@hilbras/keystone 2.5.0 → 3.0.0

package/dist/routes/sessions.js.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/routes/sessions.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAE/D,MAAM,QAAQ,GAAG,IAAI,iBAAiB,EAAE,CAAC;AAEzC,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,aAAa,CAAC,GAAoB;IAC9D,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,OAAuB,EAAE,EAAE;QACzF,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC/C,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACzB,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,iBAAiB,EAAE,CAAC,CAAC,iBAAiB;gBACtC,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,SAAS,EAAE,CAAC,CAAC,SAAS;aACvB,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,eAAe,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrH,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAEtE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,QAAQ,CAAC,kBAAkB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC1D,MAAM,QAAQ,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAEtC,MAAM,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAC1H,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAEtE,MAAM,mBAAmB,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAClE,IAAI,qBAAyC,CAAC;QAC9C,IAAI,mBAAmB,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,sBAAsB,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC,CAAC;YAClF,qBAAqB,GAAG,GAAG,EAAE,EAAE,CAAC;QAClC,CAAC;QAED,MAAM,QAAQ,CAAC,gBAAgB,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;QAC/D,MAAM,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,eAAe,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACxF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/routes/sessions.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAE/D,MAAM,QAAQ,GAAG,IAAI,iBAAiB,EAAE,CAAC;AAEzC,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,aAAa,CAAC,GAAoB;IAC9D,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,OAAuB,EAAE,EAAE;QAC7H,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC/C,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACzB,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,iBAAiB,EAAE,CAAC,CAAC,iBAAiB;gBACtC,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,SAAS,EAAE,CAAC,CAAC,SAAS;aACvB,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,eAAe,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAC3J,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAEtE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,QAAQ,CAAC,kBAAkB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC1D,MAAM,QAAQ,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAEtC,MAAM,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAChK,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAEtE,MAAM,mBAAmB,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAClE,IAAI,qBAAyC,CAAC;QAC9C,IAAI,mBAAmB,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,sBAAsB,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC,CAAC;YAClF,qBAAqB,GAAG,GAAG,EAAE,EAAE,CAAC;QAClC,CAAC;QAED,MAAM,QAAQ,CAAC,gBAAgB,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;QAC/D,MAAM,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,eAAe,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACxF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/routes/smsOtp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"smsOtp.d.ts","sourceRoot":"","sources":["../../src/routes/smsOtp.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAa7E,wBAA8B,YAAY,CAAC,GAAG,EAAE,eAAe,iBAoD9D"}
+{"version":3,"file":"smsOtp.d.ts","sourceRoot":"","sources":["../../src/routes/smsOtp.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAa7E,wBAA8B,YAAY,CAAC,GAAG,EAAE,eAAe,iBA8D9D"}

package/dist/routes/smsOtp.js

@@ -12,10 +12,15 @@ export default async function smsOtpRoutes(app) {
     app.post("/sms-otp/send", {
         preHandler: [
             app.authenticate,
+            // a machine has no phone. Placed after app.authenticate, which is what
+            // populates request.serviceAccount.
+            app.requireHumanPrincipal(),
             rateLimit({
                 keyPrefix: "sms-otp-send",
                 maxAttempts: 3,
                 windowSeconds: 300,
+                // A Redis outage must not remove the limit on an endpoint worth brute-forcing.
+                emergencyLocalLimit: true,
             }),
         ],
     }, async (request) => {
@@ -28,10 +33,15 @@ export default async function smsOtpRoutes(app) {
     app.post("/sms-otp/verify", {
         preHandler: [
             app.authenticate,
+            // a machine has no phone. Placed after app.authenticate, which is what
+            // populates request.serviceAccount.
+            app.requireHumanPrincipal(),
             rateLimit({
                 keyPrefix: "sms-otp-verify",
                 maxAttempts: 5,
                 windowSeconds: 300,
+                // A Redis outage must not remove the limit on an endpoint worth brute-forcing.
+                emergencyLocalLimit: true,
             }),
         ],
     }, async (request, reply) => {

package/dist/routes/smsOtp.js.map

@@ -1 +1 @@
-{"version":3,"file":"smsOtp.js","sourceRoot":"","sources":["../../src/routes/smsOtp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEpD,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CACvC,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACtC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC;AAEH,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,YAAY,CAAC,GAAoB;IAC7D,GAAG,CAAC,IAAI,CACN,eAAe,EACf;QACE,UAAU,EAAE;YACV,GAAG,CAAC,YAAY;YAChB,SAAS,CAAC;gBACR,SAAS,EAAE,cAAc;gBACzB,WAAW,EAAE,CAAC;gBACd,aAAa,EAAE,GAAG;aACnB,CAAC;SACH;KACF,EACD,KAAK,EAAE,OAAuB,EAAE,EAAE;QAChC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAE5C,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACzC,MAAM,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAExF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,iBAAiB,EACjB;QACE,UAAU,EAAE;YACV,GAAG,CAAC,YAAY;YAChB,SAAS,CAAC;gBACR,SAAS,EAAE,gBAAgB;gBAC3B,WAAW,EAAE,CAAC;gBACd,aAAa,EAAE,GAAG;aACnB,CAAC;SACH;KACF,EACD,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAE9C,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YAClE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACnD,MAAM,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAE5F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"smsOtp.js","sourceRoot":"","sources":["../../src/routes/smsOtp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEpD,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CACvC,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACtC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC;AAEH,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,YAAY,CAAC,GAAoB;IAC7D,GAAG,CAAC,IAAI,CACN,eAAe,EACf;QACE,UAAU,EAAE;YACV,GAAG,CAAC,YAAY;YAClB,uEAAuE;YACvE,oCAAoC;YACpC,GAAG,CAAC,qBAAqB,EAAE;YACzB,SAAS,CAAC;gBACR,SAAS,EAAE,cAAc;gBACzB,WAAW,EAAE,CAAC;gBACd,aAAa,EAAE,GAAG;gBAClB,+EAA+E;gBAC/E,mBAAmB,EAAE,IAAI;aAC1B,CAAC;SACH;KACF,EACD,KAAK,EAAE,OAAuB,EAAE,EAAE;QAChC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAE5C,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACzC,MAAM,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAExF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,iBAAiB,EACjB;QACE,UAAU,EAAE;YACV,GAAG,CAAC,YAAY;YAClB,uEAAuE;YACvE,oCAAoC;YACpC,GAAG,CAAC,qBAAqB,EAAE;YACzB,SAAS,CAAC;gBACR,SAAS,EAAE,gBAAgB;gBAC3B,WAAW,EAAE,CAAC;gBACd,aAAa,EAAE,GAAG;gBAClB,+EAA+E;gBAC/E,mBAAmB,EAAE,IAAI;aAC1B,CAAC;SACH;KACF,EACD,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAE9C,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YAClE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACnD,MAAM,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAE5F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/routes/totp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"totp.d.ts","sourceRoot":"","sources":["../../src/routes/totp.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAmC7E,wBAA8B,UAAU,CAAC,GAAG,EAAE,eAAe,iBAiM5D"}
+{"version":3,"file":"totp.d.ts","sourceRoot":"","sources":["../../src/routes/totp.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAoD7E,wBAA8B,UAAU,CAAC,GAAG,EAAE,eAAe,iBAgN5D"}

package/dist/routes/totp.js

@@ -17,9 +17,29 @@ const BackupCodeSchema = z.object({
     code: z.string().min(10).max(40),
 });
 /** Sensitive factor operations get their own budget, separate from login. */
-const factorRateLimit = (keyPrefix) => rateLimit({ keyPrefix, maxAttempts: 10, windowSeconds: 300 });
+/**
+ * Limit second-factor operations per user, not per address.
+ *
+ * These routes are authenticated, so the meaningful principal is the user doing
+ * the enrolment. Keying on the address alone meant everyone behind one NAT shared
+ * a single budget of 10, so an office or a mobile carrier's CGNAT range could
+ * exhaust it and lock legitimate users out of managing their own second factor.
+ * Brute-forcing a TOTP code is also per-account: the code is checked against one
+ * user's secret, so a per-user budget is exactly the right unit.
+ */
+const factorRateLimit = (keyPrefix) => rateLimit({
+    keyPrefix,
+    maxAttempts: 10,
+    windowSeconds: 300,
+    // A Redis outage must not remove the limit on an endpoint worth brute-forcing.
+    emergencyLocalLimit: true,
+    keyFrom: (request) => request.user?.id ?? request.ip,
+});
 export default async function totpRoutes(app) {
-    app.post("/totp/enroll", { preHandler: [app.authenticate, factorRateLimit("totp-enroll")] }, async (request, reply) => {
+    app.post("/totp/enroll", { preHandler: [app.authenticate,
+            // second-factor enrolment needs a person present. Placed after app.authenticate, which is what
+            // populates request.serviceAccount.
+            app.requireHumanPrincipal(), factorRateLimit("totp-enroll")] }, async (request, reply) => {
         const user = request.user;
         if (user.totpEnabled) {
             return reply.status(409).send({ error: "TOTP already enrolled" });
@@ -65,7 +85,10 @@ export default async function totpRoutes(app) {
      * Regenerate backup codes. Requires the current TOTP code so a hijacked
      * session cannot silently mint fresh recovery material.
      */
-    app.post("/totp/backup", { preHandler: [app.authenticate, factorRateLimit("totp-backup")] }, async (request, reply) => {
+    app.post("/totp/backup", { preHandler: [app.authenticate,
+            // backup codes are a human recovery path. Placed after app.authenticate, which is what
+            // populates request.serviceAccount.
+            app.requireHumanPrincipal(), factorRateLimit("totp-backup")] }, async (request, reply) => {
         const user = request.user;
         if (!user.totpSecret || !user.totpEnabled) {
             return reply.status(400).send({ error: "TOTP not enabled" });
@@ -89,7 +112,10 @@ export default async function totpRoutes(app) {
         await request.audit("mfa_backup_code_regenerated", { userId: user.id });
         return { backupCodes: codes };
     });
-    app.post("/totp/verify", { preHandler: [app.authenticate, factorRateLimit("totp-verify")] }, async (request, reply) => {
+    app.post("/totp/verify", { preHandler: [app.authenticate,
+            // a machine cannot present a code from its own authenticator. Placed after app.authenticate, which is what
+            // populates request.serviceAccount.
+            app.requireHumanPrincipal(), factorRateLimit("totp-verify")] }, async (request, reply) => {
         const user = request.user;
         if (!user.totpSecret) {
             return reply.status(400).send({ error: "TOTP not enrolled" });
@@ -121,7 +147,10 @@ export default async function totpRoutes(app) {
         await request.audit("totp_enabled", { userId: user.id });
         return { success: true, sessionsRevoked: true };
     });
-    app.post("/totp/disable", { preHandler: [app.authenticate, factorRateLimit("totp-disable")] }, async (request, reply) => {
+    app.post("/totp/disable", { preHandler: [app.authenticate,
+            // disabling a factor must not be automatable. Placed after app.authenticate, which is what
+            // populates request.serviceAccount.
+            app.requireHumanPrincipal(), factorRateLimit("totp-disable")] }, async (request, reply) => {
         const user = request.user;
         if (!user.totpSecret || !user.totpEnabled) {
             return reply.status(400).send({ error: "TOTP not enabled" });
@@ -150,7 +179,10 @@ export default async function totpRoutes(app) {
      * Verify a backup code out of band (e.g. account recovery tooling). This
      * never establishes a session; login completes through /auth/mfa/verify.
      */
-    app.post("/totp/backup/verify", { preHandler: [app.authenticate, factorRateLimit("totp-backup-verify")] }, async (request, reply) => {
+    app.post("/totp/backup/verify", { preHandler: [app.authenticate,
+            // a machine cannot present a backup code. Placed after app.authenticate, which is what
+            // populates request.serviceAccount.
+            app.requireHumanPrincipal(), factorRateLimit("totp-backup-verify")] }, async (request, reply) => {
         const user = request.user;
         if (!user.totpSecret || !user.totpEnabled) {
             return reply.status(400).send({ error: "TOTP not enabled" });

package/dist/routes/totp.js.map

@@ -1 +1 @@
-{"version":3,"file":"totp.js","sourceRoot":"","sources":["../../src/routes/totp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAE7B,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,wCAAwC,CAAC;IAC9E,2EAA2E;IAC3E,qEAAqE;IACrE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACrC,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CACjC,CAAC,CAAC;AAEH,6EAA6E;AAC7E,MAAM,eAAe,GAAG,CAAC,SAAiB,EAAE,EAAE,CAC5C,SAAS,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC;AAEhE,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,UAAU,CAAC,GAAoB;IAC3D,GAAG,CAAC,IAAI,CACN,cAAc,EACd,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC,aAAa,CAAC,CAAC,EAAE,EAClE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,uEAAuE;QACvE,wCAAwC;QACxC,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjG,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;YACtF,OAAO,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAM,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;gBACxD,KAAK,EAAE,MAAM,CAAC,KAAM,CAAC,OAAO;gBAC5B,IAAI,EAAE,MAAM,CAAC,KAAM,CAAC,IAAI;aACzB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,mBAAmB,EAAE,CAAC;QAEhD,2EAA2E;QAC3E,mCAAmC;QACnC,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YACrE,MAAM,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACxE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,wBAAwB,CAAC,CAAC;YACrD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,eAAe,GAAG,oBAAoB,CAAC;YAC3C,MAAM;YACN,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,MAAM,CAAC,WAAW;SAC3B,CAAC,CAAC;QAEH,MAAM,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAE1D,OAAO;YACL,MAAM;YACN,eAAe;YACf,WAAW,EAAE,KAAK;SACnB,CAAC;IACJ,CAAC,CACF,CAAC;IAEF;;;OAGG;IACH,GAAG,CAAC,IAAI,CACN,cAAc,EACd,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC,aAAa,CAAC,CAAC,EAAE,EAClE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAE5C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjG,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC5F,OAAO,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAM,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;gBACxD,KAAK,EAAE,MAAM,CAAC,KAAM,CAAC,OAAO;gBAC5B,IAAI,EAAE,MAAM,CAAC,KAAM,CAAC,IAAI;aACzB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACpB,MAAM,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YAC/E,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,mBAAmB,EAAE,CAAC;QAChD,MAAM,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACxC,MAAM,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAExE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IAChC,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,cAAc,EACd,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC,aAAa,CAAC,CAAC,EAAE,EAClE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAE5C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjG,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;YACtF,OAAO,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAM,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;gBACxD,KAAK,EAAE,MAAM,CAAC,KAAM,CAAC,OAAO;gBAC5B,IAAI,EAAE,MAAM,CAAC,KAAM,CAAC,IAAI;aACzB,CAAC,CAAC;QACL,CAAC;QAED,wEAAwE;QACxE,sEAAsE;QACtE,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;YACzD,cAAc,EAAE,KAAK;SACtB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACpB,MAAM,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/D,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEvD,qEAAqE;QACrE,yEAAyE;QACzE,oEAAoE;QACpE,MAAM,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClC,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;QAEzF,MAAM,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAEzD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;IAClD,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,eAAe,EACf,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC,cAAc,CAAC,CAAC,EAAE,EACnE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAE5C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjG,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;YACvF,OAAO,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAM,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;gBACxD,KAAK,EAAE,MAAM,CAAC,KAAM,CAAC,OAAO;gBAC5B,IAAI,EAAE,MAAM,CAAC,KAAM,CAAC,IAAI;aACzB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACpB,MAAM,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YAChE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxD,6DAA6D;QAC7D,MAAM,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAE1D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CACF,CAAC;IAEF;;;OAGG;IACH,GAAG,CAAC,IAAI,CACN,qBAAqB,EACrB,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC,oBAAoB,CAAC,CAAC,EAAE,EACzE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;YACtF,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC;IACtD,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"totp.js","sourceRoot":"","sources":["../../src/routes/totp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAE7B,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,wCAAwC,CAAC;IAC9E,2EAA2E;IAC3E,qEAAqE;IACrE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACrC,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CACjC,CAAC,CAAC;AAEH,6EAA6E;AAC7E;;;;;;;;;GASG;AACH,MAAM,eAAe,GAAG,CAAC,SAAiB,EAAE,EAAE,CAC5C,SAAS,CAAC;IACR,SAAS;IACT,WAAW,EAAE,EAAE;IACf,aAAa,EAAE,GAAG;IAClB,+EAA+E;IAC/E,mBAAmB,EAAE,IAAI;IACzB,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,OAAO,CAAC,EAAE;CACrD,CAAC,CAAC;AAEL,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,UAAU,CAAC,GAAoB;IAC3D,GAAG,CAAC,IAAI,CACN,cAAc,EACd,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY;YAC7B,+FAA+F;YAC/F,oCAAoC;YACpC,GAAG,CAAC,qBAAqB,EAAE,EAAE,eAAe,CAAC,aAAa,CAAC,CAAC,EAAE,EAChE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,uEAAuE;QACvE,wCAAwC;QACxC,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjG,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;YACtF,OAAO,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAM,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;gBACxD,KAAK,EAAE,MAAM,CAAC,KAAM,CAAC,OAAO;gBAC5B,IAAI,EAAE,MAAM,CAAC,KAAM,CAAC,IAAI;aACzB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,mBAAmB,EAAE,CAAC;QAEhD,2EAA2E;QAC3E,mCAAmC;QACnC,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YACrE,MAAM,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACxE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,wBAAwB,CAAC,CAAC;YACrD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,eAAe,GAAG,oBAAoB,CAAC;YAC3C,MAAM;YACN,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,MAAM,CAAC,WAAW;SAC3B,CAAC,CAAC;QAEH,MAAM,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAE1D,OAAO;YACL,MAAM;YACN,eAAe;YACf,WAAW,EAAE,KAAK;SACnB,CAAC;IACJ,CAAC,CACF,CAAC;IAEF;;;OAGG;IACH,GAAG,CAAC,IAAI,CACN,cAAc,EACd,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY;YAC7B,uFAAuF;YACvF,oCAAoC;YACpC,GAAG,CAAC,qBAAqB,EAAE,EAAE,eAAe,CAAC,aAAa,CAAC,CAAC,EAAE,EAChE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAE5C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjG,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC5F,OAAO,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAM,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;gBACxD,KAAK,EAAE,MAAM,CAAC,KAAM,CAAC,OAAO;gBAC5B,IAAI,EAAE,MAAM,CAAC,KAAM,CAAC,IAAI;aACzB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACpB,MAAM,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YAC/E,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,mBAAmB,EAAE,CAAC;QAChD,MAAM,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACxC,MAAM,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAExE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IAChC,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,cAAc,EACd,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY;YAC7B,2GAA2G;YAC3G,oCAAoC;YACpC,GAAG,CAAC,qBAAqB,EAAE,EAAE,eAAe,CAAC,aAAa,CAAC,CAAC,EAAE,EAChE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAE5C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjG,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;YACtF,OAAO,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAM,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;gBACxD,KAAK,EAAE,MAAM,CAAC,KAAM,CAAC,OAAO;gBAC5B,IAAI,EAAE,MAAM,CAAC,KAAM,CAAC,IAAI;aACzB,CAAC,CAAC;QACL,CAAC;QAED,wEAAwE;QACxE,sEAAsE;QACtE,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;YACzD,cAAc,EAAE,KAAK;SACtB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACpB,MAAM,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/D,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEvD,qEAAqE;QACrE,yEAAyE;QACzE,oEAAoE;QACpE,MAAM,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClC,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;QAEzF,MAAM,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAEzD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;IAClD,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,eAAe,EACf,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY;YAC7B,2FAA2F;YAC3F,oCAAoC;YACpC,GAAG,CAAC,qBAAqB,EAAE,EAAE,eAAe,CAAC,cAAc,CAAC,CAAC,EAAE,EACjE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAE5C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjG,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;YACvF,OAAO,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAM,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;gBACxD,KAAK,EAAE,MAAM,CAAC,KAAM,CAAC,OAAO;gBAC5B,IAAI,EAAE,MAAM,CAAC,KAAM,CAAC,IAAI;aACzB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACpB,MAAM,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YAChE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxD,6DAA6D;QAC7D,MAAM,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAE1D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CACF,CAAC;IAEF;;;OAGG;IACH,GAAG,CAAC,IAAI,CACN,qBAAqB,EACrB,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY;YAC7B,uFAAuF;YACvF,oCAAoC;YACpC,GAAG,CAAC,qBAAqB,EAAE,EAAE,eAAe,CAAC,oBAAoB,CAAC,CAAC,EAAE,EACvE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;YACtF,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC;IACtD,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/routes/webauthn.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webauthn.d.ts","sourceRoot":"","sources":["../../src/routes/webauthn.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAsD7E,wBAA8B,cAAc,CAAC,GAAG,EAAE,eAAe,iBAuIhE"}
+{"version":3,"file":"webauthn.d.ts","sourceRoot":"","sources":["../../src/routes/webauthn.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAsD7E,wBAA8B,cAAc,CAAC,GAAG,EAAE,eAAe,iBA6IhE"}

package/dist/routes/webauthn.js

@@ -36,13 +36,19 @@ const AuthenticateVerifySchema = z.object({
     response: z.record(z.string(), z.unknown()),
 });
 export default async function webauthnRoutes(app) {
-    app.get("/webauthn/register/options", { preHandler: [app.authenticate] }, async (request, reply) => {
+    app.get("/webauthn/register/options", { preHandler: [app.authenticate,
+            // a machine has no authenticator. Placed after app.authenticate, which is what
+            // populates request.serviceAccount.
+            app.requireHumanPrincipal()] }, async (request, reply) => {
         const user = request.user;
         const options = await buildRegistrationOptions(user);
         setChallengeCookie(reply, options.challenge);
         return options;
     });
-    app.post("/webauthn/register/verify", { preHandler: [app.authenticate] }, async (request, reply) => {
+    app.post("/webauthn/register/verify", { preHandler: [app.authenticate,
+            // a machine cannot complete a WebAuthn ceremony. Placed after app.authenticate, which is what
+            // populates request.serviceAccount.
+            app.requireHumanPrincipal()] }, async (request, reply) => {
         const user = request.user;
         const body = RegisterVerifySchema.parse(request.body);
         if (user.totpEnabled) {

package/dist/routes/webauthn.js.map

@@ -1 +1 @@
-{"version":3,"file":"webauthn.js","sourceRoot":"","sources":["../../src/routes/webauthn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAMtC,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,0BAA0B,EAC1B,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,mBAAmB,GAAG,6BAA6B,CAAC;AAE1D,SAAS,kBAAkB,CAAC,KAAmB,EAAE,SAAiB;IAChE,KAAK,CAAC,SAAS,CAAC,mBAAmB,EAAE,SAAS,EAAE;QAC9C,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,MAAM,CAAC,aAAa;QAC5B,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,GAAG;KACZ,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAuB;IACjD,OAAO,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAmB;IAC/C,KAAK,CAAC,WAAW,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC1C,wEAAwE;IACxE,uEAAuE;IACvE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAEH,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAEH,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;CAC5C,CAAC,CAAC;AAEH,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,cAAc,CAAC,GAAoB;IAC/D,GAAG,CAAC,GAAG,CACL,4BAA4B,EAC5B,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAClC,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACrD,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC7C,OAAO,OAAO,CAAC;IACjB,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,2BAA2B,EAC3B,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAClC,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEtD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,EACvC,IAAI,EACJ,IAAI,CAAC,QAAQ,CACd,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,MAAM,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBAC5F,OAAO,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAM,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;oBACxD,KAAK,EAAE,MAAM,CAAC,KAAM,CAAC,OAAO;oBAC5B,IAAI,EAAE,MAAM,CAAC,KAAM,CAAC,IAAI;iBACzB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;YACzC,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,0BAA0B,CAC9B,IAAI,EACJ,IAAI,CAAC,QAA+C,EACpD,SAAS,EACT,IAAI,CAAC,UAAU,CAChB,CAAC;YACF,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAC5B,MAAM,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YAChE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC;YAC3E,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CAAC,gCAAgC,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAChG,MAAM,IAAI,GAAG,yBAAyB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7D,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC7C,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,+BAA+B,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAC/F,MAAM,IAAI,GAAG,wBAAwB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,SAAS,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,MAAM,oBAAoB,CACjE,IAAI,CAAC,QAAiD,EACtD,SAAS,CACV,CAAC;YACF,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAE5B,oEAAoE;YACpE,sEAAsE;YACtE,8DAA8D;YAC9D,MAAM,iBAAiB,GACrB,IAAI,CAAC,WAAW;gBAChB,CAAC,CAAC,IAAI,CAAC,cAAc;gBACrB,sBAAsB,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;YAEnE,IAAI,iBAAiB,EAAE,CAAC;gBACtB,MAAM,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;gBAC9F,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBAC5B,KAAK,EACH,qHAAqH;oBACvH,IAAI,EAAE,cAAc;iBACrB,CAAC,CAAC;YACL,CAAC;YAED,MAAM,WAAW,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;YACpD,MAAM,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;YACpF,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC,IAAI,EACJ,OAAO,CAAC,EAAE,EACV,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;YAC7B,+DAA+D;YAC/D,EAAE,SAAS,EAAE,UAAU,EAAE,EACzB,WAAW,CACZ,CAAC;YACF,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;YAElE,MAAM,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACnE,OAAO;gBACL,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC;gBACtB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;aAClC,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,gBAAgB,EAAE,CAAC;gBACpC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBAC5B,KAAK,EAAE,2DAA2D;oBAClE,IAAI,EAAE,cAAc;iBACrB,CAAC,CAAC;YACL,CAAC;YACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC;YAC7E,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"webauthn.js","sourceRoot":"","sources":["../../src/routes/webauthn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAMtC,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,0BAA0B,EAC1B,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,mBAAmB,GAAG,6BAA6B,CAAC;AAE1D,SAAS,kBAAkB,CAAC,KAAmB,EAAE,SAAiB;IAChE,KAAK,CAAC,SAAS,CAAC,mBAAmB,EAAE,SAAS,EAAE;QAC9C,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,MAAM,CAAC,aAAa;QAC5B,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,GAAG;KACZ,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAuB;IACjD,OAAO,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAmB;IAC/C,KAAK,CAAC,WAAW,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC1C,wEAAwE;IACxE,uEAAuE;IACvE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAEH,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAEH,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;CAC5C,CAAC,CAAC;AAEH,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,cAAc,CAAC,GAAoB;IAC/D,GAAG,CAAC,GAAG,CACL,4BAA4B,EAC5B,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY;YAC7B,+EAA+E;YAC/E,oCAAoC;YACpC,GAAG,CAAC,qBAAqB,EAAE,CAAC,EAAE,EAChC,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACrD,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC7C,OAAO,OAAO,CAAC;IACjB,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,2BAA2B,EAC3B,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY;YAC7B,8FAA8F;YAC9F,oCAAoC;YACpC,GAAG,CAAC,qBAAqB,EAAE,CAAC,EAAE,EAChC,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEtD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,EACvC,IAAI,EACJ,IAAI,CAAC,QAAQ,CACd,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,MAAM,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBAC5F,OAAO,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAM,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;oBACxD,KAAK,EAAE,MAAM,CAAC,KAAM,CAAC,OAAO;oBAC5B,IAAI,EAAE,MAAM,CAAC,KAAM,CAAC,IAAI;iBACzB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;YACzC,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,0BAA0B,CAC9B,IAAI,EACJ,IAAI,CAAC,QAA+C,EACpD,SAAS,EACT,IAAI,CAAC,UAAU,CAChB,CAAC;YACF,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAC5B,MAAM,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YAChE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC;YAC3E,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CAAC,gCAAgC,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAChG,MAAM,IAAI,GAAG,yBAAyB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7D,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC7C,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,+BAA+B,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAC/F,MAAM,IAAI,GAAG,wBAAwB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,SAAS,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,MAAM,oBAAoB,CACjE,IAAI,CAAC,QAAiD,EACtD,SAAS,CACV,CAAC;YACF,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAE5B,oEAAoE;YACpE,sEAAsE;YACtE,8DAA8D;YAC9D,MAAM,iBAAiB,GACrB,IAAI,CAAC,WAAW;gBAChB,CAAC,CAAC,IAAI,CAAC,cAAc;gBACrB,sBAAsB,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;YAEnE,IAAI,iBAAiB,EAAE,CAAC;gBACtB,MAAM,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;gBAC9F,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBAC5B,KAAK,EACH,qHAAqH;oBACvH,IAAI,EAAE,cAAc;iBACrB,CAAC,CAAC;YACL,CAAC;YAED,MAAM,WAAW,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;YACpD,MAAM,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;YACpF,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC,IAAI,EACJ,OAAO,CAAC,EAAE,EACV,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;YAC7B,+DAA+D;YAC/D,EAAE,SAAS,EAAE,UAAU,EAAE,EACzB,WAAW,CACZ,CAAC;YACF,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;YAElE,MAAM,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACnE,OAAO;gBACL,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC;gBACtB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;aAClC,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,gBAAgB,EAAE,CAAC;gBACpC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBAC5B,KAAK,EAAE,2DAA2D;oBAClE,IAAI,EAAE,cAAc;iBACrB,CAAC,CAAC;YACL,CAAC;YACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC;YAC7E,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/services/configuration/profiles.d.ts

@@ -1,6 +1,32 @@
 export declare const REDACTED_CONFIG_VALUE = "[redacted]";
+/**
+ * Configuration keys whose *values* may be returned by the admin configuration
+ * endpoint.
+ *
+ * This is an allowlist on purpose. The previous implementation was a denylist --
+ * a set of known-sensitive names plus a regex -- and it missed 12 of 24
+ * secret-looking keys, including SIGNING_KEY, JWT_SIGNING_KEY, SENDGRID_KEY,
+ * SAML_CERT, HMAC_KEY, KMS_KEY and DB_URL. A denylist is a losing game here: the
+ * next person to add a secret-bearing variable leaks it, and nothing fails.
+ *
+ * An allowlist inverts the default. A new key is private until someone
+ * deliberately decides otherwise, so forgetting has privacy as its failure mode
+ * rather than disclosure.
+ */
+export declare const EXPOSABLE_CONFIG_KEYS: Set<string>;
 export declare function isSensitiveConfigurationKey(key: string): boolean;
+/**
+ * Mask every value that is not on the exposable allowlist.
+ *
+ * The mask is a fixed marker, not a partial reveal. A prefix would let someone
+ * confirm a guessed secret, and a length would leak entropy.
+ */
 export declare function redactConfigurationValues(values: Record<string, string | undefined>): Record<string, string>;
+/**
+ * Whether a key's value may be exposed. The inverse question to
+ * `isSensitiveConfigurationKey`, and the one the read path must ask.
+ */
+export declare function isExposableConfigurationKey(key: string): boolean;
 export declare function mergeConfigurationUpdates(existing: Record<string, string | undefined>, updates: Record<string, string>): Record<string, string>;
 export interface ConfigurationProfile {
     name: string;

package/dist/services/configuration/profiles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"profiles.d.ts","sourceRoot":"","sources":["../../../src/services/configuration/profiles.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,qBAAqB,eAAe,CAAC;AA0BlD,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAMhE;AAED,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAM5G;AAED,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EAC5C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAaxB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAgGvE,CAAC;AAEF,wBAAgB,yBAAyB,IAAI,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CAMpG;AAED,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,MAAM,GAAG,oBAAoB,GAAG,SAAS,CAEpF"}
+{"version":3,"file":"profiles.d.ts","sourceRoot":"","sources":["../../../src/services/configuration/profiles.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,qBAAqB,eAAe,CAAC;AAElD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qBAAqB,aA0ChC,CAAC;AAgCH,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAMhE;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAS5G;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEhE;AAED,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EAC5C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAaxB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAgGvE,CAAC;AAEF,wBAAgB,yBAAyB,IAAI,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CAMpG;AAED,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,MAAM,GAAG,oBAAoB,GAAG,SAAS,CAEpF"}

package/dist/services/configuration/profiles.js

@@ -1,4 +1,67 @@
 export const REDACTED_CONFIG_VALUE = "[redacted]";
+/**
+ * Configuration keys whose *values* may be returned by the admin configuration
+ * endpoint.
+ *
+ * This is an allowlist on purpose. The previous implementation was a denylist --
+ * a set of known-sensitive names plus a regex -- and it missed 12 of 24
+ * secret-looking keys, including SIGNING_KEY, JWT_SIGNING_KEY, SENDGRID_KEY,
+ * SAML_CERT, HMAC_KEY, KMS_KEY and DB_URL. A denylist is a losing game here: the
+ * next person to add a secret-bearing variable leaks it, and nothing fails.
+ *
+ * An allowlist inverts the default. A new key is private until someone
+ * deliberately decides otherwise, so forgetting has privacy as its failure mode
+ * rather than disclosure.
+ */
+export const EXPOSABLE_CONFIG_KEYS = new Set([
+    // Deployment shape. None of these are credentials.
+    "NODE_ENV",
+    "PORT",
+    "HOST",
+    "LOG_LEVEL",
+    "PUBLIC_URL",
+    "CLIENT_APP_URL",
+    "SETUP_TOKEN_URL",
+    "RESET_PASSWORD_URL",
+    "ALLOWED_ORIGINS",
+    "COOKIE_DOMAIN",
+    "COOKIE_SECURE",
+    "COOKIE_SAME_SITE",
+    "KEYSTONE_TRUSTED_PROXIES",
+    // Feature switches and limits.
+    "KEYSTONE_SETUP_MODE",
+    "KEYSTONE_FEATURE_FLAGS",
+    "KEYSTONE_QUEUE_PROVIDER",
+    "KEYSTONE_SECRETS_PROVIDER",
+    "KEYSTONE_PLUGINS",
+    "HIBP_CHECK_ENABLED",
+    "MFA_CHALLENGE_TTL_SECONDS",
+    "MFA_MAX_ATTEMPTS",
+    "TOTP_BACKUP_CODE_TTL_SECONDS",
+    "MAGIC_LINK_TTL_SECONDS",
+    "ACCESS_TOKEN_TTL_SECONDS",
+    "REFRESH_TOKEN_TTL_SECONDS",
+    "SCIM_ROTATION_GRACE_SECONDS",
+    "SCIM_RATE_LIMIT_MAX",
+    "SCIM_RATE_LIMIT_WINDOW_SECONDS",
+    "SCIM_AUTH_FAILURE_MAX",
+    "SCIM_AUTH_FAILURE_WINDOW_SECONDS",
+    // Feature presence. Deliberately presence-only, never the value.
+    "SMTP_HOST",
+    "SMTP_PORT",
+    "SMTP_FROM",
+    "SMTP_SECURE",
+    "TWILIO_ACCOUNT_SID",
+    "SENDGRID_FROM",
+    "METRICS_ENABLED",
+    "OTEL_EXPORTER_OTLP_ENDPOINT",
+]);
+/**
+ * Whether a key names something that must never be echoed back.
+ *
+ * Retained for the write path, where a client may legitimately send a sensitive
+ * value that has to be recognised as "preserve this, do not overwrite it".
+ */
 const SENSITIVE_CONFIG_KEYS = new Set([
     "DATABASE_URL",
     "REDIS_URL",
@@ -27,10 +90,26 @@ export function isSensitiveConfigurationKey(key) {
     return (SENSITIVE_CONFIG_KEYS.has(normalized) ||
         /(SECRET|TOKEN|PASSWORD|PASS|PAT|PRIVATE_KEY|API_KEY|CREDENTIAL|AUTHORIZATION|DATABASE_URL|REDIS_URL|ENCRYPTION_KEY)/.test(normalized));
 }
+/**
+ * Mask every value that is not on the exposable allowlist.
+ *
+ * The mask is a fixed marker, not a partial reveal. A prefix would let someone
+ * confirm a guessed secret, and a length would leak entropy.
+ */
 export function redactConfigurationValues(values) {
     return Object.fromEntries(Object.entries(values)
         .filter((entry) => entry[1] !== undefined)
-        .map(([key, value]) => [key, isSensitiveConfigurationKey(key) ? REDACTED_CONFIG_VALUE : value]));
+        .map(([key, value]) => [
+        key,
+        EXPOSABLE_CONFIG_KEYS.has(key.toUpperCase()) ? value : REDACTED_CONFIG_VALUE,
+    ]));
+}
+/**
+ * Whether a key's value may be exposed. The inverse question to
+ * `isSensitiveConfigurationKey`, and the one the read path must ask.
+ */
+export function isExposableConfigurationKey(key) {
+    return EXPOSABLE_CONFIG_KEYS.has(key.toUpperCase());
 }
 export function mergeConfigurationUpdates(existing, updates) {
     const merged = {};

package/dist/services/configuration/profiles.js.map

@@ -1 +1 @@
-{"version":3,"file":"profiles.js","sourceRoot":"","sources":["../../../src/services/configuration/profiles.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,qBAAqB,GAAG,YAAY,CAAC;AAElD,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,cAAc;IACd,WAAW;IACX,WAAW;IACX,eAAe;IACf,+BAA+B;IAC/B,qBAAqB;IACrB,uBAAuB;IACvB,iBAAiB;IACjB,gBAAgB;IAChB,yBAAyB;IACzB,8BAA8B;IAC9B,2BAA2B;IAC3B,0BAA0B;IAC1B,kBAAkB;IAClB,iBAAiB;IACjB,mBAAmB;IACnB,wBAAwB;IACxB,iCAAiC;IACjC,8BAA8B;IAC9B,0BAA0B;IAC1B,0BAA0B;CAC3B,CAAC,CAAC;AAEH,MAAM,UAAU,2BAA2B,CAAC,GAAW;IACrD,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IACrC,OAAO,CACL,qBAAqB,CAAC,GAAG,CAAC,UAAU,CAAC;QACrC,qHAAqH,CAAC,IAAI,CAAC,UAAU,CAAC,CACvI,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,MAA0C;IAClF,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;SACnB,MAAM,CAAC,CAAC,KAAK,EAA6B,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC;SACpE,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAClG,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,QAA4C,EAC5C,OAA+B;IAE/B,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC/C,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,KAAK,KAAK,qBAAqB,EAAE,CAAC;YACpC,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,GAAG,EAAE,CAAC,CAAC;YAClG,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAQD,MAAM,CAAC,MAAM,sBAAsB,GAAyC;IAC1E,WAAW,EAAE;QACX,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,qEAAqE;QAClF,MAAM,EAAE;YACN,QAAQ,EAAE,aAAa;YACvB,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,SAAS;YACf,YAAY,EAAE,qDAAqD;YACnE,SAAS,EAAE,wBAAwB;YACnC,uBAAuB,EAAE,YAAY;YACrC,yBAAyB,EAAE,UAAU;YACrC,cAAc,EAAE,SAAS;YACzB,YAAY,EAAE,MAAM;YACpB,oBAAoB,EAAE,MAAM;YAC5B,sBAAsB,EAAE,gCAAgC;SACzD;KACF;IACD,UAAU,EAAE;QACV,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,sEAAsE;QACnF,MAAM,EAAE;YACN,QAAQ,EAAE,YAAY;YACtB,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,SAAS;YACf,uBAAuB,EAAE,QAAQ;YACjC,yBAAyB,EAAE,UAAU;YACrC,cAAc,EAAE,MAAM;YACtB,YAAY,EAAE,QAAQ;YACtB,oBAAoB,EAAE,OAAO;YAC7B,sBAAsB,EAAE,gBAAgB;SACzC;KACF;IACD,MAAM,EAAE;QACN,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,uEAAuE;QACpF,MAAM,EAAE;YACN,QAAQ,EAAE,YAAY;YACtB,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,SAAS;YACf,YAAY,EAAE,oDAAoD;YAClE,SAAS,EAAE,oBAAoB;YAC/B,uBAAuB,EAAE,QAAQ;YACjC,yBAAyB,EAAE,UAAU;YACrC,cAAc,EAAE,MAAM;YACtB,YAAY,EAAE,MAAM;YACpB,oBAAoB,EAAE,OAAO;SAC9B;KACF;IACD,gBAAgB,EAAE;QAChB,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,8CAA8C;QAC3D,MAAM,EAAE;YACN,QAAQ,EAAE,YAAY;YACtB,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,SAAS;YACf,YAAY,EAAE,oDAAoD;YAClE,SAAS,EAAE,oBAAoB;YAC/B,uBAAuB,EAAE,QAAQ;YACjC,yBAAyB,EAAE,UAAU;YACrC,cAAc,EAAE,MAAM;YACtB,YAAY,EAAE,MAAM;YACpB,oBAAoB,EAAE,OAAO;YAC7B,oBAAoB,EAAE,MAAM;SAC7B;KACF;IACD,UAAU,EAAE;QACV,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,2DAA2D;QACxE,MAAM,EAAE;YACN,QAAQ,EAAE,YAAY;YACtB,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,SAAS;YACf,uBAAuB,EAAE,QAAQ;YACjC,yBAAyB,EAAE,aAAa;YACxC,cAAc,EAAE,MAAM;YACtB,YAAY,EAAE,QAAQ;YACtB,oBAAoB,EAAE,OAAO;YAC7B,oBAAoB,EAAE,MAAM;SAC7B;KACF;IACD,mBAAmB,EAAE;QACnB,IAAI,EAAE,mBAAmB;QACzB,WAAW,EAAE,yEAAyE;QACtF,MAAM,EAAE;YACN,QAAQ,EAAE,YAAY;YACtB,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,SAAS;YACf,uBAAuB,EAAE,QAAQ;YACjC,yBAAyB,EAAE,aAAa;YACxC,cAAc,EAAE,MAAM;YACtB,YAAY,EAAE,QAAQ;YACtB,oBAAoB,EAAE,OAAO;YAC7B,sBAAsB,EAAE,oCAAoC;SAC7D;KACF;CACF,CAAC;AAEF,MAAM,UAAU,yBAAyB;IACvC,OAAO,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACpE,EAAE;QACF,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,EAAU;IAChD,OAAO,sBAAsB,CAAC,EAAE,CAAC,CAAC;AACpC,CAAC"}
+{"version":3,"file":"profiles.js","sourceRoot":"","sources":["../../../src/services/configuration/profiles.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,qBAAqB,GAAG,YAAY,CAAC;AAElD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IAC3C,mDAAmD;IACnD,UAAU;IACV,MAAM;IACN,MAAM;IACN,WAAW;IACX,YAAY;IACZ,gBAAgB;IAChB,iBAAiB;IACjB,oBAAoB;IACpB,iBAAiB;IACjB,eAAe;IACf,eAAe;IACf,kBAAkB;IAClB,0BAA0B;IAC1B,+BAA+B;IAC/B,qBAAqB;IACrB,wBAAwB;IACxB,yBAAyB;IACzB,2BAA2B;IAC3B,kBAAkB;IAClB,oBAAoB;IACpB,2BAA2B;IAC3B,kBAAkB;IAClB,8BAA8B;IAC9B,wBAAwB;IACxB,0BAA0B;IAC1B,2BAA2B;IAC3B,6BAA6B;IAC7B,qBAAqB;IACrB,gCAAgC;IAChC,uBAAuB;IACvB,kCAAkC;IAClC,iEAAiE;IACjE,WAAW;IACX,WAAW;IACX,WAAW;IACX,aAAa;IACb,oBAAoB;IACpB,eAAe;IACf,iBAAiB;IACjB,6BAA6B;CAC9B,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,cAAc;IACd,WAAW;IACX,WAAW;IACX,eAAe;IACf,+BAA+B;IAC/B,qBAAqB;IACrB,uBAAuB;IACvB,iBAAiB;IACjB,gBAAgB;IAChB,yBAAyB;IACzB,8BAA8B;IAC9B,2BAA2B;IAC3B,0BAA0B;IAC1B,kBAAkB;IAClB,iBAAiB;IACjB,mBAAmB;IACnB,wBAAwB;IACxB,iCAAiC;IACjC,8BAA8B;IAC9B,0BAA0B;IAC1B,0BAA0B;CAC3B,CAAC,CAAC;AAEH,MAAM,UAAU,2BAA2B,CAAC,GAAW;IACrD,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IACrC,OAAO,CACL,qBAAqB,CAAC,GAAG,CAAC,UAAU,CAAC;QACrC,qHAAqH,CAAC,IAAI,CAAC,UAAU,CAAC,CACvI,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAA0C;IAClF,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;SACnB,MAAM,CAAC,CAAC,KAAK,EAA6B,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC;SACpE,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QACrB,GAAG;QACH,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,qBAAqB;KAC7E,CAAC,CACL,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,GAAW;IACrD,OAAO,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,QAA4C,EAC5C,OAA+B;IAE/B,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC/C,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,KAAK,KAAK,qBAAqB,EAAE,CAAC;YACpC,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,GAAG,EAAE,CAAC,CAAC;YAClG,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAQD,MAAM,CAAC,MAAM,sBAAsB,GAAyC;IAC1E,WAAW,EAAE;QACX,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,qEAAqE;QAClF,MAAM,EAAE;YACN,QAAQ,EAAE,aAAa;YACvB,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,SAAS;YACf,YAAY,EAAE,qDAAqD;YACnE,SAAS,EAAE,wBAAwB;YACnC,uBAAuB,EAAE,YAAY;YACrC,yBAAyB,EAAE,UAAU;YACrC,cAAc,EAAE,SAAS;YACzB,YAAY,EAAE,MAAM;YACpB,oBAAoB,EAAE,MAAM;YAC5B,sBAAsB,EAAE,gCAAgC;SACzD;KACF;IACD,UAAU,EAAE;QACV,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,sEAAsE;QACnF,MAAM,EAAE;YACN,QAAQ,EAAE,YAAY;YACtB,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,SAAS;YACf,uBAAuB,EAAE,QAAQ;YACjC,yBAAyB,EAAE,UAAU;YACrC,cAAc,EAAE,MAAM;YACtB,YAAY,EAAE,QAAQ;YACtB,oBAAoB,EAAE,OAAO;YAC7B,sBAAsB,EAAE,gBAAgB;SACzC;KACF;IACD,MAAM,EAAE;QACN,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,uEAAuE;QACpF,MAAM,EAAE;YACN,QAAQ,EAAE,YAAY;YACtB,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,SAAS;YACf,YAAY,EAAE,oDAAoD;YAClE,SAAS,EAAE,oBAAoB;YAC/B,uBAAuB,EAAE,QAAQ;YACjC,yBAAyB,EAAE,UAAU;YACrC,cAAc,EAAE,MAAM;YACtB,YAAY,EAAE,MAAM;YACpB,oBAAoB,EAAE,OAAO;SAC9B;KACF;IACD,gBAAgB,EAAE;QAChB,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,8CAA8C;QAC3D,MAAM,EAAE;YACN,QAAQ,EAAE,YAAY;YACtB,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,SAAS;YACf,YAAY,EAAE,oDAAoD;YAClE,SAAS,EAAE,oBAAoB;YAC/B,uBAAuB,EAAE,QAAQ;YACjC,yBAAyB,EAAE,UAAU;YACrC,cAAc,EAAE,MAAM;YACtB,YAAY,EAAE,MAAM;YACpB,oBAAoB,EAAE,OAAO;YAC7B,oBAAoB,EAAE,MAAM;SAC7B;KACF;IACD,UAAU,EAAE;QACV,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,2DAA2D;QACxE,MAAM,EAAE;YACN,QAAQ,EAAE,YAAY;YACtB,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,SAAS;YACf,uBAAuB,EAAE,QAAQ;YACjC,yBAAyB,EAAE,aAAa;YACxC,cAAc,EAAE,MAAM;YACtB,YAAY,EAAE,QAAQ;YACtB,oBAAoB,EAAE,OAAO;YAC7B,oBAAoB,EAAE,MAAM;SAC7B;KACF;IACD,mBAAmB,EAAE;QACnB,IAAI,EAAE,mBAAmB;QACzB,WAAW,EAAE,yEAAyE;QACtF,MAAM,EAAE;YACN,QAAQ,EAAE,YAAY;YACtB,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,SAAS;YACf,uBAAuB,EAAE,QAAQ;YACjC,yBAAyB,EAAE,aAAa;YACxC,cAAc,EAAE,MAAM;YACtB,YAAY,EAAE,QAAQ;YACtB,oBAAoB,EAAE,OAAO;YAC7B,sBAAsB,EAAE,oCAAoC;SAC7D;KACF;CACF,CAAC;AAEF,MAAM,UAAU,yBAAyB;IACvC,OAAO,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACpE,EAAE;QACF,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,EAAU;IAChD,OAAO,sBAAsB,CAAC,EAAE,CAAC,CAAC;AACpC,CAAC"}

package/dist/services/events/subscribers/auditLog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auditLog.d.ts","sourceRoot":"","sources":["../../../../src/services/events/subscribers/auditLog.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAgB5E"}
+{"version":3,"file":"auditLog.d.ts","sourceRoot":"","sources":["../../../../src/services/events/subscribers/auditLog.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAgCjD,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAyB5E"}

package/dist/services/events/subscribers/auditLog.js

@@ -1,20 +1,55 @@
 import { db } from "../../../db/index.js";
 import { auditLog } from "../../../db/schema.js";
+/**
+ * A service-account principal is represented in-memory by an id of
+ * `sa:<uuid>` so that routes expecting `request.user` keep working without a
+ * matching user row.
+ *
+ * `audit_log.user_id` is a uuid column, so that sentinel cannot be written to it
+ * as-is. Passing it through unfiltered made Postgres reject the whole insert, the
+ * subscriber logged "failed to write event", and the audit record was lost.
+ *
+ * The practical effect was that **every request made with an API key or an mTLS
+ * service account produced no audit entry at all** — the privileged, non-human
+ * path, which is the one an attacker would most want to use quietly, was the one
+ * that left no trace. Nothing failed visibly: the request succeeded, the
+ * subscriber's `catch` swallowed the error, and the absence of a record looked
+ * exactly like a request that never happened.
+ *
+ * So the sentinel is stripped and the service account is recorded in `metadata`
+ * instead, which keeps the information without violating the column type.
+ */
+const SERVICE_ACCOUNT_PREFIX = "sa:";
+function splitServiceAccountId(value) {
+    if (value == null)
+        return { userId: null, serviceAccountId: null };
+    if (!value.startsWith(SERVICE_ACCOUNT_PREFIX))
+        return { userId: value, serviceAccountId: null };
+    return { userId: null, serviceAccountId: value.slice(SERVICE_ACCOUNT_PREFIX.length) };
+}
 export async function auditLogSubscriber(event) {
     try {
-        const { userId, orgId, appId, requestId, ip, userAgent, metadata } = event.payload;
+        const { userId: rawUserId, orgId, appId, requestId, ip, userAgent, metadata } = event.payload;
+        const { userId, serviceAccountId } = splitServiceAccountId(rawUserId);
         await db.insert(auditLog).values({
-            userId: userId ?? null,
+            userId,
             orgId: orgId ?? null,
             appId: appId ?? null,
             requestId: requestId ?? null,
             event: `${event.type}:v${event.version}`,
             ipAddress: ip ?? null,
             userAgent: userAgent ?? null,
-            metadata: { ...metadata, eventVersion: event.version },
+            metadata: {
+                ...metadata,
+                ...(serviceAccountId ? { serviceAccountId } : {}),
+                eventVersion: event.version,
+            },
         });
     }
     catch (err) {
+        // A failure here means a security-relevant action went unrecorded, so it is
+        // logged at error level and the reason is kept: an operator seeing a gap in
+        // the audit log needs to know the write was attempted.
         console.error("[audit-log-subscriber] failed to write event:", err);
     }
 }

package/dist/services/events/subscribers/auditLog.js.map

@@ -1 +1 @@
-{"version":3,"file":"auditLog.js","sourceRoot":"","sources":["../../../../src/services/events/subscribers/auditLog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,sBAAsB,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAGjD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAAoB;IAC3D,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC;QACnF,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;YAC/B,MAAM,EAAE,MAAM,IAAI,IAAI;YACtB,KAAK,EAAE,KAAK,IAAI,IAAI;YACpB,KAAK,EAAE,KAAK,IAAI,IAAI;YACpB,SAAS,EAAE,SAAS,IAAI,IAAI;YAC5B,KAAK,EAAE,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE;YACxC,SAAS,EAAE,EAAE,IAAI,IAAI;YACrB,SAAS,EAAE,SAAS,IAAI,IAAI;YAC5B,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE,YAAY,EAAE,KAAK,CAAC,OAAO,EAAE;SACvD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,+CAA+C,EAAE,GAAG,CAAC,CAAC;IACtE,CAAC;AACH,CAAC"}
+{"version":3,"file":"auditLog.js","sourceRoot":"","sources":["../../../../src/services/events/subscribers/auditLog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,sBAAsB,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAGjD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,sBAAsB,GAAG,KAAK,CAAC;AAErC,SAAS,qBAAqB,CAAC,KAAgC;IAI7D,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;IACnE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,sBAAsB,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;IAChG,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,CAAC,KAAK,CAAC,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC;AACxF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAAoB;IAC3D,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC;QAC9F,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;QAEtE,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;YAC/B,MAAM;YACN,KAAK,EAAE,KAAK,IAAI,IAAI;YACpB,KAAK,EAAE,KAAK,IAAI,IAAI;YACpB,SAAS,EAAE,SAAS,IAAI,IAAI;YAC5B,KAAK,EAAE,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE;YACxC,SAAS,EAAE,EAAE,IAAI,IAAI;YACrB,SAAS,EAAE,SAAS,IAAI,IAAI;YAC5B,QAAQ,EAAE;gBACR,GAAG,QAAQ;gBACX,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjD,YAAY,EAAE,KAAK,CAAC,OAAO;aAC5B;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,4EAA4E;QAC5E,4EAA4E;QAC5E,uDAAuD;QACvD,OAAO,CAAC,KAAK,CAAC,+CAA+C,EAAE,GAAG,CAAC,CAAC;IACtE,CAAC;AACH,CAAC"}

package/dist/services/events/types.d.ts

@@ -23,5 +23,7 @@ export interface KeystoneEvent {
 export type EventHandler = (event: KeystoneEvent) => void | Promise<void>;
 export declare const EVENT_VERSIONS: Record<string, number>;
 export declare function eventVersion(type: string): number;
-export type AuditEventType = "user_registered" | "user_login" | "user_login_failed" | "user_logout" | "token_refresh" | "token_refresh_failed" | "oauth_callback" | "oauth2_authorize" | "oauth2_token" | "oauth2_refresh" | "oauth2_refresh_failed" | "oauth2_client_credentials" | "oauth2_revoke" | "oauth2_consent" | "password_reset_requested" | "password_reset_completed" | "api_key_created" | "api_key_revoked" | "api_key_used" | "service_account_created" | "service_account_updated" | "magic_link_replayed" | "sms_otp_replayed" | "password_reset_token_replayed" | "service_account_certificate_bound" | "service_account_certificate_unbound" | "service_account_revoked" | "unauthorized_access" | "organization_created" | "organization_updated" | "organization_plan_updated" | "billing_customer_provisioned" | "organization_member_invited" | "organization_member_removed" | "organization_member_role_updated" | "permission_created" | "permission_deleted" | "permission_role_updated" | "application_created" | "application_updated" | "magic_link_sent" | "magic_link_verified" | "totp_enrolled" | "totp_verify_failed" | "totp_enabled" | "totp_disable_failed" | "totp_disabled" | "webauthn_registered" | "webauthn_authenticated" | "new_device_detected" | "sms_otp_sent" | "sms_otp_verify_failed" | "sms_otp_verified" | "authz_check" | "saml_sso_login" | "oidc_enterprise_login" | "saml_connection_created" | "saml_connection_deleted" | "oidc_connection_created" | "oidc_connection_deleted" | "scim_user_created" | "scim_user_updated" | "scim_user_deleted" | "federation_login" | "workflow_triggered" | "workflow_step_executed" | "workflow_created" | "workflow_deleted" | "workflow_blocked" | "platform_user_updated" | "platform_role_changed" | "platform_user_deactivated" | "platform_account_reviewed" | "platform_signing_key_rotated" | "platform_plugin_unregistered" | "platform_feature_flag_updated" | "platform_feature_flag_deleted" | "profile_updated" | "email_verification_sent" | "email_verified" | "platform_webhook_created" | "platform_webhook_updated" | "platform_webhook_deleted" | "platform_webhook_secret_rotated" | "federation_identity_linked" | "user_token_login" | "session_revoked" | "sessions_revoked_all" | "mfa_challenge_created" | "mfa_challenge_failed" | "mfa_challenge_expired" | "mfa_challenge_rejected" | "mfa_verified" | "mfa_bypass_blocked" | "mfa_backup_code_regenerated" | "scim_connection_created" | "scim_connection_rotated" | "scim_connection_revoked" | "scim_authentication_failed" | "scim_access_denied" | "scim_group_created" | "scim_group_updated" | "scim_group_deleted";
+export type AuditEventType = "user_registered" | "user_login" | "user_login_failed" | "user_logout" | "token_refresh" | "token_refresh_failed" | "oauth_callback" | "oauth2_authorize" | "oauth2_token" | "oauth2_refresh" | "oauth2_refresh_failed" | "oauth2_client_credentials" | "oauth2_revoke" | "oauth2_consent" | "password_reset_requested" | "password_reset_completed" | "api_key_created" | "api_key_revoked" | "api_key_used" | "service_account_created" | "service_account_updated"
+/** A request refused by a rate limiter. Carries which limiter decided it. */
+ | "rate_limit_triggered" | "authentication_brute_force" | "mfa_brute_force" | "refresh_token_replayed" | "magic_link_replayed" | "sms_otp_replayed" | "password_reset_token_replayed" | "service_account_certificate_bound" | "service_account_certificate_unbound" | "service_account_revoked" | "unauthorized_access" | "organization_created" | "organization_updated" | "organization_plan_updated" | "billing_customer_provisioned" | "organization_member_invited" | "organization_member_removed" | "organization_member_role_updated" | "permission_created" | "permission_deleted" | "permission_role_updated" | "application_created" | "application_updated" | "magic_link_sent" | "magic_link_verified" | "totp_enrolled" | "totp_verify_failed" | "totp_enabled" | "totp_disable_failed" | "totp_disabled" | "webauthn_registered" | "webauthn_authenticated" | "new_device_detected" | "sms_otp_sent" | "sms_otp_verify_failed" | "sms_otp_verified" | "authz_check" | "saml_sso_login" | "oidc_enterprise_login" | "saml_connection_created" | "saml_connection_deleted" | "oidc_connection_created" | "oidc_connection_deleted" | "scim_user_created" | "scim_user_updated" | "scim_user_deleted" | "federation_login" | "workflow_triggered" | "workflow_step_executed" | "workflow_created" | "workflow_deleted" | "workflow_blocked" | "platform_user_updated" | "platform_role_changed" | "platform_user_deactivated" | "platform_account_reviewed" | "platform_signing_key_rotated" | "platform_plugin_unregistered" | "platform_feature_flag_updated" | "platform_feature_flag_deleted" | "profile_updated" | "email_verification_sent" | "email_verified" | "platform_webhook_created" | "platform_webhook_updated" | "platform_webhook_deleted" | "platform_webhook_secret_rotated" | "federation_identity_linked" | "user_token_login" | "session_revoked" | "sessions_revoked_all" | "mfa_challenge_created" | "mfa_challenge_failed" | "mfa_challenge_expired" | "mfa_challenge_rejected" | "mfa_verified" | "mfa_bypass_blocked" | "mfa_backup_code_regenerated" | "scim_connection_created" | "scim_connection_rotated" | "scim_connection_revoked" | "scim_authentication_failed" | "scim_access_denied" | "scim_group_created" | "scim_group_updated" | "scim_group_deleted";
 //# sourceMappingURL=types.d.ts.map

package/dist/services/events/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/services/events/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,YAAY;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,OAAO,EAAE,YAAY,CAAC;CACvB;AAED,MAAM,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1E,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAGjD,CAAC;AAEF,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,MAAM,MAAM,cAAc,GACtB,iBAAiB,GACjB,YAAY,GACZ,mBAAmB,GACnB,aAAa,GACb,eAAe,GACf,sBAAsB,GACtB,gBAAgB,GAChB,kBAAkB,GAClB,cAAc,GACd,gBAAgB,GAChB,uBAAuB,GACvB,2BAA2B,GAC3B,eAAe,GACf,gBAAgB,GAChB,0BAA0B,GAC1B,0BAA0B,GAC1B,iBAAiB,GACjB,iBAAiB,GACjB,cAAc,GACd,yBAAyB,GACzB,yBAAyB,GACzB,qBAAqB,GACrB,kBAAkB,GAClB,+BAA+B,GAC/B,mCAAmC,GACnC,qCAAqC,GACrC,yBAAyB,GACzB,qBAAqB,GACrB,sBAAsB,GACtB,sBAAsB,GACtB,2BAA2B,GAC3B,8BAA8B,GAC9B,6BAA6B,GAC7B,6BAA6B,GAC7B,kCAAkC,GAClC,oBAAoB,GACpB,oBAAoB,GACpB,yBAAyB,GACzB,qBAAqB,GACrB,qBAAqB,GACrB,iBAAiB,GACjB,qBAAqB,GACrB,eAAe,GACf,oBAAoB,GACpB,cAAc,GACd,qBAAqB,GACrB,eAAe,GACf,qBAAqB,GACrB,wBAAwB,GACxB,qBAAqB,GACrB,cAAc,GACd,uBAAuB,GACvB,kBAAkB,GAClB,aAAa,GACb,gBAAgB,GAChB,uBAAuB,GACvB,yBAAyB,GACzB,yBAAyB,GACzB,yBAAyB,GACzB,yBAAyB,GACzB,mBAAmB,GACnB,mBAAmB,GACnB,mBAAmB,GACnB,kBAAkB,GAClB,oBAAoB,GACpB,wBAAwB,GACxB,kBAAkB,GAClB,kBAAkB,GAClB,kBAAkB,GAClB,uBAAuB,GACvB,uBAAuB,GACvB,2BAA2B,GAC3B,2BAA2B,GAC3B,8BAA8B,GAC9B,8BAA8B,GAC9B,+BAA+B,GAC/B,+BAA+B,GAC/B,iBAAiB,GACjB,yBAAyB,GACzB,gBAAgB,GAChB,0BAA0B,GAC1B,0BAA0B,GAC1B,0BAA0B,GAC1B,iCAAiC,GACjC,4BAA4B,GAC5B,kBAAkB,GAClB,iBAAiB,GACjB,sBAAsB,GACtB,uBAAuB,GACvB,sBAAsB,GACtB,uBAAuB,GACvB,wBAAwB,GACxB,cAAc,GACd,oBAAoB,GACpB,6BAA6B,GAC7B,yBAAyB,GACzB,yBAAyB,GACzB,yBAAyB,GACzB,4BAA4B,GAC5B,oBAAoB,GACpB,oBAAoB,GACpB,oBAAoB,GACpB,oBAAoB,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/services/events/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,YAAY;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,OAAO,EAAE,YAAY,CAAC;CACvB;AAED,MAAM,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1E,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAGjD,CAAC;AAEF,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,MAAM,MAAM,cAAc,GACtB,iBAAiB,GACjB,YAAY,GACZ,mBAAmB,GACnB,aAAa,GACb,eAAe,GACf,sBAAsB,GACtB,gBAAgB,GAChB,kBAAkB,GAClB,cAAc,GACd,gBAAgB,GAChB,uBAAuB,GACvB,2BAA2B,GAC3B,eAAe,GACf,gBAAgB,GAChB,0BAA0B,GAC1B,0BAA0B,GAC1B,iBAAiB,GACjB,iBAAiB,GACjB,cAAc,GACd,yBAAyB,GACzB,yBAAyB;AAC3B,6EAA6E;GAC3E,sBAAsB,GACtB,4BAA4B,GAC5B,iBAAiB,GACjB,wBAAwB,GACxB,qBAAqB,GACrB,kBAAkB,GAClB,+BAA+B,GAC/B,mCAAmC,GACnC,qCAAqC,GACrC,yBAAyB,GACzB,qBAAqB,GACrB,sBAAsB,GACtB,sBAAsB,GACtB,2BAA2B,GAC3B,8BAA8B,GAC9B,6BAA6B,GAC7B,6BAA6B,GAC7B,kCAAkC,GAClC,oBAAoB,GACpB,oBAAoB,GACpB,yBAAyB,GACzB,qBAAqB,GACrB,qBAAqB,GACrB,iBAAiB,GACjB,qBAAqB,GACrB,eAAe,GACf,oBAAoB,GACpB,cAAc,GACd,qBAAqB,GACrB,eAAe,GACf,qBAAqB,GACrB,wBAAwB,GACxB,qBAAqB,GACrB,cAAc,GACd,uBAAuB,GACvB,kBAAkB,GAClB,aAAa,GACb,gBAAgB,GAChB,uBAAuB,GACvB,yBAAyB,GACzB,yBAAyB,GACzB,yBAAyB,GACzB,yBAAyB,GACzB,mBAAmB,GACnB,mBAAmB,GACnB,mBAAmB,GACnB,kBAAkB,GAClB,oBAAoB,GACpB,wBAAwB,GACxB,kBAAkB,GAClB,kBAAkB,GAClB,kBAAkB,GAClB,uBAAuB,GACvB,uBAAuB,GACvB,2BAA2B,GAC3B,2BAA2B,GAC3B,8BAA8B,GAC9B,8BAA8B,GAC9B,+BAA+B,GAC/B,+BAA+B,GAC/B,iBAAiB,GACjB,yBAAyB,GACzB,gBAAgB,GAChB,0BAA0B,GAC1B,0BAA0B,GAC1B,0BAA0B,GAC1B,iCAAiC,GACjC,4BAA4B,GAC5B,kBAAkB,GAClB,iBAAiB,GACjB,sBAAsB,GACtB,uBAAuB,GACvB,sBAAsB,GACtB,uBAAuB,GACvB,wBAAwB,GACxB,cAAc,GACd,oBAAoB,GACpB,6BAA6B,GAC7B,yBAAyB,GACzB,yBAAyB,GACzB,yBAAyB,GACzB,4BAA4B,GAC5B,oBAAoB,GACpB,oBAAoB,GACpB,oBAAoB,GACpB,oBAAoB,CAAC"}

package/dist/services/events/validate.d.ts

@@ -4,6 +4,7 @@ export interface EventValidationResult {
     valid: boolean;
     errors: string[];
 }
+export declare const VALID_EVENT_TYPES: Set<string>;
 export declare function validateEvent(event: EmittableEvent): EventValidationResult;
 export declare function normalizeEvent(event: EmittableEvent): KeystoneEvent;
 //# sourceMappingURL=validate.d.ts.map

package/dist/services/events/validate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../../src/services/events/validate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE/C,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AA4GD,wBAAgB,aAAa,CAAC,KAAK,EAAE,cAAc,GAAG,qBAAqB,CAqB1E;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,cAAc,GAAG,aAAa,CAYnE"}
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../../src/services/events/validate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE/C,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,eAAO,MAAM,iBAAiB,aA4G5B,CAAC;AAEH,wBAAgB,aAAa,CAAC,KAAK,EAAE,cAAc,GAAG,qBAAqB,CAqB1E;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,cAAc,GAAG,aAAa,CAYnE"}

package/dist/services/events/validate.js

@@ -1,5 +1,5 @@
 import { eventVersion } from "./types.js";
-const VALID_EVENT_TYPES = new Set([
+export const VALID_EVENT_TYPES = new Set([
     "user_registered",
     "user_login",
     "user_login_failed",
@@ -21,6 +21,10 @@ const VALID_EVENT_TYPES = new Set([
     "api_key_used",
     "service_account_created",
     "service_account_updated",
+    "rate_limit_triggered",
+    "authentication_brute_force",
+    "mfa_brute_force",
+    "refresh_token_replayed",
     "magic_link_replayed",
     "sms_otp_replayed",
     "password_reset_token_replayed",

package/dist/services/events/validate.js.map

@@ -1 +1 @@
-{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../../src/services/events/validate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAQ1C,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,iBAAiB;IACjB,YAAY;IACZ,mBAAmB;IACnB,aAAa;IACb,eAAe;IACf,sBAAsB;IACtB,gBAAgB;IAChB,kBAAkB;IAClB,cAAc;IACd,gBAAgB;IAChB,uBAAuB;IACvB,2BAA2B;IAC3B,eAAe;IACf,gBAAgB;IAChB,0BAA0B;IAC1B,0BAA0B;IAC1B,iBAAiB;IACjB,iBAAiB;IACjB,cAAc;IACd,yBAAyB;IACzB,yBAAyB;IACzB,qBAAqB;IACrB,kBAAkB;IAClB,+BAA+B;IAC/B,mCAAmC;IACnC,qCAAqC;IACrC,yBAAyB;IACzB,qBAAqB;IACrB,sBAAsB;IACtB,sBAAsB;IACtB,2BAA2B;IAC3B,8BAA8B;IAC9B,6BAA6B;IAC7B,6BAA6B;IAC7B,kCAAkC;IAClC,oBAAoB;IACpB,oBAAoB;IACpB,yBAAyB;IACzB,qBAAqB;IACrB,qBAAqB;IACrB,iBAAiB;IACjB,qBAAqB;IACrB,eAAe;IACf,oBAAoB;IACpB,cAAc;IACd,qBAAqB;IACrB,eAAe;IACf,qBAAqB;IACrB,wBAAwB;IACxB,qBAAqB;IACrB,cAAc;IACd,uBAAuB;IACvB,kBAAkB;IAClB,aAAa;IACb,gBAAgB;IAChB,yBAAyB;IACzB,yBAAyB;IACzB,uBAAuB;IACvB,yBAAyB;IACzB,yBAAyB;IACzB,mBAAmB;IACnB,mBAAmB;IACnB,mBAAmB;IACnB,kBAAkB;IAClB,oBAAoB;IACpB,wBAAwB;IACxB,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;IAClB,uBAAuB;IACvB,uBAAuB;IACvB,2BAA2B;IAC3B,2BAA2B;IAC3B,8BAA8B;IAC9B,8BAA8B;IAC9B,+BAA+B;IAC/B,+BAA+B;IAC/B,iBAAiB;IACjB,yBAAyB;IACzB,gBAAgB;IAChB,0BAA0B;IAC1B,0BAA0B;IAC1B,0BAA0B;IAC1B,iCAAiC;IACjC,4BAA4B;IAC5B,kBAAkB;IAClB,iBAAiB;IACjB,sBAAsB;IACtB,uBAAuB;IACvB,sBAAsB;IACtB,uBAAuB;IACvB,wBAAwB;IACxB,cAAc;IACd,oBAAoB;IACpB,6BAA6B;IAC7B,yBAAyB;IACzB,yBAAyB;IACzB,yBAAyB;IACzB,4BAA4B;IAC5B,oBAAoB;IACpB,oBAAoB;IACpB,oBAAoB;IACpB,oBAAoB;CACrB,CAAC,CAAC;AAEH,MAAM,UAAU,aAAa,CAAC,KAAqB;IACjD,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;QAC3D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAClC,CAAC;IAED,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,uBAAuB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,EAAE,CAAC;QAC5F,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACxF,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAqB;IAClD,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,kBAAkB,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC;QAClD,SAAS,EAAE,IAAI,IAAI,EAAE;QACrB,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../../src/services/events/validate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAQ1C,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IACvC,iBAAiB;IACjB,YAAY;IACZ,mBAAmB;IACnB,aAAa;IACb,eAAe;IACf,sBAAsB;IACtB,gBAAgB;IAChB,kBAAkB;IAClB,cAAc;IACd,gBAAgB;IAChB,uBAAuB;IACvB,2BAA2B;IAC3B,eAAe;IACf,gBAAgB;IAChB,0BAA0B;IAC1B,0BAA0B;IAC1B,iBAAiB;IACjB,iBAAiB;IACjB,cAAc;IACd,yBAAyB;IACzB,yBAAyB;IACzB,sBAAsB;IACtB,4BAA4B;IAC5B,iBAAiB;IACjB,wBAAwB;IACxB,qBAAqB;IACrB,kBAAkB;IAClB,+BAA+B;IAC/B,mCAAmC;IACnC,qCAAqC;IACrC,yBAAyB;IACzB,qBAAqB;IACrB,sBAAsB;IACtB,sBAAsB;IACtB,2BAA2B;IAC3B,8BAA8B;IAC9B,6BAA6B;IAC7B,6BAA6B;IAC7B,kCAAkC;IAClC,oBAAoB;IACpB,oBAAoB;IACpB,yBAAyB;IACzB,qBAAqB;IACrB,qBAAqB;IACrB,iBAAiB;IACjB,qBAAqB;IACrB,eAAe;IACf,oBAAoB;IACpB,cAAc;IACd,qBAAqB;IACrB,eAAe;IACf,qBAAqB;IACrB,wBAAwB;IACxB,qBAAqB;IACrB,cAAc;IACd,uBAAuB;IACvB,kBAAkB;IAClB,aAAa;IACb,gBAAgB;IAChB,yBAAyB;IACzB,yBAAyB;IACzB,uBAAuB;IACvB,yBAAyB;IACzB,yBAAyB;IACzB,mBAAmB;IACnB,mBAAmB;IACnB,mBAAmB;IACnB,kBAAkB;IAClB,oBAAoB;IACpB,wBAAwB;IACxB,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;IAClB,uBAAuB;IACvB,uBAAuB;IACvB,2BAA2B;IAC3B,2BAA2B;IAC3B,8BAA8B;IAC9B,8BAA8B;IAC9B,+BAA+B;IAC/B,+BAA+B;IAC/B,iBAAiB;IACjB,yBAAyB;IACzB,gBAAgB;IAChB,0BAA0B;IAC1B,0BAA0B;IAC1B,0BAA0B;IAC1B,iCAAiC;IACjC,4BAA4B;IAC5B,kBAAkB;IAClB,iBAAiB;IACjB,sBAAsB;IACtB,uBAAuB;IACvB,sBAAsB;IACtB,uBAAuB;IACvB,wBAAwB;IACxB,cAAc;IACd,oBAAoB;IACpB,6BAA6B;IAC7B,yBAAyB;IACzB,yBAAyB;IACzB,yBAAyB;IACzB,4BAA4B;IAC5B,oBAAoB;IACpB,oBAAoB;IACpB,oBAAoB;IACpB,oBAAoB;CACrB,CAAC,CAAC;AAEH,MAAM,UAAU,aAAa,CAAC,KAAqB;IACjD,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;QAC3D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAClC,CAAC;IAED,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,uBAAuB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,EAAE,CAAC;QAC5F,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACxF,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAqB;IAClD,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,kBAAkB,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC;QAClD,SAAS,EAAE,IAAI,IAAI,EAAE;QACrB,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;AACJ,CAAC"}