@nextsparkjs/core 0.1.0-beta.195 → 0.1.0-beta.197

package/dist/lib/api/auth/dual-auth.js

@@ -3,6 +3,8 @@ import { getUserDefaultTeamId } from "../../teams/dashboard-team.js";
 import { NextResponse } from "next/server";
 import { auth } from "../../auth.js";
 import { validateApiKey } from "../auth.js";
+import { isSuspendedRole } from "../../auth/suspension.js";
+import { apiKeyRateLimitResponse } from "../rate-limit.js";
 import { queryOne } from "../../db.js";
 import { TeamMemberService } from "../../services/team-member.service.js";
 import { TeamService } from "../../services/team.service.js";
@@ -31,6 +33,26 @@ async function authenticateRequest(request, options = {}) {
         error: failure
       };
     }
+    const rateLimitResponse = apiKeyRateLimitResponse(request, {
+      userId: apiKeyResult.user.id,
+      keyId: apiKeyResult.keyId,
+      scopes: apiKeyResult.scopes ?? []
+    });
+    if (rateLimitResponse) {
+      return {
+        success: false,
+        type: "api-key",
+        user: apiKeyResult.user,
+        scopes: apiKeyResult.scopes,
+        keyId: apiKeyResult.keyId,
+        rateLimitResponse,
+        error: {
+          code: "RATE_LIMIT_EXCEEDED",
+          status: 429,
+          message: "Rate limit exceeded"
+        }
+      };
+    }
     return applyActAsOverride(request, apiKeyResult);
   }
   const sessionResult = await trySessionAuth(request);
@@ -120,15 +142,11 @@ async function tryApiKeyAuth(request) {
 async function trySessionAuth(request) {
   var _a;
   try {
-    console.log("[dual-auth] Attempting session authentication...");
-    const session = await auth.api.getSession({ headers: request.headers });
-    console.log("[dual-auth] Session result:", session ? "found" : "not found");
-    if (!(session == null ? void 0 : session.user)) {
-      console.log("[dual-auth] No session.user found");
+    const session = await auth.api.getSession({ headers: request.headers, query: { disableCookieCache: true } });
+    if (!(session == null ? void 0 : session.user) || isSuspendedRole(session.user.role)) {
       return { success: false, type: "none", user: null };
     }
     const defaultTeamId = await getUserDefaultTeamId(session.user.id);
-    console.log("[dual-auth] Session auth successful for user:", session.user.id);
     return {
       success: true,
       type: "session",
@@ -223,6 +241,7 @@ function createAuthError(message = "Authentication required", status = 401) {
   );
 }
 function createAuthFailureResponse(authResult) {
+  if (authResult.rateLimitResponse) return authResult.rateLimitResponse;
   const failure = authResult.error ?? authenticationFailed();
   return NextResponse.json(
     {

package/dist/lib/api/auth/scope-policy.d.ts

@@ -22,11 +22,14 @@
  * visible 403 on an integration instead of a silently over-privileged
  * credential. Before, `scopes` were populated and nobody was obliged to look.
  */
-export type DualAuthFailureCode = 'AUTHENTICATION_FAILED' | 'INSUFFICIENT_SCOPE' | 'SCOPE_NOT_DECLARED';
+export type DualAuthFailureCode = 'AUTHENTICATION_FAILED' | 'INSUFFICIENT_SCOPE' | 'SCOPE_NOT_DECLARED' | 'RATE_LIMIT_EXCEEDED';
 export interface DualAuthFailure {
     code: DualAuthFailureCode;
-    /** 401 when no usable credential was presented, 403 when a valid key was rejected on scope. */
-    status: 401 | 403;
+    /**
+     * 401 when no usable credential was presented, 403 when a valid key was rejected on scope, 429 when a valid
+     * key is over its per-key limit.
+     */
+    status: 401 | 403 | 429;
     message: string;
 }
 export interface AuthenticateOptions {

package/dist/lib/api/auth/scope-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-policy.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/auth/scope-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,MAAM,MAAM,mBAAmB,GAC3B,uBAAuB,GACvB,oBAAoB,GACpB,oBAAoB,CAAA;AAExB,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,mBAAmB,CAAA;IACzB,+FAA+F;IAC/F,MAAM,EAAE,GAAG,GAAG,GAAG,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACjC;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAA;CACxB;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,IAAI,eAAe,CAEtD;AAED,wBAAgB,uBAAuB,CAAC,aAAa,EAAE,mBAAmB,CAAC,eAAe,CAAC,GAAG,MAAM,EAAE,CAKrG;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EACrC,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,GAC/B,OAAO,CAIT;AAED,kFAAkF;AAClF,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,OAAO,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;CAC/B;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAU/D;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EACrC,OAAO,EAAE,mBAAmB,EAC5B,KAAK,EAAE,MAAM,GACZ,eAAe,GAAG,IAAI,CAuBxB"}
+{"version":3,"file":"scope-policy.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/auth/scope-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,MAAM,MAAM,mBAAmB,GAC3B,uBAAuB,GACvB,oBAAoB,GACpB,oBAAoB,GACpB,qBAAqB,CAAA;AAEzB,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,mBAAmB,CAAA;IACzB;;;OAGG;IACH,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAA;IACvB,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACjC;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAA;CACxB;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,IAAI,eAAe,CAEtD;AAED,wBAAgB,uBAAuB,CAAC,aAAa,EAAE,mBAAmB,CAAC,eAAe,CAAC,GAAG,MAAM,EAAE,CAKrG;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EACrC,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,GAC/B,OAAO,CAIT;AAED,kFAAkF;AAClF,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,OAAO,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;CAC/B;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAU/D;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EACrC,OAAO,EAAE,mBAAmB,EAC5B,KAAK,EAAE,MAAM,GACZ,eAAe,GAAG,IAAI,CAuBxB"}

package/dist/lib/api/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/lib/api/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAO1C;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAEnF;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAQD,6FAA6F;AAC7F,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,UAAU,GAAG,IAAI,CAEtE;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CA0GrF;AA8CD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE3D;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ5E;AAID;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAM/E;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAMhF;AAiBD;;GAEG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,UAAU;QAG1C,MAAM;WACH,MAAM;eACF,MAAM,GAAG,IAAI;cACd,MAAM,GAAG,IAAI;UACjB,MAAM;GAWjB;AAED;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAwBvE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,eAAe,EAAE,MAAM,EAAE,GACxB,OAAO,CAAC;IACT,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB,CAAC,CAyED"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/lib/api/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAO1C;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAEnF;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAQD,6FAA6F;AAC7F,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,UAAU,GAAG,IAAI,CAEtE;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAsHrF;AA8CD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE3D;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ5E;AAID;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAM/E;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAMhF;AAiBD;;GAEG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,UAAU;QAG1C,MAAM;WACH,MAAM;eACF,MAAM,GAAG,IAAI;cACd,MAAM,GAAG,IAAI;UACjB,MAAM;GAWjB;AAED;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAwBvE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,eAAe,EAAE,MAAM,EAAE,GACxB,OAAO,CAAC;IACT,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB,CAAC,CAyED"}

package/dist/lib/api/auth.js

@@ -11,6 +11,8 @@ function getValidatedApiKey(request) {
   return validatedKeys.get(request) ?? null;
 }
 async function validateApiKey(request) {
+  const validatedBefore = validatedKeys.get(request);
+  if (validatedBefore) return validatedBefore;
   const startTime = Date.now();
   try {
     const apiKey = presentedApiKey(request.headers);
@@ -63,6 +65,11 @@ async function validateApiKey(request) {
       await constantTimeDelay(startTime);
       return null;
     }
+    const owner = await queryOne('SELECT role FROM "users" WHERE id = $1', [keyData.userId]);
+    if ((owner == null ? void 0 : owner.role) === "suspended") {
+      await constantTimeDelay(startTime);
+      return null;
+    }
     if (keyData.failedAttempts && keyData.failedAttempts > 0) {
       resetFailedAttempts(keyData.id).catch(console.error);
     }

package/dist/lib/api/cors-response.d.ts

@@ -13,7 +13,7 @@ export declare const CORS_ALLOW_HEADERS: string;
  * cookie-authenticated writes only from it (checkRequestOrigin).
  */
 export declare function isAppOnlyCorsPath(pathname: string): boolean;
-/** A request's path, for corsGrant (undefined when its URL does not parse). */
+/** A request's path, for corsGrant (undefined when its URL does not parse, which corsGrant treats as app-only). */
 export declare function requestPathname(request: Request): string | undefined;
 /** The app's own origins: NEXT_PUBLIC_APP_URL and BETTER_AUTH_URL. */
 export declare function appOrigins(): string[];
@@ -26,7 +26,8 @@ export declare function appOrigins(): string[];
  * response names no origin and sends no credentials header.
  * Under the admin and developer areas (isAppOnlyCorsPath, given the request's
  * `pathname`), only the app's own origin is granted, with credentials; no
- * other origin, listed or not.
+ * other origin, listed or not. A `pathname` that is undefined (not known)
+ * gets the same answer as those areas.
  */
 export declare function corsGrant(origin: string, config: CorsConfig, env: string, pathname?: string): {
     origin: string;

package/dist/lib/api/cors-response.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cors-response.d.ts","sourceRoot":"","sources":["../../../src/lib/api/cors-response.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAG1C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAG/D,KAAK,UAAU,GAAG,IAAI,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAA;AAEhD,eAAO,MAAM,kBAAkB,2CAA2C,CAAA;AAC1E,eAAO,MAAM,kBAAkB,QAAuF,CAAA;AAKtH;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAI3D;AAED,+EAA+E;AAC/E,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAEpE;AAED,sEAAsE;AACtE,wBAAgB,UAAU,IAAI,MAAM,EAAE,CAKrC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,CACvB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,GAAG,EAAE,MAAM,EACX,QAAQ,CAAC,EAAE,MAAM,GAChB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAYjD;AAED,oFAAoF;AACpF,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAGnD;AAED,oGAAoG;AACpG,wBAAgB,cAAc,CAC5B,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,GACrD,IAAI,CAWN;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,CAAC,SAAS,QAAQ,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,GAAG,CAAC,CAa7E;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,YAAY,CAE5D"}
+{"version":3,"file":"cors-response.d.ts","sourceRoot":"","sources":["../../../src/lib/api/cors-response.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAG1C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAG/D,KAAK,UAAU,GAAG,IAAI,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAA;AAEhD,eAAO,MAAM,kBAAkB,2CAA2C,CAAA;AAC1E,eAAO,MAAM,kBAAkB,QAAuF,CAAA;AAKtH;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAM3D;AAED,mHAAmH;AACnH,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAEpE;AAED,sEAAsE;AACtE,wBAAgB,UAAU,IAAI,MAAM,EAAE,CAKrC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CACvB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,GAAG,EAAE,MAAM,EACX,QAAQ,CAAC,EAAE,MAAM,GAChB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAYjD;AAED,oFAAoF;AACpF,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAGnD;AAED,oGAAoG;AACpG,wBAAgB,cAAc,CAC5B,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,GACrD,IAAI,CAWN;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,CAAC,SAAS,QAAQ,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,GAAG,CAAC,CAa7E;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,YAAY,CAE5D"}

package/dist/lib/api/cors-response.js

@@ -6,11 +6,13 @@ const CORS_ALLOW_METHODS = "GET, POST, PUT, PATCH, DELETE, OPTIONS";
 const CORS_ALLOW_HEADERS = ["Content-Type", "Authorization", "X-API-Key", ...CLIENT_REQUEST_HEADERS].join(", ");
 const APP_ONLY_PATH = /(^|\/)api\/(v1\/)?(superadmin|devtools)(\/|$)/;
 function isAppOnlyCorsPath(pathname) {
-  let path = pathname;
-  try {
-    path = decodeURIComponent(pathname);
-  } catch {
-  }
+  const path = pathname.split("/").map((segment) => {
+    try {
+      return decodeURIComponent(segment);
+    } catch {
+      return segment;
+    }
+  }).join("/");
   return APP_ONLY_PATH.test(path.toLowerCase().replace(/\/{2,}/g, "/"));
 }
 function requestPathname(request) {
@@ -32,7 +34,7 @@ function appOrigins() {
 }
 function corsGrant(origin, config, env, pathname) {
   const normalizedOrigin = normalizeOrigin(origin);
-  if (pathname !== void 0 && isAppOnlyCorsPath(pathname)) {
+  if (pathname === void 0 || isAppOnlyCorsPath(pathname)) {
     return appOrigins().includes(normalizedOrigin) ? { origin: normalizedOrigin, credentials: true } : null;
   }
   const listed = isOriginAllowed(normalizedOrigin, getCorsOrigins(config, env));

package/dist/lib/api/entity/generic-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generic-handler.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/entity/generic-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AA+wBvD;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAEnF;AA8lBD;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAErF;AAyaD;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAEpJ;AAoND;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAEtJ;AA6ZD;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAEtJ;AAwKD;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAEtF"}
+{"version":3,"file":"generic-handler.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/entity/generic-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AA+wBvD;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAEnF;AA8lBD;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAErF;AAwcD;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAEpJ;AAoND;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAEtJ;AA4bD;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAEtJ;AAwKD;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAEtF"}

package/dist/lib/api/entity/generic-handler.js

@@ -5,7 +5,7 @@ import { generateEntitySchemas } from "../../entities/schema-generator.js";
 import { publicSlugIssue, otherBasePathSegments } from "../../entities/public-slug.js";
 import { getAllEntityConfigs } from "../../entities/registry.js";
 import { entityResponseSystemColumns, taxonomyResponseFields } from "../../entities/portable/response-shape.js";
-import { queryWithRLS, mutateWithRLS, queryOneWithRLS } from "../../db.js";
+import { queryWithRLS, mutateWithRLS, queryOneWithRLS, getTransactionClient } from "../../db.js";
 import {
   createApiResponse,
   createApiError,
@@ -22,7 +22,7 @@ import {
 } from "../helpers.js";
 import { beforeEntityCreate, afterEntityCreate, beforeEntityUpdate, afterEntityUpdate, beforeEntityDelete, afterEntityDelete, beforeEntityRead, afterEntityRead } from "../../entities/entity-hooks.js";
 import { logGenericHandlerUsage } from "./audit-log.js";
-import { checkPermission } from "../../permissions/check.js";
+import { checkPermission, declaredPublishPermission, publishPermissionFor } from "../../permissions/check.js";
 import { extractPatternIds } from "../../blocks/pattern-resolver.js";
 import { isPatternReference } from "../../../types/pattern-reference.js";
 import { PatternUsageService } from "../../services/pattern-usage.service.js";
@@ -122,7 +122,7 @@ async function includeTaxonomiesInData(entityConfig, items, userId) {
     };
   });
 }
-async function processTaxonomyRelations(entityConfig, entityId, data, userId, isUpdate = false) {
+async function processTaxonomyRelations(entityConfig, entityId, data, userId, teamId, isUpdate = false) {
   var _a, _b, _c;
   if (!((_a = entityConfig.taxonomies) == null ? void 0 : _a.enabled) || !((_c = (_b = entityConfig.taxonomies) == null ? void 0 : _b.types) == null ? void 0 : _c.length)) {
     return;
@@ -146,8 +146,9 @@ async function processTaxonomyRelations(entityConfig, entityId, data, userId, is
         const taxonomyId = typeof taxonomyIds[i] === "object" && taxonomyIds[i] !== null ? taxonomyIds[i].id : taxonomyIds[i];
         await mutateWithRLS(
           `INSERT INTO entity_taxonomy_relations ("entityType", "entityId", "taxonomyId", "order")
-           VALUES ($1, $2, $3, $4)`,
-          [entityType, entityId, taxonomyId, i + 1],
+           SELECT $1, $2, id, $4 FROM taxonomies
+           WHERE id = $3 AND type = $5 AND ("teamId" IS NULL OR "teamId" = $6)`,
+          [entityType, entityId, taxonomyId, i + 1, taxonomyType.type, teamId],
           userId
         );
       }
@@ -350,13 +351,11 @@ async function checkAuthPermission(authResult, entitySlug, action, teamId, reque
 }
 async function validateTeamMembership(userId, teamId) {
   try {
-    console.log("[GenericHandler] Validating team membership:", { userId, teamId, teamIdLength: teamId == null ? void 0 : teamId.length });
     const member = await queryOneWithRLS(
       'SELECT id FROM "team_members" WHERE "teamId" = $1 AND "userId" = $2',
       [teamId, userId],
       userId
     );
-    console.log("[GenericHandler] Team membership result:", { found: !!member, memberId: member == null ? void 0 : member.id });
     return !!member;
   } catch (error) {
     console.error("[GenericHandler] Error validating team membership:", error);
@@ -367,7 +366,6 @@ async function validateTeamContextWithBypass(request, authResult, userId) {
   const teamId = getTeamIdFromRequest(request);
   const canBypass = await canBypassTeamContext(authResult, request);
   if (canBypass) {
-    console.log("[GenericHandler] Admin bypass active:", { userId, teamId: teamId || "cross-team" });
     return { valid: true, teamId, isBypass: true };
   }
   if (!teamId) {
@@ -788,7 +786,7 @@ async function handleGenericCreate(request) {
   return runWithAuditLog(request, (audit) => handleGenericCreateImpl(request, audit));
 }
 async function handleGenericCreateImpl(request, audit) {
-  var _a, _b, _c, _d, _e, _f, _g, _h, _i;
+  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j;
   try {
     const resolution = await resolveEntityFromUrl(request.nextUrl.pathname);
     if (!resolution.isValidEntity || !resolution.entityConfig) {
@@ -889,6 +887,13 @@ async function handleGenericCreateImpl(request, audit) {
       );
       return addCorsHeaders(response2, request);
     }
+    const createStatusField = entityConfig.fields.find((f) => f.name === "status");
+    const createStatus = validatedData.status ?? (createStatusField == null ? void 0 : createStatusField.defaultValue);
+    if (publishPermissionFor(entityConfig.slug, createStatus)) {
+      const publishDenied = await checkAuthPermission(authResult, entityConfig.slug, "publish", teamId, request);
+      if (publishDenied) return publishDenied;
+    }
+    const checkStoredStatus = createStatus === void 0 && !!createStatusField && !!declaredPublishPermission(entityConfig.slug);
     if (idStrategy === "serial") {
       insertFields = ['"userId"', '"teamId"'];
       placeholders = ["$1", "$2"];
@@ -987,8 +992,28 @@ async function handleGenericCreateImpl(request, audit) {
       INSERT INTO "${tableName}" (${insertFields.join(", ")})
       VALUES (${placeholders.join(", ")}) RETURNING *
     `;
-    const insertResult = await mutateWithRLS(insertQuery, values, authResult.user.id);
-    const createdEntityId = String((_g = insertResult.rows[0]) == null ? void 0 : _g.id);
+    let insertResult;
+    if (checkStoredStatus) {
+      const tx = await getTransactionClient(authResult.user.id);
+      try {
+        insertResult = await tx.mutate(insertQuery, values);
+        if (((_g = insertResult.rows[0]) == null ? void 0 : _g.status) === "published") {
+          const publishDenied = await checkAuthPermission(authResult, entityConfig.slug, "publish", teamId, request);
+          if (publishDenied) {
+            await tx.rollback();
+            return publishDenied;
+          }
+        }
+        await tx.commit();
+      } catch (error) {
+        await tx.rollback().catch(() => {
+        });
+        throw error;
+      }
+    } else {
+      insertResult = await mutateWithRLS(insertQuery, values, authResult.user.id);
+    }
+    const createdEntityId = String((_h = insertResult.rows[0]) == null ? void 0 : _h.id);
     if (limitSlug) {
       UsageService.track({
         teamId,
@@ -1018,8 +1043,8 @@ async function handleGenericCreateImpl(request, audit) {
     `;
     const createdItems = await queryWithRLS(selectQuery, [createdEntityId], authResult.user.id);
     const createdItem = createdItems[0];
-    if ((_h = entityConfig.taxonomies) == null ? void 0 : _h.enabled) {
-      await processTaxonomyRelations(entityConfig, createdEntityId, body, authResult.user.id, false);
+    if ((_i = entityConfig.taxonomies) == null ? void 0 : _i.enabled) {
+      await processTaxonomyRelations(entityConfig, createdEntityId, body, authResult.user.id, teamId, false);
     }
     const metadataWasProvided = metas && typeof metas === "object" && Object.keys(metas).length > 0;
     if (metadataWasProvided) {
@@ -1031,7 +1056,7 @@ async function handleGenericCreateImpl(request, audit) {
       );
     }
     let responseItem = createdItem;
-    if ((_i = entityConfig.taxonomies) == null ? void 0 : _i.enabled) {
+    if ((_j = entityConfig.taxonomies) == null ? void 0 : _j.enabled) {
       const itemsWithTaxonomies = await includeTaxonomiesInData(
         entityConfig,
         [createdItem],
@@ -1330,6 +1355,18 @@ async function handleGenericUpdateImpl(request, audit, { params }) {
       );
       return addCorsHeaders(response2, request);
     }
+    let statusRead;
+    if ("status" in entityData && entityConfig.fields.some((f) => f.name === "status") && declaredPublishPermission(entityConfig.slug)) {
+      statusRead = (await queryWithRLS(
+        `SELECT "status" FROM "${tableName}" WHERE id = $1 AND "teamId" = $2`,
+        [id, teamId],
+        authResult.user.id
+      ))[0];
+      if (statusRead && publishPermissionFor(entityConfig.slug, validatedData.status, statusRead.status)) {
+        const publishDenied = await checkAuthPermission(authResult, entityConfig.slug, "publish", teamId, request);
+        if (publishDenied) return publishDenied;
+      }
+    }
     const updates = [];
     const values = [];
     let paramCount = 1;
@@ -1428,6 +1465,10 @@ async function handleGenericUpdateImpl(request, audit, { params }) {
         whereConditions.push(`"${updateOwnershipFilter.field}" = $${paramCount++}`);
         values.push(updateOwnershipFilter.value);
       }
+      if (statusRead) {
+        whereConditions.push(`"status" IS NOT DISTINCT FROM $${paramCount++}`);
+        values.push(statusRead.status);
+      }
       const updateQuery = `
         UPDATE "${tableName}"
         SET ${updates.join(", ")}
@@ -1436,6 +1477,16 @@ async function handleGenericUpdateImpl(request, audit, { params }) {
       `;
       const result = await mutateWithRLS(updateQuery, values, authResult.user.id);
       if (!result.rows || result.rows.length === 0) {
+        if (statusRead) {
+          const [now] = await queryWithRLS(
+            `SELECT "status" FROM "${tableName}" WHERE id = $1 AND "teamId" = $2`,
+            [id, teamId],
+            authResult.user.id
+          );
+          if (now && now.status !== statusRead.status) {
+            return addCorsHeaders(createApiError("The record changed while it was being saved. Reload it and try again.", 409, void 0, "STATUS_CHANGED"), request);
+          }
+        }
         const response2 = createApiError("Item not found", 404);
         return addCorsHeaders(response2, request);
       }
@@ -1455,7 +1506,7 @@ async function handleGenericUpdateImpl(request, audit, { params }) {
       updatedItem = result[0];
     }
     if ((_g = entityConfig.taxonomies) == null ? void 0 : _g.enabled) {
-      await processTaxonomyRelations(entityConfig, id, body, authResult.user.id, true);
+      await processTaxonomyRelations(entityConfig, id, body, authResult.user.id, teamId, true);
     }
     if (metadataWasProvided) {
       await processEntityMetadata(

package/dist/lib/api/entity-handler.js

@@ -1,4 +1,4 @@
-import { getTypedSession } from "../auth.js";
+import { getAuthorizationSession } from "../auth/authorization-session.js";
 import { entityRegistry, ensureInitialized } from "../entities/registry.js";
 import {
   createApiResponse,
@@ -13,7 +13,7 @@ import {
 import { afterEntityCreate, afterEntityUpdate, afterEntityDelete } from "../entities/entity-hooks.js";
 async function checkBasicAuth(request, entityName) {
   try {
-    const session = await getTypedSession(request.headers);
+    const session = await getAuthorizationSession(request.headers);
     if (!session) {
       return {
         allowed: false,

package/dist/lib/api/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/lib/api/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,UAAU,EAAsC,MAAM,QAAQ,CAAC;AAaxE,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EACL,KAAK,mBAAmB,EAKzB,MAAM,qBAAqB,CAAC;AAG7B,UAAU,WAAW;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,OAAO,mBAAmB,EAAE,QAAQ,EAAE,CAAC;IAC9C,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,KAAK,IAAI,GAAG,UAAU,GAAG,WAAW,CAAC;AAErC;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,8BAA8B,CAClD,OAAO,EAAE,WAAW,EACpB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC;IACT,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,iBAAiB,CAAC,EAAE,YAAY,CAAC;IACjC,wEAAwE;IACxE,aAAa,CAAC,EAAE,YAAY,CAAC;CAC9B,CAAC,CAwDD;AAgFD;;;;;;;;GAQG;AACH,wBAAsB,iCAAiC,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC;IACrF,IAAI,EAAE,UAAU,CAAC;IACjB,iBAAiB,CAAC,EAAE,YAAY,CAAC;CAClC,CAAC,CASD;AA+BD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,WAAW,GAAG,UAAU,CAM3D;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,YAAY,GAAG,IAAI,CAiB5F;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAE,MAAY;;;;;;GASzG;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,MAAY,EACpB,OAAO,CAAC,EAAE,OAAO,EACjB,IAAI,CAAC,EAAE,MAAM;;;;;;;;GAWd;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,WAAW,GAAG;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,CAQA;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM;;;;;;;EAUd;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,WAAW,EACpB,UAAU,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE,MAAM,EACrB,WAAW,CAAC,EAAE,OAAO,GACpB,OAAO,CAAC,IAAI,CAAC,CA4Bf;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,OAAO,EAAE,EAChD,OAAO,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC,IAEtD,SAAS,WAAW,EAAE,GAAG,MAAM,CAAC,KAAG,OAAO,CAAC,YAAY,CAAC,CAkBvE;AAED;;GAEG;AACH,OAAO,EAAE,WAAW,EAAE,CAAC;AAEvB;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUzD;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAezE;AAUD;;;GAGG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAkBzG;AAED;;GAEG;AACH,wBAAsB,0BAA0B,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAG7F;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,EAChC,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,QAAQ,CAAC,CAuBnB;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,eAAe,EAAE,OAAO,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,WAAW,GAAG,UAAU,CA0BhE;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,eAAe,EAAE,OAAO,CAAC;IACzB,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,WAAW,GAAG,WAAW,CA0BlE;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAClE,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,CAAC,EAAE,EACb,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,EAAE,CAAC,CA6BtD;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAClE,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,CAAC,EAAE,EACb,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,OAAO,GACrB,OAAO,CAAC,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;CAAE,CAAC,EAAE,CAAC,CAgExD;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC3E,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,CAAC,EACT,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,CA2BlD;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC3E,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,CAAC,EACT,eAAe,EAAE,OAAO,EACxB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,CAiBlD;AAoBD;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CA+DjD"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/lib/api/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,UAAU,EAAsC,MAAM,QAAQ,CAAC;AAcxE,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EACL,KAAK,mBAAmB,EAKzB,MAAM,qBAAqB,CAAC;AAG7B,UAAU,WAAW;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,OAAO,mBAAmB,EAAE,QAAQ,EAAE,CAAC;IAC9C,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,KAAK,IAAI,GAAG,UAAU,GAAG,WAAW,CAAC;AAErC;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,8BAA8B,CAClD,OAAO,EAAE,WAAW,EACpB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC;IACT,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,iBAAiB,CAAC,EAAE,YAAY,CAAC;IACjC,wEAAwE;IACxE,aAAa,CAAC,EAAE,YAAY,CAAC;CAC9B,CAAC,CA2DD;AAgFD;;;;;;;;GAQG;AACH,wBAAsB,iCAAiC,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC;IACrF,IAAI,EAAE,UAAU,CAAC;IACjB,iBAAiB,CAAC,EAAE,YAAY,CAAC;CAClC,CAAC,CAUD;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,WAAW,GAAG,UAAU,CAM3D;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,YAAY,GAAG,IAAI,CAiB5F;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAE,MAAY;;;;;;GASzG;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,MAAY,EACpB,OAAO,CAAC,EAAE,OAAO,EACjB,IAAI,CAAC,EAAE,MAAM;;;;;;;;GAWd;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,WAAW,GAAG;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,CAQA;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM;;;;;;;EAUd;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,WAAW,EACpB,UAAU,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE,MAAM,EACrB,WAAW,CAAC,EAAE,OAAO,GACpB,OAAO,CAAC,IAAI,CAAC,CA4Bf;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,OAAO,EAAE,EAChD,OAAO,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC,IAEtD,SAAS,WAAW,EAAE,GAAG,MAAM,CAAC,KAAG,OAAO,CAAC,YAAY,CAAC,CAkBvE;AAED;;GAEG;AACH,OAAO,EAAE,WAAW,EAAE,CAAC;AAEvB;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUzD;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAezE;AAUD;;;GAGG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAkBzG;AAED;;GAEG;AACH,wBAAsB,0BAA0B,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAG7F;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,EAChC,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,QAAQ,CAAC,CAuBnB;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,eAAe,EAAE,OAAO,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,WAAW,GAAG,UAAU,CA0BhE;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,eAAe,EAAE,OAAO,CAAC;IACzB,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,WAAW,GAAG,WAAW,CA0BlE;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAClE,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,CAAC,EAAE,EACb,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,EAAE,CAAC,CA6BtD;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAClE,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,CAAC,EAAE,EACb,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,OAAO,GACrB,OAAO,CAAC,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;CAAE,CAAC,EAAE,CAAC,CAgExD;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC3E,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,CAAC,EACT,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,CA2BlD;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC3E,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,CAAC,EACT,eAAe,EAAE,OAAO,EACxB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,CAiBlD;AAoBD;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CA+DjD"}

package/dist/lib/api/helpers.js

@@ -1,10 +1,11 @@
 import { NextResponse } from "next/server";
 import { getValidatedApiKey, validateApiKey } from "./auth.js";
 import { mutateWithRLS, queryWithRLS } from "../db.js";
-import { checkRateLimit, addRateLimitHeaders } from "./rate-limit.js";
+import { apiKeyRateLimitResponse } from "./rate-limit.js";
 import { getRecordedClientIp } from "./client-ip.js";
 import { getApplicationConfig } from "../config/index.js";
 import { auth } from "../auth.js";
+import { isSuspendedRole } from "../auth/suspension.js";
 import { MetaService } from "../services/meta.service.js";
 import { ScopeService } from "../services/scope.service.js";
 import { getChildEntities } from "../entities/queries.js";
@@ -25,9 +26,10 @@ async function validateAndAuthenticateRequest(request, options = {}) {
       const session = await auth.api.getSession({
         headers: new Headers({
           cookie: cookieHeader
-        })
+        }),
+        query: { disableCookieCache: true }
       });
-      if ((_a = session == null ? void 0 : session.user) == null ? void 0 : _a.id) {
+      if (((_a = session == null ? void 0 : session.user) == null ? void 0 : _a.id) && !isSuspendedRole(session.user.role)) {
         const userRole = session.user.role || "member";
         const userFlags = session.user.flags || [];
         const sessionAuth = {
@@ -36,7 +38,6 @@ async function validateAndAuthenticateRequest(request, options = {}) {
           flags: userFlags,
           isSession: true
         };
-        console.log(`[Auth] Session authentication successful for user ${session.user.id} with role ${userRole}`);
         return { auth: sessionAuth };
       }
     } catch (sessionError) {
@@ -58,7 +59,8 @@ async function validateAndAuthenticateRequest(request, options = {}) {
       )
     };
   }
-  return applyApiKeyRateLimit(apiKeyAuth);
+  const rateLimitResponse = apiKeyRateLimitResponse(request, apiKeyAuth);
+  return rateLimitResponse ? { auth: apiKeyAuth, rateLimitResponse } : { auth: apiKeyAuth };
 }
 function generateScopesForRole(role, flags = []) {
   const baseScopes = getBaseScopesFromRegistry();
@@ -103,25 +105,8 @@ async function validateAndAuthenticateApiRequest(request) {
   if (!auth2) {
     throw new Error("Invalid API key");
   }
-  return applyApiKeyRateLimit(auth2);
-}
-function applyApiKeyRateLimit(auth2) {
-  const rateLimitResult = checkRateLimit(auth2.keyId);
-  if (!rateLimitResult.allowed) {
-    const response = NextResponse.json(
-      {
-        success: false,
-        error: "Rate limit exceeded",
-        message: `Too many requests. Limit: ${rateLimitResult.limit} requests per minute`,
-        code: "RATE_LIMIT_EXCEEDED",
-        retryAfter: Math.ceil((rateLimitResult.resetTime - Date.now()) / 1e3)
-      },
-      { status: 429 }
-    );
-    addRateLimitHeaders(response, auth2.keyId, auth2.scopes);
-    return { auth: auth2, rateLimitResponse: response };
-  }
-  return { auth: auth2 };
+  const rateLimitResponse = apiKeyRateLimitResponse(request, auth2);
+  return rateLimitResponse ? { auth: auth2, rateLimitResponse } : { auth: auth2 };
 }
 function getApiAuth(request) {
   const auth2 = getValidatedApiKey(request);

package/dist/lib/api/permission-middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permission-middleware.d.ts","sourceRoot":"","sources":["../../../src/lib/api/permission-middleware.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAc1C;;GAEG;AACH,eAAO,MAAM,WAAW,SAAS,CAAA;AAEjC;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,CAElF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,GAAG,MAAM,CAOjF;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,YAAY,CAAA;CAAE,CAAC,CAkCtE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,OAAO,GACpB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAK9B"}
+{"version":3,"file":"permission-middleware.d.ts","sourceRoot":"","sources":["../../../src/lib/api/permission-middleware.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAc1C;;GAEG;AACH,eAAO,MAAM,WAAW,SAAS,CAAA;AAEjC;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,CAElF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,GAAG,MAAM,CAOjF;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,YAAY,CAAA;CAAE,CAAC,CA8BtE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,OAAO,GACpB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAK9B"}

package/dist/lib/api/permission-middleware.js

@@ -21,9 +21,7 @@ function getActionFromMethod(method, isCollection) {
 }
 async function checkEntityPermission(userId, teamId, entitySlug, action) {
   const permission = getEntityPermission(entitySlug, action);
-  console.log(`[PermMiddleware] Checking permission: ${permission} for user ${userId} in team ${teamId}`);
   const hasPermission = await checkPermission(userId, teamId, permission);
-  console.log(`[PermMiddleware] Result: ${hasPermission}`);
   if (!hasPermission) {
     return {
       allowed: false,

package/dist/lib/api/post-categories.d.ts

@@ -0,0 +1,29 @@
+import { NextRequest, NextResponse } from 'next/server';
+/**
+ * Post categories (`taxonomies` rows of type `post_category`) belong to a team: they are created in the caller's
+ * team (`x-team-id`) and read, changed and deleted only there, under the same team-role permissions as the posts
+ * entity (`posts.list`, `posts.create`, `posts.update`, `posts.delete`). Rows without a team (the only kind before
+ * categories were scoped) stay readable by every team and by visitors; only a superadmin can change or delete them.
+ */
+/** A refusal the route returns as it is. */
+export type Refusal = {
+    response: NextResponse;
+};
+/**
+ * The team whose categories a read sees, besides the rows without a team. No `x-team-id`: none (a visitor, or a
+ * caller without a team context, sees only the rows without a team). With one: the caller must be able to list
+ * posts there.
+ */
+export declare function categoryReadTeam(request: NextRequest): Promise<{
+    teamId: string | null;
+} | Refusal>;
+export interface CategoryWriter {
+    userId: string;
+    /** The caller's team (`x-team-id`), when the caller holds `posts.<action>` there. */
+    teamId: string | null;
+    /** A superadmin may change or delete the rows without a team. */
+    superadmin: boolean;
+}
+/** Who writes, and in which team, after the API-key scope and the team-role check for `posts.<action>`. */
+export declare function categoryWriter(request: NextRequest, action: 'create' | 'update' | 'delete'): Promise<CategoryWriter | Refusal>;
+//# sourceMappingURL=post-categories.d.ts.map

package/dist/lib/api/post-categories.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"post-categories.d.ts","sourceRoot":"","sources":["../../../src/lib/api/post-categories.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAIvD;;;;;GAKG;AAEH,4CAA4C;AAC5C,MAAM,MAAM,OAAO,GAAG;IAAE,QAAQ,EAAE,YAAY,CAAA;CAAE,CAAA;AAOhD;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,OAAO,CAAC,CASzG;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAA;IACd,qFAAqF;IACrF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,iEAAiE;IACjE,UAAU,EAAE,OAAO,CAAA;CACpB;AAED,2GAA2G;AAC3G,wBAAsB,cAAc,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC,cAAc,GAAG,OAAO,CAAC,CAYpI"}

package/dist/lib/api/post-categories.js

@@ -0,0 +1,33 @@
+import { NextResponse } from "next/server";
+import { authenticateRequest, createAuthFailureResponse } from "./auth/dual-auth.js";
+import { checkPermission } from "../permissions/check.js";
+const deny = (status, code, error) => ({ response: NextResponse.json({ success: false, error, code }, { status }) });
+const isSuperadmin = (auth) => {
+  var _a;
+  return ((_a = auth.user) == null ? void 0 : _a.role) === "superadmin";
+};
+async function categoryReadTeam(request) {
+  const teamId = request.headers.get("x-team-id");
+  if (!teamId) return { teamId: null };
+  const auth = await authenticateRequest(request, { requiredScope: "posts:read" });
+  if (!auth.success || !auth.user) return { response: createAuthFailureResponse(auth) };
+  if (!isSuperadmin(auth) && !await checkPermission(auth.user.id, teamId, "posts.list")) {
+    return deny(403, "PERMISSION_DENIED", "Permission denied: insufficient permissions for posts.list");
+  }
+  return { teamId };
+}
+async function categoryWriter(request, action) {
+  const auth = await authenticateRequest(request, { requiredScope: action === "delete" ? "posts:delete" : "posts:write" });
+  if (!auth.success || !auth.user) return { response: createAuthFailureResponse(auth) };
+  const superadmin = isSuperadmin(auth);
+  const requested = request.headers.get("x-team-id");
+  const teamId = requested && await checkPermission(auth.user.id, requested, `posts.${action}`) ? requested : null;
+  if (!teamId && !(superadmin && action !== "create")) {
+    return requested ? deny(403, "PERMISSION_DENIED", `Permission denied: insufficient permissions for posts.${action}`) : deny(400, "TEAM_CONTEXT_REQUIRED", "Team context required. Include x-team-id header.");
+  }
+  return { userId: auth.user.id, teamId, superadmin };
+}
+export {
+  categoryReadTeam,
+  categoryWriter
+};

package/dist/lib/api/rate-limit.d.ts

@@ -1,4 +1,5 @@
 import { NextRequest, NextResponse } from 'next/server';
+import { type ApiKeyAuth } from './auth';
 import { type RateLimitTier } from '../rate-limit-redis';
 export interface RateLimitResult {
     allowed: boolean;
@@ -10,6 +11,13 @@ export interface RateLimitResult {
  * Verifica el rate limit para un identificador específico
  */
 export declare function checkRateLimit(identifier: string, limit?: number, windowMs?: number): RateLimitResult;
+/**
+ * The per-key limit (checkRateLimit, by the key's id) for a request authenticated with `auth`: a 429 ready to
+ * return when the key is over it, null otherwise. Counted once per request, however many times the request is
+ * authenticated (authenticateRequest, validateAndAuthenticate*Request). The per-address limit of the route
+ * wrapper (withRateLimitTier) still applies on top. It is a safety cap, so DISABLE_RATE_LIMITING does not turn it off.
+ */
+export declare function apiKeyRateLimitResponse(request: Request, auth: ApiKeyAuth): NextResponse | null;
 /**
  * Rate limit types for distributed rate limiting
  * Re-export from rate-limit-redis for convenience

package/dist/lib/api/rate-limit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../src/lib/api/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAMxD,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAC;AAI7B,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,MAAa,EACpB,QAAQ,GAAE,MAAc,GACvB,eAAe,CAyCjB;AAED;;;GAGG;AACH,YAAY,EAAE,aAAa,EAAE,CAAC;AAE9B;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAC7C,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,aAAqB,GAC1B,OAAO,CAAC,eAAe,GAAG;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA6CpD;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,eAAe,GAAG;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,YAAY,CAwB5G;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,IAAI,OAAO,CAEzD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,WAAW,EACpB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EAAE,GACf,YAAY,GAAG,IAAI,CAkCrB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,YAAY,EACtB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EAAE,GACf,YAAY,CASd;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,OAAO,EAAE,EAC/C,OAAO,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC,IAEtD,SAAS,WAAW,EAAE,GAAG,MAAM,CAAC,KAAG,OAAO,CAAC,YAAY,CAAC,CA2BvE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG;IAChD,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC;CACtB,GAAG,IAAI,CAaP;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAGlD;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,KAAK,CAAC;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC,CASD;AAED;;GAEG;AACH,wBAAgB,sBAAsB;;;;;EAErC;AA4DD,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,OAAO,EAAE,EACnD,OAAO,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC,EACpE,IAAI,GAAE,aAAqB,IAkCb,SAAS,WAAW,EAAE,GAAG,MAAM,CAAC,KAAG,OAAO,CAAC,YAAY,CAAC,CAIvE"}
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../src/lib/api/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAGxD,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,QAAQ,CAAC;AAGzD,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAC;AAI7B,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,MAAa,EACpB,QAAQ,GAAE,MAAc,GACvB,eAAe,CAyCjB;AAKD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,GAAG,YAAY,GAAG,IAAI,CA0B/F;AAED;;;GAGG;AACH,YAAY,EAAE,aAAa,EAAE,CAAC;AAE9B;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAC7C,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,aAAqB,GAC1B,OAAO,CAAC,eAAe,GAAG;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA6CpD;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,eAAe,GAAG;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,YAAY,CAwB5G;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,IAAI,OAAO,CAEzD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,WAAW,EACpB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EAAE,GACf,YAAY,GAAG,IAAI,CAkCrB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,YAAY,EACtB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EAAE,GACf,YAAY,CASd;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,OAAO,EAAE,EAC/C,OAAO,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC,IAEtD,SAAS,WAAW,EAAE,GAAG,MAAM,CAAC,KAAG,OAAO,CAAC,YAAY,CAAC,CA2BvE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG;IAChD,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC;CACtB,GAAG,IAAI,CAaP;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAGlD;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,KAAK,CAAC;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC,CASD;AAED;;GAEG;AACH,wBAAgB,sBAAsB;;;;;EAErC;AA4DD,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,OAAO,EAAE,EACnD,OAAO,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC,EACpE,IAAI,GAAE,aAAqB,IAqCb,SAAS,WAAW,EAAE,GAAG,MAAM,CAAC,KAAG,OAAO,CAAC,YAAY,CAAC,CAIvE"}