@kindgi/api 0.1.4 → 0.1.5

package/dist/memory-erasure-binding.d.ts

@@ -0,0 +1,145 @@
+import type { TenantId } from '@kindgi/types';
+/**
+ * Caller-plugged surface for erasing a person's words
+ * (`/v1/memory/erasures`). The API package validates, authorizes (a
+ * tenant admin only) and shapes the wire; the binding runs the erasure:
+ * memory facts, conversations, the runs that served them, and what they
+ * left in provenance, as the deployment's runtime knows its stores. An
+ * erasure runs in the background; `create` answers once it's recorded.
+ *
+ * A completed erasure keeps no identifier: what's left is its ledger row
+ * (the selector's kind, a keyed hash of it, who, when, how much), which
+ * an operator exports off-box and replays after restoring a backup.
+ */
+export interface MemoryErasureBinding {
+    create(input: {
+        readonly tenantId: TenantId;
+        readonly selector: MemoryErasureSelector;
+        /** `user:<id>` or `service:<id>`: who asked. */
+        readonly requestedBy: string;
+    }): Promise<CreateMemoryErasureOutcome>;
+    get(tenantId: TenantId, id: string): Promise<MemoryErasure | undefined>;
+    /** Newest first. `undefined` when the cursor isn't one this binding issued. */
+    list(tenantId: TenantId, page: {
+        readonly limit: number;
+        readonly cursor?: string;
+    }): Promise<{
+        readonly data: readonly MemoryErasure[];
+        readonly nextCursor?: string;
+    } | undefined>;
+    /** The whole ledger, content-free, oldest first. */
+    exportLedger(tenantId: TenantId): Promise<readonly MemoryErasureLedgerEntry[]>;
+    /**
+     * Try an unfinished erasure again now; with `force`, stop waiting for a
+     * run in a flow that serves other people (it's cancelled). A finished
+     * one comes back as it is; `undefined` when there's no such erasure.
+     */
+    resume(tenantId: TenantId, id: string, options: {
+        readonly force?: boolean;
+    }): Promise<MemoryErasure | undefined>;
+    /** After a backup restore: restore the ledger and run its erasures again. */
+    replay(tenantId: TenantId, entries: readonly MemoryErasureLedgerEntry[]): Promise<ReplayMemoryErasuresResult>;
+}
+/**
+ * Whose words to erase: one fact, a person (an app's end user
+ * `participant`, or an `external` subject facts name), or one
+ * conversation. Erasing a Kindgi user isn't offered.
+ */
+export type MemoryErasureSelector = {
+    readonly factId: string;
+} | {
+    readonly subject: {
+        readonly kind: 'participant' | 'external';
+        readonly id: string;
+    };
+} | {
+    readonly conversationId: string;
+};
+export type MemoryErasureSelectorKind = 'fact' | 'participant' | 'external' | 'conversation';
+/**
+ * `waiting-on-run`: a turn of the person's sits in a flow that serves
+ * other people; the erasure waits for it (`waitingOn`) until its
+ * deadline, then cancels it. `resume` with `force` stops the wait.
+ */
+export type MemoryErasureStatus = 'pending' | 'running' | 'waiting-on-run' | 'completed' | 'failed';
+export interface MemoryErasure {
+    readonly id: string;
+    readonly selectorKind: MemoryErasureSelectorKind;
+    /** Only while it runs: a completed or failed erasure keeps no identifier. */
+    readonly selector?: MemoryErasureSelector;
+    readonly status: MemoryErasureStatus;
+    /**
+     * Where a running erasure is: `seed`, `expand`, `settle` (the person's
+     * unfinished runs end, or it waits for them, before anything is
+     * cleared), `erase`, then `done`.
+     */
+    readonly phase: 'seed' | 'expand' | 'settle' | 'erase' | 'done';
+    readonly requestedBy: string;
+    /** A replay after a backup restore can find this person again (a keyed hash was kept). */
+    readonly matchable: boolean;
+    /** What each store cleared or deleted, by store. */
+    readonly counts: Readonly<Record<string, number>>;
+    /** Failed attempts so far. */
+    readonly attempts: number;
+    /** The last failure's code, or why it's waiting (`not-yet:<reason>`). Never content. */
+    readonly lastError?: string;
+    /** The run it waits (or waited) for, and until when; kept as the record of the wait. */
+    readonly waitingOn?: {
+        readonly runId: string;
+        readonly until?: string;
+    };
+    /** A tenant admin said not to wait. */
+    readonly forced?: true;
+    /**
+     * Runs of the person's kept appearing, round after round: the erasure
+     * went on to erase after its last round rather than wait any longer.
+     */
+    readonly settleRoundsCapped?: true;
+    readonly createdAt: string;
+    readonly startedAt?: string;
+    readonly completedAt?: string;
+    readonly replayedAt?: string;
+}
+/** One ledger row, as exported off-box and given back to a replay. Content-free. */
+export interface MemoryErasureLedgerEntry {
+    readonly id: string;
+    readonly selectorKind: MemoryErasureSelectorKind;
+    /** HMAC-SHA256 (hex) of the selector under the tenant's ledger key; absent without one. */
+    readonly selectorHmac?: string;
+    /** Which ledger key made `selectorHmac`. */
+    readonly keyId?: string;
+    readonly requestedBy: string;
+    readonly status: MemoryErasureStatus;
+    readonly createdAt: string;
+    readonly completedAt?: string;
+}
+export interface MemoryErasureWarning {
+    /** `erasure-unmatchable`: no ledger key, so a replay after a restore can't find this person. */
+    readonly code: 'erasure-unmatchable';
+    readonly message: string;
+}
+export type CreateMemoryErasureOutcome = {
+    readonly kind: 'created';
+    readonly erasure: MemoryErasure;
+    readonly warnings: readonly MemoryErasureWarning[];
+} | {
+    readonly kind: 'refused';
+    /** Legal hold on a fact it reaches: nothing started. */
+    readonly refusal: {
+        readonly code: 'legal-hold';
+        readonly message: string;
+        readonly factIds?: readonly string[];
+    };
+};
+export interface ReplayMemoryErasuresResult {
+    /** Matched to an id in the tenant again: run again. */
+    readonly replayed: readonly string[];
+    /** Put back in the ledger; nothing in the tenant matches (nothing to erase). */
+    readonly restored: readonly string[];
+    /** No keyed hash, or a key this deployment doesn't hold. */
+    readonly unmatched: readonly {
+        readonly id: string;
+        readonly reason: 'no-keyed-hash' | 'unknown-key';
+    }[];
+}
+//# sourceMappingURL=memory-erasure-binding.d.ts.map

package/dist/memory-erasure-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-erasure-binding.d.ts","sourceRoot":"","sources":["../src/memory-erasure-binding.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAE9C;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,KAAK,EAAE;QACZ,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAC5B,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;QACzC,gDAAgD;QAChD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;KAC9B,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACxC,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAC;IACxE,+EAA+E;IAC/E,IAAI,CACF,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GACzD,OAAO,CAAC;QAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,aAAa,EAAE,CAAC;QAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,CAAC;IAClG,oDAAoD;IACpD,YAAY,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,SAAS,wBAAwB,EAAE,CAAC,CAAC;IAC/E;;;;OAIG;IACH,MAAM,CACJ,QAAQ,EAAE,QAAQ,EAClB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE;QAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GACpC,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAC;IACtC,6EAA6E;IAC7E,MAAM,CACJ,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,SAAS,wBAAwB,EAAE,GAC3C,OAAO,CAAC,0BAA0B,CAAC,CAAC;CACxC;AAED;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3B;IACE,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,UAAU,CAAC;QAC1C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;KACrB,CAAC;CACH,GACD;IAAE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC;AAExC,MAAM,MAAM,yBAAyB,GAAG,MAAM,GAAG,aAAa,GAAG,UAAU,GAAG,cAAc,CAAC;AAE7F;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,SAAS,GAAG,gBAAgB,GAAG,WAAW,GAAG,QAAQ,CAAC;AAEpG,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,YAAY,EAAE,yBAAyB,CAAC;IACjD,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,CAAC,EAAE,qBAAqB,CAAC;IAC1C,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;IAChE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,0FAA0F;IAC1F,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,oDAAoD;IACpD,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD,8BAA8B;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,wFAAwF;IACxF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,wFAAwF;IACxF,QAAQ,CAAC,SAAS,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACzE,uCAAuC;IACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,IAAI,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,oFAAoF;AACpF,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,YAAY,EAAE,yBAAyB,CAAC;IACjD,2FAA2F;IAC3F,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,4CAA4C;IAC5C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,oBAAoB;IACnC,gGAAgG;IAChG,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,0BAA0B,GAClC;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACpD,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,wDAAwD;IACxD,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;QAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KACtC,CAAC;CACH,CAAC;AAEN,MAAM,WAAW,0BAA0B;IACzC,uDAAuD;IACvD,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,gFAAgF;IAChF,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,4DAA4D;IAC5D,QAAQ,CAAC,SAAS,EAAE,SAAS;QAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,MAAM,EAAE,eAAe,GAAG,aAAa,CAAC;KAClD,EAAE,CAAC;CACL"}

package/dist/memory-erasure-binding.js

@@ -0,0 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+export {};
+//# sourceMappingURL=memory-erasure-binding.js.map

package/dist/memory-erasure-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-erasure-binding.js","sourceRoot":"","sources":["../src/memory-erasure-binding.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC"}

package/dist/middleware/auth.d.ts

@@ -39,11 +39,27 @@ export interface TokenResolution {
      */
     readonly userId?: UserId;
     /**
-     * The id of a durable API key (`POST /v1/tokens`). The caller is then
-     * the key's service account (`service_account:<tokenId>`), not a user;
-     * the middleware surfaces it as `c.get('tokenId')`.
+     * The id of a durable API key (`POST /v1/tokens`), surfaced as
+     * `c.get('tokenId')`. The caller is the key's principal: `userId` for a
+     * person's key, `serviceAccountId` for a service account's. A key with
+     * neither (a store built before principals) is its own service account,
+     * `service_account:<tokenId>`.
      */
     readonly tokenId?: ApiTokenId;
+    /** The service account an API key acts for (`service_account:<id>`). */
+    readonly serviceAccountId?: string;
+    /**
+     * An API key's role: the most it may do, under its principal's grants.
+     * A `member` key is refused tenant-admin actions even when its principal
+     * is an admin.
+     */
+    readonly tokenRole?: 'admin' | 'member';
+    /**
+     * The project an API key is narrowed to. A request naming another
+     * project is refused (`key-project-mismatch`), and so is an `admin`
+     * action on the tenant.
+     */
+    readonly tokenProjectId?: string;
     /**
      * Optional session id. Populated by the session-token verifier path
      * (`kgi_sk_*` tokens) so `/v1/identity/whoami` and `/v1/auth/logout`
@@ -103,10 +119,41 @@ export interface TokenResolution {
  */
 export declare const SESSION_TOKEN_PREFIX: "kgi_sk_";
 /**
- * Compose the on-wire session token from a `SessionId`. Session tokens
- * are opaque to clients — the shape below is a framework convention,
- * not part of the wire contract. Do NOT parse it in downstream code
- * outside the middleware.
+ * The cookie a browser carries its session token in, when the deployment
+ * turns cookie sessions on (`SessionConfig.cookie`). `__Host-`: Secure,
+ * Path=/, no Domain, so it's sent only to the origin that set it.
+ */
+export declare const SESSION_COOKIE_NAME: "__Host-kindgi_session";
+/**
+ * Cookie sessions: where the middleware reads a browser's session token
+ * when the request has no `Authorization` header.
+ */
+export interface SessionCookieOptions {
+    /** The cookie's name. Default `SESSION_COOKIE_NAME`. */
+    readonly name?: string;
+    /**
+     * The origins a cookie-authenticated request may come from (the
+     * console's origin, e.g. `https://kindgi.example.com`). An unsafe method
+     * (anything but GET, HEAD and OPTIONS) authenticated by the cookie must
+     * carry one of them in `Origin`, else 403 `csrf-origin-mismatch`; so
+     * must a request with no `Origin` at all. Bearer requests are unaffected.
+     */
+    readonly allowedOrigins: readonly string[];
+    /**
+     * Also accept an `Origin` naming the host the request was sent to (its
+     * `Host`, or `X-Forwarded-Host` behind a proxy that sets it): the
+     * console served from the runtime itself, wherever it's reached. For a
+     * deployment that doesn't know its public URL. A cross-site page can't
+     * forge `Origin`, nor add `X-Forwarded-Host` without a CORS preflight.
+     */
+    readonly sameOrigin?: boolean;
+}
+/**
+ * The older session token, `kgi_sk_<sessionId>`, for a session store
+ * without `resolveToken`. A store with it mints its own token
+ * (`SessionCreateOutput.token`), and the routes hand that out instead.
+ * Session tokens are opaque to clients: never parse one outside the
+ * middleware or the store that minted it.
  */
 export declare function encodeSessionToken(sessionId: SessionId): string;
 /**
@@ -135,6 +182,12 @@ export interface BearerAuthMiddlewareOptions {
      * fewer writes but coarser inactivity enforcement. Defaults to 60s.
      */
     readonly touchThrottleMs?: number;
+    /**
+     * Read a session token from a cookie when the request carries no
+     * `Authorization` header (browser sessions). Only `kgi_sk_` tokens are
+     * taken from it, and only with a `sessionStore`.
+     */
+    readonly sessionCookie?: SessionCookieOptions;
     /**
      * Accept public run tokens (`kgi_pt_…`), verified against
      * `signingKey`, on the routes `isAllowed` admits (every other route
@@ -151,9 +204,9 @@ export interface BearerAuthMiddlewareOptions {
  * handlers.
  *
  * Two token flavors are accepted:
- * - `kgi_sk_<sessionId>` — framework-issued OAuth session tokens.
- *   Verified via `sessionStore.get`; expiration + revocation are pulled
- *   from the session row.
+ * - `kgi_sk_…` — session tokens. Verified by the session store
+ *   (`resolveToken`, or `get` for an older store); expiration +
+ *   revocation are pulled from the session row.
  * - anything else — caller-plugged static bearer tokens. Verified via
  *   `resolveToken`. Byte-shape-identical with the session-less contract.
  */
@@ -161,9 +214,9 @@ export declare function bearerAuthMiddleware(resolve: TokenResolver, options?: B
 /**
  * Sentinel `tenantId` value the middleware passes to
  * `SessionStoreBinding.get` when it needs to look up a session by its
- * id without knowing the tenant in advance. Session-store adapters
- * MUST honor this by skipping the tenant filter — the tenant is not
- * known until the session row has been read.
+ * id without knowing the tenant in advance: only for a store without
+ * `resolveToken`. Such stores MUST honor it by skipping the tenant
+ * filter (the tenant is not known until the session row has been read).
  */
 export declare const MULTI_TENANT_LOOKUP: TenantId;
 //# sourceMappingURL=auth.d.ts.map

package/dist/middleware/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAW,iBAAiB,EAAQ,MAAM,MAAM,CAAC;AAE7D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAE7E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAIxD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAEvE;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;AAE/E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC;IAC1B,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C;AAED;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAG,SAAkB,CAAC;AAEvD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,SAAS,GAAG,MAAM,CAE/D;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C;;;;;;;;OAQG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE;QACzB,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;QACvC,QAAQ,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;KAC/D,CAAC;CACH;AAID;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,aAAa,EACtB,OAAO,GAAE,2BAAgC,GACxC,iBAAiB,CA+JnB;AAiDD;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,EAA0D,QAAQ,CAAC"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAW,iBAAiB,EAAQ,MAAM,MAAM,CAAC;AAG7D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAE7E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAIxD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAEvE;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;AAE/E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC;IAC1B,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC;IAC9B,wEAAwE;IACxE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;IACxC;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C;AAED;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAG,SAAkB,CAAC;AAEvD;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAG,uBAAgC,CAAC;AAEpE;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,wDAAwD;IACxD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AAID;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,SAAS,GAAG,MAAM,CAE/D;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C;;;;;;;;OAQG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,oBAAoB,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE;QACzB,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;QACvC,QAAQ,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;KAC/D,CAAC;CACH;AAID;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,aAAa,EACtB,OAAO,GAAE,2BAAgC,GACxC,iBAAiB,CA2LnB;AAuHD;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,EAA0D,QAAQ,CAAC"}

package/dist/middleware/auth.js

@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0
 // Copyright (C) 2026 Kindgi Inc.
+import { getCookie } from 'hono/cookie';
 import { statusFor, toWireError } from '../errors.js';
 import { PUBLIC_RUN_TOKEN_PREFIX, verifyPublicRunToken } from '../public-run-token.js';
 /**
@@ -11,10 +12,18 @@ import { PUBLIC_RUN_TOKEN_PREFIX, verifyPublicRunToken } from '../public-run-tok
  */
 export const SESSION_TOKEN_PREFIX = 'kgi_sk_';
 /**
- * Compose the on-wire session token from a `SessionId`. Session tokens
- * are opaque to clients — the shape below is a framework convention,
- * not part of the wire contract. Do NOT parse it in downstream code
- * outside the middleware.
+ * The cookie a browser carries its session token in, when the deployment
+ * turns cookie sessions on (`SessionConfig.cookie`). `__Host-`: Secure,
+ * Path=/, no Domain, so it's sent only to the origin that set it.
+ */
+export const SESSION_COOKIE_NAME = '__Host-kindgi_session';
+const SAFE_METHODS = new Set(['GET', 'HEAD', 'OPTIONS']);
+/**
+ * The older session token, `kgi_sk_<sessionId>`, for a session store
+ * without `resolveToken`. A store with it mints its own token
+ * (`SessionCreateOutput.token`), and the routes hand that out instead.
+ * Session tokens are opaque to clients: never parse one outside the
+ * middleware or the store that minted it.
  */
 export function encodeSessionToken(sessionId) {
     return `${SESSION_TOKEN_PREFIX}${sessionId}`;
@@ -26,9 +35,9 @@ const DEFAULT_TOUCH_THROTTLE_MS = 60_000;
  * handlers.
  *
  * Two token flavors are accepted:
- * - `kgi_sk_<sessionId>` — framework-issued OAuth session tokens.
- *   Verified via `sessionStore.get`; expiration + revocation are pulled
- *   from the session row.
+ * - `kgi_sk_…` — session tokens. Verified by the session store
+ *   (`resolveToken`, or `get` for an older store); expiration +
+ *   revocation are pulled from the session row.
  * - anything else — caller-plugged static bearer tokens. Verified via
  *   `resolveToken`. Byte-shape-identical with the session-less contract.
  */
@@ -40,26 +49,8 @@ export function bearerAuthMiddleware(resolve, options = {}) {
     // bucket is bounded by the number of active sessions the process
     // has recently observed.
     const touchBucket = new Map();
-    return async (c, next) => {
-        const requestId = c.get('requestId');
-        const header = c.req.header('authorization');
-        if (header === undefined || header.length === 0) {
-            const body = toWireError({ code: 'auth-missing', message: 'Authorization header is required' }, requestId);
-            return c.json(body, statusFor('auth-missing'));
-        }
-        const match = /^Bearer\s+(.+)$/i.exec(header);
-        if (match === null) {
-            const body = toWireError({
-                code: 'auth-missing',
-                message: 'Authorization header must be "Bearer <token>"',
-            }, requestId);
-            return c.json(body, statusFor('auth-missing'));
-        }
-        const token = match[1]?.trim() ?? '';
-        if (token.length === 0) {
-            const body = toWireError({ code: 'auth-missing', message: 'Bearer token is empty' }, requestId);
-            return c.json(body, statusFor('auth-missing'));
-        }
+    // Everything after the token is found: the header's or the cookie's.
+    const authenticate = async (c, next, token, requestId) => {
         if (token.startsWith(PUBLIC_RUN_TOKEN_PREFIX)) {
             return authenticatePublicRunToken(c, next, token, requestId, options.publicRunTokens);
         }
@@ -125,6 +116,18 @@ export function bearerAuthMiddleware(resolve, options = {}) {
         if (resolution.tokenId !== undefined) {
             c.set('tokenId', resolution.tokenId);
         }
+        if (resolution.serviceAccountId !== undefined) {
+            c.set('serviceAccountId', resolution.serviceAccountId);
+        }
+        if (resolution.tokenRole !== undefined) {
+            c.set('tokenRole', resolution.tokenRole);
+        }
+        if (resolution.tokenProjectId !== undefined) {
+            c.set('tokenProjectId', resolution.tokenProjectId);
+        }
+        if (resolution.expiresAt !== undefined && !isSessionToken) {
+            c.set('tokenExpiresAt', resolution.expiresAt);
+        }
         if (resolution.sessionId !== undefined) {
             c.set('sessionId', resolution.sessionId);
         }
@@ -163,6 +166,36 @@ export function bearerAuthMiddleware(resolve, options = {}) {
         await next();
         return;
     };
+    return async (c, next) => {
+        const requestId = c.get('requestId');
+        const header = c.req.header('authorization');
+        if (header === undefined || header.length === 0) {
+            const fromCookie = sessionCookieToken(c, sessionStore, options.sessionCookie);
+            if (fromCookie !== undefined) {
+                const refusal = csrfRefusal(c, options.sessionCookie, requestId);
+                if (refusal !== undefined)
+                    return refusal;
+                c.set('sessionCookieName', options.sessionCookie?.name ?? SESSION_COOKIE_NAME);
+                return authenticate(c, next, fromCookie, requestId);
+            }
+            const body = toWireError({ code: 'auth-missing', message: 'Authorization header is required' }, requestId);
+            return c.json(body, statusFor('auth-missing'));
+        }
+        const match = /^Bearer\s+(.+)$/i.exec(header);
+        if (match === null) {
+            const body = toWireError({
+                code: 'auth-missing',
+                message: 'Authorization header must be "Bearer <token>"',
+            }, requestId);
+            return c.json(body, statusFor('auth-missing'));
+        }
+        const token = match[1]?.trim() ?? '';
+        if (token.length === 0) {
+            const body = toWireError({ code: 'auth-missing', message: 'Bearer token is empty' }, requestId);
+            return c.json(body, statusFor('auth-missing'));
+        }
+        return authenticate(c, next, token, requestId);
+    };
 }
 /**
  * Session-token verification path. Distinct from `TokenResolver` because
@@ -170,29 +203,17 @@ export function bearerAuthMiddleware(resolve, options = {}) {
  * scopes + expiration + revocation) that the store returns natively —
  * we don't want to squeeze that shape through the resolver contract.
  *
- * Session-token tenant scoping: the stored session is the source of
- * truth for `tenantId`. We look up ACROSS tenants here — the resolved
- * `tenantId` is whatever the session was written under, so everything
- * downstream is scoped to that tenant only. A stolen session token still
- * can't cross tenants because the session it points to belongs to
- * exactly one tenant.
+ * A store with `resolveToken` gets the whole token: it reads the tenant
+ * from it, looks only in that tenant and compares a hash, so nothing is
+ * read across tenants before the token is authenticated. The session it
+ * returns is authoritative for `tenantId`.
  *
- * Since `SessionStoreBinding.get` requires `tenantId`, the lookup is:
- * extract `sessionId` from the token, then call
- * `sessionStore.get({ tenantId: MULTI_TENANT_LOOKUP, sessionId })`.
- * Session-store implementations MUST recognize the `MULTI_TENANT_LOOKUP`
- * sentinel and skip the tenant filter; the `tenantId` on the stored
- * session is authoritative.
+ * A store without it gets the older lookup: the token's remainder is the
+ * session id, read with `get({ tenantId: MULTI_TENANT_LOOKUP, sessionId })`,
+ * which such stores must honor by skipping the tenant filter.
  */
 async function resolveSessionToken(sessionStore, token) {
-    const sessionIdStr = token.slice(SESSION_TOKEN_PREFIX.length);
-    if (sessionIdStr.length === 0)
-        return null;
-    const sessionId = sessionIdStr;
-    const session = await sessionStore.get({
-        tenantId: MULTI_TENANT_LOOKUP,
-        sessionId,
-    });
+    const session = await findSession(sessionStore, token);
     if (session === null)
         return null;
     return {
@@ -209,12 +230,84 @@ async function resolveSessionToken(sessionStore, token) {
         }),
     };
 }
+/**
+ * The session token in the request's cookie, when cookie sessions are on
+ * and the cookie holds a session token; `undefined` otherwise (an API
+ * key or any other token is never taken from a cookie).
+ */
+function sessionCookieToken(c, sessionStore, cookie) {
+    if (cookie === undefined || sessionStore === undefined)
+        return undefined;
+    const value = getCookie(c, cookie.name ?? SESSION_COOKIE_NAME)?.trim();
+    if (value === undefined || !value.startsWith(SESSION_TOKEN_PREFIX))
+        return undefined;
+    return value;
+}
+/**
+ * A cookie-authenticated unsafe request must come from an allowed origin:
+ * a browser always sends `Origin` on such requests, and a cross-site page
+ * can't forge it. A missing `Origin` is refused too.
+ */
+function csrfRefusal(c, cookie, requestId) {
+    if (SAFE_METHODS.has(c.req.method))
+        return undefined;
+    const origin = c.req.header('origin');
+    if (origin !== undefined && cookie.allowedOrigins.includes(origin))
+        return undefined;
+    if (origin !== undefined && cookie.sameOrigin === true && isSameHost(c, origin))
+        return undefined;
+    const body = toWireError({
+        code: 'csrf-origin-mismatch',
+        message: origin === undefined
+            ? 'A request signed in by the session cookie must say where it comes from (Origin)'
+            : `A request signed in by the session cookie can't come from ${origin}`,
+    }, requestId);
+    return c.json(body, statusFor('csrf-origin-mismatch'));
+}
+/**
+ * Whether `origin` names the host this request was sent to, over https (or
+ * plain http on loopback, for local development). The session cookie is
+ * `__Host-` and Secure, so a browser holding it is on https: a plain-http
+ * page on the same host (an on-path attacker's) is not the same origin.
+ */
+function isSameHost(c, origin) {
+    let host;
+    try {
+        const url = new URL(origin);
+        if (url.protocol !== 'https:' && !(url.protocol === 'http:' && isLoopback(url.hostname))) {
+            return false;
+        }
+        host = url.host;
+    }
+    catch {
+        return false;
+    }
+    // The request's own URL carries its Host (the Node server builds it from it).
+    const sentTo = [
+        new URL(c.req.url).host,
+        c.req.header('host'),
+        c.req.header('x-forwarded-host')?.split(',')[0]?.trim(),
+    ];
+    return sentTo.some((h) => h !== undefined && h !== '' && h.toLowerCase() === host.toLowerCase());
+}
+async function findSession(sessionStore, token) {
+    if (sessionStore.resolveToken !== undefined) {
+        return sessionStore.resolveToken({ token });
+    }
+    const sessionIdStr = token.slice(SESSION_TOKEN_PREFIX.length);
+    if (sessionIdStr.length === 0)
+        return null;
+    return sessionStore.get({
+        tenantId: MULTI_TENANT_LOOKUP,
+        sessionId: sessionIdStr,
+    });
+}
 /**
  * Sentinel `tenantId` value the middleware passes to
  * `SessionStoreBinding.get` when it needs to look up a session by its
- * id without knowing the tenant in advance. Session-store adapters
- * MUST honor this by skipping the tenant filter — the tenant is not
- * known until the session row has been read.
+ * id without knowing the tenant in advance: only for a store without
+ * `resolveToken`. Such stores MUST honor it by skipping the tenant
+ * filter (the tenant is not known until the session row has been read).
  */
 export const MULTI_TENANT_LOOKUP = '__kindgi_session_multi_tenant_lookup__';
 /**
@@ -244,4 +337,11 @@ async function authenticatePublicRunToken(c, next, token, requestId, config) {
     await next();
     return undefined;
 }
+/** `localhost`, `127.0.0.0/8` or `::1`. */
+function isLoopback(hostname) {
+    return (hostname === 'localhost' ||
+        hostname === '[::1]' ||
+        hostname === '::1' ||
+        /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(hostname));
+}
 //# sourceMappingURL=auth.js.map

package/dist/middleware/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AASjC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAgGvF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,SAAkB,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAoB;IACrD,OAAO,GAAG,oBAAoB,GAAG,SAA8B,EAAE,CAAC;AACpE,CAAC;AAuCD,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAEzC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAsB,EACtB,UAAuC,EAAE;IAEzC,MAAM,EAAE,YAAY,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAC;IACtD,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,yBAAyB,CAAC;IAC7E,+DAA+D;IAC/D,gEAAgE;IAChE,iEAAiE;IACjE,yBAAyB;IACzB,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC9C,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAW,CAAC;QAC/C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC7C,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,GAAG,WAAW,CACtB,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,kCAAkC,EAAE,EACrE,SAAS,CACV,CAAC;YACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,cAAc,CAAU,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,GAAG,WAAW,CACtB;gBACE,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,+CAA+C;aACzD,EACD,SAAS,CACV,CAAC;YACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,cAAc,CAAU,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,WAAW,CACtB,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAC1D,SAAS,CACV,CAAC;YACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,cAAc,CAAU,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,KAAK,CAAC,UAAU,CAAC,uBAAuB,CAAC,EAAE,CAAC;YAC9C,OAAO,0BAA0B,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;QACxF,CAAC;QAED,MAAM,cAAc,GAAG,YAAY,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;QAC5F,MAAM,UAAU,GAAG,cAAc;YAC/B,CAAC,CAAC,MAAM,mBAAmB,CAAC,YAAa,EAAE,KAAK,CAAC;YACjD,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,WAAW,CACtB,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,gCAAgC,EAAE,EACnE,SAAS,CACV,CAAC;YACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,cAAc,CAAU,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,UAAU,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAChC,kEAAkE;YAClE,iEAAiE;YACjE,+DAA+D;YAC/D,gEAAgE;YAChE,6CAA6C;YAC7C,IAAI,UAAU,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;gBAChC,MAAM,IAAI,GAAG,WAAW,CACtB;oBACE,IAAI,EAAE,uBAAuB;oBAC7B,OAAO,EAAE,8EAA8E;iBACxF,EACD,SAAS,CACV,CAAC;gBACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,uBAAuB,CAAU,CAAC,CAAC;YACnE,CAAC;YACD,MAAM,IAAI,GAAG,WAAW,CACtB,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,+BAA+B,EAAE,EAClE,SAAS,CACV,CAAC;YACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,cAAc,CAAU,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,UAAU,CAAC,SAAS,KAAK,SAAS,IAAI,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACtF,yDAAyD;YACzD,6DAA6D;YAC7D,MAAM,WAAW,GAAG,cAAc,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,cAAc,CAAC;YACxE,MAAM,UAAU,GAAG,cAAc;gBAC/B,CAAC,CAAC,4CAA4C;gBAC9C,CAAC,CAAC,0BAA0B,CAAC;YAC/B,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,SAAS,CAAC,CAAC;YAChF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;QACvD,CAAC;QACD,mEAAmE;QACnE,gEAAgE;QAChE,mEAAmE;QACnE,iEAAiE;QACjE,cAAc;QACd,IACE,cAAc;YACd,mBAAmB,KAAK,SAAS;YACjC,mBAAmB,GAAG,CAAC;YACvB,UAAU,CAAC,YAAY,KAAK,SAAS,EACrC,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,mBAAmB,CAAC;YAChD,IAAI,UAAU,CAAC,YAAY,CAAC,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;gBAC/C,MAAM,IAAI,GAAG,WAAW,CACtB;oBACE,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,qDAAqD;iBAC/D,EACD,SAAS,CACV,CAAC;gBACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,kBAAkB,CAAU,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;QAED,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,UAAU,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAC1C,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,UAAU,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACrC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,UAAU,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACvC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,UAAU,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACxC,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,UAAU,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAC1C,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC;QACjD,CAAC;QAED,gEAAgE;QAChE,iEAAiE;QACjE,4DAA4D;QAC5D,IAAI,cAAc,IAAI,YAAY,EAAE,KAAK,KAAK,SAAS,IAAI,UAAU,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAC9F,MAAM,GAAG,GAAG,UAAU,CAAC,SAA8B,CAAC;YACtD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,IAAI,GAAG,GAAG,IAAI,IAAI,eAAe,EAAE,CAAC;gBAClC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBAC1B,4DAA4D;gBAC5D,6DAA6D;gBAC7D,2DAA2D;gBAC3D,KAAK,YAAY;qBACd,KAAK,CAAC;oBACL,QAAQ,EAAE,UAAU,CAAC,QAAQ;oBAC7B,SAAS,EAAE,UAAU,CAAC,SAAS;oBAC/B,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC;iBAClB,CAAC;qBACD,KAAK,CAAC,GAAG,EAAE;oBACV,0CAA0C;gBAC5C,CAAC,CAAC,CAAC;YACP,CAAC;QACH,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;QACb,OAAO;IACT,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,KAAK,UAAU,mBAAmB,CAChC,YAAiC,EACjC,KAAa;IAEb,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC9D,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,SAAS,GAAG,YAAoC,CAAC;IACvD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC;QACrC,QAAQ,EAAE,mBAAmB;QAC7B,SAAS;KACV,CAAC,CAAC;IACH,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,MAAM,EAAE,OAAO,CAAC,MAA2B;QAC3C,SAAS,EAAE,OAAO,CAAC,EAAE;QACrB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,SAA8B,CAAC;QAC3D,OAAO,EAAE,OAAO,CAAC,SAAS,KAAK,SAAS;QACxC,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACzD,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,IAAI;YACxC,YAAY,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,YAAiC,CAAC;SAClE,CAAC;KACH,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,wCAA+D,CAAC;AAEnG;;;;GAIG;AACH,KAAK,UAAU,0BAA0B,CACvC,CAAU,EACV,IAAU,EACV,KAAa,EACb,SAAiB,EACjB,MAAsD;IAEtD,MAAM,QAAQ,GACZ,MAAM,KAAK,SAAS;QAClB,CAAC,CAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAY;QACnD,CAAC,CAAC,oBAAoB,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IACrE,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC;QAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC;QACvD,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,gCAAgC,CAAC;QAC5F,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,SAAS,CAAC,EAAE,SAAS,CAAC,IAAI,CAAU,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACxE,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;YACE,IAAI,EAAE,mBAAmB;YACzB,OAAO,EACL,8HAA8H;SACjI,EACD,SAAS,CACV,EACD,SAAS,CAAC,mBAAmB,CAAU,CACxC,CAAC;IACJ,CAAC;IACD,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IACjC,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,IAAI,EAAE,CAAC;IACb,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAGjC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAOxC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAgHvF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,SAAkB,CAAC;AAEvD;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,uBAAgC,CAAC;AA2BpE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAEzD;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAoB;IACrD,OAAO,GAAG,oBAAoB,GAAG,SAA8B,EAAE,CAAC;AACpE,CAAC;AA6CD,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAEzC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAsB,EACtB,UAAuC,EAAE;IAEzC,MAAM,EAAE,YAAY,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAC;IACtD,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,yBAAyB,CAAC;IAC7E,+DAA+D;IAC/D,gEAAgE;IAChE,iEAAiE;IACjE,yBAAyB;IACzB,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC9C,qEAAqE;IACrE,MAAM,YAAY,GAAG,KAAK,EACxB,CAAU,EACV,IAAU,EACV,KAAa,EACb,SAAiB,EACc,EAAE;QACjC,IAAI,KAAK,CAAC,UAAU,CAAC,uBAAuB,CAAC,EAAE,CAAC;YAC9C,OAAO,0BAA0B,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;QACxF,CAAC;QAED,MAAM,cAAc,GAAG,YAAY,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;QAC5F,MAAM,UAAU,GAAG,cAAc;YAC/B,CAAC,CAAC,MAAM,mBAAmB,CAAC,YAAa,EAAE,KAAK,CAAC;YACjD,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,WAAW,CACtB,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,gCAAgC,EAAE,EACnE,SAAS,CACV,CAAC;YACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,cAAc,CAAU,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,UAAU,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAChC,kEAAkE;YAClE,iEAAiE;YACjE,+DAA+D;YAC/D,gEAAgE;YAChE,6CAA6C;YAC7C,IAAI,UAAU,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;gBAChC,MAAM,IAAI,GAAG,WAAW,CACtB;oBACE,IAAI,EAAE,uBAAuB;oBAC7B,OAAO,EAAE,8EAA8E;iBACxF,EACD,SAAS,CACV,CAAC;gBACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,uBAAuB,CAAU,CAAC,CAAC;YACnE,CAAC;YACD,MAAM,IAAI,GAAG,WAAW,CACtB,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,+BAA+B,EAAE,EAClE,SAAS,CACV,CAAC;YACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,cAAc,CAAU,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,UAAU,CAAC,SAAS,KAAK,SAAS,IAAI,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACtF,yDAAyD;YACzD,6DAA6D;YAC7D,MAAM,WAAW,GAAG,cAAc,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,cAAc,CAAC;YACxE,MAAM,UAAU,GAAG,cAAc;gBAC/B,CAAC,CAAC,4CAA4C;gBAC9C,CAAC,CAAC,0BAA0B,CAAC;YAC/B,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,SAAS,CAAC,CAAC;YAChF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;QACvD,CAAC;QACD,mEAAmE;QACnE,gEAAgE;QAChE,mEAAmE;QACnE,iEAAiE;QACjE,cAAc;QACd,IACE,cAAc;YACd,mBAAmB,KAAK,SAAS;YACjC,mBAAmB,GAAG,CAAC;YACvB,UAAU,CAAC,YAAY,KAAK,SAAS,EACrC,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,mBAAmB,CAAC;YAChD,IAAI,UAAU,CAAC,YAAY,CAAC,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;gBAC/C,MAAM,IAAI,GAAG,WAAW,CACtB;oBACE,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,qDAAqD;iBAC/D,EACD,SAAS,CACV,CAAC;gBACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,kBAAkB,CAAU,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;QAED,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,UAAU,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAC1C,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,UAAU,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACrC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,UAAU,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;YAC9C,CAAC,CAAC,GAAG,CAAC,kBAAkB,EAAE,UAAU,CAAC,gBAAgB,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,UAAU,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACvC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,UAAU,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YAC5C,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,UAAU,CAAC,cAAc,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,UAAU,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,cAAc,EAAE,CAAC;YAC1D,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,UAAU,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACvC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,UAAU,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACxC,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,UAAU,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAC1C,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC;QACjD,CAAC;QAED,gEAAgE;QAChE,iEAAiE;QACjE,4DAA4D;QAC5D,IAAI,cAAc,IAAI,YAAY,EAAE,KAAK,KAAK,SAAS,IAAI,UAAU,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAC9F,MAAM,GAAG,GAAG,UAAU,CAAC,SAA8B,CAAC;YACtD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,IAAI,GAAG,GAAG,IAAI,IAAI,eAAe,EAAE,CAAC;gBAClC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBAC1B,4DAA4D;gBAC5D,6DAA6D;gBAC7D,2DAA2D;gBAC3D,KAAK,YAAY;qBACd,KAAK,CAAC;oBACL,QAAQ,EAAE,UAAU,CAAC,QAAQ;oBAC7B,SAAS,EAAE,UAAU,CAAC,SAAS;oBAC/B,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC;iBAClB,CAAC;qBACD,KAAK,CAAC,GAAG,EAAE;oBACV,0CAA0C;gBAC5C,CAAC,CAAC,CAAC;YACP,CAAC;QACH,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;QACb,OAAO;IACT,CAAC,CAAC;IACF,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAW,CAAC;QAC/C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC7C,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChD,MAAM,UAAU,GAAG,kBAAkB,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;YAC9E,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7B,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,EAAE,OAAO,CAAC,aAAqC,EAAE,SAAS,CAAC,CAAC;gBACzF,IAAI,OAAO,KAAK,SAAS;oBAAE,OAAO,OAAO,CAAC;gBAC1C,CAAC,CAAC,GAAG,CAAC,mBAAmB,EAAE,OAAO,CAAC,aAAa,EAAE,IAAI,IAAI,mBAAmB,CAAC,CAAC;gBAC/E,OAAO,YAAY,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;YACtD,CAAC;YACD,MAAM,IAAI,GAAG,WAAW,CACtB,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,kCAAkC,EAAE,EACrE,SAAS,CACV,CAAC;YACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,cAAc,CAAU,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,GAAG,WAAW,CACtB;gBACE,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,+CAA+C;aACzD,EACD,SAAS,CACV,CAAC;YACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,cAAc,CAAU,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,WAAW,CACtB,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAC1D,SAAS,CACV,CAAC;YACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,cAAc,CAAU,CAAC,CAAC;QAC1D,CAAC;QAED,OAAO,YAAY,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IACjD,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,KAAK,UAAU,mBAAmB,CAChC,YAAiC,EACjC,KAAa;IAEb,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IACvD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,MAAM,EAAE,OAAO,CAAC,MAA2B;QAC3C,SAAS,EAAE,OAAO,CAAC,EAAE;QACrB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,SAA8B,CAAC;QAC3D,OAAO,EAAE,OAAO,CAAC,SAAS,KAAK,SAAS;QACxC,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACzD,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,IAAI;YACxC,YAAY,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,YAAiC,CAAC;SAClE,CAAC;KACH,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CACzB,CAAU,EACV,YAA6C,EAC7C,MAAwC;IAExC,IAAI,MAAM,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzE,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,IAAI,mBAAmB,CAAC,EAAE,IAAI,EAAE,CAAC;IACvE,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,oBAAoB,CAAC;QAAE,OAAO,SAAS,CAAC;IACrF,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAClB,CAAU,EACV,MAA4B,EAC5B,SAAiB;IAEjB,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IACrD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IACrF,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAClG,MAAM,IAAI,GAAG,WAAW,CACtB;QACE,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EACL,MAAM,KAAK,SAAS;YAClB,CAAC,CAAC,iFAAiF;YACnF,CAAC,CAAC,6DAA6D,MAAM,EAAE;KAC5E,EACD,SAAS,CACV,CAAC;IACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,sBAAsB,CAAU,CAAC,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CAAC,CAAU,EAAE,MAAc;IAC5C,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YACzF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,8EAA8E;IAC9E,MAAM,MAAM,GAAG;QACb,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI;QACvB,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;QACpB,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;KACxD,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;AACnG,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,YAAiC,EAAE,KAAa;IACzE,IAAI,YAAY,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC5C,OAAO,YAAY,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC9D,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,OAAO,YAAY,CAAC,GAAG,CAAC;QACtB,QAAQ,EAAE,mBAAmB;QAC7B,SAAS,EAAE,YAAoC;KAChD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,wCAA+D,CAAC;AAEnG;;;;GAIG;AACH,KAAK,UAAU,0BAA0B,CACvC,CAAU,EACV,IAAU,EACV,KAAa,EACb,SAAiB,EACjB,MAAsD;IAEtD,MAAM,QAAQ,GACZ,MAAM,KAAK,SAAS;QAClB,CAAC,CAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAY;QACnD,CAAC,CAAC,oBAAoB,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IACrE,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC;QAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC;QACvD,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,gCAAgC,CAAC;QAC5F,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,SAAS,CAAC,EAAE,SAAS,CAAC,IAAI,CAAU,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACxE,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;YACE,IAAI,EAAE,mBAAmB;YACzB,OAAO,EACL,8HAA8H;SACjI,EACD,SAAS,CACV,EACD,SAAS,CAAC,mBAAmB,CAAU,CACxC,CAAC;IACJ,CAAC;IACD,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IACjC,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,IAAI,EAAE,CAAC;IACb,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,2CAA2C;AAC3C,SAAS,UAAU,CAAC,QAAgB;IAClC,OAAO,CACL,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,OAAO;QACpB,QAAQ,KAAK,KAAK;QAClB,kCAAkC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAClD,CAAC;AACJ,CAAC"}

package/dist/middleware/authorize.d.ts

@@ -21,6 +21,15 @@ export interface Authorizer {
      * what they'd be allowed to touch.
      */
     readonly filterByCan: <T>(c: Context<AppEnv>, action: Action, items: readonly T[], refFn: (item: T) => ResourceRef) => Promise<T[]>;
+    /**
+     * The ids of every object of `type` the caller may `action`
+     * (`AuthzCheckBinding.listObjects`), within its API key's limits as
+     * `filterByCan` holds them: a key limited to a project lists no project
+     * but its own, and other types as a check decides them (it still reads
+     * the orgs its user reads); `undefined` when the binding can't list, so
+     * the caller falls back to `filterByCan`.
+     */
+    readonly listObjects?: (c: Context<AppEnv>, action: Action, type: ResourceRef['type']) => Promise<readonly string[] | undefined>;
 }
 export declare function createAuthorizer(binding: AuthzCheckBinding): Authorizer;
 //# sourceMappingURL=authorize.d.ts.map

package/dist/middleware/authorize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../src/middleware/authorize.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAEvD,OAAO,EACL,KAAK,MAAM,EACX,KAAK,iBAAiB,EACtB,KAAK,QAAQ,EAEb,KAAK,WAAW,EAEjB,MAAM,eAAe,CAAC;AAGvB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;AAExF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,KAAK,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC/F,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9F,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjG;;;;;;;;OAQG;IACH,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,EACtB,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,EAClB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,SAAS,CAAC,EAAE,EACnB,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,WAAW,KAC5B,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;CACnB;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,GAAG,UAAU,CA+EvE"}
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../src/middleware/authorize.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAEvD,OAAO,EACL,KAAK,MAAM,EACX,KAAK,iBAAiB,EACtB,KAAK,QAAQ,EAIb,KAAK,WAAW,EAEjB,MAAM,eAAe,CAAC;AAGvB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;AAExF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,KAAK,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC/F,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9F,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjG;;;;;;;;OAQG;IACH,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,EACtB,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,EAClB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,SAAS,CAAC,EAAE,EACnB,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,WAAW,KAC5B,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IAClB;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CACrB,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,EAClB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,KACtB,OAAO,CAAC,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;CAC7C;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,GAAG,UAAU,CAgJvE"}