@mybuildex/pkg 0.3.4 → 0.4.0

package/README.md

@@ -26,6 +26,29 @@ const mt = createMultitenantPrisma({
 
 A lib **não** depende de `@prisma/client`/`mariadb`: cada API injeta o client gerado e o driver nas versões dela.
 
+## 0.4.0 — concorrência e isolamento entre escolas
+
+Quatro módulos novos, todos opt-in (nada muda numa API que não os usar):
+
+- `createRequestScopePlugin()` + `requestScoped(Ctor, ...args)` — escopo por request via `AsyncLocalStorage`. Resolve o padrão `const service = new XService(fastify)` + `service.setRequest(request)` no preHandler, que compartilhava `this.request` (e o `request.prisma` do tenant) entre requests concorrentes. Troca mecânica: `new XService(fastify)` → `requestScoped(XService, fastify)`; registrar o plugin antes dos controllers. Uso fora de request lança `RequestScopeError`.
+- `createTenantMembershipAssert({getTenantClient})` — o `assertTenant` pronto: consulta `users.firebase_id = uid` no schema do `:id_school` da URL; sem vínculo → 403. Fail-closed em erro de banco; cache positivo por `escola:uid` (120 s).
+- `createTenantMiddleware({..., strictTenant: true})` — `id_school` presente mas inválido responde 400 (`InvalidTenantError`) em vez de cair no client default, que é a escola do `DATABASE_URL`. Sem `id_school` nenhum, o default continua.
+- `createSharedSecretGuard({env: "INTERNAL_API_SECRET", header: "x-internal-secret"})` — `preHandler` para rotas chamadas entre APIs (ex: `emailsend`): compara o segredo do env em tempo constante; 401 se inválido, 503 (fail-closed) se a variável não existe em produção.
+- `publicRoute(recurso, sufixo, {methods, prefix})`, `publicPath`, `isPublicRoute`, `safeEqual` — rotas públicas ancoradas (`^/v1/\d+/recurso/sufixo$`, com filtro de método) no lugar de regex de substring, e comparação de segredo/HMAC em tempo constante. `createAuthMiddleware.publicRoutes` aceita as regras e continua aceitando `RegExp`.
+
+```ts
+import {createRequestScopePlugin, requestScoped, createTenantMembershipAssert, publicRoute} from "@mybuildex/pkg";
+
+await createRequestScopePlugin()(fastify);            // antes do autoload dos módulos
+const service = requestScoped(PayService, fastify);   // em cada controller
+createAuthMiddleware({
+  publicRoutes: [publicRoute("pay_checkouts", "public/new", {methods: ["POST"]})],
+  assertTenant: createTenantMembershipAssert({getTenantClient}),
+  ...
+});
+createTenantMiddleware({getTenantClient, defaultClient, strictTenant: true});
+```
+
 ## Consumo pelas APIs (npmjs público)
 
 O pacote é publicado **público no npmjs** — só o `dist/` compilado vai no tarball (`files: ["dist"]`); testes e repo continuam privados. Zero token: `npm i` funciona no dev, no Actions e no build do GCP.

package/dist/http/public-route.d.ts

@@ -0,0 +1,33 @@
+export interface PublicRouteOptions {
+    /** Prefixo opcional antes de /v1 (ex: "v2_payments" quando a função recebe
+     *  o path completo). Aceito como opcional na regex: casa com e sem ele. */
+    prefix?: string;
+    /** Versão da rota (default "v1") */
+    version?: string;
+    /** Métodos HTTP liberados (default: todos). Comparação case-insensitive. */
+    methods?: string[];
+}
+export interface PublicRouteRule {
+    pattern: RegExp;
+    methods?: string[];
+}
+/**
+ * Regra de rota pública ancorada: `^(/prefix)?/v1/\d+/recurso(/sufixo)?$`.
+ * Exemplos:
+ *   publicRoute("pay_checkouts", "public/new")            -> POST /v1/3/pay_checkouts/public/new
+ *   publicRoute("pay", "public/:hash")                    -> /v1/3/pay/public/eyJ...
+ *   publicRoute("pay_products", ":id", {methods: ["GET"]}) -> só GET /v1/3/pay_products/7
+ */
+export declare function publicRoute(resource: string, suffix?: string, options?: PublicRouteOptions): PublicRouteRule;
+/** Rota pública fora do padrão /v1/:id_school (ex: documentação): regex ancorada literal. */
+export declare function publicPath(pathname: string, options?: {
+    methods?: string[];
+}): PublicRouteRule;
+export type PublicRouteLike = RegExp | PublicRouteRule;
+/** Um pathname (sem query string) + método casam com alguma regra? */
+export declare function isPublicRoute(rules: PublicRouteLike[], pathname: string, method?: string): boolean;
+/**
+ * Comparação em tempo constante. Devolve false (nunca lança) quando qualquer
+ * lado não é string ou quando os tamanhos diferem.
+ */
+export declare function safeEqual(a: unknown, b: unknown): boolean;

package/dist/http/public-route.js

@@ -0,0 +1,91 @@
+"use strict";
+// Rotas públicas ANCORADAS e comparação segura de segredos.
+//
+// As APIs liberavam rotas públicas com regex de substring
+// (`/\/public\b/`, `/\/pay_products\/\b/`): qualquer path que contivesse o
+// trecho passava sem token — inclusive `/pay_products/delete/5`. `publicRoute`
+// gera uma regex ancorada no formato real das rotas (`/v1/:id_school/recurso/
+// sufixo`), opcionalmente restrita a métodos HTTP.
+//
+// `safeEqual` encapsula `crypto.timingSafeEqual` para comparar assinaturas de
+// webhook e segredos sem vazar o ponto de divergência pelo tempo de resposta,
+// e sem lançar quando os tamanhos diferem.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.publicRoute = publicRoute;
+exports.publicPath = publicPath;
+exports.isPublicRoute = isPublicRoute;
+exports.safeEqual = safeEqual;
+const node_crypto_1 = require("node:crypto");
+function escapeSegment(segment) {
+    return segment.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/** Converte "public/:hash" em "public/[^/]+" (cada :param vira um segmento).
+ *  Um param pode restringir o formato: ":id(\\d+)" vira "(?:\\d+)". */
+function suffixToPattern(suffix) {
+    if (!suffix)
+        return "";
+    return "/" + suffix
+        .replace(/^\/+|\/+$/g, "")
+        .split("/")
+        .map(part => {
+        const param = /^:[A-Za-z_][A-Za-z0-9_]*(?:\((.+)\))?$/.exec(part);
+        if (!param)
+            return escapeSegment(part);
+        return param[1] ? `(?:${param[1]})` : "[^/]+";
+    })
+        .join("/");
+}
+/**
+ * Regra de rota pública ancorada: `^(/prefix)?/v1/\d+/recurso(/sufixo)?$`.
+ * Exemplos:
+ *   publicRoute("pay_checkouts", "public/new")            -> POST /v1/3/pay_checkouts/public/new
+ *   publicRoute("pay", "public/:hash")                    -> /v1/3/pay/public/eyJ...
+ *   publicRoute("pay_products", ":id", {methods: ["GET"]}) -> só GET /v1/3/pay_products/7
+ */
+function publicRoute(resource, suffix = "", options = {}) {
+    const version = escapeSegment(options.version ?? "v1");
+    const prefix = options.prefix ? `(?:/${escapeSegment(options.prefix.replace(/^\/+|\/+$/g, ""))})?` : "";
+    const source = `^${prefix}/${version}/\\d+/${escapeSegment(resource)}${suffixToPattern(suffix)}$`;
+    const rule = { pattern: new RegExp(source) };
+    if (options.methods && options.methods.length) {
+        rule.methods = options.methods.map(m => m.toUpperCase());
+    }
+    return rule;
+}
+/** Rota pública fora do padrão /v1/:id_school (ex: documentação): regex ancorada literal. */
+function publicPath(pathname, options = {}) {
+    const rule = { pattern: new RegExp(`^${escapeSegment(pathname)}$`) };
+    if (options.methods && options.methods.length)
+        rule.methods = options.methods.map(m => m.toUpperCase());
+    return rule;
+}
+/** Um pathname (sem query string) + método casam com alguma regra? */
+function isPublicRoute(rules, pathname, method = "GET") {
+    const upper = String(method || "GET").toUpperCase();
+    for (const rule of rules) {
+        if (rule instanceof RegExp) {
+            if (rule.test(pathname))
+                return true;
+            continue;
+        }
+        if (!rule.pattern.test(pathname))
+            continue;
+        if (!rule.methods || rule.methods.includes(upper))
+            return true;
+    }
+    return false;
+}
+/**
+ * Comparação em tempo constante. Devolve false (nunca lança) quando qualquer
+ * lado não é string ou quando os tamanhos diferem.
+ */
+function safeEqual(a, b) {
+    if (typeof a !== "string" || typeof b !== "string")
+        return false;
+    const bufA = Buffer.from(a, "utf8");
+    const bufB = Buffer.from(b, "utf8");
+    if (bufA.length !== bufB.length)
+        return false;
+    return (0, node_crypto_1.timingSafeEqual)(bufA, bufB);
+}
+//# sourceMappingURL=public-route.js.map

package/dist/http/public-route.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-route.js","sourceRoot":"","sources":["../../src/http/public-route.ts"],"names":[],"mappings":";AAAA,4DAA4D;AAC5D,EAAE;AACF,0DAA0D;AAC1D,2EAA2E;AAC3E,+EAA+E;AAC/E,8EAA8E;AAC9E,mDAAmD;AACnD,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,2CAA2C;;AA6C3C,kCASC;AAGD,gCAIC;AAKD,sCAWC;AAMD,8BAMC;AAvFD,6CAA4C;AAiB5C,SAAS,aAAa,CAAC,OAAe;IAClC,OAAO,OAAO,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAC1D,CAAC;AAED;uEACuE;AACvE,SAAS,eAAe,CAAC,MAAc;IACnC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,OAAO,GAAG,GAAG,MAAM;SACd,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;SACzB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,IAAI,CAAC,EAAE;QACR,MAAM,KAAK,GAAG,wCAAwC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK;YAAE,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;IAClD,CAAC,CAAC;SACD,IAAI,CAAC,GAAG,CAAC,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,WAAW,CAAC,QAAgB,EAAE,SAAiB,EAAE,EAAE,UAA8B,EAAE;IAC/F,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACxG,MAAM,MAAM,GAAG,IAAI,MAAM,IAAI,OAAO,SAAS,aAAa,CAAC,QAAQ,CAAC,GAAG,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC;IAClG,MAAM,IAAI,GAAoB,EAAC,OAAO,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,EAAC,CAAC;IAC5D,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QAC5C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,6FAA6F;AAC7F,SAAgB,UAAU,CAAC,QAAgB,EAAE,UAAgC,EAAE;IAC3E,MAAM,IAAI,GAAoB,EAAC,OAAO,EAAE,IAAI,MAAM,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAC,CAAC;IACpF,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM;QAAE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IACxG,OAAO,IAAI,CAAC;AAChB,CAAC;AAID,sEAAsE;AACtE,SAAgB,aAAa,CAAC,KAAwB,EAAE,QAAgB,EAAE,SAAiB,KAAK;IAC5F,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IACpD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,IAAI,IAAI,YAAY,MAAM,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrC,SAAS;QACb,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,SAAS;QAC3C,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;IACnE,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,SAAgB,SAAS,CAAC,CAAU,EAAE,CAAU;IAC5C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACjE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,IAAA,6BAAe,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACvC,CAAC"}

package/dist/http/shared-secret.d.ts

@@ -0,0 +1,14 @@
+export interface SharedSecretGuardOptions {
+    /** Nome da variável de ambiente com o segredo (default INTERNAL_API_SECRET) */
+    env?: string;
+    /** Header lido no request (default x-internal-secret) */
+    header?: string;
+    /** Aceitar o segredo também por query string com esse nome (default: não) */
+    query?: string;
+    /** Sem a variável e fora de produção: liberar (default false) */
+    allowMissingInDev?: boolean;
+    /** Considerado produção quando true (default: NODE_ENV === "production") */
+    isProduction?: () => boolean;
+    log?: (message: string) => void;
+}
+export declare function createSharedSecretGuard(options?: SharedSecretGuardOptions): (request: any, reply: any) => Promise<any>;

package/dist/http/shared-secret.js

@@ -0,0 +1,37 @@
+"use strict";
+// Guard de segredo compartilhado para chamadas ENTRE APIs (ex: v2_payments ->
+// v1_atendimento/emailsend). O valor vem de env (Secret Manager, o mesmo nas
+// duas functions); a comparação é em tempo constante (safeEqual).
+//
+// Fail-closed: em produção, sem a variável configurada a rota responde 503 e
+// loga — nunca fica aberta por omissão. Fora de produção, `allowMissingInDev`
+// libera explicitamente (nunca por hostname).
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createSharedSecretGuard = createSharedSecretGuard;
+const public_route_1 = require("./public-route");
+function createSharedSecretGuard(options = {}) {
+    const ENV = options.env ?? "INTERNAL_API_SECRET";
+    const HEADER = (options.header ?? "x-internal-secret").toLowerCase();
+    const QUERY = options.query;
+    const isProduction = options.isProduction ?? (() => process.env.NODE_ENV === "production");
+    const log = options.log ?? ((m) => console.error(m));
+    /** preHandler/onRequest do Fastify: `{preHandler: guard}` na rota interna */
+    return async function sharedSecretGuard(request, reply) {
+        const expected = process.env[ENV];
+        if (!expected) {
+            if (!isProduction() && options.allowMissingInDev)
+                return;
+            log(`[shared-secret] variável ${ENV} ausente: rota interna indisponível`);
+            return reply.status(503).send({ statusCode: 503, message: "Rota interna indisponível: segredo não configurado" });
+        }
+        let provided = request.headers?.[HEADER];
+        if (provided === undefined && QUERY)
+            provided = request.query?.[QUERY];
+        if (Array.isArray(provided))
+            provided = provided[0];
+        if (!(0, public_route_1.safeEqual)(provided, expected)) {
+            return reply.status(401).send({ statusCode: 401, message: "Segredo interno inválido" });
+        }
+    };
+}
+//# sourceMappingURL=shared-secret.js.map

package/dist/http/shared-secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-secret.js","sourceRoot":"","sources":["../../src/http/shared-secret.ts"],"names":[],"mappings":";AAAA,8EAA8E;AAC9E,6EAA6E;AAC7E,kEAAkE;AAClE,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,8CAA8C;;AAkB9C,0DAwBC;AAxCD,iDAAyC;AAgBzC,SAAgB,uBAAuB,CAAC,UAAoC,EAAE;IAC1E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,qBAAqB,CAAC;IACjD,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,mBAAmB,CAAC,CAAC,WAAW,EAAE,CAAC;IACrE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC;IAC3F,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAE7D,6EAA6E;IAC7E,OAAO,KAAK,UAAU,iBAAiB,CAAC,OAAY,EAAE,KAAU;QAC5D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACZ,IAAI,CAAC,YAAY,EAAE,IAAI,OAAO,CAAC,iBAAiB;gBAAE,OAAO;YACzD,GAAG,CAAC,4BAA4B,GAAG,qCAAqC,CAAC,CAAC;YAC1E,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,oDAAoD,EAAC,CAAC,CAAC;QACpH,CAAC;QAED,IAAI,QAAQ,GAAY,OAAO,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,QAAQ,KAAK,SAAS,IAAI,KAAK;YAAE,QAAQ,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC;QACvE,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;YAAE,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAEpD,IAAI,CAAC,IAAA,wBAAS,EAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,0BAA0B,EAAC,CAAC,CAAC;QAC1F,CAAC;IACL,CAAC,CAAC;AACN,CAAC"}

package/dist/index.d.ts

@@ -1,9 +1,17 @@
-export { resolveTenantId } from "./tenant/resolve";
+export { resolveTenantId, readRawTenantId } from "./tenant/resolve";
 export type { TenantRequestLike } from "./tenant/resolve";
-export { createTenantMiddleware } from "./tenant/middleware";
+export { createTenantMiddleware, InvalidTenantError } from "./tenant/middleware";
 export type { TenantMiddlewareOptions } from "./tenant/middleware";
 export { createAuthMiddleware } from "./tenant/auth";
 export type { AuthMiddlewareOptions, TenantAuthLike } from "./tenant/auth";
+export { createTenantMembershipAssert } from "./tenant/membership";
+export type { TenantMembershipOptions, TenantMembershipAssert } from "./tenant/membership";
+export { createRequestScopePlugin, requestScoped, getRequestScope, runInRequestScope, RequestScopeError } from "./scope/request-scope";
+export type { RequestScopeStore } from "./scope/request-scope";
+export { publicRoute, publicPath, isPublicRoute, safeEqual } from "./http/public-route";
+export { createSharedSecretGuard } from "./http/shared-secret";
+export type { SharedSecretGuardOptions } from "./http/shared-secret";
+export type { PublicRouteOptions, PublicRouteRule, PublicRouteLike } from "./http/public-route";
 export { createMultitenantPrisma } from "./prisma/multitenant";
 export { createMultitenantPrismaMariaDb } from "./prisma/mariadb-factory";
 export type { MariaDbMultitenantOptions } from "./prisma/mariadb-factory";

package/dist/index.js

@@ -1,12 +1,29 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.EMBED_MODEL = exports.GEMINI_MODEL = exports.EMBED_DIM = exports.GeminiHelp = exports.createGcfHandler = exports.isInternalError = exports.createErrorHandler = exports.getBucket = exports.getDefaultAuth = exports.getTenantAuth = exports.initFirebaseAdmin = exports.getFirebaseStorage = exports.getFirebaseClientApp = exports.createFirebaseClientPlugin = exports.createSwaggerPlugin = exports.DEFAULT_CORS = exports.createCorsPlugin = exports.withTenantSchema = exports.createMultitenantPrismaMariaDb = exports.createMultitenantPrisma = exports.createAuthMiddleware = exports.createTenantMiddleware = exports.resolveTenantId = void 0;
+exports.EMBED_MODEL = exports.GEMINI_MODEL = exports.EMBED_DIM = exports.GeminiHelp = exports.createGcfHandler = exports.isInternalError = exports.createErrorHandler = exports.getBucket = exports.getDefaultAuth = exports.getTenantAuth = exports.initFirebaseAdmin = exports.getFirebaseStorage = exports.getFirebaseClientApp = exports.createFirebaseClientPlugin = exports.createSwaggerPlugin = exports.DEFAULT_CORS = exports.createCorsPlugin = exports.withTenantSchema = exports.createMultitenantPrismaMariaDb = exports.createMultitenantPrisma = exports.createSharedSecretGuard = exports.safeEqual = exports.isPublicRoute = exports.publicPath = exports.publicRoute = exports.RequestScopeError = exports.runInRequestScope = exports.getRequestScope = exports.requestScoped = exports.createRequestScopePlugin = exports.createTenantMembershipAssert = exports.createAuthMiddleware = exports.InvalidTenantError = exports.createTenantMiddleware = exports.readRawTenantId = exports.resolveTenantId = void 0;
 var resolve_1 = require("./tenant/resolve");
 Object.defineProperty(exports, "resolveTenantId", { enumerable: true, get: function () { return resolve_1.resolveTenantId; } });
+Object.defineProperty(exports, "readRawTenantId", { enumerable: true, get: function () { return resolve_1.readRawTenantId; } });
 var middleware_1 = require("./tenant/middleware");
 Object.defineProperty(exports, "createTenantMiddleware", { enumerable: true, get: function () { return middleware_1.createTenantMiddleware; } });
+Object.defineProperty(exports, "InvalidTenantError", { enumerable: true, get: function () { return middleware_1.InvalidTenantError; } });
 var auth_1 = require("./tenant/auth");
 Object.defineProperty(exports, "createAuthMiddleware", { enumerable: true, get: function () { return auth_1.createAuthMiddleware; } });
+var membership_1 = require("./tenant/membership");
+Object.defineProperty(exports, "createTenantMembershipAssert", { enumerable: true, get: function () { return membership_1.createTenantMembershipAssert; } });
+var request_scope_1 = require("./scope/request-scope");
+Object.defineProperty(exports, "createRequestScopePlugin", { enumerable: true, get: function () { return request_scope_1.createRequestScopePlugin; } });
+Object.defineProperty(exports, "requestScoped", { enumerable: true, get: function () { return request_scope_1.requestScoped; } });
+Object.defineProperty(exports, "getRequestScope", { enumerable: true, get: function () { return request_scope_1.getRequestScope; } });
+Object.defineProperty(exports, "runInRequestScope", { enumerable: true, get: function () { return request_scope_1.runInRequestScope; } });
+Object.defineProperty(exports, "RequestScopeError", { enumerable: true, get: function () { return request_scope_1.RequestScopeError; } });
+var public_route_1 = require("./http/public-route");
+Object.defineProperty(exports, "publicRoute", { enumerable: true, get: function () { return public_route_1.publicRoute; } });
+Object.defineProperty(exports, "publicPath", { enumerable: true, get: function () { return public_route_1.publicPath; } });
+Object.defineProperty(exports, "isPublicRoute", { enumerable: true, get: function () { return public_route_1.isPublicRoute; } });
+Object.defineProperty(exports, "safeEqual", { enumerable: true, get: function () { return public_route_1.safeEqual; } });
+var shared_secret_1 = require("./http/shared-secret");
+Object.defineProperty(exports, "createSharedSecretGuard", { enumerable: true, get: function () { return shared_secret_1.createSharedSecretGuard; } });
 var multitenant_1 = require("./prisma/multitenant");
 Object.defineProperty(exports, "createMultitenantPrisma", { enumerable: true, get: function () { return multitenant_1.createMultitenantPrisma; } });
 var mariadb_factory_1 = require("./prisma/mariadb-factory");

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,4CAAiD;AAAzC,0GAAA,eAAe,OAAA;AAGvB,kDAA2D;AAAnD,oHAAA,sBAAsB,OAAA;AAG9B,sCAAmD;AAA3C,4GAAA,oBAAoB,OAAA;AAG5B,oDAA6D;AAArD,sHAAA,uBAAuB,OAAA;AAC/B,4DAAwE;AAAhE,iIAAA,8BAA8B,OAAA;AAGtC,kDAAqD;AAA7C,8GAAA,gBAAgB,OAAA;AAUxB,wCAA6D;AAArD,0GAAA,gBAAgB,OAAA;AAAE,sGAAA,YAAY,OAAA;AAGtC,2CAAqD;AAA7C,6GAAA,mBAAmB,OAAA;AAG3B,0DAA8G;AAAtG,2HAAA,0BAA0B,OAAA;AAAE,qHAAA,oBAAoB,OAAA;AAAE,mHAAA,kBAAkB,OAAA;AAG5E,0CAA6F;AAArF,0GAAA,iBAAiB,OAAA;AAAE,sGAAA,aAAa,OAAA;AAAE,uGAAA,cAAc,OAAA;AAAE,kGAAA,SAAS,OAAA;AAGnE,sDAAyE;AAAjE,mHAAA,kBAAkB,OAAA;AAAE,gHAAA,eAAe,OAAA;AAG3C,kDAAoD;AAA5C,+GAAA,gBAAgB,OAAA;AAGxB,sCAA6E;AAArE,oGAAA,UAAU,OAAA;AAAE,mGAAA,SAAS,OAAA;AAAE,sGAAA,YAAY,OAAA;AAAE,qGAAA,WAAW,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,4CAAkE;AAA1D,0GAAA,eAAe,OAAA;AAAE,0GAAA,eAAe,OAAA;AAGxC,kDAA+E;AAAvE,oHAAA,sBAAsB,OAAA;AAAE,gHAAA,kBAAkB,OAAA;AAGlD,sCAAmD;AAA3C,4GAAA,oBAAoB,OAAA;AAG5B,kDAAiE;AAAzD,0HAAA,4BAA4B,OAAA;AAGpC,uDAAqI;AAA7H,yHAAA,wBAAwB,OAAA;AAAE,8GAAA,aAAa,OAAA;AAAE,gHAAA,eAAe,OAAA;AAAE,kHAAA,iBAAiB,OAAA;AAAE,kHAAA,iBAAiB,OAAA;AAGtG,oDAAsF;AAA9E,2GAAA,WAAW,OAAA;AAAE,0GAAA,UAAU,OAAA;AAAE,6GAAA,aAAa,OAAA;AAAE,yGAAA,SAAS,OAAA;AACzD,sDAA6D;AAArD,wHAAA,uBAAuB,OAAA;AAI/B,oDAA6D;AAArD,sHAAA,uBAAuB,OAAA;AAC/B,4DAAwE;AAAhE,iIAAA,8BAA8B,OAAA;AAGtC,kDAAqD;AAA7C,8GAAA,gBAAgB,OAAA;AAUxB,wCAA6D;AAArD,0GAAA,gBAAgB,OAAA;AAAE,sGAAA,YAAY,OAAA;AAGtC,2CAAqD;AAA7C,6GAAA,mBAAmB,OAAA;AAG3B,0DAA8G;AAAtG,2HAAA,0BAA0B,OAAA;AAAE,qHAAA,oBAAoB,OAAA;AAAE,mHAAA,kBAAkB,OAAA;AAG5E,0CAA6F;AAArF,0GAAA,iBAAiB,OAAA;AAAE,sGAAA,aAAa,OAAA;AAAE,uGAAA,cAAc,OAAA;AAAE,kGAAA,SAAS,OAAA;AAGnE,sDAAyE;AAAjE,mHAAA,kBAAkB,OAAA;AAAE,gHAAA,eAAe,OAAA;AAG3C,kDAAoD;AAA5C,+GAAA,gBAAgB,OAAA;AAGxB,sCAA6E;AAArE,oGAAA,UAAU,OAAA;AAAE,mGAAA,SAAS,OAAA;AAAE,sGAAA,YAAY,OAAA;AAAE,qGAAA,WAAW,OAAA"}

package/dist/scope/request-scope.d.ts

@@ -0,0 +1,28 @@
+export interface RequestScopeStore {
+    /** Identificador sequencial da request (diagnóstico) */
+    id: number;
+    /** Instâncias criadas nesta request, por proxy */
+    instances: Map<symbol, unknown>;
+}
+export declare class RequestScopeError extends Error {
+    constructor(className: string);
+}
+/** Store da request atual (null fora de request). Útil em testes e diagnóstico. */
+export declare function getRequestScope(): RequestScopeStore | null;
+/** Executa `fn` dentro de um escopo novo (uso em jobs/testes fora do Fastify). */
+export declare function runInRequestScope<T>(fn: () => T): T;
+/**
+ * Plugin Fastify: abre o escopo no `onRequest` (antes de auth, tenant e
+ * preHandler) e descarta as instâncias no `onResponse`. Registrar ANTES dos
+ * controllers — chamando como função (`await plugin(fastify)`) ou via
+ * `fastify.register`. Registrar duas vezes no mesmo contexto não duplica o hook.
+ */
+export declare function createRequestScopePlugin(): (fastify: any) => Promise<void>;
+/**
+ * Devolve um Proxy que se comporta como uma instância de `Ctor`, mas resolve
+ * para a instância da REQUEST ATUAL (criada sob demanda com `args`). Cada
+ * chamada de `requestScoped` é um "slot" próprio: dois proxies da mesma
+ * classe, na mesma request, são instâncias diferentes; o mesmo proxy, na
+ * mesma request, é sempre a mesma instância.
+ */
+export declare function requestScoped<T extends object>(Ctor: new (...args: any[]) => T, ...args: any[]): T;

package/dist/scope/request-scope.js

@@ -0,0 +1,123 @@
+"use strict";
+// Escopo por request para services das APIs.
+//
+// PROBLEMA QUE RESOLVE: todos os controllers das APIs instanciam o service UMA
+// vez por plugin (`const service = new XService(fastify)`) e, no preHandler de
+// cada rota, fazem `service.setRequest(request)`. O `request` (e com ele o
+// `request.prisma`, que é o client do TENANT) fica numa propriedade de
+// instância compartilhada por todas as requests da instância. Com concurrency
+// > 1 (o default do Cloud Run gen2 é 80), a request B sobrescreve
+// `this.request` enquanto a request A está num `await`, e a query seguinte de
+// A roda no schema da escola de B.
+//
+// SOLUÇÃO: um AsyncLocalStorage aberto no `onRequest` (o contexto sobrevive a
+// await, setTimeout, streams e callbacks) e `requestScoped(Ctor, ...args)`,
+// um Proxy que entrega uma instância PRÓPRIA da request atual. A troca na API
+// é mecânica: `new XService(fastify)` vira `requestScoped(XService, fastify)`.
+// Handlers, services e o `setRequest` não mudam.
+//
+// Uso fora de uma request (timer, escopo de módulo, job) lança
+// RequestScopeError com o nome da classe: é a proteção desejada — antes,
+// misturava dados em silêncio.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RequestScopeError = void 0;
+exports.getRequestScope = getRequestScope;
+exports.runInRequestScope = runInRequestScope;
+exports.createRequestScopePlugin = createRequestScopePlugin;
+exports.requestScoped = requestScoped;
+const node_async_hooks_1 = require("node:async_hooks");
+class RequestScopeError extends Error {
+    constructor(className) {
+        super(`[request-scope] ${className} usado fora do escopo de request. ` +
+            `Services com requestScoped() só podem ser acessados durante o processamento de uma request.`);
+        this.name = "RequestScopeError";
+    }
+}
+exports.RequestScopeError = RequestScopeError;
+const storage = new node_async_hooks_1.AsyncLocalStorage();
+const kInstalled = Symbol.for("@mybuildex/pkg/request-scope-installed");
+let sequence = 0;
+/** Store da request atual (null fora de request). Útil em testes e diagnóstico. */
+function getRequestScope() {
+    return storage.getStore() ?? null;
+}
+/** Executa `fn` dentro de um escopo novo (uso em jobs/testes fora do Fastify). */
+function runInRequestScope(fn) {
+    return storage.run({ id: ++sequence, instances: new Map() }, fn);
+}
+/**
+ * Plugin Fastify: abre o escopo no `onRequest` (antes de auth, tenant e
+ * preHandler) e descarta as instâncias no `onResponse`. Registrar ANTES dos
+ * controllers — chamando como função (`await plugin(fastify)`) ou via
+ * `fastify.register`. Registrar duas vezes no mesmo contexto não duplica o hook.
+ */
+function createRequestScopePlugin() {
+    return async function requestScopePlugin(fastify) {
+        if (fastify[kInstalled])
+            return;
+        fastify[kInstalled] = true;
+        fastify.addHook("onRequest", (_req, _reply, done) => {
+            storage.run({ id: ++sequence, instances: new Map() }, done);
+        });
+        fastify.addHook("onResponse", (_req, _reply, done) => {
+            const store = storage.getStore();
+            if (store)
+                store.instances.clear();
+            done();
+        });
+    };
+}
+/**
+ * Devolve um Proxy que se comporta como uma instância de `Ctor`, mas resolve
+ * para a instância da REQUEST ATUAL (criada sob demanda com `args`). Cada
+ * chamada de `requestScoped` é um "slot" próprio: dois proxies da mesma
+ * classe, na mesma request, são instâncias diferentes; o mesmo proxy, na
+ * mesma request, é sempre a mesma instância.
+ */
+function requestScoped(Ctor, ...args) {
+    const slot = Symbol(Ctor.name);
+    const resolve = () => {
+        const store = storage.getStore();
+        if (!store)
+            throw new RequestScopeError(Ctor.name || "Service");
+        let instance = store.instances.get(slot);
+        if (!instance) {
+            instance = new Ctor(...args);
+            store.instances.set(slot, instance);
+        }
+        return instance;
+    };
+    // O alvo tem o protótipo da classe para `instanceof` funcionar sem
+    // resolver o escopo (checagens estruturais fora de request não lançam).
+    const target = Object.create(Ctor.prototype);
+    return new Proxy(target, {
+        get(_t, prop) {
+            const instance = resolve();
+            const value = Reflect.get(instance, prop, instance);
+            return typeof value === "function" ? value.bind(instance) : value;
+        },
+        set(_t, prop, value) {
+            const instance = resolve();
+            return Reflect.set(instance, prop, value, instance);
+        },
+        has(_t, prop) {
+            return Reflect.has(resolve(), prop);
+        },
+        deleteProperty(_t, prop) {
+            return Reflect.deleteProperty(resolve(), prop);
+        },
+        ownKeys() {
+            return Reflect.ownKeys(resolve());
+        },
+        getOwnPropertyDescriptor(_t, prop) {
+            const descriptor = Reflect.getOwnPropertyDescriptor(resolve(), prop);
+            if (descriptor)
+                descriptor.configurable = true;
+            return descriptor;
+        },
+        getPrototypeOf() {
+            return Ctor.prototype;
+        },
+    });
+}
+//# sourceMappingURL=request-scope.js.map

package/dist/scope/request-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-scope.js","sourceRoot":"","sources":["../../src/scope/request-scope.ts"],"names":[],"mappings":";AAAA,6CAA6C;AAC7C,EAAE;AACF,+EAA+E;AAC/E,+EAA+E;AAC/E,2EAA2E;AAC3E,uEAAuE;AACvE,8EAA8E;AAC9E,kEAAkE;AAClE,8EAA8E;AAC9E,mCAAmC;AACnC,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,8EAA8E;AAC9E,+EAA+E;AAC/E,iDAAiD;AACjD,EAAE;AACF,+DAA+D;AAC/D,yEAAyE;AACzE,+BAA+B;;;AAwB/B,0CAEC;AAGD,8CAEC;AAQD,4DAeC;AASD,sCA8CC;AA3GD,uDAAmD;AASnD,MAAa,iBAAkB,SAAQ,KAAK;IACxC,YAAY,SAAiB;QACzB,KAAK,CAAC,mBAAmB,SAAS,oCAAoC;YAClE,6FAA6F,CAAC,CAAC;QACnG,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IACpC,CAAC;CACJ;AAND,8CAMC;AAED,MAAM,OAAO,GAAG,IAAI,oCAAiB,EAAqB,CAAC;AAC3D,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;AACxE,IAAI,QAAQ,GAAG,CAAC,CAAC;AAEjB,mFAAmF;AACnF,SAAgB,eAAe;IAC3B,OAAO,OAAO,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC;AACtC,CAAC;AAED,kFAAkF;AAClF,SAAgB,iBAAiB,CAAI,EAAW;IAC5C,OAAO,OAAO,CAAC,GAAG,CAAC,EAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,EAAC,EAAE,EAAE,CAAC,CAAC;AACnE,CAAC;AAED;;;;;GAKG;AACH,SAAgB,wBAAwB;IACpC,OAAO,KAAK,UAAU,kBAAkB,CAAC,OAAY;QACjD,IAAI,OAAO,CAAC,UAAU,CAAC;YAAE,OAAO;QAChC,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;QAE3B,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,IAAS,EAAE,MAAW,EAAE,IAAgB,EAAE,EAAE;YACtE,OAAO,CAAC,GAAG,CAAC,EAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,EAAC,EAAE,IAAI,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,IAAS,EAAE,MAAW,EAAE,IAAgB,EAAE,EAAE;YACvE,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;YACjC,IAAI,KAAK;gBAAE,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YACnC,IAAI,EAAE,CAAC;QACX,CAAC,CAAC,CAAC;IACP,CAAC,CAAC;AACN,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,aAAa,CAAmB,IAA+B,EAAE,GAAG,IAAW;IAC3F,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAE/B,MAAM,OAAO,GAAG,GAAM,EAAE;QACpB,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QACjC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,CAAC;QAChE,IAAI,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAkB,CAAC;QAC1D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACZ,QAAQ,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;YAC7B,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,QAAQ,CAAC;IACpB,CAAC,CAAC;IAEF,mEAAmE;IACnE,wEAAwE;IACxE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAM,CAAC;IAElD,OAAO,IAAI,KAAK,CAAC,MAAM,EAAE;QACrB,GAAG,CAAC,EAAE,EAAE,IAAI;YACR,MAAM,QAAQ,GAAG,OAAO,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,QAAe,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;YAC3D,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACtE,CAAC;QACD,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK;YACf,MAAM,QAAQ,GAAG,OAAO,EAAE,CAAC;YAC3B,OAAO,OAAO,CAAC,GAAG,CAAC,QAAe,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC/D,CAAC;QACD,GAAG,CAAC,EAAE,EAAE,IAAI;YACR,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,EAAS,EAAE,IAAI,CAAC,CAAC;QAC/C,CAAC;QACD,cAAc,CAAC,EAAE,EAAE,IAAI;YACnB,OAAO,OAAO,CAAC,cAAc,CAAC,OAAO,EAAS,EAAE,IAAI,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO;YACH,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,EAAS,CAAC,CAAC;QAC7C,CAAC;QACD,wBAAwB,CAAC,EAAE,EAAE,IAAI;YAC7B,MAAM,UAAU,GAAG,OAAO,CAAC,wBAAwB,CAAC,OAAO,EAAS,EAAE,IAAI,CAAC,CAAC;YAC5E,IAAI,UAAU;gBAAE,UAAU,CAAC,YAAY,GAAG,IAAI,CAAC;YAC/C,OAAO,UAAU,CAAC;QACtB,CAAC;QACD,cAAc;YACV,OAAO,IAAI,CAAC,SAAS,CAAC;QAC1B,CAAC;KACJ,CAAC,CAAC;AACP,CAAC"}

package/dist/tenant/auth.d.ts

@@ -1,9 +1,12 @@
+import { PublicRouteLike } from "../http/public-route";
 export interface TenantAuthLike {
     verifyIdToken(token: string, checkRevoked?: boolean): Promise<any>;
 }
 export interface AuthMiddlewareOptions {
-    /** Rotas públicas (regex sobre o PATHNAME, sem query string) — dispensam token */
-    publicRoutes: RegExp[];
+    /** Rotas públicas — dispensam token. Regex sobre o PATHNAME (sem query
+     *  string) ou regra `{pattern, methods}` gerada por publicRoute()/publicPath(),
+     *  que também restringe o método HTTP. */
+    publicRoutes: PublicRouteLike[];
     /** Resolve o Auth do tenant Firebase (ex: getTenantAuth do pkg) */
     getTenantAuth: (tenantId: string | undefined) => TenantAuthLike;
     /** false = API single-tenant (ex: core): não lê o claim firebase.tenant e

package/dist/tenant/auth.js

@@ -15,6 +15,7 @@
 // um token forjado para outro tenant não verifica.
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createAuthMiddleware = createAuthMiddleware;
+const public_route_1 = require("../http/public-route");
 function createAuthMiddleware(options) {
     const TOKEN_CACHE = new Map();
     const MAX_CACHE_SIZE = options.cacheMaxSize ?? 2000;
@@ -52,7 +53,7 @@ function createAuthMiddleware(options) {
                 // (GET protegido → 401, mas `...?cb=/webhook` → 200 sem token).
                 const rawUrl = request.raw?.url || "";
                 const pathname = rawUrl.split("?")[0];
-                if (options.publicRoutes.some(regex => regex.test(pathname)) || pathname === "" || pathname === "/") {
+                if ((0, public_route_1.isPublicRoute)(options.publicRoutes, pathname, request.method) || pathname === "" || pathname === "/") {
                     return;
                 }
                 let authHeader = request.headers?.authorization;

package/dist/tenant/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/tenant/auth.ts"],"names":[],"mappings":";AAAA,8DAA8D;AAC9D,EAAE;AACF,qEAAqE;AACrE,4EAA4E;AAC5E,uEAAuE;AACvE,wEAAwE;AACxE,0EAA0E;AAC1E,6EAA6E;AAC7E,0EAA0E;AAC1E,oEAAoE;AACpE,EAAE;AACF,uEAAuE;AACvE,wEAAwE;AACxE,mDAAmD;;AA6BnD,oDAwGC;AAxGD,SAAgB,oBAAoB,CAAC,OAA8B;IAC/D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAuB,CAAC;IACnD,MAAM,cAAc,GAAG,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC;IACpD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,GAAG,GAAG,IAAI,CAAC;IAEpD,SAAS,SAAS,CAAC,KAAa;QAC5B,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC1B,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,CAAC;IACpB,CAAC;IAED,SAAS,SAAS,CAAC,KAAa,EAAE,IAAS,EAAE,UAAkB;QAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,IAAI,EAAE,GAAG,GAAG,UAAU,CAAC,CAAC;QAC5D,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,EAAC,KAAK,EAAE,IAAI,EAAC,CAAC,CAAC;QACtC,IAAI,WAAW,CAAC,IAAI,GAAG,cAAc,EAAE,CAAC;YACpC,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC;YAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,IAAI,WAAW,CAAC,IAAI,GAAG,cAAc,EAAE,CAAC,EAAE,EAAE,CAAC;gBAChE,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;gBAC1B,IAAI,CAAC,CAAC;oBAAE,MAAM;gBACd,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC1B,CAAC;QACL,CAAC;IACL,CAAC;IAED,OAAO,KAAK,UAAU,cAAc,CAAC,OAAY;QAC7C,OAAO,CAAC,QAAQ,CAAC,cAAc,EAAE,KAAK,EAAE,OAAY,EAAE,KAAU,EAAE,EAAE;YAChE,IAAI,CAAC;gBACD,8DAA8D;gBAC9D,0DAA0D;gBAC1D,8DAA8D;gBAC9D,gEAAgE;gBAChE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;gBACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBACtC,IAAI,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,QAAQ,KAAK,EAAE,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;oBAClG,OAAO;gBACX,CAAC;gBAED,IAAI,UAAU,GAAG,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC;gBAChD,IAAI,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC;oBAClD,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;gBACrC,CAAC;gBAED,IAAI,CAAC,UAAU,EAAE,CAAC;oBACd,4DAA4D;oBAC5D,IAAI,OAAO,CAAC,SAAS;wBAAE,OAAO;oBAC9B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,OAAO,EAAE,2BAA2B,EAAC,CAAC,CAAC;gBAC1E,CAAC;gBAED,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;gBAC/C,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACrB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,OAAO,EAAE,gBAAgB,EAAC,CAAC,CAAC;gBAC/D,CAAC;gBAED,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;gBACrC,IAAI,MAAM,EAAE,CAAC;oBACT,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;wBACvB,IAAI,CAAC;4BACD,MAAM,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;wBAChD,CAAC;wBAAC,MAAM,CAAC;4BACL,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,OAAO,EAAE,gCAAgC,EAAC,CAAC,CAAC;wBAC/E,CAAC;oBACL,CAAC;oBACD,OAAO,CAAC,IAAI,GAAG,MAAM,CAAC;oBACtB,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC;oBAC7B,OAAO,CAAC,SAAS,GAAG,UAAU,CAAC;oBAC/B,OAAO;gBACX,CAAC;gBAED,sEAAsE;gBACtE,IAAI,QAA4B,CAAC;gBACjC,IAAI,OAAO,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;oBAChC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;oBAC9E,QAAQ,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC;gBACzC,CAAC;gBACD,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;gBAC7C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;gBAEhE,SAAS,CAAC,UAAU,EAAE,YAAY,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC;gBAEtD,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;oBACvB,IAAI,CAAC;wBACD,MAAM,OAAO,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;oBACtD,CAAC;oBAAC,MAAM,CAAC;wBACL,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,OAAO,EAAE,gCAAgC,EAAC,CAAC,CAAC;oBAC/E,CAAC;gBACL,CAAC;gBAED,OAAO,CAAC,IAAI,GAAG,YAAY,CAAC;gBAC5B,OAAO,CAAC,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC;gBACnC,OAAO,CAAC,SAAS,GAAG,UAAU,CAAC;YACnC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;gBAC5C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,OAAO,EAAE,gBAAgB,EAAC,CAAC,CAAC;YAC/D,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACvD,CAAC,CAAC;AACN,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/tenant/auth.ts"],"names":[],"mappings":";AAAA,8DAA8D;AAC9D,EAAE;AACF,qEAAqE;AACrE,4EAA4E;AAC5E,uEAAuE;AACvE,wEAAwE;AACxE,0EAA0E;AAC1E,6EAA6E;AAC7E,0EAA0E;AAC1E,oEAAoE;AACpE,EAAE;AACF,uEAAuE;AACvE,wEAAwE;AACxE,mDAAmD;;AAkCnD,oDAwGC;AAxID,uDAAoE;AAgCpE,SAAgB,oBAAoB,CAAC,OAA8B;IAC/D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAuB,CAAC;IACnD,MAAM,cAAc,GAAG,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC;IACpD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,GAAG,GAAG,IAAI,CAAC;IAEpD,SAAS,SAAS,CAAC,KAAa;QAC5B,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC1B,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,CAAC;IACpB,CAAC;IAED,SAAS,SAAS,CAAC,KAAa,EAAE,IAAS,EAAE,UAAkB;QAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,IAAI,EAAE,GAAG,GAAG,UAAU,CAAC,CAAC;QAC5D,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,EAAC,KAAK,EAAE,IAAI,EAAC,CAAC,CAAC;QACtC,IAAI,WAAW,CAAC,IAAI,GAAG,cAAc,EAAE,CAAC;YACpC,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC;YAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,IAAI,WAAW,CAAC,IAAI,GAAG,cAAc,EAAE,CAAC,EAAE,EAAE,CAAC;gBAChE,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;gBAC1B,IAAI,CAAC,CAAC;oBAAE,MAAM;gBACd,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC1B,CAAC;QACL,CAAC;IACL,CAAC;IAED,OAAO,KAAK,UAAU,cAAc,CAAC,OAAY;QAC7C,OAAO,CAAC,QAAQ,CAAC,cAAc,EAAE,KAAK,EAAE,OAAY,EAAE,KAAU,EAAE,EAAE;YAChE,IAAI,CAAC;gBACD,8DAA8D;gBAC9D,0DAA0D;gBAC1D,8DAA8D;gBAC9D,gEAAgE;gBAChE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;gBACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBACtC,IAAI,IAAA,4BAAa,EAAC,OAAO,CAAC,YAAY,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,QAAQ,KAAK,EAAE,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;oBACvG,OAAO;gBACX,CAAC;gBAED,IAAI,UAAU,GAAG,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC;gBAChD,IAAI,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC;oBAClD,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;gBACrC,CAAC;gBAED,IAAI,CAAC,UAAU,EAAE,CAAC;oBACd,4DAA4D;oBAC5D,IAAI,OAAO,CAAC,SAAS;wBAAE,OAAO;oBAC9B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,OAAO,EAAE,2BAA2B,EAAC,CAAC,CAAC;gBAC1E,CAAC;gBAED,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;gBAC/C,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACrB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,OAAO,EAAE,gBAAgB,EAAC,CAAC,CAAC;gBAC/D,CAAC;gBAED,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;gBACrC,IAAI,MAAM,EAAE,CAAC;oBACT,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;wBACvB,IAAI,CAAC;4BACD,MAAM,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;wBAChD,CAAC;wBAAC,MAAM,CAAC;4BACL,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,OAAO,EAAE,gCAAgC,EAAC,CAAC,CAAC;wBAC/E,CAAC;oBACL,CAAC;oBACD,OAAO,CAAC,IAAI,GAAG,MAAM,CAAC;oBACtB,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC;oBAC7B,OAAO,CAAC,SAAS,GAAG,UAAU,CAAC;oBAC/B,OAAO;gBACX,CAAC;gBAED,sEAAsE;gBACtE,IAAI,QAA4B,CAAC;gBACjC,IAAI,OAAO,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;oBAChC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;oBAC9E,QAAQ,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC;gBACzC,CAAC;gBACD,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;gBAC7C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;gBAEhE,SAAS,CAAC,UAAU,EAAE,YAAY,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC;gBAEtD,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;oBACvB,IAAI,CAAC;wBACD,MAAM,OAAO,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;oBACtD,CAAC;oBAAC,MAAM,CAAC;wBACL,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,OAAO,EAAE,gCAAgC,EAAC,CAAC,CAAC;oBAC/E,CAAC;gBACL,CAAC;gBAED,OAAO,CAAC,IAAI,GAAG,YAAY,CAAC;gBAC5B,OAAO,CAAC,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC;gBACnC,OAAO,CAAC,SAAS,GAAG,UAAU,CAAC;YACnC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;gBAC5C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,OAAO,EAAE,gBAAgB,EAAC,CAAC,CAAC;YAC/D,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACvD,CAAC,CAAC;AACN,CAAC"}

package/dist/tenant/membership.d.ts

@@ -0,0 +1,21 @@
+import { TenantRequestLike } from "./resolve";
+export interface TenantMembershipOptions {
+    /** Client Prisma da escola (ex: mt.getTenantClient do pkg) */
+    getTenantClient: (idSchool: string) => any;
+    /** TTL do cache positivo, em ms (default 120 s) */
+    cacheTtlMs?: number;
+    /** Tamanho máximo do cache (default 5000) */
+    cacheMaxSize?: number;
+    /** Nome do model Prisma com a coluna firebase_id (default "users") */
+    model?: string;
+    /** Log de falha de consulta (default console.error) */
+    log?: (message: string, error?: unknown) => void;
+}
+export interface TenantMembershipAssert {
+    (decodedToken: any, request: TenantRequestLike): Promise<void>;
+    /** Limpa o cache (testes / rotação manual) */
+    clearCache(): void;
+    /** Quantidade de entradas em cache (diagnóstico) */
+    cacheSize(): number;
+}
+export declare function createTenantMembershipAssert(options: TenantMembershipOptions): TenantMembershipAssert;

package/dist/tenant/membership.js

@@ -0,0 +1,78 @@
+"use strict";
+// Vínculo do token ao id_school da URL (o gancho `assertTenant` pronto).
+//
+// O auth middleware valida a ASSINATURA do token no tenant Firebase do
+// próprio token, mas nada amarra esse usuário ao `:id_school` da URL: um
+// token válido da escola A servia em `/v1/B/...`. Este assert consulta a
+// tabela `users` do schema da escola da URL por `firebase_id = uid` e
+// `deleted_at is null`; sem vínculo, lança (o middleware responde 403).
+//
+// Regras do domínio MyBuilder: cada escola tem o próprio tenant Firebase e
+// nunca compartilha usuário — por isso não há caso "usuário em duas escolas".
+//
+// Fail-closed: erro de banco na consulta NEGA e loga. Cache em memória por
+// `idSchool:uid` só para resultados positivos, com TTL igual ao do cache de
+// tokens (120 s), para não repetir a consulta a cada request.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createTenantMembershipAssert = createTenantMembershipAssert;
+const resolve_1 = require("./resolve");
+function createTenantMembershipAssert(options) {
+    const TTL_MS = options.cacheTtlMs ?? 120 * 1000;
+    const MAX_SIZE = options.cacheMaxSize ?? 5000;
+    const MODEL = options.model ?? "users";
+    const log = options.log ?? ((message, error) => console.error(message, error ?? ""));
+    const cache = new Map();
+    function remember(key) {
+        cache.set(key, Date.now() + TTL_MS);
+        if (cache.size > MAX_SIZE) {
+            const it = cache.keys();
+            for (let i = 0; i < 100 && cache.size > MAX_SIZE; i++) {
+                const k = it.next().value;
+                if (k === undefined)
+                    break;
+                cache.delete(k);
+            }
+        }
+    }
+    function isRemembered(key) {
+        const exp = cache.get(key);
+        if (exp === undefined)
+            return false;
+        if (exp <= Date.now()) {
+            cache.delete(key);
+            return false;
+        }
+        return true;
+    }
+    const assert = (async (decodedToken, request) => {
+        const idSchool = (0, resolve_1.resolveTenantId)(request);
+        // Sem tenant na URL (raiz, documentação): nada a amarrar.
+        if (!idSchool)
+            return;
+        const uid = decodedToken?.uid;
+        if (!uid)
+            throw new Error("Token sem uid");
+        const key = `${idSchool}:${uid}`;
+        if (isRemembered(key))
+            return;
+        let found;
+        try {
+            const client = options.getTenantClient(idSchool);
+            found = await client[MODEL].findFirst({
+                where: { firebase_id: uid, deleted_at: null },
+                select: { id: true },
+            });
+        }
+        catch (error) {
+            log(`[tenant-membership] falha ao consultar ${MODEL} da escola ${idSchool}; negando acesso`, error);
+            throw new Error("Falha ao verificar vínculo com a escola");
+        }
+        if (!found)
+            throw new Error(`Usuário ${uid} sem vínculo com a escola ${idSchool}`);
+        remember(key);
+    });
+    assert.clearCache = () => cache.clear();
+    assert.cacheSize = () => cache.size;
+    return assert;
+}
+//# sourceMappingURL=membership.js.map

package/dist/tenant/membership.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"membership.js","sourceRoot":"","sources":["../../src/tenant/membership.ts"],"names":[],"mappings":";AAAA,yEAAyE;AACzE,EAAE;AACF,uEAAuE;AACvE,yEAAyE;AACzE,yEAAyE;AACzE,sEAAsE;AACtE,wEAAwE;AACxE,EAAE;AACF,2EAA2E;AAC3E,8EAA8E;AAC9E,EAAE;AACF,2EAA2E;AAC3E,4EAA4E;AAC5E,8DAA8D;;AAyB9D,oEA2DC;AAlFD,uCAA6D;AAuB7D,SAAgB,4BAA4B,CAAC,OAAgC;IACzE,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,IAAI,GAAG,GAAG,IAAI,CAAC;IAChD,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,OAAe,EAAE,KAAe,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IACvG,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IAExC,SAAS,QAAQ,CAAC,GAAW;QACzB,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC;QACpC,IAAI,KAAK,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC;YACxB,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;YACxB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;gBACpD,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;gBAC1B,IAAI,CAAC,KAAK,SAAS;oBAAE,MAAM;gBAC3B,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACpB,CAAC;QACL,CAAC;IACL,CAAC;IAED,SAAS,YAAY,CAAC,GAAW;QAC7B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACpC,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACpB,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClB,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,KAAK,EAAE,YAAiB,EAAE,OAA0B,EAAE,EAAE;QACpE,MAAM,QAAQ,GAAG,IAAA,yBAAe,EAAC,OAAO,CAAC,CAAC;QAC1C,0DAA0D;QAC1D,IAAI,CAAC,QAAQ;YAAE,OAAO;QAEtB,MAAM,GAAG,GAAG,YAAY,EAAE,GAAG,CAAC;QAC9B,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QAE3C,MAAM,GAAG,GAAG,GAAG,QAAQ,IAAI,GAAG,EAAE,CAAC;QACjC,IAAI,YAAY,CAAC,GAAG,CAAC;YAAE,OAAO;QAE9B,IAAI,KAAc,CAAC;QACnB,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;YACjD,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC;gBAClC,KAAK,EAAE,EAAC,WAAW,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAC;gBAC3C,MAAM,EAAE,EAAC,EAAE,EAAE,IAAI,EAAC;aACrB,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,GAAG,CAAC,0CAA0C,KAAK,cAAc,QAAQ,kBAAkB,EAAE,KAAK,CAAC,CAAC;YACpG,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC/D,CAAC;QAED,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,GAAG,6BAA6B,QAAQ,EAAE,CAAC,CAAC;QACnF,QAAQ,CAAC,GAAG,CAAC,CAAC;IAClB,CAAC,CAA2B,CAAC;IAE7B,MAAM,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACxC,MAAM,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;IACpC,OAAO,MAAM,CAAC;AAClB,CAAC"}

package/dist/tenant/middleware.d.ts

@@ -5,5 +5,12 @@ export interface TenantMiddlewareOptions<TClient> {
      *  quando o request caiu no default. Erros aqui NÃO derrubam o request
      *  (log + segue) — enriquecimento é best-effort. */
     onTenantResolved?: (req: any, idSchool: string | null) => void | Promise<void>;
+    /** id_school presente mas inválido => 400 (default: false, mantém o
+     *  comportamento histórico de cair no default). */
+    strictTenant?: boolean;
+}
+export declare class InvalidTenantError extends Error {
+    statusCode: number;
+    constructor(raw: unknown);
 }
 export declare function createTenantMiddleware<TClient>(options: TenantMiddlewareOptions<TClient>): (fastify: any) => Promise<void>;

package/dist/tenant/middleware.js

@@ -8,9 +8,32 @@
 // Também seta req.id_school (número; undefined quando sem id válido) e
 // oferece onTenantResolved para enriquecer o request (ex: carregar
 // permissões do usuário) sem cada API duplicar lógica no middleware.
+//
+// strictTenant (opt-in): quando o request TRAZ um id_school (params, query ou
+// header) mas ele é inválido ("abc", "0", "-3", "12abc"), responde 400 em vez
+// de cair no default. O default é o database do DATABASE_URL — uma escola
+// real — e as rotas sem schema de params não validam o :id_school, então
+// `PUT /v1/abc/.../restore/5` executava na escola 1 sem erro. Sem id_school
+// nenhum (raiz, documentação) o default continua valendo.
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.InvalidTenantError = void 0;
 exports.createTenantMiddleware = createTenantMiddleware;
 const resolve_1 = require("./resolve");
+class InvalidTenantError extends Error {
+    statusCode = 400;
+    constructor(raw) {
+        super(`id_school inválido: ${String(raw)}`);
+        this.name = "InvalidTenantError";
+    }
+}
+exports.InvalidTenantError = InvalidTenantError;
+function hasRawTenant(raw) {
+    if (raw === undefined || raw === null)
+        return false;
+    if (typeof raw === "string" && raw.trim() === "")
+        return false;
+    return true;
+}
 function createTenantMiddleware(options) {
     return async function tenantMiddleware(fastify) {
         fastify.addHook("preValidation", async (req) => {
@@ -20,6 +43,12 @@ function createTenantMiddleware(options) {
                 req.id_school = Number(idSchool);
             }
             else {
+                const raw = (0, resolve_1.readRawTenantId)(req);
+                if (options.strictTenant && hasRawTenant(raw)) {
+                    // Sem client atribuído: o error handler responde 400 e
+                    // nenhum handler roda contra a escola default.
+                    throw new InvalidTenantError(raw);
+                }
                 req.prisma = options.defaultClient;
             }
             if (options.onTenantResolved) {

package/dist/tenant/middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/tenant/middleware.ts"],"names":[],"mappings":";AAAA,4EAA4E;AAC5E,4EAA4E;AAC5E,4EAA4E;AAC5E,4EAA4E;AAC5E,2BAA2B;AAC3B,EAAE;AACF,uEAAuE;AACvE,mEAAmE;AACnE,qEAAqE;;AAarE,wDAsBC;AAjCD,uCAA6D;AAW7D,SAAgB,sBAAsB,CAAU,OAAyC;IACrF,OAAO,KAAK,UAAU,gBAAgB,CAAC,OAAY;QAC/C,OAAO,CAAC,OAAO,CAAC,eAAe,EAAE,KAAK,EAAE,GAGvC,EAAE,EAAE;YACD,MAAM,QAAQ,GAAG,IAAA,yBAAe,EAAC,GAAG,CAAC,CAAC;YACtC,IAAI,QAAQ,EAAE,CAAC;gBACX,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;gBAC/C,GAAG,CAAC,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;YACrC,CAAC;iBAAM,CAAC;gBACJ,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;YACvC,CAAC;YACD,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;gBAC3B,IAAI,CAAC;oBACD,MAAM,OAAO,CAAC,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBAClD,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACT,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,CAAC,CAAC,CAAC;gBAChD,CAAC;YACL,CAAC;QACL,CAAC,CAAC,CAAC;IACP,CAAC,CAAC;AACN,CAAC"}
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/tenant/middleware.ts"],"names":[],"mappings":";AAAA,4EAA4E;AAC5E,4EAA4E;AAC5E,4EAA4E;AAC5E,4EAA4E;AAC5E,2BAA2B;AAC3B,EAAE;AACF,uEAAuE;AACvE,mEAAmE;AACnE,qEAAqE;AACrE,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,0EAA0E;AAC1E,yEAAyE;AACzE,4EAA4E;AAC5E,0DAA0D;;;AA+B1D,wDA4BC;AAzDD,uCAA8E;AAc9E,MAAa,kBAAmB,SAAQ,KAAK;IACzC,UAAU,GAAG,GAAG,CAAC;IAEjB,YAAY,GAAY;QACpB,KAAK,CAAC,uBAAuB,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACrC,CAAC;CACJ;AAPD,gDAOC;AAED,SAAS,YAAY,CAAC,GAAY;IAC9B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAC/D,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,SAAgB,sBAAsB,CAAU,OAAyC;IACrF,OAAO,KAAK,UAAU,gBAAgB,CAAC,OAAY;QAC/C,OAAO,CAAC,OAAO,CAAC,eAAe,EAAE,KAAK,EAAE,GAGvC,EAAE,EAAE;YACD,MAAM,QAAQ,GAAG,IAAA,yBAAe,EAAC,GAAG,CAAC,CAAC;YACtC,IAAI,QAAQ,EAAE,CAAC;gBACX,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;gBAC/C,GAAG,CAAC,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;YACrC,CAAC;iBAAM,CAAC;gBACJ,MAAM,GAAG,GAAG,IAAA,yBAAe,EAAC,GAAG,CAAC,CAAC;gBACjC,IAAI,OAAO,CAAC,YAAY,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC5C,uDAAuD;oBACvD,+CAA+C;oBAC/C,MAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC;gBACtC,CAAC;gBACD,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;YACvC,CAAC;YACD,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;gBAC3B,IAAI,CAAC;oBACD,MAAM,OAAO,CAAC,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBAClD,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACT,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,CAAC,CAAC,CAAC;gBAChD,CAAC;YACL,CAAC;QACL,CAAC,CAAC,CAAC;IACP,CAAC,CAAC;AACN,CAAC"}

package/dist/tenant/resolve.d.ts

@@ -3,4 +3,7 @@ export interface TenantRequestLike {
     query?: Record<string, unknown> | null;
     headers?: Record<string, unknown> | null;
 }
+/** Valor bruto de id_school como veio no request (undefined quando ausente em
+ *  params, query e header). Serve para distinguir "não informado" de "inválido". */
+export declare function readRawTenantId(req: TenantRequestLike): unknown;
 export declare function resolveTenantId(req: TenantRequestLike): string | null;

package/dist/tenant/resolve.js

@@ -4,11 +4,17 @@
 // Só aceita inteiro positivo em string de dígitos — qualquer outra coisa é
 // tratada como "sem tenant" (o chamador decide o fallback), nunca interpolada em SQL.
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.readRawTenantId = readRawTenantId;
 exports.resolveTenantId = resolveTenantId;
-function resolveTenantId(req) {
-    const raw = req.params?.id_school ??
+/** Valor bruto de id_school como veio no request (undefined quando ausente em
+ *  params, query e header). Serve para distinguir "não informado" de "inválido". */
+function readRawTenantId(req) {
+    return req.params?.id_school ??
         req.query?.id_school ??
         req.headers?.["x-id-school"];
+}
+function resolveTenantId(req) {
+    const raw = readRawTenantId(req);
     const idStr = typeof raw === "string" ? raw : raw != null ? String(raw) : "";
     if (idStr && /^\d+$/.test(idStr) && Number(idStr) > 0)
         return idStr;

package/dist/tenant/resolve.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/tenant/resolve.ts"],"names":[],"mappings":";AAAA,2CAA2C;AAC3C,4GAA4G;AAC5G,2EAA2E;AAC3E,sFAAsF;;AAQtF,0CASC;AATD,SAAgB,eAAe,CAAC,GAAsB;IAClD,MAAM,GAAG,GACJ,GAAG,CAAC,MAAc,EAAE,SAAS;QAC7B,GAAG,CAAC,KAAa,EAAE,SAAS;QAC5B,GAAG,CAAC,OAAe,EAAE,CAAC,aAAa,CAAC,CAAC;IAE1C,MAAM,KAAK,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,IAAI,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACpE,OAAO,IAAI,CAAC;AAChB,CAAC"}
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/tenant/resolve.ts"],"names":[],"mappings":";AAAA,2CAA2C;AAC3C,4GAA4G;AAC5G,2EAA2E;AAC3E,sFAAsF;;AAUtF,0CAIC;AAED,0CAMC;AAdD;oFACoF;AACpF,SAAgB,eAAe,CAAC,GAAsB;IAClD,OAAQ,GAAG,CAAC,MAAc,EAAE,SAAS;QAChC,GAAG,CAAC,KAAa,EAAE,SAAS;QAC5B,GAAG,CAAC,OAAe,EAAE,CAAC,aAAa,CAAC,CAAC;AAC9C,CAAC;AAED,SAAgB,eAAe,CAAC,GAAsB;IAClD,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAEjC,MAAM,KAAK,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,IAAI,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACpE,OAAO,IAAI,CAAC;AAChB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mybuildex/pkg",
-  "version": "0.3.4",
+  "version": "0.4.0",
   "description": "Infra comum das APIs MyBuilder: multitenancy Prisma (pool único), middleware de tenant e CORS",
   "license": "MIT",
   "repository": {