@jazzmind/busibox-app 3.0.18

package/dist/lib/services/manifest.js

@@ -0,0 +1,137 @@
+/**
+ * Busibox Manifest Fetcher
+ *
+ * Fetches and validates busibox.json manifest files from GitHub repositories.
+ */
+import { validateManifest } from './manifest-schema';
+/**
+ * Parse GitHub URL into owner and repo
+ * Supports:
+ * - https://github.com/owner/repo
+ * - github.com/owner/repo
+ * - owner/repo
+ */
+export function parseGitHubUrl(url) {
+    // Remove trailing .git if present
+    url = url.replace(/\.git$/, '');
+    // Try full URL format
+    const fullUrlMatch = url.match(/^https?:\/\/github\.com\/([^\/]+)\/([^\/]+)/);
+    if (fullUrlMatch) {
+        return {
+            owner: fullUrlMatch[1],
+            repo: fullUrlMatch[2],
+        };
+    }
+    // Try without protocol
+    const noProtocolMatch = url.match(/^github\.com\/([^\/]+)\/([^\/]+)/);
+    if (noProtocolMatch) {
+        return {
+            owner: noProtocolMatch[1],
+            repo: noProtocolMatch[2],
+        };
+    }
+    // Try owner/repo format
+    const shortMatch = url.match(/^([^\/]+)\/([^\/]+)$/);
+    if (shortMatch) {
+        return {
+            owner: shortMatch[1],
+            repo: shortMatch[2],
+        };
+    }
+    return null;
+}
+/**
+ * Fetch manifest from GitHub repository
+ */
+export async function fetchManifest(options) {
+    const { owner, repo, branch = 'main', token } = options;
+    // Construct raw GitHub URL
+    const manifestUrl = `https://raw.githubusercontent.com/${owner}/${repo}/${branch}/busibox.json`;
+    try {
+        // Fetch manifest file
+        const headers = {
+            'Accept': 'application/json',
+        };
+        if (token) {
+            headers['Authorization'] = `Bearer ${token}`;
+        }
+        const response = await fetch(manifestUrl, {
+            headers,
+            cache: 'no-store',
+        });
+        if (!response.ok) {
+            if (response.status === 404) {
+                return {
+                    success: false,
+                    error: 'Manifest file (busibox.json) not found in repository. This repository may not be a Busibox-compatible app.',
+                };
+            }
+            if (response.status === 401 || response.status === 403) {
+                return {
+                    success: false,
+                    error: 'Access denied. The repository may be private and require authentication.',
+                };
+            }
+            return {
+                success: false,
+                error: `Failed to fetch manifest: ${response.status} ${response.statusText}`,
+            };
+        }
+        // Parse JSON
+        let manifestData;
+        try {
+            manifestData = await response.json();
+        }
+        catch (err) {
+            return {
+                success: false,
+                error: 'Invalid JSON in busibox.json file',
+            };
+        }
+        // Validate manifest
+        const validation = validateManifest(manifestData);
+        if (!validation.success) {
+            return {
+                success: false,
+                error: 'Manifest validation failed',
+                validationErrors: validation.errors,
+            };
+        }
+        return {
+            success: true,
+            manifest: validation.manifest,
+        };
+    }
+    catch (err) {
+        return {
+            success: false,
+            error: err instanceof Error ? err.message : 'Unknown error fetching manifest',
+        };
+    }
+}
+/**
+ * Fetch manifest from GitHub URL (convenience wrapper)
+ */
+export async function fetchManifestFromUrl(url, token, branch) {
+    const parsed = parseGitHubUrl(url);
+    if (!parsed) {
+        return {
+            success: false,
+            error: 'Invalid GitHub URL. Expected format: https://github.com/owner/repo or owner/repo',
+        };
+    }
+    return fetchManifest({
+        owner: parsed.owner,
+        repo: parsed.repo,
+        branch,
+        token,
+    });
+}
+/**
+ * Check if a repository has a valid Busibox manifest
+ */
+export async function hasValidManifest(owner, repo, token) {
+    const result = await fetchManifest({ owner, repo, token });
+    return result.success;
+}
+//# sourceMappingURL=manifest.js.map

package/dist/lib/services/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../../../src/lib/services/manifest.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,gBAAgB,EAAuD,MAAM,mBAAmB,CAAC;AAmB1G;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,kCAAkC;IAClC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAEhC,sBAAsB;IACtB,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAC9E,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO;YACL,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC;YACtB,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;SACtB,CAAC;IACJ,CAAC;IAED,uBAAuB;IACvB,MAAM,eAAe,GAAG,GAAG,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtE,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO;YACL,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC;YACzB,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC;SACzB,CAAC;IACJ,CAAC;IAED,wBAAwB;IACxB,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACrD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO;YACL,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;YACpB,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;SACpB,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAA6B;IAC/D,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IAExD,2BAA2B;IAC3B,MAAM,WAAW,GAAG,qCAAqC,KAAK,IAAI,IAAI,IAAI,MAAM,eAAe,CAAC;IAEhG,IAAI,CAAC;QACH,sBAAsB;QACtB,MAAM,OAAO,GAA2B;YACtC,QAAQ,EAAE,kBAAkB;SAC7B,CAAC;QAEF,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,KAAK,EAAE,CAAC;QAC/C,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE;YACxC,OAAO;YACP,KAAK,EAAE,UAAU;SAClB,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,4GAA4G;iBACpH,CAAC;YACJ,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvD,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,0EAA0E;iBAClF,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,6BAA6B,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE;aAC7E,CAAC;QACJ,CAAC;QAED,aAAa;QACb,IAAI,YAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,mCAAmC;aAC3C,CAAC;QACJ,CAAC;QAED,oBAAoB;QACpB,MAAM,UAAU,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;QAElD,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,4BAA4B;gBACnC,gBAAgB,EAAE,UAAU,CAAC,MAAM;aACpC,CAAC;QACJ,CAAC;QAED,OAAO;YACL,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,UAAU,CAAC,QAAQ;SAC9B,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,iCAAiC;SAC9E,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAAW,EACX,KAAc,EACd,MAAe;IAEf,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAEnC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,kFAAkF;SAC1F,CAAC;IACJ,CAAC;IAED,OAAO,aAAa,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM;QACN,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAa,EACb,IAAY,EACZ,KAAc;IAEd,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,OAAO,MAAM,CAAC,OAAO,CAAC;AACxB,CAAC"}

package/dist/lib/services/permissions.d.ts

@@ -0,0 +1,109 @@
+/**
+ * RBAC Permission Checking Utilities (busibox-portal wrapper)
+ *
+ * Zero Trust Architecture:
+ * All authorization checks are delegated to the authz service via busibox-app.
+ *
+ * For user self-service operations (checking own access, listing own resources),
+ * the session JWT is passed directly to authz - no token exchange required.
+ *
+ * Token exchange is only needed for:
+ * - Admin operations on other users
+ * - Downstream service access (busibox-agents, etc.)
+ */
+import { type Role } from '@jazzmind/busibox-app';
+/**
+ * Check if a user can access a specific app
+ *
+ * Queries the authz service to check if the user has any role
+ * that is bound to the specified app.
+ *
+ * @param userId - User ID to check
+ * @param appId - App ID to check access for
+ * @param accessToken - Optional access token for authenticated check
+ * @returns true if user has permission, false otherwise
+ */
+export declare function canAccessApp(userId: string, appId: string, accessToken?: string): Promise<boolean>;
+/**
+ * Get all apps a user can access
+ *
+ * Queries the authz service for accessible app IDs, then fetches
+ * app details from the local database.
+ *
+ * @param userId - User ID
+ * @param accessToken - Optional access token for authenticated check
+ * @returns Array of apps the user has permission to access
+ */
+export declare function getUserApps(userId: string, accessToken?: string): Promise<{
+    id: string;
+    name: string;
+    description: string | null;
+    type: import("../stores/app-config-store").AppConfigType;
+    url: string | null;
+    iconUrl: string | null;
+    selectedIcon: string | null;
+    displayOrder: number;
+    isActive: boolean;
+}[]>;
+/**
+ * Get user's roles from authz service
+ *
+ * @deprecated Use busibox-app's getUserRoles() directly
+ */
+export declare function getUserRoles(userId: string): Promise<Role[]>;
+/**
+ * Get user's role names
+ *
+ * @deprecated Use busibox-app's getUserRoleNames() directly
+ */
+export declare function getUserRoleNames(userId: string): Promise<string[]>;
+/**
+ * Check if user has a specific role
+ *
+ * @deprecated Use busibox-app's hasRole() directly
+ */
+export declare function hasRole(userId: string, roleName: string): Promise<boolean>;
+/**
+ * Check if user is an admin
+ *
+ * @deprecated Use busibox-app's isAdmin() directly
+ */
+export declare function isAdmin(userId: string): Promise<boolean>;
+/**
+ * Check if user is a guest
+ *
+ * @deprecated Use busibox-app's isGuest() directly
+ */
+export declare function isGuest(userId: string): Promise<boolean>;
+/**
+ * Check if user has any of the specified roles
+ *
+ * @deprecated Use busibox-app's hasAnyRole() directly
+ */
+export declare function hasAnyRole(userId: string, roleNames: string[]): Promise<boolean>;
+/**
+ * Check if user has all of the specified roles
+ *
+ * @deprecated Use busibox-app's hasAllRoles() directly
+ */
+export declare function hasAllRoles(userId: string, roleNames: string[]): Promise<boolean>;
+/**
+ * Check if user is active
+ *
+ * This checks the authz service.
+ */
+export declare function isUserActive(userId: string): Promise<boolean>;
+/**
+ * Get user with roles from authz service
+ */
+export declare function getUserWithRoles(userId: string): Promise<{
+    id: string;
+    email: string;
+    status: string | undefined;
+    lastLoginAt: Date | null;
+    createdAt: Date;
+    updatedAt: Date;
+    roles: Role[];
+} | null>;
+export type { Role } from '@jazzmind/busibox-app';
+//# sourceMappingURL=permissions.d.ts.map

package/dist/lib/services/permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../../src/lib/services/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAML,KAAK,IAAI,EAEV,MAAM,uBAAuB,CAAC;AA0B/B;;;;;;;;;;GAUG;AACH,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAqBxG;AAED;;;;;;;;;GASG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM;;;;;;;;;;KAkCrE;AAMD;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAGlE;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAIxE;AAED;;;;GAIG;AACH,wBAAsB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAGhF;AAED;;;;GAIG;AACH,wBAAsB,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAG9D;AAED;;;;GAIG;AACH,wBAAsB,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAG9D;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAKtF;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAKvF;AAMD;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CASnE;AAYD;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM;;;;;;;;UA0BpD;AAGD,YAAY,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/lib/services/permissions.js

@@ -0,0 +1,238 @@
+/**
+ * RBAC Permission Checking Utilities (busibox-portal wrapper)
+ *
+ * Zero Trust Architecture:
+ * All authorization checks are delegated to the authz service via busibox-app.
+ *
+ * For user self-service operations (checking own access, listing own resources),
+ * the session JWT is passed directly to authz - no token exchange required.
+ *
+ * Token exchange is only needed for:
+ * - Admin operations on other users
+ * - Downstream service access (busibox-agents, etc.)
+ */
+import { getUserRoles as busiboxGetUserRoles, hasRole as busiboxHasRole, isAdmin as busiboxIsAdmin, userCanAccessResource, getUserAccessibleResources, } from '@jazzmind/busibox-app';
+import { getAuthzOptions } from '../next/authz-client';
+import { getAppByIdFromStore, getAppConfigStoreContextForUser, listAppsFromStore } from '../stores/app-config-store';
+/**
+ * Get RBAC options with session JWT for self-service operations.
+ *
+ * Authz now accepts session JWTs directly for self-service operations
+ * (user checking their own access, listing their own resources).
+ * No token exchange is required.
+ *
+ * @param sessionJwt - The user's session JWT
+ * @returns RbacClientOptions with the session JWT as accessToken
+ */
+function getRbacOptionsWithToken(sessionJwt) {
+    // Pass session JWT directly - authz accepts it for self-service operations
+    return {
+        accessToken: sessionJwt,
+        ...getAuthzOptions(),
+    };
+}
+// ============================================================================
+// App-Specific Permission Checks (via authz bindings)
+// ============================================================================
+/**
+ * Check if a user can access a specific app
+ *
+ * Queries the authz service to check if the user has any role
+ * that is bound to the specified app.
+ *
+ * @param userId - User ID to check
+ * @param appId - App ID to check access for
+ * @param accessToken - Optional access token for authenticated check
+ * @returns true if user has permission, false otherwise
+ */
+export async function canAccessApp(userId, appId, accessToken) {
+    try {
+        if (!accessToken) {
+            return false;
+        }
+        // First check if the app exists and is active
+        const appStoreContext = await getAppConfigStoreContextForUser(userId, accessToken);
+        const app = await getAppByIdFromStore(appStoreContext.accessToken, appId);
+        if (!app || !app.isActive) {
+            return false;
+        }
+        // Check if user can access the app via authz bindings
+        const options = accessToken ? getRbacOptionsWithToken(accessToken) : getAuthzOptions();
+        return await userCanAccessResource(userId, 'app', appId, options);
+    }
+    catch (error) {
+        console.error('[PERMISSIONS] Error checking app access:', error);
+        return false;
+    }
+}
+/**
+ * Get all apps a user can access
+ *
+ * Queries the authz service for accessible app IDs, then fetches
+ * app details from the local database.
+ *
+ * @param userId - User ID
+ * @param accessToken - Optional access token for authenticated check
+ * @returns Array of apps the user has permission to access
+ */
+export async function getUserApps(userId, accessToken) {
+    try {
+        if (!accessToken) {
+            return [];
+        }
+        // Get list of app IDs the user can access from authz
+        const options = accessToken ? getRbacOptionsWithToken(accessToken) : getAuthzOptions();
+        const accessibleAppIds = await getUserAccessibleResources(userId, 'app', options);
+        if (accessibleAppIds.length === 0) {
+            return [];
+        }
+        // Fetch app details from app config store
+        const appStoreContext = await getAppConfigStoreContextForUser(userId, accessToken);
+        const accessibleSet = new Set(accessibleAppIds);
+        return (await listAppsFromStore(appStoreContext.accessToken))
+            .filter((app) => app.isActive && accessibleSet.has(app.id))
+            .map((app) => ({
+            id: app.id,
+            name: app.name,
+            description: app.description,
+            type: app.type,
+            url: app.url,
+            iconUrl: app.iconUrl,
+            selectedIcon: app.selectedIcon,
+            displayOrder: app.displayOrder,
+            isActive: app.isActive,
+        }));
+    }
+    catch (error) {
+        console.error('[PERMISSIONS] Error getting user apps:', error);
+        return [];
+    }
+}
+// ============================================================================
+// Role Checks (delegate to busibox-app)
+// ============================================================================
+/**
+ * Get user's roles from authz service
+ *
+ * @deprecated Use busibox-app's getUserRoles() directly
+ */
+export async function getUserRoles(userId) {
+    validateUserId(userId);
+    return busiboxGetUserRoles(userId, getAuthzOptions());
+}
+/**
+ * Get user's role names
+ *
+ * @deprecated Use busibox-app's getUserRoleNames() directly
+ */
+export async function getUserRoleNames(userId) {
+    validateUserId(userId);
+    const roles = await busiboxGetUserRoles(userId, getAuthzOptions());
+    return roles.map(r => r.name);
+}
+/**
+ * Check if user has a specific role
+ *
+ * @deprecated Use busibox-app's hasRole() directly
+ */
+export async function hasRole(userId, roleName) {
+    validateUserId(userId);
+    return busiboxHasRole(userId, roleName, getAuthzOptions());
+}
+/**
+ * Check if user is an admin
+ *
+ * @deprecated Use busibox-app's isAdmin() directly
+ */
+export async function isAdmin(userId) {
+    validateUserId(userId);
+    return busiboxIsAdmin(userId, getAuthzOptions());
+}
+/**
+ * Check if user is a guest
+ *
+ * @deprecated Use busibox-app's isGuest() directly
+ */
+export async function isGuest(userId) {
+    validateUserId(userId);
+    return busiboxHasRole(userId, 'Guest', getAuthzOptions());
+}
+/**
+ * Check if user has any of the specified roles
+ *
+ * @deprecated Use busibox-app's hasAnyRole() directly
+ */
+export async function hasAnyRole(userId, roleNames) {
+    validateUserId(userId);
+    const roles = await busiboxGetUserRoles(userId, getAuthzOptions());
+    const userRoleNames = roles.map(r => r.name);
+    return roleNames.some(roleName => userRoleNames.includes(roleName));
+}
+/**
+ * Check if user has all of the specified roles
+ *
+ * @deprecated Use busibox-app's hasAllRoles() directly
+ */
+export async function hasAllRoles(userId, roleNames) {
+    validateUserId(userId);
+    const roles = await busiboxGetUserRoles(userId, getAuthzOptions());
+    const userRoleNames = roles.map(r => r.name);
+    return roleNames.every(roleName => userRoleNames.includes(roleName));
+}
+// ============================================================================
+// User Status Checks (busibox-portal Prisma-based)
+// ============================================================================
+/**
+ * Check if user is active
+ *
+ * This checks the authz service.
+ */
+export async function isUserActive(userId) {
+    try {
+        const { getUser } = await import('./user-management');
+        const user = await getUser(userId);
+        return user?.status === 'ACTIVE';
+    }
+    catch (error) {
+        console.error('[PERMISSIONS] Error checking user status:', error);
+        return false;
+    }
+}
+/**
+ * Validate that a user ID is a valid UUID format
+ */
+function validateUserId(userId) {
+    const uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+    if (!userId || !uuidRegex.test(userId)) {
+        throw new Error(`Invalid user ID format: ${userId}`);
+    }
+}
+/**
+ * Get user with roles from authz service
+ */
+export async function getUserWithRoles(userId) {
+    try {
+        // Validate user ID is a valid UUID before calling RBAC functions
+        validateUserId(userId);
+        const { getUser } = await import('./user-management');
+        const user = await getUser(userId);
+        if (!user) {
+            console.warn(`[PERMISSIONS] getUser returned null for userId: ${userId}`);
+            return null;
+        }
+        return {
+            id: userId,
+            email: user.email,
+            status: user.status,
+            lastLoginAt: user.last_login_at ? new Date(user.last_login_at) : null,
+            createdAt: new Date(user.created_at),
+            updatedAt: new Date(user.updated_at),
+            roles: user.roles || [],
+        };
+    }
+    catch (error) {
+        console.error(`[PERMISSIONS] Error getting user with roles for userId ${userId}:`, error);
+        return null;
+    }
+}
+//# sourceMappingURL=permissions.js.map

package/dist/lib/services/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../../src/lib/services/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EACL,YAAY,IAAI,mBAAmB,EACnC,OAAO,IAAI,cAAc,EACzB,OAAO,IAAI,cAAc,EACzB,qBAAqB,EACrB,0BAA0B,GAG3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,+BAA+B,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAErH;;;;;;;;;GASG;AACH,SAAS,uBAAuB,CAAC,UAAkB;IACjD,2EAA2E;IAC3E,OAAO;QACL,WAAW,EAAE,UAAU;QACvB,GAAG,eAAe,EAAE;KACrB,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,sDAAsD;AACtD,+EAA+E;AAE/E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,KAAa,EAAE,WAAoB;IACpF,IAAI,CAAC;QACH,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,8CAA8C;QAC9C,MAAM,eAAe,GAAG,MAAM,+BAA+B,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACnF,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,eAAe,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAE1E,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,sDAAsD;QACtD,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,uBAAuB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;QACvF,OAAO,MAAM,qBAAqB,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,KAAK,CAAC,CAAC;QACjE,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAc,EAAE,WAAoB;IACpE,IAAI,CAAC;QACH,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,qDAAqD;QACrD,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,uBAAuB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;QACvF,MAAM,gBAAgB,GAAG,MAAM,0BAA0B,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAElF,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,0CAA0C;QAC1C,MAAM,eAAe,GAAG,MAAM,+BAA+B,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACnF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAChD,OAAO,CAAC,MAAM,iBAAiB,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;aAC1D,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;aAC1D,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACb,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,QAAQ,EAAE,GAAG,CAAC,QAAQ;SACvB,CAAC,CAAC,CAAC;IACR,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,wCAAwC,EAAE,KAAK,CAAC,CAAC;QAC/D,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,wCAAwC;AACxC,+EAA+E;AAE/E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAc;IAC/C,cAAc,CAAC,MAAM,CAAC,CAAC;IACvB,OAAO,mBAAmB,CAAC,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAc;IACnD,cAAc,CAAC,MAAM,CAAC,CAAC;IACvB,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;IACnE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,MAAc,EAAE,QAAgB;IAC5D,cAAc,CAAC,MAAM,CAAC,CAAC;IACvB,OAAO,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,MAAc;IAC1C,cAAc,CAAC,MAAM,CAAC,CAAC;IACvB,OAAO,cAAc,CAAC,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,MAAc;IAC1C,cAAc,CAAC,MAAM,CAAC,CAAC;IACvB,OAAO,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAc,EAAE,SAAmB;IAClE,cAAc,CAAC,MAAM,CAAC,CAAC;IACvB,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;IACnE,MAAM,aAAa,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7C,OAAO,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACtE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAc,EAAE,SAAmB;IACnE,cAAc,CAAC,MAAM,CAAC,CAAC;IACvB,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;IACnE,MAAM,aAAa,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7C,OAAO,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,+EAA+E;AAC/E,mDAAmD;AACnD,+EAA+E;AAE/E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAc;IAC/C,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,OAAO,IAAI,EAAE,MAAM,KAAK,QAAQ,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,KAAK,CAAC,CAAC;QAClE,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,MAAc;IACpC,MAAM,SAAS,GAAG,iEAAiE,CAAC;IACpF,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,EAAE,CAAC,CAAC;IACvD,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAc;IACnD,IAAI,CAAC;QACH,iEAAiE;QACjE,cAAc,CAAC,MAAM,CAAC,CAAC;QAEvB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;QAEnC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,IAAI,CAAC,mDAAmD,MAAM,EAAE,CAAC,CAAC;YAC1E,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO;YACL,EAAE,EAAE,MAAM;YACV,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI;YACrE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;YACpC,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;YACpC,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;SACxB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,0DAA0D,MAAM,GAAG,EAAE,KAAK,CAAC,CAAC;QAC1F,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/lib/services/service-client.d.ts

@@ -0,0 +1,99 @@
+/**
+ * Service client helpers for calling downstream Busibox services.
+ *
+ * Provides utilities for:
+ * - Obtaining authz-issued access tokens for specific services (Zero Trust)
+ * - Making authenticated requests to data-api, search-api, agent-api
+ * - Handling token caching and refresh
+ *
+ * Zero Trust Architecture:
+ * - Requires session JWT for token exchange (cryptographic proof of identity)
+ * - NO client credentials required for user operations
+ */
+export type ServiceName = 'data-api' | 'search-api' | 'agent-api';
+export type ServiceClientOptions = {
+    /** Session JWT from authz (required for Zero Trust) */
+    sessionJwt: string;
+    /** User ID */
+    userId: string;
+    /** Target service */
+    service: ServiceName;
+    /** OAuth2 scopes (optional) */
+    scopes?: string[];
+    /** Purpose label for audit/debug (optional) */
+    purpose?: string;
+};
+/**
+ * Get the base URL for a service from environment variables.
+ */
+export declare function getServiceBaseUrl(service: ServiceName): string;
+/**
+ * Get default scopes for a service.
+ *
+ * Note: Currently returns empty arrays because scopes are not enforced
+ * by the downstream services. Authorization is handled via RBAC and
+ * audience-bound tokens.
+ */
+export declare function getDefaultScopes(service: ServiceName): string[];
+/**
+ * Create authenticated headers for calling a downstream service.
+ *
+ * This obtains an authz-issued access token and returns headers
+ * suitable for fetch() calls.
+ *
+ * @example
+ * ```typescript
+ * const headers = await createServiceHeaders({
+ *   userId: user.id,
+ *   service: 'search-api',
+ *   scopes: ['read'],
+ * });
+ *
+ * const response = await fetch(`${getServiceBaseUrl('search-api')}/search`, {
+ *   method: 'POST',
+ *   headers,
+ *   body: JSON.stringify({ query: 'example' }),
+ * });
+ * ```
+ */
+export declare function createServiceHeaders(options: ServiceClientOptions): Promise<Record<string, string>>;
+/**
+ * Make an authenticated request to a downstream service.
+ *
+ * This is a convenience wrapper around fetch() that:
+ * - Obtains an authz-issued access token
+ * - Constructs the full URL
+ * - Sets appropriate headers
+ * - Returns the response
+ *
+ * @example
+ * ```typescript
+ * const response = await callService({
+ *   userId: user.id,
+ *   service: 'search-api',
+ *   path: '/search',
+ *   method: 'POST',
+ *   body: { query: 'example' },
+ * });
+ *
+ * if (!response.ok) {
+ *   throw new Error(`Search failed: ${response.statusText}`);
+ * }
+ *
+ * const data = await response.json();
+ * ```
+ */
+export declare function callService(options: ServiceClientOptions & {
+    path: string;
+    method?: string;
+    body?: unknown;
+    extraHeaders?: Record<string, string>;
+}): Promise<Response>;
+/**
+ * Legacy compatibility: create headers with X-User-Id.
+ *
+ * @deprecated Use createServiceHeaders() instead. This is only for
+ * gradual migration of existing routes.
+ */
+export declare function createLegacyHeaders(userId: string): Record<string, string>;
+//# sourceMappingURL=service-client.d.ts.map

package/dist/lib/services/service-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-client.d.ts","sourceRoot":"","sources":["../../../src/lib/services/service-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,YAAY,GAAG,WAAW,CAAC;AAElE,MAAM,MAAM,oBAAoB,GAAG;IACjC,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc;IACd,MAAM,EAAE,MAAM,CAAC;IACf,qBAAqB;IACrB,OAAO,EAAE,WAAW,CAAC;IACrB,+BAA+B;IAC/B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAkB9D;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,EAAE,CAI/D;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAgBzG;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,oBAAoB,GAAG;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC,GACA,OAAO,CAAC,QAAQ,CAAC,CA8BnB;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAK1E"}