQ,CAAC,cAAc,EAAE,KAAK,UAAU,YAAY,CAAC,OAAO,EAAE,KAAK;QACrE,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC9C,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAC;YACjD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;YACpB,OAAO,CAAC,UAAU,GAAG,MAAM,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,QAAQ,CAAC,sBAAsB,EAAE,KAAK,UAAU,oBAAoB,CAAC,OAAO,EAAE,KAAK;QACrF,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC9C,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAC;YACjD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;YACpB,OAAO;QACT,CAAC;QAAC,MAAM,CAAC;YACP,0CAA0C;QAC5C,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,qBAAqB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC/D,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;YAC/B,OAAO,CAAC,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC;YACzC,OAAO;QACT,CAAC;QAED,MAAM,oBAAoB,GAAG,MAAM,+BAA+B,CAAC,KAAK,CAAC,CAAC;QAC1E,IAAI,oBAAoB,EAAE,CAAC;YACzB,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,oBAAoB,CAAC;YAC/D,OAAO,CAAC,cAAc,GAAG,cAAc,CAAC;YACxC,OAAO,CAAC,YAAY,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC;YACpE,MAAM,IAAI,CAAC;gBACT,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE;oBACP,KAAK,EAAE,cAAc,CAAC,KAAK;oBAC3B,SAAS,EAAE,OAAO,CAAC,EAAE;oBACrB,EAAE,EAAE,OAAO,CAAC,EAAE;oBACd,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;oBACxC,QAAQ,EAAE,EAAE,gBAAgB,EAAE,cAAc,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;iBACjE;aACF,CAAC,CAAC;YACH,8EAA8E;YAC9E,OAAO,CAAC,IAAI,GAAG;gBACb,EAAE,EAAE,MAAM,cAAc,CAAC,EAAE,EAAE;gBAC7B,KAAK,EAAE,mBAAmB,cAAc,CAAC,EAAE,WAAW;gBACtD,QAAQ,EAAE,MAAM,cAAc,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;gBAC/C,IAAI,EAAE,cAAc,CAAC,IAAI;gBACzB,SAAS,EAAE,IAAI;gBACf,aAAa,EAAE,IAAI;gBACnB,IAAI,EAAE,YAAY;gBAClB,IAAI,EAAE,iBAAiB;gBACvB,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,SAAS;gBACnB,aAAa,EAAE,IAAI;gBACnB,YAAY,EAAE,cAAc,CAAC,KAAK;gBAClC,WAAW,EAAE,IAAI;gBACjB,aAAa,EAAE,KAAK;gBACpB,UAAU,EAAE,IAAI;gBAChB,WAAW,EAAE,KAAK;gBAClB,cAAc,EAAE,IAAI;gBACpB,SAAS,EAAE,cAAc,CAAC,SAAS;gBACnC,SAAS,EAAE,cAAc,CAAC,SAAS;aAC5B,CAAC;YACV,OAAO;QACT,CAAC;QAED,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,QAAQ,CAAC,eAAe,EAAE,SAAS,aAAa,CAAC,GAAG,QAAkB;QACxE,OAAO,KAAK,UAAU,UAAU,CAAC,OAAuB,EAAE,KAAmB;YAC3E,sDAAsD;YACtD,IAAI,CAAC,OAAO,CAAC,YAAY;gBAAE,OAAO;YAClC,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;YACpC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC;YACvG,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,QAAQ,EAAE,CAAC,CAAC;YACnF,CAAC;QACH,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,+BAA+B,CAAC,GAAW;IACxD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE;SACzB,MAAM,EAAE;SACR,IAAI,CAAC,OAAO,CAAC;SACb,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;SAChE,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACjC,IAAI,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE;QAAE,OAAO,SAAS,CAAC;IAC9E,IAAI,CAAC,SAAS,CAAC,gBAAgB;QAAE,OAAO,SAAS,CAAC;IAElD,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7F,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,EAAE;SACR,IAAI,CAAC,eAAe,CAAC;SACrB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,SAAS,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;SAClG,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAChH,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/plugins/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAEhC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAa,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEtE,OAAO,EAAE,IAAI,EAAE,MAAM,2BAA2B,CAAC;AACjD,OAAO,EAAE,8BAA8B,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAiBlF,MAAM,qBAAqB,GAAG,MAAM,CAAC,WAAW,CAAC;AACjD,MAAM,sBAAsB,GAAG,GAAG,MAAM,CAAC,WAAW,UAAU,CAAC;AAE/D,MAAM,UAAU,gBAAgB,CAAC,QAAiB;IAChD,OAAO,QAAQ,CAAC,CAAC,CAAC,OAAO,QAAQ,UAAU,CAAC,CAAC,CAAC,qBAAqB,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAiB;IACjD,OAAO,QAAQ,CAAC,CAAC,CAAC,OAAO,QAAQ,kBAAkB,CAAC,CAAC,CAAC,sBAAsB,CAAC;AAC/E,CAAC;AAED,SAAS,aAAa;IAOpB,MAAM,QAAQ,GAAI,MAAM,CAAC,gBAA8C,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACjI,OAAO;QACL,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,MAAM,CAAC,aAAa;QAC5B,QAAQ;QACR,MAAM,EAAE,MAAM,CAAC,aAAa,IAAI,SAAS;KAC1C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,KAAmB,EACnB,WAAmB,EACnB,YAAoB,EACpB,QAAiB;IAEjB,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAE7B,KAAK,CAAC,SAAS,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE;QACvD,GAAG,IAAI;QACP,MAAM,EAAE,MAAM,CAAC,wBAAwB;KACxC,CAAC,CAAC;IACH,KAAK,CAAC,SAAS,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,YAAY,EAAE;QACzD,GAAG,IAAI;QACP,MAAM,EAAE,MAAM,CAAC,yBAAyB;KACzC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAmB,EAAE,QAAiB;IACxE,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,KAAK,CAAC,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;IACpD,KAAK,CAAC,WAAW,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAuB,EAAE,QAAiB;IACxE,OAAO,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,MAAmB;IACtD,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACtF,OAAO,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3C,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,GAAW;IAC5C,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE;SACzB,MAAM,EAAE;SACR,IAAI,CAAC,OAAO,CAAC;SACb,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;SAChE,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,GAAW,EACX,OAAuB;IAEvB,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACjD,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACjC,IAAI,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE;QAAE,OAAO,SAAS,CAAC;IAE9E,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;IAE7F,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5F,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC9C,MAAM,IAAI,CAAC;YACT,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE;gBACP,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,SAAS;gBACnC,SAAS,EAAE,OAAO,CAAC,EAAE;gBACrB,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;gBACxC,QAAQ,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,EAAE,EAAE;aAClE;SACF,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC;IACvE,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAuB;IACjD,+DAA+D;IAC/D,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC;IACjD,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3F,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAEhC,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC7D,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAExC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;IAC7C,IAAI,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,eAAe,EAAE,CAAC,KAAK,UAAU,UAAU,CAAC,GAAoB;IAC9D,GAAG,CAAC,QAAQ,CAAC,cAAc,EAAE,KAAK,UAAU,YAAY,CAAC,OAAO,EAAE,KAAK;QACrE,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC9C,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAC;YACjD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;YACpB,OAAO,CAAC,UAAU,GAAG,MAAM,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,QAAQ,CAAC,sBAAsB,EAAE,KAAK,UAAU,oBAAoB,CAAC,OAAO,EAAE,KAAK;QACrF,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC9C,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAC;YACjD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;YACpB,OAAO;QACT,CAAC;QAAC,MAAM,CAAC;YACP,0CAA0C;QAC5C,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,qBAAqB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC/D,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;YAC/B,OAAO,CAAC,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC;YACzC,OAAO,CAAC,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC;YACpC,OAAO;QACT,CAAC;QAED,MAAM,oBAAoB,GAAG,MAAM,+BAA+B,CAAC,KAAK,CAAC,CAAC;QAC1E,IAAI,oBAAoB,EAAE,CAAC;YACzB,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,oBAAoB,CAAC;YAC/D,OAAO,CAAC,cAAc,GAAG,cAAc,CAAC;YACxC,oEAAoE;YACpE,wEAAwE;YACxE,kEAAkE;YAClE,OAAO,CAAC,YAAY,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,8BAA8B,CAAC;YACnF,OAAO,CAAC,QAAQ,GAAG,KAAK,CAAC;YACzB,MAAM,IAAI,CAAC;gBACT,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE;oBACP,KAAK,EAAE,cAAc,CAAC,KAAK;oBAC3B,SAAS,EAAE,OAAO,CAAC,EAAE;oBACrB,EAAE,EAAE,OAAO,CAAC,EAAE;oBACd,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;oBACxC,QAAQ,EAAE,EAAE,gBAAgB,EAAE,cAAc,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;iBACjE;aACF,CAAC,CAAC;YACH,8EAA8E;YAC9E,OAAO,CAAC,IAAI,GAAG;gBACb,EAAE,EAAE,MAAM,cAAc,CAAC,EAAE,EAAE;gBAC7B,KAAK,EAAE,mBAAmB,cAAc,CAAC,EAAE,WAAW;gBACtD,QAAQ,EAAE,MAAM,cAAc,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;gBAC/C,IAAI,EAAE,cAAc,CAAC,IAAI;gBACzB,SAAS,EAAE,IAAI;gBACf,aAAa,EAAE,IAAI;gBACnB,IAAI,EAAE,YAAY;gBAClB,IAAI,EAAE,iBAAiB;gBACvB,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,SAAS;gBACnB,aAAa,EAAE,IAAI;gBACnB,YAAY,EAAE,cAAc,CAAC,KAAK;gBAClC,WAAW,EAAE,IAAI;gBACjB,aAAa,EAAE,KAAK;gBACpB,UAAU,EAAE,IAAI;gBAChB,WAAW,EAAE,KAAK;gBAClB,cAAc,EAAE,IAAI;gBACpB,SAAS,EAAE,cAAc,CAAC,SAAS;gBACnC,SAAS,EAAE,cAAc,CAAC,SAAS;aAC5B,CAAC;YACV,OAAO;QACT,CAAC;QAED,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,QAAQ,CAAC,eAAe,EAAE,SAAS,aAAa,CAAC,GAAG,QAAkB;QACxE,OAAO,KAAK,UAAU,UAAU,CAAC,OAAuB,EAAE,KAAmB;YAC3E,oEAAoE;YACpE,0EAA0E;YAC1E,iBAAiB;YACjB,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAAE,OAAO;YAE9B,4DAA4D;YAC5D,wEAAwE;YACxE,2EAA2E;YAC3E,yDAAyD;YACzD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAC/C,MAAM,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE;oBACzC,MAAM,EAAE,4BAA4B;oBACpC,aAAa,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;iBAClC,CAAC,CAAC;gBACH,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,QAAQ,EAAE,CAAC,CAAC;YACnF,CAAC;QACH,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,+BAA+B,CAAC,GAAW;IACxD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE;SACzB,MAAM,EAAE;SACR,IAAI,CAAC,OAAO,CAAC;SACb,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;SAChE,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACjC,IAAI,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE;QAAE,OAAO,SAAS,CAAC;IAC9E,IAAI,CAAC,SAAS,CAAC,gBAAgB;QAAE,OAAO,SAAS,CAAC;IAElD,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7F,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,EAAE;SACR,IAAI,CAAC,eAAe,CAAC;SACrB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,SAAS,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;SAClG,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAChH,CAAC"}

package/dist/plugins/headerSanitization.d.ts

@@ -0,0 +1,15 @@
+import type { FastifyInstance } from "fastify";
+/**
+ * Runs before routing, authentication, and every route handler.
+ *
+ * Identity-bearing headers are removed from any request that did not arrive
+ * from a configured trusted proxy. Stripping — rather than merely ignoring the
+ * headers where we happen to check them — means no route, plugin, or future
+ * feature can read a spoofed identity by accident.
+ *
+ * With no trusted proxies configured, this strips unconditionally, which is
+ * the safe default.
+ */
+declare const _default: (app: FastifyInstance) => Promise<void>;
+export default _default;
+//# sourceMappingURL=headerSanitization.d.ts.map

package/dist/plugins/headerSanitization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"headerSanitization.d.ts","sourceRoot":"","sources":["../../src/plugins/headerSanitization.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAQ/C;;;;;;;;;;GAUG;8BAC4D,eAAe"}

package/dist/plugins/headerSanitization.js

@@ -0,0 +1,39 @@
+import fp from "fastify-plugin";
+import { describeUntrustedPeer, hasTrustedProxies, peerAddress, stripUntrustedHeaders, } from "../services/trustedProxies.js";
+/**
+ * Runs before routing, authentication, and every route handler.
+ *
+ * Identity-bearing headers are removed from any request that did not arrive
+ * from a configured trusted proxy. Stripping — rather than merely ignoring the
+ * headers where we happen to check them — means no route, plugin, or future
+ * feature can read a spoofed identity by accident.
+ *
+ * With no trusted proxies configured, this strips unconditionally, which is
+ * the safe default.
+ */
+export default fp(async function headerSanitizationPlugin(app) {
+    let warned = false;
+    app.addHook("onRequest", async (request) => {
+        const trusted = stripUntrustedHeaders(request);
+        if (trusted)
+            return;
+        request.log.debug({ peer: peerAddress(request) }, "stripped untrusted client-identity headers");
+        // The one stripping outcome that indicates a broken deployment rather than
+        // a hostile client: an infrastructure address arriving while no trusted
+        // proxy is configured. That state fails silently — every client shares one
+        // rate-limit budget — so say so once instead of leaving it to be guessed.
+        if (!warned) {
+            const reason = describeUntrustedPeer(peerAddress(request));
+            if (reason) {
+                warned = true;
+                request.log.warn({ peer: peerAddress(request) }, `mTLS/proxy trust boundary not configured: ${reason}`);
+            }
+        }
+    });
+    // State the trust posture at boot. A deployment that expected a proxy to be
+    // trusted should not have to discover the mistake from a support ticket.
+    app.log.info(hasTrustedProxies()
+        ? "client-identity headers will be honoured from configured trusted proxies"
+        : "no trusted proxies configured: client-identity headers will be stripped from every request");
+});
+//# sourceMappingURL=headerSanitization.js.map

package/dist/plugins/headerSanitization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"headerSanitization.js","sourceRoot":"","sources":["../../src/plugins/headerSanitization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAEhC,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,WAAW,EACX,qBAAqB,GACtB,MAAM,+BAA+B,CAAC;AAEvC;;;;;;;;;;GAUG;AACH,eAAe,EAAE,CAAC,KAAK,UAAU,wBAAwB,CAAC,GAAoB;IAC5E,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACzC,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,OAAO;YAAE,OAAO;QAEpB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,EAAE,4CAA4C,CAAC,CAAC;QAEhG,2EAA2E;QAC3E,wEAAwE;QACxE,2EAA2E;QAC3E,0EAA0E;QAC1E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,MAAM,GAAG,qBAAqB,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3D,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,GAAG,IAAI,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,IAAI,CACd,EAAE,IAAI,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,EAC9B,6CAA6C,MAAM,EAAE,CACtD,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,yEAAyE;IACzE,GAAG,CAAC,GAAG,CAAC,IAAI,CACV,iBAAiB,EAAE;QACjB,CAAC,CAAC,0EAA0E;QAC5E,CAAC,CAAC,4FAA4F,CACjG,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/plugins/machinePrincipal.d.ts

@@ -0,0 +1,28 @@
+import type { FastifyInstance } from "fastify";
+declare module "fastify" {
+    interface FastifyInstance {
+        requireHumanPrincipal: () => (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
+    }
+}
+/**
+ * Reject machine credentials on routes that only make sense for a person.
+ *
+ * A service account authenticates by presenting an API key, and the auth plugin
+ * then synthesizes a `request.user` so existing routes keep working. The
+ * synthesized principal has an id of `sa:<uuid>`, which matches no row in
+ * `users` and no row in `org_memberships`.
+ *
+ * That makes most routes fail by accident rather than by decision: a write keyed
+ * on `request.user.id` updates zero rows, and an org-permission check finds no
+ * membership and returns 403. Correct, but incidental — and it relies on every
+ * future route happening to key off the user id. A route that acted on
+ * `request.state.org`, or on the service account's own `orgId`, would not be
+ * stopped by any of that.
+ *
+ * So the boundary is stated rather than implied. On the routes this guard is
+ * applied to, a machine credential is refused with a 403 that says why, instead
+ * of being allowed through to fail somewhere less obvious.
+ */
+declare const _default: (app: FastifyInstance) => Promise<void>;
+export default _default;
+//# sourceMappingURL=machinePrincipal.d.ts.map

package/dist/plugins/machinePrincipal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"machinePrincipal.d.ts","sourceRoot":"","sources":["../../src/plugins/machinePrincipal.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAE7E,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,eAAe;QACvB,qBAAqB,EAAE,MAAM,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;KAC9F;CACF;AAED;;;;;;;;;;;;;;;;;;GAkBG;8BAC4D,eAAe"}

package/dist/plugins/machinePrincipal.js

@@ -0,0 +1,45 @@
+import fp from "fastify-plugin";
+/**
+ * Reject machine credentials on routes that only make sense for a person.
+ *
+ * A service account authenticates by presenting an API key, and the auth plugin
+ * then synthesizes a `request.user` so existing routes keep working. The
+ * synthesized principal has an id of `sa:<uuid>`, which matches no row in
+ * `users` and no row in `org_memberships`.
+ *
+ * That makes most routes fail by accident rather than by decision: a write keyed
+ * on `request.user.id` updates zero rows, and an org-permission check finds no
+ * membership and returns 403. Correct, but incidental — and it relies on every
+ * future route happening to key off the user id. A route that acted on
+ * `request.state.org`, or on the service account's own `orgId`, would not be
+ * stopped by any of that.
+ *
+ * So the boundary is stated rather than implied. On the routes this guard is
+ * applied to, a machine credential is refused with a 403 that says why, instead
+ * of being allowed through to fail somewhere less obvious.
+ */
+export default fp(async function machinePrincipalBoundary(app) {
+    /**
+     * Refuse the request if a service account authenticated it.
+     *
+     * Place after `authenticate`, since that is what populates
+     * `request.serviceAccount`.
+     */
+    app.decorate("requireHumanPrincipal", function requireHumanPrincipal() {
+        return async function humanPrincipalCheck(request, reply) {
+            if (!request.serviceAccount)
+                return;
+            await request.audit("unauthorized_access", {
+                action: "machine_principal_on_interactive_route",
+                serviceAccountId: request.serviceAccount.id,
+                method: request.method,
+                url: request.url,
+            });
+            return reply.status(403).send({
+                error: "This endpoint is for user sessions only",
+                code: "MACHINE_PRINCIPAL_REFUSED",
+            });
+        };
+    });
+});
+//# sourceMappingURL=machinePrincipal.js.map

package/dist/plugins/machinePrincipal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"machinePrincipal.js","sourceRoot":"","sources":["../../src/plugins/machinePrincipal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAShC;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAe,EAAE,CAAC,KAAK,UAAU,wBAAwB,CAAC,GAAoB;IAC5E;;;;;OAKG;IACH,GAAG,CAAC,QAAQ,CAAC,uBAAuB,EAAE,SAAS,qBAAqB;QAClE,OAAO,KAAK,UAAU,mBAAmB,CAAC,OAAuB,EAAE,KAAmB;YACpF,IAAI,CAAC,OAAO,CAAC,cAAc;gBAAE,OAAO;YACpC,MAAM,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE;gBACzC,MAAM,EAAE,wCAAwC;gBAChD,gBAAgB,EAAE,OAAO,CAAC,cAAc,CAAC,EAAE;gBAC3C,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,GAAG,EAAE,OAAO,CAAC,GAAG;aACjB,CAAC,CAAC;YACH,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,yCAAyC;gBAChD,IAAI,EAAE,2BAA2B;aAClC,CAAC,CAAC;QACL,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/plugins/mtls.d.ts

@@ -4,11 +4,30 @@ declare module "fastify" {
         requireMTLS: (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
     }
 }
-export declare function extractClientCert(request: FastifyRequest): {
+export interface ClientCertEvidence {
     fingerprint?: string;
     subject?: string;
-};
+    /** Whether the evidence came from a configured trusted proxy. */
+    trusted: boolean;
+}
+/**
+ * Read certificate evidence. Returns nothing when the peer is not a trusted
+ * proxy, even if the headers are present.
+ */
+export declare function extractClientCert(request: FastifyRequest): ClientCertEvidence;
 export declare function requireMTLS(): (request: FastifyRequest, reply: FastifyReply) => Promise<undefined>;
 declare const _default: (app: FastifyInstance) => Promise<void>;
 export default _default;
+/** Exported for tests: find any service account bound to a fingerprint. */
+export declare function findServiceAccountByFingerprint(fingerprint: string): Promise<{
+    certFingerprint: string | null;
+    createdAt: Date;
+    description: string | null;
+    id: string;
+    isActive: boolean;
+    name: string;
+    orgId: string;
+    revokedAt: Date | null;
+    updatedAt: Date;
+} | undefined>;
 //# sourceMappingURL=mtls.d.ts.map

package/dist/plugins/mtls.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mtls.d.ts","sourceRoot":"","sources":["../../src/plugins/mtls.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAuB7E,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,eAAe;QACvB,WAAW,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;KAC9E;CACF;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,cAAc,GAAG;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAOrG;AAkCD,wBAAgB,WAAW,cACO,cAAc,SAAS,YAAY,wBAiBpE;8BAEgD,eAAe"}
+{"version":3,"file":"mtls.d.ts","sourceRoot":"","sources":["../../src/plugins/mtls.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AA2C7E,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,eAAe;QACvB,WAAW,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;KAC9E;CACF;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iEAAiE;IACjE,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,cAAc,GAAG,kBAAkB,CAiB7E;AAyCD,wBAAgB,WAAW,cACO,cAAc,SAAS,YAAY,wBAuCpE;8BAEgD,eAAe;;AAIhE,2EAA2E;AAC3E,wBAAsB,+BAA+B,CAAC,WAAW,EAAE,MAAM;;;;;;;;;;eAExE"}

package/dist/plugins/mtls.js

@@ -1,70 +1,112 @@
 import fp from "fastify-plugin";
-import { eq } from "drizzle-orm";
+import { and, eq, isNull, or } from "drizzle-orm";
 import { db } from "../db/index.js";
 import { serviceAccounts } from "../db/schema.js";
+import { canonicalFingerprint, isFromTrustedProxy, isValidFingerprint, peerAddress, } from "../services/trustedProxies.js";
 /**
- * mTLS authentication plugin.
+ * mTLS service-account authentication.
  *
- * In production, terminate TLS at a reverse proxy (nginx, envoy, AWS ALB, etc.)
- * that validates the client certificate and forwards the certificate fingerprint
- * or subject in a trusted header. This plugin reads that header and maps
- * certificates to service accounts.
+ * TLS is terminated at a reverse proxy that validates the client certificate.
+ * Keystone learns the result from headers the proxy sets — but only when the
+ * request actually came from that proxy.
  *
- * Headers read:
- *   - x-client-cert-fingerprint: SHA-256 fingerprint of the client certificate
- *   - x-forwarded-client-cert: PEM-encoded client certificate or DN subject
- *   - x-service-account-id: Optional explicit service account ID (for non-mTLS fallback)
+ * Rules this plugin enforces:
+ *
+ *  1. **A header never establishes identity by itself.** Identity comes from a
+ *     client certificate fingerprint that a trusted proxy forwarded, and that
+ *     fingerprint is cryptographically bound to the service account in the
+ *     database. The previous `x-service-account-id` shortcut is gone: it let any
+ *     client name a service account and become it, with no certificate at all.
+ *  2. **A request that did not come from a trusted proxy has no certificate
+ *     identity.** `x-service-account-id` is accepted only as a *hint*, and only
+ *     when the request also presents a valid fingerprint; the hint is then
+ *     cross-checked against that fingerprint's binding.
+ *  3. **A fingerprint must be a well-formed SHA-256 digest**, so a garbage or
+ *     oversized header cannot be used as a lookup key.
+ *
+ * Service accounts without a bound fingerprint cannot authenticate by
+ * certificate at all.
  */
 const MTLS_HEADER = "x-forwarded-client-cert";
 const MTLS_FINGERPRINT_HEADER = "x-client-cert-fingerprint";
 const SERVICE_ACCOUNT_ID_HEADER = "x-service-account-id";
+/** Cap on header length before parsing, so a hostile proxy cannot inflate work. */
+const MAX_CERT_HEADER_LENGTH = 8192;
+/**
+ * Read certificate evidence. Returns nothing when the peer is not a trusted
+ * proxy, even if the headers are present.
+ */
 export function extractClientCert(request) {
-    const fingerprint = request.headers[MTLS_FINGERPRINT_HEADER];
-    const cert = request.headers[MTLS_HEADER];
-    return {
-        fingerprint: typeof fingerprint === "string" ? fingerprint : undefined,
-        subject: typeof cert === "string" ? cert : undefined,
-    };
+    if (!isFromTrustedProxy(request))
+        return { trusted: false };
+    const rawFingerprint = request.headers[MTLS_FINGERPRINT_HEADER];
+    const rawCert = request.headers[MTLS_HEADER];
+    const fingerprint = typeof rawFingerprint === "string" && isValidFingerprint(rawFingerprint.trim())
+        ? canonicalFingerprint(rawFingerprint)
+        : undefined;
+    const subject = typeof rawCert === "string" && rawCert.length > 0 && rawCert.length <= MAX_CERT_HEADER_LENGTH
+        ? rawCert
+        : undefined;
+    return { fingerprint, subject, trusted: true };
 }
-async function resolveServiceAccount(request) {
-    const explicitId = request.headers[SERVICE_ACCOUNT_ID_HEADER];
-    if (typeof explicitId === "string" && explicitId) {
-        const [sa] = await db
-            .select()
-            .from(serviceAccounts)
-            .where(eq(serviceAccounts.id, explicitId))
-            .limit(1);
-        if (sa?.isActive) {
-            return sa;
-        }
-    }
-    const { fingerprint, subject } = extractClientCert(request);
-    if (!fingerprint && !subject)
-        return undefined;
-    // Look up service accounts by name matching the fingerprint or subject.
-    // In a production system, you would store the certificate fingerprint in
-    // the service_accounts table and query by it directly.
-    const [sa] = await db
+/**
+ * Resolve a service account from a validated certificate fingerprint.
+ *
+ * The lookup is by `certFingerprint`, not by `name`: a name is operator-chosen
+ * and guessable, whereas the fingerprint is pinned to a certificate.
+ */
+async function resolveByFingerprint(fingerprint) {
+    const [record] = await db
         .select()
         .from(serviceAccounts)
-        .where(eq(serviceAccounts.name, fingerprint || subject || ""))
+        .where(and(eq(serviceAccounts.certFingerprint, fingerprint), eq(serviceAccounts.isActive, true), isNull(serviceAccounts.revokedAt)))
         .limit(1);
-    if (sa?.isActive) {
-        return sa;
-    }
-    return undefined;
+    return record;
+}
+/**
+ * Optional narrowing: when the proxy also named the service account, the named
+ * account must be the one bound to the presented certificate. A mismatch is a
+ * spoofing signal, not a fallback.
+ */
+async function crossCheckHint(hintId, fingerprint) {
+    const [hinted] = await db
+        .select()
+        .from(serviceAccounts)
+        .where(and(eq(serviceAccounts.id, hintId), isNull(serviceAccounts.revokedAt)))
+        .limit(1);
+    if (!hinted)
+        return undefined;
+    if (hinted.certFingerprint && hinted.certFingerprint !== fingerprint)
+        return undefined;
+    return resolveByFingerprint(fingerprint);
 }
 export function requireMTLS() {
     return async function (request, reply) {
-        const { fingerprint, subject } = extractClientCert(request);
-        const explicitId = request.headers[SERVICE_ACCOUNT_ID_HEADER];
-        if (!fingerprint && !subject && !explicitId) {
-            return reply.status(401).send({ error: "Client certificate required" });
+        const evidence = extractClientCert(request);
+        if (!evidence.trusted) {
+            // Distinguish "not behind a proxy we trust" from "no certificate" so an
+            // operator can tell a misconfiguration from an attack.
+            return reply.status(401).send({
+                error: "Client certificate required",
+                code: isFromTrustedProxy(request) ? "MTLS_CERTIFICATE_MISSING" : "MTLS_UNTRUSTED_PEER",
+            });
         }
-        const serviceAccount = await resolveServiceAccount(request);
+        if (!evidence.fingerprint) {
+            return reply.status(401).send({
+                error: "A valid client certificate fingerprint is required",
+                code: "MTLS_FINGERPRINT_MISSING",
+            });
+        }
+        const hint = request.headers[SERVICE_ACCOUNT_ID_HEADER];
+        const serviceAccount = typeof hint === "string" && hint
+            ? await crossCheckHint(hint, evidence.fingerprint)
+            : await resolveByFingerprint(evidence.fingerprint);
         if (!serviceAccount) {
-            request.log.warn({ fingerprint, subject }, "mTLS: no matching service account found");
-            return reply.status(403).send({ error: "Client certificate not mapped to a service account" });
+            request.log.warn({ fingerprint: evidence.fingerprint, peer: peerAddress(request) }, "mTLS: no active service account is bound to the presented certificate");
+            return reply.status(403).send({
+                error: "Client certificate not mapped to a service account",
+                code: "MTLS_CERTIFICATE_UNMAPPED",
+            });
         }
         request.serviceAccount = serviceAccount;
         request.log.debug({ serviceAccountId: serviceAccount.id }, "mTLS: service account authenticated");
@@ -73,4 +115,9 @@ export function requireMTLS() {
 export default fp(async function mtlsPlugin(app) {
     app.decorate("requireMTLS", requireMTLS());
 });
+/** Exported for tests: find any service account bound to a fingerprint. */
+export async function findServiceAccountByFingerprint(fingerprint) {
+    return resolveByFingerprint(canonicalFingerprint(fingerprint));
+}
+void or;
 //# sourceMappingURL=mtls.js.map

package/dist/plugins/mtls.js.map

@@ -1 +1 @@
-{"version":3,"file":"mtls.js","sourceRoot":"","sources":["../../src/plugins/mtls.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAEhC,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD;;;;;;;;;;;;GAYG;AAEH,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAC9C,MAAM,uBAAuB,GAAG,2BAA2B,CAAC;AAC5D,MAAM,yBAAyB,GAAG,sBAAsB,CAAC;AAQzD,MAAM,UAAU,iBAAiB,CAAC,OAAuB;IACvD,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1C,OAAO;QACL,WAAW,EAAE,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;QACtE,OAAO,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;KACrD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,OAAuB;IAC1D,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAC9D,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,EAAE,CAAC;QACjD,MAAM,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE;aAClB,MAAM,EAAE;aACR,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;aACzC,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC;YACjB,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC5D,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAE/C,wEAAwE;IACxE,yEAAyE;IACzE,uDAAuD;IACvD,MAAM,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE;SAClB,MAAM,EAAE;SACR,IAAI,CAAC,eAAe,CAAC;SACrB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,WAAW,IAAI,OAAO,IAAI,EAAE,CAAC,CAAC;SAC7D,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC;QACjB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,OAAO,KAAK,WAAW,OAAuB,EAAE,KAAmB;QACjE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC5D,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;QAE9D,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC;YAC5C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,yCAAyC,CAAC,CAAC;YACtF,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oDAAoD,EAAE,CAAC,CAAC;QACjG,CAAC;QAED,OAAO,CAAC,cAAc,GAAG,cAAc,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,gBAAgB,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,qCAAqC,CAAC,CAAC;IACpG,CAAC,CAAC;AACJ,CAAC;AAED,eAAe,EAAE,CAAC,KAAK,UAAU,UAAU,CAAC,GAAoB;IAC9D,GAAG,CAAC,QAAQ,CAAC,aAAa,EAAE,WAAW,EAAE,CAAC,CAAC;AAC7C,CAAC,CAAC,CAAC"}
+{"version":3,"file":"mtls.js","sourceRoot":"","sources":["../../src/plugins/mtls.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAEhC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,GACZ,MAAM,+BAA+B,CAAC;AAEvC;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAC9C,MAAM,uBAAuB,GAAG,2BAA2B,CAAC;AAC5D,MAAM,yBAAyB,GAAG,sBAAsB,CAAC;AAEzD,mFAAmF;AACnF,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAepC;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAuB;IACvD,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAE5D,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAE7C,MAAM,WAAW,GACf,OAAO,cAAc,KAAK,QAAQ,IAAI,kBAAkB,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAC7E,CAAC,CAAC,oBAAoB,CAAC,cAAc,CAAC;QACtC,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,OAAO,GACX,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,IAAI,sBAAsB;QAC3F,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACjD,CAAC;AAID;;;;;GAKG;AACH,KAAK,UAAU,oBAAoB,CAAC,WAAmB;IACrD,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,EAAE;SACR,IAAI,CAAC,eAAe,CAAC;SACrB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,eAAe,CAAC,eAAe,EAAE,WAAW,CAAC,EAChD,EAAE,CAAC,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,EAClC,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAClC,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,cAAc,CAAC,MAAc,EAAE,WAAmB;IAC/D,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,EAAE;SACR,IAAI,CAAC,eAAe,CAAC;SACrB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;SAC7E,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,IAAI,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,eAAe,KAAK,WAAW;QAAE,OAAO,SAAS,CAAC;IACvF,OAAO,oBAAoB,CAAC,WAAW,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,OAAO,KAAK,WAAW,OAAuB,EAAE,KAAmB;QACjE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAE5C,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,wEAAwE;YACxE,uDAAuD;YACvD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,6BAA6B;gBACpC,IAAI,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,qBAAqB;aACvF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,oDAAoD;gBAC3D,IAAI,EAAE,0BAA0B;aACjC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;QACxD,MAAM,cAAc,GAClB,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI;YAC9B,CAAC,CAAC,MAAM,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,WAAW,CAAC;YAClD,CAAC,CAAC,MAAM,oBAAoB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAEvD,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,IAAI,CACd,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,IAAI,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,EACjE,uEAAuE,CACxE,CAAC;YACF,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,oDAAoD;gBAC3D,IAAI,EAAE,2BAA2B;aAClC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,CAAC,cAAc,GAAG,cAAc,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,gBAAgB,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,qCAAqC,CAAC,CAAC;IACpG,CAAC,CAAC;AACJ,CAAC;AAED,eAAe,EAAE,CAAC,KAAK,UAAU,UAAU,CAAC,GAAoB;IAC9D,GAAG,CAAC,QAAQ,CAAC,aAAa,EAAE,WAAW,EAAE,CAAC,CAAC;AAC7C,CAAC,CAAC,CAAC;AAEH,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,WAAmB;IACvE,OAAO,oBAAoB,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,KAAK,EAAE,CAAC"}

package/dist/plugins/rateLimit.d.ts

@@ -1,4 +1,5 @@
 import type { FastifyInstance, FastifyReply, FastifyRequest } from "fastify";
+import { clientAddress } from "../services/trustedProxies.js";
 interface RateLimitPluginOptions {
     keyPrefix: string;
     maxAttempts: number;
@@ -17,11 +18,11 @@ export interface GlobalRateLimitOptions {
 }
 declare function isAllowed(key: string, maxAttempts: number, windowSeconds: number): Promise<boolean>;
 /**
- * The resolved client address. Exposed so a route that must run before the
- * normal limiter (because it emits audit events on failure) can still budget
- * itself rather than being unbounded.
+ * Re-exported so a route that must run before the normal limiter (because it
+ * emits audit events on failure) can still budget itself rather than being
+ * unbounded.
  */
-export declare function clientAddress(request: FastifyRequest): string;
+export { clientAddress };
 /** Raw sliding-window check, for the same pre-limiter case. */
 export { isAllowed };
 export declare function rateLimit(options: RateLimitPluginOptions): (request: FastifyRequest, reply: FastifyReply) => Promise<undefined>;

package/dist/plugins/rateLimit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rateLimit.d.ts","sourceRoot":"","sources":["../../src/plugins/rateLimit.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAG7E,UAAU,sBAAsB;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,MAAM,CAAC;CAC/C;AAED,MAAM,WAAW,sBAAsB;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AA4BD,iBAAe,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAyBlG;AAaD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAE7D;AAED,+DAA+D;AAC/D,OAAO,EAAE,SAAS,EAAE,CAAC;AAErB,wBAAgB,SAAS,CAAC,OAAO,EAAE,sBAAsB,aACb,cAAc,SAAS,YAAY,wBAW9E;AAED,wBAAgB,eAAe,CAAC,OAAO,GAAE,sBAA2B,aAKzB,cAAc,SAAS,YAAY,wBAW7E;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,aACxC,cAAc,SAAS,YAAY,wBAY9E;8BAEqD,eAAe"}
+{"version":3,"file":"rateLimit.d.ts","sourceRoot":"","sources":["../../src/plugins/rateLimit.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE7E,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAE9D,UAAU,sBAAsB;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,MAAM,CAAC;CAC/C;AAED,MAAM,WAAW,sBAAsB;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AA4BD,iBAAe,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAyBlG;AAeD;;;;GAIG;AACH,OAAO,EAAE,aAAa,EAAE,CAAC;AAEzB,+DAA+D;AAC/D,OAAO,EAAE,SAAS,EAAE,CAAC;AAErB,wBAAgB,SAAS,CAAC,OAAO,EAAE,sBAAsB,aACb,cAAc,SAAS,YAAY,wBAW9E;AAED,wBAAgB,eAAe,CAAC,OAAO,GAAE,sBAA2B,aAKzB,cAAc,SAAS,YAAY,wBAW7E;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,aACxC,cAAc,SAAS,YAAY,wBAY9E;8BAEqD,eAAe"}

package/dist/plugins/rateLimit.js

@@ -1,6 +1,7 @@
 import crypto from "node:crypto";
 import fp from "fastify-plugin";
 import { redis, isRedisReady } from "../services/redis.js";
+import { clientAddress } from "../services/trustedProxies.js";
 /**
  * Atomic sliding-window rate limit script.
  *
@@ -46,18 +47,20 @@ async function isAllowed(key, maxAttempts, windowSeconds) {
 function cryptoRandom() {
     return crypto.randomBytes(8).toString("hex");
 }
+/**
+ * Rate-limit key source. Uses the peer address unless the request came from a
+ * configured trusted proxy, so a client cannot rotate `x-forwarded-for` to get a
+ * fresh budget.
+ */
 function clientIdentifier(request) {
-    return (request.headers["x-forwarded-for"]?.split(",")[0]?.trim() ||
-        request.ip);
+    return clientAddress(request);
 }
 /**
- * The resolved client address. Exposed so a route that must run before the
- * normal limiter (because it emits audit events on failure) can still budget
- * itself rather than being unbounded.
+ * Re-exported so a route that must run before the normal limiter (because it
+ * emits audit events on failure) can still budget itself rather than being
+ * unbounded.
  */
-export function clientAddress(request) {
-    return clientIdentifier(request);
-}
+export { clientAddress };
 /** Raw sliding-window check, for the same pre-limiter case. */
 export { isAllowed };
 export function rateLimit(options) {

package/dist/plugins/rateLimit.js.map

@@ -1 +1 @@
-{"version":3,"file":"rateLimit.js","sourceRoot":"","sources":["../../src/plugins/rateLimit.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAEhC,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAoB3D;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;CAiBxB,CAAC;AAEF,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,WAAmB,EAAE,aAAqB;IAC9E,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;QACpB,0EAA0E;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,GAAG,GAAG,IAAI,YAAY,EAAE,EAAE,CAAC;IAE1C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,CAC7B,gBAAgB,EAChB,CAAC,EACD,GAAG,EACH,aAAa,GAAG,IAAI,EACpB,GAAG,EACH,MAAM,EACN,WAAW,CACZ,CAAW,CAAC;QACb,OAAO,KAAK,GAAG,WAAW,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,+EAA+E;QAC/E,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAuB;IAC/C,OAAO,CACJ,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAY,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;QACrE,OAAO,CAAC,EAAE,CACX,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAAuB;IACnD,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC;AACnC,CAAC;AAED,+DAA+D;AAC/D,OAAO,EAAE,SAAS,EAAE,CAAC;AAErB,MAAM,UAAU,SAAS,CAAC,OAA+B;IACvD,OAAO,KAAK,UAAU,UAAU,CAAC,OAAuB,EAAE,KAAmB;QAC3E,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAClF,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,IAAK,OAAO,CAAC,IAA2C,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;QAC9G,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;QACjF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK;iBACT,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;iBACpD,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC,CAAC;QACnE,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAO,GAA2B,EAAE;IAClE,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,GAAG,CAAC;IAC/C,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;IAClD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAC;IAEhD,OAAO,KAAK,UAAU,SAAS,CAAC,OAAuB,EAAE,KAAmB;QAC1E,MAAM,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,GAAG,SAAS,IAAI,EAAE,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;QACjE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK;iBACT,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;iBAC5C,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAuD;IAClF,OAAO,KAAK,UAAU,UAAU,CAAC,OAAuB,EAAE,KAAmB;QAC3E,MAAM,QAAQ,GAAI,OAAO,CAAC,IAA2C,EAAE,SAAS,IAAI,WAAW,CAAC;QAChG,MAAM,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,OAAO,QAAQ,IAAI,EAAE,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;QACjF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK;iBACT,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;iBACpD,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,EAAE,KAAK,EAAE,iEAAiE,EAAE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,eAAe,EAAE,CAAC,KAAK,UAAU,eAAe,CAAC,GAAoB;IACnE,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QAChC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"rateLimit.js","sourceRoot":"","sources":["../../src/plugins/rateLimit.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAEhC,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAoB9D;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;CAiBxB,CAAC;AAEF,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,WAAmB,EAAE,aAAqB;IAC9E,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;QACpB,0EAA0E;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,GAAG,GAAG,IAAI,YAAY,EAAE,EAAE,CAAC;IAE1C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,CAC7B,gBAAgB,EAChB,CAAC,EACD,GAAG,EACH,aAAa,GAAG,IAAI,EACpB,GAAG,EACH,MAAM,EACN,WAAW,CACZ,CAAW,CAAC;QACb,OAAO,KAAK,GAAG,WAAW,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,+EAA+E;QAC/E,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,OAAuB;IAC/C,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,OAAO,EAAE,aAAa,EAAE,CAAC;AAEzB,+DAA+D;AAC/D,OAAO,EAAE,SAAS,EAAE,CAAC;AAErB,MAAM,UAAU,SAAS,CAAC,OAA+B;IACvD,OAAO,KAAK,UAAU,UAAU,CAAC,OAAuB,EAAE,KAAmB;QAC3E,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAClF,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,IAAK,OAAO,CAAC,IAA2C,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;QAC9G,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;QACjF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK;iBACT,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;iBACpD,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC,CAAC;QACnE,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAO,GAA2B,EAAE;IAClE,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,GAAG,CAAC;IAC/C,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;IAClD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAC;IAEhD,OAAO,KAAK,UAAU,SAAS,CAAC,OAAuB,EAAE,KAAmB;QAC1E,MAAM,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,GAAG,SAAS,IAAI,EAAE,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;QACjE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK;iBACT,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;iBAC5C,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAuD;IAClF,OAAO,KAAK,UAAU,UAAU,CAAC,OAAuB,EAAE,KAAmB;QAC3E,MAAM,QAAQ,GAAI,OAAO,CAAC,IAA2C,EAAE,SAAS,IAAI,WAAW,CAAC;QAChG,MAAM,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,OAAO,QAAQ,IAAI,EAAE,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;QACjF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK;iBACT,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;iBACpD,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,EAAE,KAAK,EAAE,iEAAiE,EAAE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,eAAe,EAAE,CAAC,KAAK,UAAU,eAAe,CAAC,GAAoB;IACnE,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QAChC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/repositories/application.d.ts

@@ -3,7 +3,7 @@ import type { ApplicationRepository, CreateApplicationInput, UpdateApplicationIn
 export declare class DrizzleApplicationRepository implements ApplicationRepository {
     private generateClientId;
     create(input: CreateApplicationInput): Promise<Application & {
-        clientSecret: string;
+        clientSecret: string | null;
     }>;
     findByClientId(clientId: string): Promise<Application | undefined>;
     listByOrgId(orgId: string): Promise<Application[]>;

package/dist/repositories/application.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"application.d.ts","sourceRoot":"","sources":["../../src/repositories/application.ts"],"names":[],"mappings":"AAGA,OAAO,EAAgB,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEjE,OAAO,KAAK,EACV,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB,qBAAa,4BAA6B,YAAW,qBAAqB;IACxE,OAAO,CAAC,gBAAgB;IAIlB,MAAM,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,WAAW,GAAG;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAc3F;IAEK,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAOvE;IAEK,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAEvD;IAEK,MAAM,CACV,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAOlC;IAEK,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAU3F;CACF"}
+{"version":3,"file":"application.d.ts","sourceRoot":"","sources":["../../src/repositories/application.ts"],"names":[],"mappings":"AAGA,OAAO,EAAgB,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEjE,OAAO,KAAK,EACV,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB,qBAAa,4BAA6B,YAAW,qBAAqB;IACxE,OAAO,CAAC,gBAAgB;IAIlB,MAAM,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,WAAW,GAAG;QAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAoBlG;IAEK,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAOvE;IAEK,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAEvD;IAEK,MAAM,CACV,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAOlC;IAEK,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAU3F;CACF"}

package/dist/repositories/application.js

@@ -8,13 +8,19 @@ export class DrizzleApplicationRepository {
         return `app_${crypto.randomBytes(16).toString("base64url")}`;
     }
     async create(input) {
-        const clientSecret = input.clientSecret || generateClientSecret();
+        // A public client is issued no secret at all, rather than a secret it is
+        // expected to ignore. Storing one would leave a credential in the database
+        // that appears to protect the client and does not.
+        const clientType = input.clientType ?? "confidential";
+        const clientSecret = clientType === "public" ? null : input.clientSecret || generateClientSecret();
         const [app] = await db
             .insert(applications)
             .values({
             orgId: input.orgId,
             clientId: input.clientId || this.generateClientId(),
-            clientSecretHash: hashClientSecret(clientSecret),
+            clientSecretHash: clientSecret ? hashClientSecret(clientSecret) : null,
+            clientType,
+            allowedScopes: input.allowedScopes ?? [],
             name: input.name,
             redirectUris: input.redirectUris ?? [],
             allowedOrigins: input.allowedOrigins ?? [],